@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/sweep.js

@@ -1,14 +1,36 @@
-import { claimedFnVerifyActions, pendingAgentEffects, reconcilePendingAgentEffect, reofferFnVerifyClaim, } from "../core/flow-host.js";
+/**
+ * The Tenant sweep (architecture §12.3, "Timers"): one self-re-arming pass per Tenant, armed
+ * with `DurableExecution.armSweep` when the Tenant opens. It replaces every in-process timer
+ * and startup scan the Tenant runtime used to keep:
+ *
+ * 1. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
+ *    are completed and the workflow is woken (a crash between the two, or data written by an
+ *    older Runtime). One transaction per effect, child session locked before its workflow.
+ * 2. **Orphaned sessions.** `running` or `runnable` sessions with no owner, or an owner whose
+ *    lease expired, are woken with reason `recover`: a wake lost between commit and send, or
+ *    a Worker that died mid-advance (the advance then takes over, §11.4).
+ * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute this process no longer
+ *    holds are marked stopped, and sandboxes whose session is gone are removed. Idle MCP
+ *    connections are closed.
+ * 4. **Hooks.** Callbacks registered with `ctx.onSweep`.
+ * 5. **Deliveries.** Deliveries to Action endpoints whose deadline passed without an answer are
+ *    lost (`delivery.ts` `loseAction`), and pending Actions of agents with an endpoint are sent
+ *    again, in case a send was lost between a commit and the execution.
+ *
+ * Every step runs one transaction per session it changes (a linked agent and its workflow
+ * share one, child first), so the sweep follows the lock order in `store/types.ts`. A failing
+ * step does not stop the others; the first error is rethrown at the end so the execution
+ * reports it.
+ */
+import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-host.js";
+import { sweepDeliveries } from "./delivery.js";
 const BATCH = 100;
-export async function sweep(ctx, options = {}) {
+export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
         return;
     const now = new Date();
     const steps = [
-        ...(options.afterOpen
-            ? [["reoffer", () => reofferFnVerifyClaims(ctx)]]
-            : []),
-        ["claims", () => expireClaims(ctx, now)],
+        ["deliveries", () => sweepDeliveries(ctx, now)],
         ["linked", () => reconcileLinkedAgents(ctx)],
         ["orphans", () => wakeOrphanedSessions(ctx, now)],
         [
@@ -18,6 +40,7 @@ export async function sweep(ctx, options = {}) {
                 sessionExists: async (id) => !!(await ctx.store.tx((t) => t.get("sessions", id))),
             }),
         ],
+        ["mcp", () => ctx.mcp.sweep()],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
     let failure;
@@ -38,69 +61,6 @@ export async function sweep(ctx, options = {}) {
     if (failure)
         throw failure.error;
 }
-/**
- * Expire lapsed Action claims: hooks, fn and verify are offered again, tools become
- * `uncertain`. One transaction per claim, so each locks only its own session.
- */
-export async function expireClaims(ctx, now = new Date()) {
-    const { store } = ctx;
-    const seen = new Set();
-    let expiredCount = 0;
-    for (;;) {
-        const expired = (await store.tx((t) => t.expiredClaims(now, BATCH))).filter((action) => !seen.has(action.actionId));
-        for (const found of expired) {
-            seen.add(found.actionId);
-            const changed = await store.tx(async (t) => {
-                const s = await t.lockSession(found.sessionId);
-                // Read again under the session lock: a heartbeat or result may have won.
-                const action = await t.get("actions", found.actionId);
-                if (!action ||
-                    action.status !== "claimed" ||
-                    Date.parse(action.leaseExpiresAt) > now.getTime())
-                    return false;
-                if (action.kind === "hook" ||
-                    action.kind === "fn" ||
-                    action.kind === "verify") {
-                    action.status = "pending";
-                    action.claimId = null;
-                    action.leaseExpiresAt = null;
-                    await t.put("actions", action.actionId, action);
-                    t.signalWork();
-                    return true;
-                }
-                action.status = "uncertain";
-                await t.put("actions", action.actionId, action);
-                const effect = await t.get("effects", action.actionId);
-                if (effect) {
-                    effect.status = "uncertain";
-                    await t.put("effects", action.actionId, effect);
-                }
-                if (s && s.status !== "cancelled" && s.activeTurnId === action.turnId) {
-                    s.status = "uncertain";
-                    await t.put("sessions", s.id, s);
-                    await t.event(s.id, s.activeTurnId, "action.uncertain", {
-                        actionId: action.actionId,
-                        ...(action.agent ? { agent: action.agent } : {}),
-                    });
-                }
-                return true;
-            });
-            if (changed)
-                expiredCount += 1;
-        }
-        if (expired.length < BATCH)
-            return expiredCount;
-    }
-}
-/** Offer claimed `fn`/`verify` Actions again, one transaction each. Returns how many. */
-export async function reofferFnVerifyClaims(ctx) {
-    const claimed = await ctx.store.tx((t) => claimedFnVerifyActions(t));
-    let count = 0;
-    for (const action of claimed)
-        if (await ctx.store.tx((t) => reofferFnVerifyClaim(t, action.actionId)))
-            count += 1;
-    return count;
-}
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export async function reconcileLinkedAgents(ctx) {
     const { store } = ctx;

