@nylorun/runtime 0.15.1-beta → 0.16.0-beta

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, SessionCommandSchema, AdminStatusSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, AdminStatusSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -14,6 +14,22 @@ export const ProtocolRejected = named("ProtocolRejected", ProtocolRejectedRespon
 export const AdminStatus = named("AdminStatus", AdminStatusSchema);
 export const HostShutdownResponse = named("HostShutdownResponse", HostShutdownResponseSchema);
 export const SandboxToolOutcome = named("SandboxToolOutcome", SandboxToolOutcomeSchema);
+export const PutSandboxRequest = named("PutSandboxRequest", PutSandboxRequestSchema);
+export const SandboxView = named("SandboxView", SandboxViewSchema);
+export const ListSandboxesResponse = named("ListSandboxesResponse", ListSandboxesResponseSchema);
+export const DeleteSandboxResponse = named("DeleteSandboxResponse", DeleteSandboxResponseSchema);
+export const ListSandboxEventsResponse = named("ListSandboxEventsResponse", ListSandboxEventsResponseSchema);
+export const ArtifactVersionView = named("ArtifactVersionView", ArtifactVersionViewSchema);
+export const ArtifactView = named("ArtifactView", ArtifactViewSchema);
+export const ListArtifactsResponse = named("ListArtifactsResponse", ListArtifactsResponseSchema);
+export const UploadArtifactResponse = named("UploadArtifactResponse", UploadArtifactResponseSchema);
+export const DeleteArtifactResponse = named("DeleteArtifactResponse", DeleteArtifactResponseSchema);
+export const CreateArtifactLinkRequest = named("CreateArtifactLinkRequest", CreateArtifactLinkRequestSchema);
+export const ArtifactLink = named("ArtifactLink", ArtifactLinkSchema);
+export const PutTenantArtifactsRequest = named("PutTenantArtifactsRequest", PutTenantArtifactsRequestSchema);
+export const TenantArtifactsView = named("TenantArtifactsView", TenantArtifactsViewSchema);
+export const ArtifactTree = named("ArtifactTree", ArtifactTreeSchema);
+export const ArtifactDiff = named("ArtifactDiff", ArtifactDiffSchema);
 export const PutEndpointsRequest = named("PutEndpointsRequest", PutEndpointsRequestSchema);
 export const ListEndpointsResponse = named("ListEndpointsResponse", ListEndpointsResponseSchema);
 export const DeleteEndpointResponse = named("DeleteEndpointResponse", DeleteEndpointResponseSchema);

package/dist/api/gate/keys.d.ts

@@ -3,11 +3,12 @@
  * `Keys` per request, run with the vault key of the gateway's Tenant. Errors keep their status,
  * code and details. Logs the operation and its outcome, never an argument or a result.
  */
-import type { Hono, MiddlewareHandler } from "hono";
+import type { Env, Hono, MiddlewareHandler } from "hono";
 import type { Logger } from "../../tenant/types.js";
 import { type Keys } from "../../keys/keys.js";
-export declare function mountKeysRoutes(app: Hono, options: {
-    readonly authorized: MiddlewareHandler;
+export declare function mountKeysRoutes<E extends Env>(app: Hono<E>, options: {
+    /** Core's credential: no run token reaches the keys (F5). */
+    readonly authorized: MiddlewareHandler<E>;
     /** The gateway's Tenant's keys; rejects when the Tenant is not ready. */
     readonly keys: () => Promise<Keys>;
     readonly logger: Logger;

