@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/outbound.js

@@ -0,0 +1,127 @@
+/**
+ * The Runtime's requests to Action endpoints (design: Action endpoints §8.3): one POST, no
+ * redirects, a bounded answer, and the Host's address policy checked on the address actually
+ * connected to, so a DNS answer cannot steer a delivery somewhere the Host forbids.
+ *
+ * The result says whether anything reached the endpoint. A request that failed before its body
+ * was flushed (refused connection, unknown host, TLS failure, a refused address) was `not_sent`
+ * and is safe to send again, even for a tool; one that failed after (reset, timeout) is `lost`.
+ */
+import { lookup as dnsLookup } from "node:dns";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { BlockList, isIP } from "node:net";
+/** The largest answer read from an endpoint. */
+export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const PRIVATE = new BlockList();
+for (const [network, prefix] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.168.0.0", 16],
+])
+    PRIVATE.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+    ["::", 128],
+    ["::1", 128],
+    ["fc00::", 7],
+    ["fe80::", 10],
+])
+    PRIVATE.addSubnet(network, prefix, "ipv6");
+/** True when `address` is private, loopback, link-local or unspecified (IPv4-mapped included). */
+export function isPrivateAddress(address) {
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(address);
+    if (mapped)
+        return PRIVATE.check(mapped[1], "ipv4");
+    const family = isIP(address);
+    if (family === 0)
+        return false;
+    return PRIVATE.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+class RefusedAddress extends Error {
+    code = "ENDPOINT_ADDRESS_REFUSED";
+}
+/** Why the Host refuses `url`, or `undefined` when it may be called. */
+export function refusal(url, policy) {
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && policy.allowHttp !== false))
+        return `This Runtime calls only ${policy.allowHttp === false ? "https" : "http and https"} endpoints`;
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    if (policy.privateAddresses === "refuse" && isIP(host) && isPrivateAddress(host))
+        return "This Runtime does not call private addresses; expose the endpoint through a public URL (a tunnel, for a local app)";
+    return undefined;
+}
+/** POSTs `body` to `url` under `policy`. Never throws; `signal` aborts the request. */
+export async function post(target, body, headers, options) {
+    const { policy, signal } = options;
+    const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
+    const url = new URL(target);
+    const refused = refusal(url, policy);
+    if (refused)
+        return { kind: "not_sent", code: "ENDPOINT_ADDRESS_REFUSED", message: refused };
+    const originalHost = url.host;
+    if (policy.loopback === "docker-host" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))
+        url.hostname = "host.docker.internal";
+    const lookup = (hostname, lookupOptions, callback) => dnsLookup(hostname, { ...lookupOptions, all: true }, (error, addresses) => {
+        if (error)
+            return callback(error, []);
+        const allowed = policy.privateAddresses === "refuse"
+            ? addresses.filter((a) => !isPrivateAddress(a.address))
+            : addresses;
+        if (allowed.length === 0)
+            return callback(new RefusedAddress(`${hostname} resolves only to private addresses, which this Runtime does not call`), []);
+        if (lookupOptions.all)
+            return callback(null, allowed);
+        return callback(null, allowed[0].address, allowed[0].family);
+    });
+    return new Promise((resolve) => {
+        let sent = false;
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
+        const failed = (error) => finish({
+            kind: sent ? "lost" : "not_sent",
+            code: signal.aborted ? "ABORTED" : (error.code ?? error.name),
+            message: signal.aborted ? "The delivery was aborted" : error.message,
+        });
+        const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+            method: "POST",
+            headers: {
+                ...headers,
+                host: originalHost,
+                "content-type": "application/json",
+                "content-length": String(Buffer.byteLength(body)),
+            },
+            lookup: lookup,
+            signal,
+        }, (response) => {
+            const status = response.statusCode ?? 0;
+            const chunks = [];
+            let size = 0;
+            response.on("data", (chunk) => {
+                size += chunk.length;
+                if (size > limit) {
+                    // Settle first: destroying the answer reports an error of its own.
+                    finish({ kind: "too_large", status });
+                    response.destroy();
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on("end", () => finish({ kind: "response", status, headers: response.headers, body: Buffer.concat(chunks) }));
+            response.on("error", failed);
+            response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
+        });
+        request.on("finish", () => {
+            sent = true;
+        });
+        request.on("error", failed);
+        request.end(body);
+    });
+}