package/dist/tenant/tokens.d.ts

@@ -0,0 +1,14 @@
+import { type CreateTokenRequest, type CreateTokenResponse } from "@nylorun/core/contracts";
+import type { AuthScope, TenantContext } from "./context.js";
+export { looksLikeToken } from "./jwt.js";
+export declare function mintToken(ctx: TenantContext, body: CreateTokenRequest): Promise<CreateTokenResponse>;
+export type TokenScopeAuth = Extract<AuthScope, {
+    kind: "token";
+}>;
+/**
+ * Verifies a subject token. Returns the request's scope, answers `401 token_expired` for
+ * the cases a new token fixes, and the opaque 404 for everything else.
+ */
+export declare function verifySubjectToken(ctx: TenantContext, raw: string): Promise<TokenScopeAuth>;
+/** True when a token caller may reach `agentId`. Other callers always may. */
+export declare function mayUseAgent(scope: AuthScope, agentId: string): boolean;

package/dist/tenant/tokens.js

@@ -0,0 +1,180 @@
+/**
+ * Subject tokens (Host feature `subject-tokens`): ES256 JWTs minted by `POST /v1/tokens` with
+ * an application key, for one subject and one role of the access policy.
+ *
+ * Verification order matters: everything a forger controls is checked before any signature
+ * work, and nothing but the signature-verified cases reveals more than the opaque 404.
+ * Expired tokens, a stale revocation epoch, a revoked key or a removed role answer
+ * `401 token_expired`, so clients always react the same way: get a new token.
+ */
+import { randomUUID } from "node:crypto";
+import { errors, jwtVerify } from "jose";
+import { isSubject, SUBJECT_TOKEN_AUDIENCE, SUBJECT_TOKEN_TYPE, subjectTokenIssuer, TOKEN_SCOPES, TOKEN_TTL_MIN_SECONDS, } from "@nylorun/core/contracts";
+import { agentAllowed, readPolicy, resolveRole } from "./access-policy.js";
+import { fail, failOpaque, HttpError } from "./http.js";
+import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
+/** Allowed spread between `iat` and `exp` beyond the policy's longest lifetime. */
+const LIFETIME_SLACK_SECONDS = 60;
+export { looksLikeToken } from "./jwt.js";
+/** The 401 every "get a new token" case answers. The reason is logged, never returned. */
+function expired(ctx, reason, jti) {
+    ctx.config.logger.warn("subject token refused", {
+        reason,
+        ...(jti ? { jti } : {}),
+    });
+    throw new HttpError(401, "The subject token has expired or was revoked", { code: "token_expired" }, { "www-authenticate": 'Bearer error="invalid_token"' });
+}
+function rejected(ctx, reason) {
+    ctx.config.logger.warn("credential rejected", { reason });
+    return failOpaque();
+}
+export async function mintToken(ctx, body) {
+    const tenantId = ctx.config.tenantId;
+    const { access, epoch, ttl } = await ctx.store.tx(async (t) => {
+        const policy = await readPolicy(t);
+        const role = Object.hasOwn(policy.roles, body.role)
+            ? policy.roles[body.role]
+            : undefined;
+        if (!role)
+            return fail(400, `Role ${body.role} is not in the access policy`, {
+                code: "invalid_request",
+            });
+        const scopes = body.scopes ?? role.scopes;
+        const outside = scopes.filter((scope) => !role.scopes.includes(scope));
+        if (outside.length > 0)
+            fail(400, `Role ${body.role} does not allow ${outside.join(", ")}`, {
+                code: "invalid_request",
+            });
+        if (body.agents && role.agents !== "*") {
+            const allowed = new Set(role.agents);
+            const extra = body.agents.filter((agent) => !allowed.has(agent));
+            if (extra.length > 0)
+                fail(400, `Role ${body.role} does not allow agent ${extra.join(", ")}`, {
+                    code: "invalid_request",
+                });
+        }
+        const maxTtl = policy.tokens.maxTtlSeconds;
+        const ttl = Math.min(body.ttlSeconds ?? maxTtl, maxTtl);
+        if (ttl < TOKEN_TTL_MIN_SECONDS)
+            fail(400, `ttlSeconds must be at least ${TOKEN_TTL_MIN_SECONDS}`);
+        return {
+            access: resolveRole(policy, body.role, scopes, body.agents),
+            epoch: await t.subjectEpoch(body.subject),
+            ttl,
+        };
+    });
+    const iat = Math.floor(Date.now() / 1000);
+    const jti = randomUUID();