package/dist/api/gate/routes.d.ts

@@ -6,9 +6,18 @@ import type { ToolCalls } from "../../gates/tool-calls.js";
 import type { Keys } from "../../keys/keys.js";
 import type { Logger } from "../../tenant/types.js";
 import { type OutboundPolicy } from "../../tenant/outbound.js";
+import type { RunClaims, RunTokenVerdict } from "../../tenant/run-token.js";
+/** How the gateway checks a run token: its signature and claims, then its lease (G4). */
+export interface RunTokenCheck {
+    verify(raw: string): Promise<RunTokenVerdict>;
+    /** Why calls under `claims` are stale, or undefined while the lease is the session's. */
+    stale(claims: RunClaims): Promise<string | undefined>;
+}
 export interface GatesAppOptions {
-    /** The bearer every model call must present (`NYLORUN_GATES_TOKEN`). */
+    /** Core's credential (`NYLORUN_GATES_TOKEN`): keys, deliveries, MCP requests outside a run. */
     readonly token: string;
+    /** Checks run tokens (F5): the credential of model calls and a session's MCP requests. */
+    readonly runs: RunTokenCheck;
     /** Serves an authenticated, well-formed call. */
     readonly modelGate: ModelCallHandler;
     /** Keyed calls, which outlive their client (P1.2). */
@@ -23,7 +32,7 @@ export interface GatesAppOptions {
     readonly toolCalls?: ToolCalls;
     /** The keys service's operations (F4.2). Without it the keys route answers 404. */
     readonly keys?: () => Promise<Keys>;
-    /** Logs the keys service's requests. */
+    /** Logs the keys service's requests and refused credentials. */
     readonly logger?: Logger;
     /**
      * How the gate may call Action endpoints (the gateway's own `NYLORUN_ENDPOINT_*`), for
@@ -31,4 +40,11 @@ export interface GatesAppOptions {
      */
     readonly delivery?: OutboundPolicy;
 }
-export declare function createGatesApp(options: GatesAppOptions): Hono;
+/** The verified run token of a request on a run route; absent under core's credential. */
+type GateEnv = {
+    Variables: {
+        run?: RunClaims;
+    };
+};
+export declare function createGatesApp(options: GatesAppOptions): Hono<GateEnv>;
+export {};