package/dist/tenant/paths.d.ts

@@ -1,28 +1,23 @@
-import type { Logger, TenantPaths } from "./types.js";
+import type { TenantPaths } from "./types.js";
 export interface HostPaths {
     root: string;
     config: string;
     credentials: string;
     home: string;
     tmp: string;
-    tenants: string;
-    trash: string;
+    /** The Tenant directory (`tenantPaths`). */
+    tenant: string;
 }
 /** Host layout under NYLORUN_HOME / ~/.nylorun. */
 export declare function hostPaths(hostRoot: string): HostPaths;
 /**
- * Absolute Tenant directory paths under `<hostRoot>/tenants/<tenantId>/`.
- * Validates the id and asserts containment after realpath.
+ * Absolute paths of the Tenant directory, `<hostRoot>/tenant/`: a Host serves one Tenant
+ * (tenancy.md §1), so the directory has no id segment. Asserts that it stays inside the Host
+ * root after realpath.
  *
- * The directory holds what stays on the Host (the Tenant's data is its Postgres schema):
- * `vault-kek`, `home/`, `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
+ * `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`. The vault key is the one exception:
+ * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
+ * mounts only into the gateway (F4.2), never into the runtime container.
  */
-export declare function tenantPaths(hostRoot: string, tenantId: string): TenantPaths;
-/**
- * Moves every Tenant directory that holds a `tenant.sqlite` to `trash/`, logging each.
- *
- * Those are beta Tenants from the SQLite Runtime. They are not migrated (recreate them); a
- * Postgres Tenant's directory never holds that file. Moving them at Host start keeps a new
- * Postgres Tenant with the same id from sharing the old directory. Returns the moved ids.
- */
-export declare function trashSqliteTenants(hostRoot: string, logger: Logger): string[];
+export declare function tenantPaths(hostRoot: string): TenantPaths;

