@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/host/admin-api.js

@@ -1,13 +1,14 @@
 /**
- * The Admin API (`/v1/admin/**`): the Host's status and shutdown, for a caller with the admin
- * key. A Host serves one Tenant, so there are no Tenant routes: the status names the Tenant
- * and, when it could not be opened, why (tenancy.md §9). The Host checks the listener, the
- * protocol and the admin key first (`app.ts`); what gets here is authorized. Routes are
- * declared once, for serving and for the OpenAPI document.
+ * The Admin API (`/v1/admin/**`): the Host's status and shutdown, and the Tenant's operator
+ * keys (F9 I1), for a caller with the admin key. A Host serves one Tenant, so there are no
+ * Tenant routes: the status names the Tenant and, when it could not be opened, why
+ * (tenancy.md §9). The Host checks the listener, the protocol and the admin key first
+ * (`app.ts`); what gets here is authorized. Routes are declared once, for serving and for the
+ * OpenAPI document.
  */
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { z } from "zod";
-import { AdminStatus as AdminStatusBody, HostShutdownResponse, ProtocolRejected, Rejected, } from "../api/components.js";
+import { AdminStatus as AdminStatusBody, DeleteOperatorKeyResponse, HostShutdownResponse, ListOperatorKeysResponse, PutOperatorKeyResponse, ProtocolRejected, Rejected, } from "../api/components.js";
 import { serveRoute } from "../api/route.js";
 import { jsonResponse, rejectedResponse } from "./http.js";
 const json = (schema, description) => ({
@@ -54,6 +55,68 @@ export function createAdminApi(options) {
         c.env.outgoing.once("finish", () => options.shutdown());
         return jsonResponse(200, { status: "shutting_down" });
     });
+    const keyId = z.object({
+        id: z.string().meta({ description: "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`" }),
+    });
+    const keysOf = async () => (await options.operatorKeys?.()) ??
+        rejectedResponse(503, "request_rejected", "The Tenant is not open: see /v1/admin/status");
+    serveRoute(api, adminRoute({
+        method: "get",
+        path: "/v1/admin/keys",
+        summary: "List the Tenant's keys",
+        description: "Every application key of the Tenant by name, with its role and when it was issued. Keys themselves are never shown again.",
+        responses: {
+            200: json(ListOperatorKeysResponse, "The keys, by id"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async () => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        return jsonResponse(200, { keys: await keys.list() });
+    });
+    serveRoute(api, adminRoute({
+        method: "put",
+        path: "/v1/admin/keys/{id}",
+        summary: "Create or rotate a key",
+        description: "Issues a new key named `id` and returns it this once. A key of that name is replaced: the old one stops authenticating at once. `studio` is refused.",
+        request: { params: keyId },
+        responses: {
+            200: json(PutOperatorKeyResponse, "The new key, shown once"),
+            400: rejected("Not a key name, or `studio`"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async (c) => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        const put = await keys.put(c.req.param("id") ?? "");
+        return "reason" in put ? refusedResponse(put) : jsonResponse(200, put);
+    });
+    serveRoute(api, adminRoute({
+        method: "delete",
+        path: "/v1/admin/keys/{id}",
+        summary: "Delete a key",
+        description: "The key stops authenticating at once. `studio` is refused.",
+        request: { params: keyId },
+        responses: {
+            200: json(DeleteOperatorKeyResponse, "The key is deleted"),
+            400: rejected("Not a key name, or `studio`"),
+            404: rejected("No key of that name; or an unknown admin key, or the public listener"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async (c) => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        const id = c.req.param("id") ?? "";
+        const deleted = await keys.delete(id);
+        if (typeof deleted !== "boolean")
+            return refusedResponse(deleted);
+        return deleted
+            ? jsonResponse(200, { id, deleted: true })
+            : rejectedResponse(404, "not_found", `No key ${id}`);
+    });
     serveRoute(api, adminRoute({
         method: "get",
         path: "/v1/admin/openapi.json",
@@ -72,3 +135,6 @@ export function createAdminApi(options) {
 function notFound() {
     return rejectedResponse(404, "not_found", "Route not found");
 }
+function refusedResponse(refusal) {
+    return rejectedResponse(400, refusal.reason === "invalid" ? "invalid_request" : "request_rejected", refusal.message);
+}