package/dist/api/gate/routes.js

@@ -1,45 +1,99 @@
 /**
  * The gates service's HTTP routes (blueprint §15, P1.1): the Model Gate's IR endpoint, the Tool
- * Gate's remote MCP and delivery routes (F4.1), and the health and readiness probes. Internal:
- * only the loop calls them, with the stack's gates token, so they are not in the published
- * OpenAPI documents. The wire formats are `gates/contract.ts` and `gates/tool-contract.ts`.
+ * Gate's remote MCP and delivery routes (F4.1), the keys service (F4.2), and the health and
+ * readiness probes. Internal, so they are not in the published OpenAPI documents. The wire
+ * formats are `gates/contract.ts` and `gates/tool-contract.ts`.
+ *
+ * Two credentials (F5, gate trust):
+ *
+ * | Route | Accepts | Scope from |
+ * | --- | --- | --- |
+ * | `POST /nylorun/v1/model-calls`, its cancel | run token | the token |
+ * | `POST /nylorun/v1/tool-calls`, its cancel; `mcp/connect`, `mcp/list`, `mcp/close` | run token, or core's | the token; the body only for core's |
+ * | `POST /nylorun/v1/keys/:operation` | core's | — |
+ * | `POST /nylorun/v1/deliveries` | core's | — |
+ *
+ * Core's credential is `NYLORUN_GATES_TOKEN`, which only the runtime container holds. A run
+ * token (`tenant/run-token.ts`) names one lease of one session's turn: a call under it must
+ * still be the session's (`409 run_stale` otherwise); a cancel need not, since a user cancel
+ * makes the token stale, but stops only its own session's call.
  */
 import { createHash } from "node:crypto";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { isTenantId } from "@nylorun/core/compatibility";
 import { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, TENANT_HEADER, } from "../../gates/contract.js";
-import { InflightConflict } from "../../gates/inflight.js";
+import { InflightConflict, InflightStale } from "../../gates/inflight.js";
 import { mountKeysRoutes } from "./keys.js";
 import { DELIVERIES_PATH, DELIVERY_HEADERS, DeliveryBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "../../gates/tool-contract.js";
 import { post } from "../../tenant/outbound.js";
+import { looksLikeToken } from "../../tenant/jwt.js";
 import { adminKeyMatches } from "../../host/http.js";
 import { canonical } from "../../store/canonical.js";
 const invalid = (message) => ({
     error: { code: "invalid_request", message },
 });
+const gateError = (code, message) => ({
+    error: { code, message },
+});
 export function createGatesApp(options) {
     const app = new Hono();
     const maxSize = options.maxBodyBytes ?? MAX_MODEL_CALL_BYTES;
+    const logger = options.logger ?? { info() { }, warn() { }, error() { } };
     app.get("/health", (c) => c.json({ status: "ok" }));
     app.get("/ready", async (c) => (await options.ready()) ? c.json({ ready: true }) : c.json({ ready: false }, 503));
-    const authorized = async (c, next) => {
-        const presented = /^Bearer (.+)$/.exec(c.req.header("authorization") ?? "")?.[1];
-        if (!adminKeyMatches(presented, options.token)) {
-            const body = {
-                error: {
-                    code: "gate_unauthorized",
-                    message: "Missing or wrong gates token; the caller and the gateway must share NYLORUN_GATES_TOKEN",
-                },
-            };
-            return c.json(body, 401);
+    const bearerOf = (c) => /^Bearer (.+)$/.exec(c.req.header("authorization") ?? "")?.[1];
+    const unauthorized = (c, message) => c.json(gateError("gate_unauthorized", message), 401);
+    /** Core's credential, compared in constant time. */
+    const core = async (c, next) => {
+        if (!adminKeyMatches(bearerOf(c), options.token))
+            return unauthorized(c, "Missing or wrong credential: this route takes core's (NYLORUN_GATES_TOKEN)");
+        await next();
+    };
+    /**
+     * A run token, verified and put on the context; with `live`, its lease must still be the
+     * session's. With `orCore`, core's credential is accepted instead, and the route reads the
+     * session from the body.
+     */
+    const run = (accept) => async (c, next) => {
+        const presented = bearerOf(c);
+        // Core's credential is never JWT-shaped; a run token always is.
+        if (accept.orCore && presented !== undefined && !looksLikeToken(presented))
+            return core(c, next);
+        if (presented === undefined || !looksLikeToken(presented))
+            return unauthorized(c, "Missing or wrong credential: this route takes a run token");
+        const verdict = await options.runs.verify(presented);
+        if (!verdict.ok) {
+            logger.warn("gate_credential_refused", { route: c.req.path, reason: verdict.reason });
+            return unauthorized(c, "The run token is malformed, expired, revoked or not this Tenant's");
         }
+        if (accept.live) {
+            const stale = await options.runs.stale(verdict.claims);
+            if (stale) {
+                logger.warn("gate_run_stale", {
+                    route: c.req.path,
+                    session: verdict.claims.sessionId,
+                    epoch: verdict.claims.epoch,
+                    reason: stale,
+                });
+                return c.json(gateError("run_stale", `The run token's lease is over: ${stale}`), 409);
+            }
+        }
+        c.set("run", verdict.claims);
         await next();
     };
+    /**
+     * The Tenant a request is for: a run token's, which a `Nylorun-Tenant` header must then
+     * name; else the header's, when it is a Tenant id. `false` for a bad header.
+     */
     const tenantOf = (c) => {
         const tenantId = c.req.header(TENANT_HEADER);
-        return tenantId !== undefined && !isTenantId(tenantId) ? false : tenantId;
+        const claims = c.get("run");
+        if (tenantId !== undefined && (!isTenantId(tenantId) || (claims && tenantId !== claims.tenantId)))
+            return false;
+        return claims?.tenantId ?? tenantId;
     };