package/dist/tenant/paths.js

@@ -1,14 +1,9 @@
-import { existsSync, mkdirSync, readdirSync, realpathSync, renameSync, } from "node:fs";
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
-import { isTenantId } from "@nylorun/core/compatibility";
-function ensureDir(path) {
-    mkdirSync(path, { recursive: true });
-    return realpathSync(path);
-}
 function assertContained(parent, child) {
     const root = parent.endsWith(sep) ? parent : parent + sep;
     if (child !== parent && !child.startsWith(root)) {
-        throw new Error(`Path ${child} escapes host tenants root ${parent}`);
+        throw new Error(`Path ${child} escapes the Host root ${parent}`);
     }
 }
 /** Host layout under NYLORUN_HOME / ~/.nylorun. */
@@ -20,72 +15,33 @@ export function hostPaths(hostRoot) {
         credentials: join(root, "host-credentials.json"),
         home: join(root, "home"),
         tmp: join(root, "tmp"),
-        tenants: join(root, "tenants"),
-        trash: join(root, "trash"),
+        tenant: join(root, "tenant"),
     };
 }
 /**
- * Absolute Tenant directory paths under `<hostRoot>/tenants/<tenantId>/`.
- * Validates the id and asserts containment after realpath.
+ * Absolute paths of the Tenant directory, `<hostRoot>/tenant/`: a Host serves one Tenant
+ * (tenancy.md §1), so the directory has no id segment. Asserts that it stays inside the Host
+ * root after realpath.
  *
- * The directory holds what stays on the Host (the Tenant's data is its Postgres schema):
- * `vault-kek`, `home/`, `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`.
+ * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
+ * `tmp/`, `sandboxes/`, `plugin-data/`, `logs/tenant.log`. The vault key is the one exception:
+ * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
+ * mounts only into the gateway (F4.2), never into the runtime container.
  */
-export function tenantPaths(hostRoot, tenantId) {
-    if (!isTenantId(tenantId)) {
-        throw new Error(`Invalid tenant id: ${String(tenantId)}`);
-    }
-    const host = hostPaths(hostRoot);
-    const tenantsRoot = ensureDir(host.tenants);
-    const root = join(tenantsRoot, tenantId);
-    // Containment before the Tenant directory exists: resolve under real tenants root.
-    const resolvedRoot = resolve(tenantsRoot, tenantId);
-    assertContained(tenantsRoot, resolvedRoot);
-    if (existsSync(root)) {
-        assertContained(tenantsRoot, realpathSync(root));
-    }
+export function tenantPaths(hostRoot) {
+    mkdirSync(hostRoot, { recursive: true });
+    const host = realpathSync(hostRoot);
+    const root = join(host, "tenant");
+    if (existsSync(root))
+        assertContained(host, realpathSync(root));
     return {
-        root: resolvedRoot,
-        kek: join(resolvedRoot, "vault-kek"),
-        home: join(resolvedRoot, "home"),
-        tmp: join(resolvedRoot, "tmp"),
-        sandboxes: join(resolvedRoot, "sandboxes"),
-        pluginData: join(resolvedRoot, "plugin-data"),
-        logs: join(resolvedRoot, "logs"),
-        log: join(resolvedRoot, "logs", "tenant.log"),
+        root,
+        kek: join(host, "keys", "vault-kek"),
+        home: join(root, "home"),
+        tmp: join(root, "tmp"),
+        sandboxes: join(root, "sandboxes"),
+        pluginData: join(root, "plugin-data"),
+        logs: join(root, "logs"),
+        log: join(root, "logs", "tenant.log"),
     };
 }
-/** The database file of a Tenant from before the Postgres Session Store. */
-const SQLITE_DATABASE = "tenant.sqlite";
-/**
- * Moves every Tenant directory that holds a `tenant.sqlite` to `trash/`, logging each.
- *
- * Those are beta Tenants from the SQLite Runtime. They are not migrated (recreate them); a
- * Postgres Tenant's directory never holds that file. Moving them at Host start keeps a new
- * Postgres Tenant with the same id from sharing the old directory. Returns the moved ids.
- */
-export function trashSqliteTenants(hostRoot, logger) {
-    const host = hostPaths(hostRoot);
-    if (!existsSync(host.tenants))
-        return [];
-    const moved = [];
-    const stamp = new Date().toISOString().replaceAll(":", "-");
-    for (const entry of readdirSync(host.tenants, { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
-        const directory = join(host.tenants, entry.name);
-        if (!existsSync(join(directory, SQLITE_DATABASE)))
-            continue;
-        mkdirSync(host.trash, { recursive: true });
-        const destination = join(host.trash, `${entry.name}-sqlite-${stamp}`);
-        renameSync(directory, destination);
-        moved.push(entry.name);
-        logger.warn("sqlite_tenant_moved_to_trash", {
-            tenant: entry.name,
-            from: directory,
-            to: destination,
-            reason: "SQLite Tenants are not migrated to the Postgres Session Store; recreate the Tenant",
-        });
-    }
-    return moved;
-}

package/dist/tenant/pool.d.ts

@@ -1,10 +1,8 @@
-/** Run async work over items with a fixed concurrency limit. */
-export declare function mapPool<T, R>(items: readonly T[], concurrency: number, worker: (item: T, index: number) => Promise<R>): Promise<R[]>;
 export declare class TimeoutError extends Error {
     constructor(message?: string);
 }
 /**
  * Race a promise against a timeout. On timeout the late result is handed to
- * `onLate` (Risk R6: mark quarantined and close a late handle).
+ * `onLate` (Risk R6: the module closes a handle that opened too late).
  */
 export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, onLate?: (late: Promise<T>) => void): Promise<T>;

package/dist/tenant/pool.js

@@ -1,21 +1,3 @@
-/** Run async work over items with a fixed concurrency limit. */
-export async function mapPool(items, concurrency, worker) {
-    if (items.length === 0)
-        return [];
-    const limit = Math.max(1, Math.min(concurrency, items.length));
-    const results = new Array(items.length);
-    let next = 0;
-    async function run() {
-        for (;;) {
-            const index = next++;
-            if (index >= items.length)
-                return;
-            results[index] = await worker(items[index], index);
-        }
-    }
-    await Promise.all(Array.from({ length: limit }, () => run()));
-    return results;
-}
 export class TimeoutError extends Error {
     constructor(message = "operation timed out") {
         super(message);
@@ -24,7 +6,7 @@ export class TimeoutError extends Error {
 }
 /**
  * Race a promise against a timeout. On timeout the late result is handed to
- * `onLate` (Risk R6: mark quarantined and close a late handle).
+ * `onLate` (Risk R6: the module closes a handle that opened too late).
  */
 export async function withTimeout(promise, timeoutMs, onLate) {
     let timer;