+    const scopes = [...access.scopes];
+    const claims = {
+        tnt: tenantId,
+        role: body.role,
+        scp: scopes.join(" "),
+        ...(body.agents ? { agt: [...body.agents] } : {}),
+        epc: epoch,
+    };
+    // Signed by the keys service (F4.2): this process never holds the private key.
+    const { token, keyId } = await ctx.keys.sign({
+        typ: SUBJECT_TOKEN_TYPE,
+        claims: {
+            ...claims,
+            iss: subjectTokenIssuer(tenantId),
+            aud: SUBJECT_TOKEN_AUDIENCE,
+            sub: body.subject,
+            iat,
+            exp: iat + ttl,
+            jti,
+        },
+    });
+    const signer = { id: keyId };
+    ctx.config.logger.info("subject token minted", {
+        jti,
+        kid: signer.id,
+        role: body.role,
+    });
+    return {
+        token,
+        expiresAt: new Date((iat + ttl) * 1000).toISOString(),
+        subject: body.subject,
+        role: body.role,
+        scopes,
+        agents: access.agents === "*" ? "*" : [...access.agents],
+        keyId: signer.id,
+    };
+}
+/**
+ * Verifies a subject token. Returns the request's scope, answers `401 token_expired` for
+ * the cases a new token fixes, and the opaque 404 for everything else.
+ */
+export async function verifySubjectToken(ctx, raw) {
+    const checked = tokenKeyId(raw, SUBJECT_TOKEN_TYPE);
+    if ("refused" in checked)
+        return rejected(ctx, checked.refused === "malformed" ? "token_malformed" : "token_header");
+    const { kid } = checked;
+    const { row, policy } = await ctx.store.tx(async (t) => ({
+        row: await t.signingKey(kid),
+        policy: await readPolicy(t),
+    }));
+    if (!row)
+        return rejected(ctx, "token_key_unknown");
+    const tenantId = ctx.config.tenantId;
+    let claims;
+    try {
+        const verified = await jwtVerify(raw, await ctx.signingKeys.publicKey(row), {
+            algorithms: ["ES256"],
+            issuer: subjectTokenIssuer(tenantId),
+            audience: SUBJECT_TOKEN_AUDIENCE,
+            typ: SUBJECT_TOKEN_TYPE,
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            requiredClaims: ["sub", "iat", "exp", "jti"],
+        });
+        claims = verified.payload;
+    }
+    catch (error) {
+        if (error instanceof errors.JWTExpired) {
+            // The signature was valid; only now may the answer differ from a forgery.
+            return expired(ctx, "expired");
+        }
+        return rejected(ctx, "token_invalid");
+    }
+    // The key was revoked after it signed: a new token uses the current key.
+    if (row.state === "revoked")
+        return expired(ctx, "key_revoked", claims.jti);
+    const scopeNames = typeof claims.scp === "string" ? claims.scp.split(" ").filter(Boolean) : [];
+    if (claims.tnt !== tenantId ||
+        !isSubject(claims.sub) ||
+        typeof claims.role !== "string" ||
+        typeof claims.epc !== "number" ||
+        !Number.isInteger(claims.epc) ||
+        claims.exp - claims.iat >
+            policy.tokens.maxTtlSeconds + LIFETIME_SLACK_SECONDS ||
+        scopeNames.some((name) => !TOKEN_SCOPES.includes(name)) ||
+        (claims.agt !== undefined &&
+            (!Array.isArray(claims.agt) ||
+                claims.agt.some((agent) => typeof agent !== "string"))))
+        return rejected(ctx, "token_claims");
+    const epoch = await ctx.store.tx((t) => t.subjectEpoch(claims.sub));
+    if (claims.epc !== epoch)
+        return expired(ctx, "revoked", claims.jti);
+    const access = resolveRole(policy, claims.role, scopeNames, claims.agt);
+    if (!access)
+        return expired(ctx, "role_removed", claims.jti);
+    if (access.scopes.size === 0)
+        return expired(ctx, "role_narrowed", claims.jti);
+    return {
+        kind: "token",
+        subject: claims.sub,
+        scopes: access.scopes,
+        agents: access.agents,
+        role: access.role,
+        ...(access.limits ? { limits: access.limits } : {}),
+        epoch,
+        expiresAt: claims.exp * 1000,
+        tokenId: claims.jti,
+        keyId: kid,
+    };
+}
+/** True when a token caller may reach `agentId`. Other callers always may. */
+export function mayUseAgent(scope, agentId) {
+    return scope.kind !== "token" || agentAllowed(scope.agents, agentId);
+}