+    const badTenant = (c) => c.json(invalid(`The ${TENANT_HEADER} header must name a Tenant, the run token's when there is one`), 400);
     const toolBodies = bodyLimit({
         maxSize: MAX_TOOL_BODY_BYTES,
         onError: (c) => c.json(invalid(`A request body may be at most ${MAX_TOOL_BODY_BYTES} bytes`), 400),
@@ -48,7 +102,7 @@ export function createGatesApp(options) {
     async function read(c, schema) {
         const tenantId = tenantOf(c);
         if (tenantId === false)
-            return { ok: false, response: c.json(invalid(`The ${TENANT_HEADER} header must name a Tenant`), 400) };
+            return { ok: false, response: badTenant(c) };
         let raw;
         try {
             raw = await c.req.json();
@@ -64,61 +118,111 @@ export function createGatesApp(options) {
             };
         return { ok: true, tenantId, body: parsed.data };
     }
+    /**
+     * The MCP server a request names, in its session: a run token's session (a body naming
+     * another is refused), or, under core's credential, the body's.
+     */
+    function serverOf(c, server) {
+        const claims = c.get("run");
+        if (claims) {
+            if (server.sessionId !== undefined && server.sessionId !== claims.sessionId)
+                return {
+                    ok: false,
+                    response: c.json(gateError("gate_forbidden", "The run token is for another session"), 403),
+                };
+            return { ok: true, server: { ...server, sessionId: claims.sessionId } };
+        }
+        if (server.sessionId === undefined)
+            return {
+                ok: false,
+                response: c.json(invalid("server.sessionId is required with core's credential"), 400),
+            };
+        return { ok: true, server: server };
+    }
+    /** The run a keyed call belongs to, for the in-flight map (G4). */
+    const ownerOf = (c) => {
+        const claims = c.get("run");
+        return claims ? { sessionId: claims.sessionId, epoch: claims.epoch } : undefined;
+    };
+    /** 409 for a keyed re-send the in-flight map refused, or undefined. */
+    const refusedJoin = (c, error) => {
+        if (error instanceof InflightStale)
+            return c.json(gateError("run_stale", error.message), 409);
+        if (error instanceof InflightConflict)
+            return c.json(gateError("gate_conflict", error.message), 409);
+        return undefined;
+    };
     if (options.keys)
         mountKeysRoutes(app, {
-            authorized,
+            authorized: core,
             keys: options.keys,
-            logger: options.logger ?? { info() { }, warn() { }, error() { } },
+            logger,
         });
     const mcp = options.mcp;
     if (mcp) {
-        app.post(MCP_CONNECT_PATH, authorized, toolBodies, async (c) => {
+        const scoped = run({ live: true, orCore: true });
+        app.post(MCP_CONNECT_PATH, scoped, toolBodies, async (c) => {
             const request = await read(c, McpServerBodySchema);
             if (!request.ok)
                 return request.response;
-            return c.json(await mcp.connect(request.tenantId, request.body.server));
+            const server = serverOf(c, request.body.server);
+            if (!server.ok)
+                return server.response;
+            return c.json(await mcp.connect(request.tenantId, server.server));
         });
-        app.post(MCP_LIST_PATH, authorized, toolBodies, async (c) => {
+        app.post(MCP_LIST_PATH, scoped, toolBodies, async (c) => {
             const request = await read(c, McpListBodySchema);
             if (!request.ok)
                 return request.response;
-            const { server, cursor } = request.body;
-            return c.json(await mcp.list(request.tenantId, server, cursor, c.req.raw.signal));
+            const server = serverOf(c, request.body.server);
+            if (!server.ok)
+                return server.response;
+            return c.json(await mcp.list(request.tenantId, server.server, request.body.cursor, c.req.raw.signal));
         });
-        app.post(MCP_CLOSE_PATH, authorized, toolBodies, async (c) => {
+        // Closing a session's own connection needs no live lease: the gate reopens it on demand.
+        app.post(MCP_CLOSE_PATH, run({ live: false, orCore: true }), toolBodies, async (c) => {
             const request = await read(c, McpServerBodySchema);
             if (!request.ok)
                 return request.response;
-            await mcp.close(request.body.server);
+            const server = serverOf(c, request.body.server);
+            if (!server.ok)
+                return server.response;
+            await mcp.close(server.server);
             return c.body(null, 204);
         });
         const toolCalls = options.toolCalls;
-        app.post(`${TOOL_CALLS_PATH}/:key/cancel`, authorized, (c) => {
+        app.post(`${TOOL_CALLS_PATH}/:key/cancel`, run({ live: false, orCore: true }), (c) => {
             if (tenantOf(c) === false)
-                return c.json(invalid(`The ${TENANT_HEADER} header must name a Tenant`), 400);
-            toolCalls?.cancel(c.req.param("key"));
+                return badTenant(c);
+            const owner = ownerOf(c);
+            if (toolCalls && !toolCalls.cancel(c.req.param("key"), owner?.sessionId))
+                return c.json(gateError("gate_forbidden", "The call is another session's"), 403);
             return c.body(null, 204);
         });
-        app.post(TOOL_CALLS_PATH, authorized, toolBodies, async (c) => {
+        app.post(TOOL_CALLS_PATH, scoped, toolBodies, async (c) => {
             const request = await read(c, ToolCallBodySchema);
             if (!request.ok)
                 return request.response;
+            const server = serverOf(c, request.body.server);
+            if (!server.ok)
+                return server.response;
+            const body = { ...request.body, server: server.server };
             const signal = c.req.raw.signal;
             const key = c.req.header("idempotency-key");