package/dist/tenant/principals.d.ts

@@ -1,16 +1,28 @@
-import type { Tx } from "../store/types.js";
-import type { BootstrapPrincipal } from "./types.js";
+import type { InitialPrincipal } from "../store/postgres/tenant.js";
 export type { PrincipalRow } from "../store/types.js";
 /** Principal id of the Studio key derived from the admin key. */
 export declare const STUDIO_PRINCIPAL_ID = "studio";
+/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
+export declare const PROJECT_PRINCIPAL_ID = "project";
+/** The derived principals a Host registers when not told otherwise. */
+export declare const DEFAULT_DERIVED_PRINCIPALS: readonly string[];
+/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
+export declare function deriveStudioKey(adminKey: string, tenantId: string): string;
+/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
+export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;
+/** Whether `id` may name a derived principal: the client's name, never `studio`. */
+export declare function isDerivedPrincipalId(id: string): boolean;
 /**
- * Writes the application principal and idempotency key in the caller's transaction, plus
- * principal `studio` when the bootstrap carries a Studio credential hash.
- * Exported for WS-B's `TenantStore.create` (A3).
+ * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
+ * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
  */
-export declare function bootstrapPrincipal(t: Tx, bootstrap: BootstrapPrincipal, now?: Date): Promise<void>;
-/**
- * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
- * create names the same derived principals, so each must be stored with its hash.
- */
-export declare function bootstrapPrincipalMatches(t: Tx, bootstrap: BootstrapPrincipal): Promise<boolean>;
+export declare function hostPrincipals(options: {
+    adminKey: string;
+    derived?: readonly string[];
+    application?: {
+        principalId: string;
+        key: string;
+    };
+    /** Registers `studio` with this hash instead of the admin key's derivation. */
+    studioCredentialHash?: string;
+}): (tenantId: string) => InitialPrincipal[];