package/dist/tenant/transcript.d.ts

@@ -14,7 +14,7 @@ export declare function toolIds(context: unknown): {
  * provider returns a `ModelCandidate` or a bare string; anything else writes no event.
  */
 export declare function assistantMessage(request: HostEffect, value: unknown): {
-    agent: import("@nylorun/core").AgentRef;
+    agent: import("@nylorun/core/define").AgentRef;
     invocationId: string;
     text: string;
     toolCalls: {
@@ -22,6 +22,12 @@ export declare function assistantMessage(request: HostEffect, value: unknown): {
         name: string;
         input: unknown;
     }[];
+    model?: {
+        provider: string;
+        model: string;
+    } | undefined;
+    finishReason?: string | undefined;
+    usage?: object | undefined;
 } | {
     agent?: undefined;
     invocationId: string;
@@ -31,10 +37,47 @@ export declare function assistantMessage(request: HostEffect, value: unknown): {
         name: string;
         input: unknown;
     }[];
+    model?: {
+        provider: string;
+        model: string;
+    } | undefined;
+    finishReason?: string | undefined;
+    usage?: object | undefined;
+} | undefined;
+/**
+ * `context.compacted` for a model effect that summarized history (Model Calls §8): the
+ * engine replaced the older transcript with that summary.
+ */
+export declare function contextCompacted(request: HostEffect, value: unknown): {
+    agent: import("@nylorun/core/define").AgentRef;
+    invocationId?: string | undefined;
+    trigger: "overflow" | "threshold";
+    tokensBefore: number;
+    tokensAfter: number;
+} | {
+    agent?: undefined;
+    invocationId?: string | undefined;
+    trigger: "overflow" | "threshold";
+    tokensBefore: number;
+    tokensAfter: number;
+} | undefined;
+/** `model.failed` for a model effect that completed with a failure outcome (Model Calls §6.4). */
+export declare function modelFailed(request: HostEffect, value: unknown): {
+    agent: import("@nylorun/core/define").AgentRef;
+    invocationId?: string | undefined;
+    code: import("@nylorun/core/define").ModelFailureCode;
+    message: string;
+    retryable: boolean;
+} | {
+    agent?: undefined;
+    invocationId?: string | undefined;
+    code: import("@nylorun/core/define").ModelFailureCode;
+    message: string;
+    retryable: boolean;
 } | undefined;
 /** `tool.completed` for an MCP or sandbox tool: its output, or the tool error it reported. */
 export declare function toolCompleted(request: HostEffect, value: unknown): {
-    agent: import("@nylorun/core").AgentRef;
+    agent: import("@nylorun/core/define").AgentRef;
     error: {
         code: string;
         message: string;
@@ -52,7 +95,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
-    agent: import("@nylorun/core").AgentRef;
+    agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
     capabilityId: string;
@@ -66,7 +109,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
 } | {
     callId: string;
     invocationId: string;
-    agent: import("@nylorun/core").AgentRef;
+    agent: import("@nylorun/core/define").AgentRef;
     error: {
         code: string;
         message: string;
@@ -88,7 +131,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
 } | {
     callId: string;
     invocationId: string;
-    agent: import("@nylorun/core").AgentRef;
+    agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
     capabilityId: string;