             try {
-                // Keyed: the call runs under its own signal, once, and outlives this request (G3).
+                // Keyed: the call runs under its own signal, once, and outlives this request (G3). The
+                // hash covers the session, so a re-send joins only its own session's call.
                 const answer = key && toolCalls
-                    ? await untilAborted(toolCalls.run(request.tenantId, key, createHash("sha256").update(canonical(request.body)).digest("hex"), request.body), signal)
-                    : await mcp.call(request.tenantId, request.body, signal);
+                    ? await untilAborted(toolCalls.run(request.tenantId, key, createHash("sha256").update(canonical(body)).digest("hex"), body, ownerOf(c)), signal)
+                    : await mcp.call(request.tenantId, body, signal);
                 if (signal.aborted)
                     return new Response(null, { status: 499 });
                 return c.json(answer);
             }
             catch (error) {
-                if (error instanceof InflightConflict) {
-                    const body = { error: { code: "gate_conflict", message: error.message } };
-                    return c.json(body, 409);
-                }
+                const refused = refusedJoin(c, error);
+                if (refused)
+                    return refused;
                 if (signal.aborted)
                     return new Response(null, { status: 499 });
                 throw error;
@@ -127,7 +231,7 @@ export function createGatesApp(options) {
     }
     const policy = options.delivery;
     if (policy) {
-        app.post(DELIVERIES_PATH, authorized, toolBodies, async (c) => {
+        app.post(DELIVERIES_PATH, core, toolBodies, async (c) => {
             const request = await read(c, DeliveryBodySchema);
             if (!request.ok)
                 return request.response;
@@ -158,22 +262,22 @@ export function createGatesApp(options) {
             return c.json(answer);
         });
     }
-    app.post(`${MODEL_CALLS_PATH}/:key/cancel`, authorized, (c) => {
+    app.post(`${MODEL_CALLS_PATH}/:key/cancel`, run({ live: false }), (c) => {
         // Optional, as on a call: the gate serves one Tenant, so the key alone names the call.
-        const tenantId = c.req.header(TENANT_HEADER);
-        if (tenantId !== undefined && !isTenantId(tenantId))
-            return c.json(invalid(`The ${TENANT_HEADER} header must name a Tenant`), 400);
-        options.inflight.cancel(c.req.param("key"));
+        if (tenantOf(c) === false)
+            return badTenant(c);
+        if (!options.inflight.cancel(c.req.param("key"), c.get("run").sessionId))
+            return c.json(gateError("gate_forbidden", "The call is another session's"), 403);
         return c.body(null, 204);
     });
-    app.post(MODEL_CALLS_PATH, authorized, bodyLimit({
+    app.post(MODEL_CALLS_PATH, run({ live: true }), bodyLimit({
         maxSize,
         onError: (c) => c.json(invalid(`A model call body may be at most ${maxSize} bytes`), 400),
     }), async (c) => {
         // Optional: the gate serves its database's one Tenant, and refuses a call naming another.
-        const tenantId = c.req.header(TENANT_HEADER);
-        if (tenantId !== undefined && !isTenantId(tenantId))
-            return c.json(invalid(`The ${TENANT_HEADER} header must name a Tenant`), 400);
+        const tenantId = tenantOf(c);
+        if (tenantId === false)
+            return badTenant(c);
         let raw;
         try {
             raw = await c.req.json();
@@ -184,9 +288,14 @@ export function createGatesApp(options) {
         const parsed = ModelCallBodySchema.safeParse(raw);
         if (!parsed.success)
             return c.json(invalid(`Invalid model call: ${parsed.error.issues[0]?.message ?? "malformed"}`), 400);
+        // Session, turn and agent come from the run token, never the body: they scope the
+        // ledger rows and the turn and agent caps.
+        const claims = c.get("run");
+        const scope = { sessionId: claims.sessionId, turnId: claims.turnId, agentId: claims.agentId };
         const { call, ...ids } = parsed.data;
         const request = {
             ...(tenantId === undefined ? {} : { tenantId }),
+            ...scope,
             ...ids,
             call: call,
         };
@@ -196,19 +305,19 @@ export function createGatesApp(options) {
             let outcome;
             if (key) {
                 // Keyed: the call runs under its own signal and outlives this request (P1.2). The
-                // gate serves one Tenant, so the effect id alone is the key.
-                const hash = createHash("sha256").update(canonical(parsed.data)).digest("hex");
-                outcome = await untilAborted(options.inflight.run(key, hash, (own) => options.modelGate.call(request, own)), signal);
+                // gate serves one Tenant, so the effect id alone is the key. The hash covers the
+                // token's scope, so the new owner's re-send after a takeover hashes the same.
+                const hash = createHash("sha256").update(canonical({ ...scope, ...parsed.data })).digest("hex");
+                outcome = await untilAborted(options.inflight.run(key, hash, (own) => options.modelGate.call(request, own), ownerOf(c)), signal);
             }
             else
                 outcome = await options.modelGate.call(request, signal);
             return c.json({ outcome });
         }
         catch (error) {
-            if (error instanceof InflightConflict) {
-                const body = { error: { code: "gate_conflict", message: error.message } };
-                return c.json(body, 409);
-            }
+            const refused = refusedJoin(c, error);
+            if (refused)
+                return refused;
             // The caller went away (or cancelled): nobody reads the answer.
             if (signal.aborted)
                 return new Response(null, { status: 499 });