package/dist/tenant/principals.js

@@ -1,56 +1,68 @@
+/**
+ * The principals the Host gives its Tenant when it creates it (tenancy.md §4, plan P9): the
+ * Studio principal and the derived principals, whose keys the admin key derives, so the
+ * clients holding the admin key (Studio, `nylorun start`, Babai) store none. The Tenant keeps
+ * only their hashes.
+ *
+ * The derivations are the ones `@nylorun/admin` computes on the client side
+ * (`admin/src/derived-credentials.ts`: `deriveStudioToken`, `deriveTenantKey`); both sides
+ * must stay byte for byte the same.
+ */
+import { createHmac } from "node:crypto";
+import { DERIVED_PRINCIPAL_ID_PATTERN } from "@nylorun/core/compatibility";
+import { hashToken } from "../core/bearer.js";
 /** Principal id of the Studio key derived from the admin key. */
 export const STUDIO_PRINCIPAL_ID = "studio";
+/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
+export const PROJECT_PRINCIPAL_ID = "project";
+/** The derived principals a Host registers when not told otherwise. */
+export const DEFAULT_DERIVED_PRINCIPALS = [PROJECT_PRINCIPAL_ID];
+/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
+export function deriveStudioKey(adminKey, tenantId) {
+    return hmac(adminKey, ["nylorun/studio/v1", tenantId]);
+}
+/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
+export function deriveTenantKey(adminKey, tenantId, principalId) {
+    return hmac(adminKey, ["nylorun/principal/v1", principalId, tenantId]);
+}
+/** Whether `id` may name a derived principal: the client's name, never `studio`. */
+export function isDerivedPrincipalId(id) {
+    return DERIVED_PRINCIPAL_ID_PATTERN.test(id) && id !== STUDIO_PRINCIPAL_ID;
+}
 /**
- * Writes the application principal and idempotency key in the caller's transaction, plus
- * principal `studio` when the bootstrap carries a Studio credential hash.
- * Exported for WS-B's `TenantStore.create` (A3).
+ * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
+ * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
  */
-export async function bootstrapPrincipal(t, bootstrap, now = new Date()) {
-    const createdAt = now.toISOString();
-    await t.insertPrincipal({
-        id: bootstrap.principalId,
-        role: "application",
-        tokenHash: bootstrap.credentialHash,
-        idempotencyKey: bootstrap.idempotencyKey,
-        createdAt,
-    });
-    if (bootstrap.studioCredentialHash)
-        await t.insertPrincipal({
+export function hostPrincipals(options) {
+    const derived = options.derived ?? DEFAULT_DERIVED_PRINCIPALS;
+    for (const id of derived)
+        if (!isDerivedPrincipalId(id))
+            throw new Error(`Derived principal id '${id}' must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be '${STUDIO_PRINCIPAL_ID}'`);
+    return (tenantId) => [
+        ...(options.application
+            ? [
+                {
+                    id: options.application.principalId,
+                    credentialHash: hashToken(options.application.key),
+                },
+            ]
+            : []),
+        {
             id: STUDIO_PRINCIPAL_ID,
-            role: "application",
-            tokenHash: bootstrap.studioCredentialHash,
-            idempotencyKey: null,
-            createdAt,
-        });
-    for (const principal of bootstrap.derivedPrincipals ?? [])
-        await t.insertPrincipal({
-            id: principal.id,
-            role: "application",
-            tokenHash: principal.credentialHash,
-            idempotencyKey: null,
-            createdAt,
-        });
+            credentialHash: options.studioCredentialHash ??
+                hashToken(deriveStudioKey(options.adminKey, tenantId)),
+        },
+        ...[...new Set(derived)].map((id) => ({
+            id,
+            credentialHash: hashToken(deriveTenantKey(options.adminKey, tenantId, id)),
+        })),
+    ];
 }
-/**
- * Whether the stored bootstrap, Studio and derived principals equal `bootstrap`. A retried
- * create names the same derived principals, so each must be stored with its hash.
- */
-export async function bootstrapPrincipalMatches(t, bootstrap) {
-    const row = await t.principalById(bootstrap.principalId);
-    if (!row ||
-        row.role !== "application" ||
-        row.tokenHash !== bootstrap.credentialHash ||
-        row.idempotencyKey !== bootstrap.idempotencyKey)
-        return false;
-    const studio = await t.principalById(STUDIO_PRINCIPAL_ID);
-    if ((studio?.role === "application" ? studio.tokenHash : undefined) !==
-        bootstrap.studioCredentialHash)
-        return false;
-    for (const principal of bootstrap.derivedPrincipals ?? []) {
-        const stored = await t.principalById(principal.id);
-        if (stored?.role !== "application" ||
-            stored.tokenHash !== principal.credentialHash)
-            return false;
-    }
-    return true;
+/** HMAC-SHA256 (hex) of `parts` joined by NUL bytes, keyed with the admin key. */
+function hmac(adminKey, parts) {
+    const message = Buffer.concat(parts.flatMap((part, index) => [
+        ...(index > 0 ? [Buffer.from([0])] : []),
+        Buffer.from(part, "utf8"),
+    ]));
+    return createHmac("sha256", Buffer.from(adminKey, "utf8")).update(message).digest("hex");
 }

package/dist/tenant/reset.d.ts

@@ -1,17 +1,13 @@
 import type { ResetScope, SessionStore } from "../store/types.js";
-import type { ExecutorRegistry } from "../core/executors.js";
 import type { SandboxManager } from "../sandbox/manager.js";
 import type { TenantPaths } from "./types.js";
 export type { ResetScope } from "../store/types.js";
 export interface ResetTenantContext {
     store: SessionStore;
-    registry: ExecutorRegistry;
     sandbox: SandboxManager;
     paths: TenantPaths;
     /** Clear in-memory session observers after the store wipe. */
     clearSessionState: () => void;
-    /** Clear executor SSE streams when registrations are removed. */
-    clearExecutorStreams: () => void;
 }
 /**
  * Reset Tenant durable state for `scope` (A17).