package/dist/tenant/transcript.js

@@ -1,3 +1,4 @@
+import { isModelFailureOutcome } from "@nylorun/core/define";
 /** The model's tool call id and the harness invocation, for tool effects and tool actions. */
 export function toolIds(context) {
     const c = context;
@@ -32,7 +33,63 @@ export function assistantMessage(request, value) {
     }
     if (!text && toolCalls.length === 0)
         return undefined;
-    return { invocationId, text, toolCalls, ...agentOf(request) };
+    const candidate = (typeof value === "object" && value !== null ? value : {});
+    const producer = candidate.evidence?.extras?.producer;
+    return {
+        invocationId,
+        text,
+        toolCalls,
+        ...(typeof producer?.provider === "string" && typeof producer.model === "string"
+            ? { model: { provider: producer.provider, model: producer.model } }
+            : {}),
+        ...(typeof candidate.finishReason === "string"
+            ? { finishReason: candidate.finishReason }
+            : {}),
+        ...(candidate.usage && typeof candidate.usage === "object"
+            ? { usage: candidate.usage }
+            : {}),
+        ...agentOf(request),
+    };
+}
+/**
+ * `context.compacted` for a model effect that summarized history (Model Calls §8): the
+ * engine replaced the older transcript with that summary.
+ */
+export function contextCompacted(request, value) {
+    const compaction = request.context?.compaction;
+    if (!compaction || compaction.partial || isModelFailureOutcome(value))
+        return undefined;
+    const summary = typeof value === "string"
+        ? value
+        : Array.isArray(value?.output)
+            ? value.output
+                .map((block) => (block.type === "text" && typeof block.text === "string" ? block.text : ""))
+                .join("")
+            : "";
+    const invocationId = request.context?.invocationId;
+    const tokensBefore = Number(compaction.tokensBefore) || 0;
+    const keptTokens = Number(compaction.keptTokens) || 0;
+    return {
+        ...(typeof invocationId === "string" ? { invocationId } : {}),
+        trigger: compaction.trigger === "overflow" ? "overflow" : "threshold",
+        tokensBefore,
+        tokensAfter: keptTokens + Math.ceil(summary.trim().length / 4),
+        ...agentOf(request),
+    };
+}
+/** `model.failed` for a model effect that completed with a failure outcome (Model Calls §6.4). */
+export function modelFailed(request, value) {
+    if (!isModelFailureOutcome(value))
+        return undefined;
+    const invocationId = request.context
+        ?.invocationId;
+    return {
+        ...(typeof invocationId === "string" ? { invocationId } : {}),
+        code: value.code,
+        message: value.message,
+        retryable: value.retryable,
+        ...agentOf(request),
+    };
 }
 /** `tool.completed` for an MCP or sandbox tool: its output, or the tool error it reported. */
 export function toolCompleted(request, value) {