package/dist/api/http/app.js

@@ -8,6 +8,8 @@ import { jsonResponse, rejectionOf } from "./respond.js";
 import { accessRoutes } from "./routes/access.js";
 import { endpointRoutes } from "./routes/endpoints.js";
 import { actionRoutes } from "./routes/actions.js";
+import { sandboxRoutes } from "./routes/sandboxes.js";
+import { artifactRoutes } from "./routes/artifacts.js";
 import { sessionRoutes } from "./routes/sessions.js";
 import { tenantRoutes } from "./routes/tenant.js";
 import { vaultRoutes } from "./routes/vaults.js";
@@ -38,6 +40,8 @@ function build() {
     actionRoutes(api);
     endpointRoutes(api);
     sessionRoutes(api);
+    sandboxRoutes(api);
+    artifactRoutes(api);
     tenantRoutes(api);
     vaultRoutes(api);
     accessRoutes(api);

package/dist/api/http/define.d.ts

@@ -27,6 +27,16 @@ export interface RouteAccess {
      * served too. A credential that is sent is still checked, so a wrong one stays the opaque 404.
      */
     readonly anonymous?: boolean;
+    /**
+     * The body is the bytes of a file, of any media type (an artifact upload): the Host lets it
+     * through without `application/json`, and the handler streams it.
+     */
+    readonly bytes?: boolean;
+    /**
+     * Served without `Nylorun-Protocol` (a capability link, opened by a browser or an `<img>`):
+     * the Host checks the header only when it is sent.
+     */
+    readonly unversioned?: boolean;
 }
 /** The route's path segments, decoded, as the Tenant's checks read them. */
 export declare function pathSegments(incoming: IncomingMessage): string[];

package/dist/api/http/define.js

@@ -68,8 +68,9 @@ function authenticated(access) {
 export function tenantRoute(api, access, route, handler) {
     const takes = (credential) => access.credentials.includes(credential);
     const schemes = [...new Set(access.credentials.map((credential) => SCHEMES[credential]))];
+    const protocol = z.string().meta({ description: `The protocol version, \`${PROTOCOL_VERSION}\`` });
     const headers = z.object({
-        "Nylorun-Protocol": z.string().meta({ description: `The protocol version, \`${PROTOCOL_VERSION}\`` }),
+        "Nylorun-Protocol": access.unversioned ? protocol.optional() : protocol,
         ...(takes("subject")
             ? {
                 "Nylorun-Subject": z

package/dist/api/http/routes/artifacts.d.ts

@@ -0,0 +1,11 @@
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+/**
+ * One `bytes=` range of a file of `size` bytes: what to send, `"unsatisfiable"`, or undefined
+ * to send the whole file (no header, several ranges, or one the Runtime ignores).
+ */
+export declare function parseRange(header: string | undefined, size: number): {
+    start: number;
+    end: number;
+} | "unsatisfiable" | undefined;
+export declare function artifactRoutes(api: OpenAPIHono<TenantEnv>): void;