package/dist/tenant/reset.js

@@ -42,13 +42,8 @@ export async function resetTenant(ctx, scope) {
         await ctx.sandbox.reconcile(() => false);
     }
     await ctx.store.tx((t) => t.reset(scope));
-    if (clearAll)
-        for (const row of ctx.registry.list())
-            ctx.registry.remove(row.agentId);
     if (clearSessions)
         ctx.clearSessionState();
-    if (clearAll)
-        ctx.clearExecutorStreams();
     if (clearSandboxes)
         replaceDirectory(ctx.paths.sandboxes);
     if (clearAll) {

package/dist/tenant/runtime.d.ts

@@ -1,30 +1,31 @@
-/**
- * Composition root of an open Tenant: validates the config, opens the Session Store and the
- * vault key, builds the services and the `TenantContext`, wires the seams, registers the
- * Tenant's Worker handlers and arms its sweep, and implements `TenantHandle` (handle,
- * summary, drain, close) by delegating to the Tenant modules.
- *
- * Seams wired here: `wireStreams()` connects the store's commits to Durable Streams (the
- * relay, and the history, SSE, work and control readers); `wake` goes to the
- * `DurableExecution`, whose handlers (`worker.ts`) call `advance` and `sweep`; `abortLocal`
- * aborts an advance running on this process. The sweep also drains the outbox.
- *
- * Execution: the Host passes one `TenantExecution` for every Tenant it opens
- * (`TenantOpenHooks.execution`); without one, the Tenant runs its own in-process
- * `MemoryExecution`. No lock file: several processes may open a Tenant, and ownership of each
- * session (§10.6) keeps its advances apart.
- */
-import type { ServerResponse, IncomingMessage } from "node:http";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import { type ModelProvider } from "../core/provider.js";
+import type { ModelGate } from "../gates/model-gate.js";
 import { type AuthorizeResult } from "../vault/service.js";
 import type { DurableStreams } from "../streams/types.js";
-import type { OpenedTenant, TenantConfig, TenantHandle, TenantSummary } from "./types.js";
+import type { NodeBindings, OpenedTenant, TenantConfig, TenantHandle, TenantSummary } from "./types.js";
 import { type StreamsStatus } from "./streams.js";
 import { type TenantExecution, type TenantWorker } from "./worker.js";
+import { type ToolGate } from "../gates/tool-gate.js";
+import { type Keys } from "../keys/keys.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
+    /**
+     * Serves the Tenant's vault-backed model calls (the gates service's client). Without one,
+     * the Tenant calls the model in this process.
+     */
+    modelGate?: ModelGate;
+    /**
+     * Serves the Tenant's remote MCP servers and Action deliveries (the gates service's client).
+     * Without one, the Tenant opens them and POSTs deliveries in this process.
+     */
+    toolGate?: ToolGate;
+    /**
+     * Runs vault writes and token signing (the `keys` service's client, F4.2). With one, this
+     * process never reads, creates or holds the vault key. Without one, it does them here.
+     */
+    keys?: Keys;
     vaultKek?: Buffer | string | null;
     /** When true, create the KEK file on first vault write (tests / new Tenants). */
     createKekIfMissing?: boolean;
@@ -42,6 +43,13 @@ export type TenantOpenHooks = {
      * survive a restart (tests, and a Host without S2).
      */
     streams?: DurableStreams;
+    /**
+     * The Host's stream relay feeds `streams` from the record. Without it the
+     * Tenant relays its own commits.
+     */
+    hostRelay?: boolean;
+    /** How long a retired stream basin is kept after a reset (tests). Default 60 s. */
+    retireGraceMs?: number;
 } & OpenedTenant;
 export declare class TenantRuntime implements TenantHandle {
     private readonly ctx;
@@ -53,7 +61,7 @@ export declare class TenantRuntime implements TenantHandle {
     private readonly closeGraceMs;
     private constructor();
     static open(config: TenantConfig, hooks: TenantOpenHooks): Promise<TenantRuntime>;
-    handle(request: IncomingMessage, response: ServerResponse, url?: URL): Promise<void>;
+    fetch(request: Request, node: NodeBindings): Promise<Response>;
     authorize(sessionId: string, request: {
         url: string;
         serverName?: string;
@@ -67,7 +75,7 @@ export declare class TenantRuntime implements TenantHandle {
     abortLocal(sessionId: string): void;
     /**
      * The Durable Streams seam's status for Tenant status and readiness: S2 reachability, the
-     * basin, outbox depth and relay lag (`streamsStatus` in `tenant/streams.ts`).
+     * basin, its generation and the Tenant's relay (`streamsStatus` in `tenant/streams.ts`).
      */
     streamsStatus(): Promise<StreamsStatus>;
     /** Adds a callback to the Tenant sweep. Returns a function that removes it. */