package/dist/host/app.d.ts

@@ -20,7 +20,6 @@ export interface HostAppOptions {
     adminKey: string;
     coreVersion: string;
     pid: number;
-    browserAccess: boolean;
     readiness?: () => Promise<{
         ok: boolean;
         checks: Record<string, boolean>;

package/dist/host/app.js

@@ -1,10 +1,9 @@
 import { Hono } from "hono";
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
-import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, PUBLISHABLE_KEY_HEADER, TENANT_HEADER, tenantOfPublishableKey, } from "@nylorun/core/compatibility";
+import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
 import { RUNTIME_VERSION } from "../version.js";
 import { findTenantRoute } from "../api/http/app.js";
 import { tenantDocument } from "../api/openapi.js";
-import { answerPreflight } from "./cors.js";
 import { adminKeyMatches, headerValue, isJsonContentType, jsonResponse, opaqueNotFoundResponse, protocolRejectedResponse, readBearer, pathnameIsLogged, redactRoutePath, rejectedResponse, requestHasBody, } from "./http.js";
 export function createHostApp(options) {
     const { module, logger } = options;
@@ -27,25 +26,26 @@ export function createHostApp(options) {
         }
     });
     app.use(async (c, next) => {
-        const { incoming, outgoing, role } = c.env;
+        const { incoming, role } = c.env;
         if (headerValue(incoming, "origin") !== undefined) {
             const route = pathnameOf(incoming).split("/").filter(Boolean);
-            // Only Tenant routes, and only when the operator allows browsers; the Tenant then
-            // checks the publishable key and its origins before adding any CORS header.
+            // Only Tenant routes of the public listener; the Tenant then accepts only a trusted
+            // issuer's token from a browser. The operator listener never serves browsers.
             const tenantRoute = route[0] === "v1" && route[1] !== "admin";
-            // The operator listener never serves browsers.
-            if (!options.browserAccess || role === "operator" || !tenantRoute)
+            if (role === "operator" || !tenantRoute)
                 return rejectedResponse(403, "origin_rejected", "Browser Origin headers are not accepted");
-            if (incoming.method === "OPTIONS") {
-                c.set("status", answerPreflight(incoming, outgoing, route, browserRoute));
-                return RESPONSE_ALREADY_SENT;
-            }
         }
+        // CORS is the operator's proxy's: an OPTIONS request gets no CORS header.
+        if (incoming.method === "OPTIONS")
+            return new Response(null, { status: 204, headers: { allow: ALLOWED_METHODS } });
         await next();
     });
     app.use(async (c, next) => {
         const { incoming } = c.env;
-        if (requestHasBody(incoming) && !isJsonContentType(headerValue(incoming, "content-type")))
+        if (requestHasBody(incoming) &&
+            !isJsonContentType(headerValue(incoming, "content-type")) &&
+            // An artifact upload's body is the file itself, of any type.
+            tenantRouteOf(incoming)?.bytes !== true)
             return rejectedResponse(415, "unsupported_media_type", "Request bodies must use application/json");
         await next();
     });
@@ -93,14 +93,13 @@ export function createHostApp(options) {
                 return opaqueNotFoundResponse();
             return await options.admin(c.req.raw, { incoming, outgoing });
         }
-        // Tenant routes: key pattern → protocol → the Tenant → selection → the Tenant's routes.
-        const keyHeader = headerValue(incoming, PUBLISHABLE_KEY_HEADER);
-        const keyTenant = keyHeader === undefined ? undefined : tenantOfPublishableKey(keyHeader);
-        if (keyHeader !== undefined && keyTenant === undefined)
-            return rejectedResponse(400, "invalid_request", `${PUBLISHABLE_KEY_HEADER} header is malformed`);
+        // Tenant routes: protocol → the Tenant → selection → the Tenant's routes.
         const tenantHeader = headerValue(incoming, TENANT_HEADER);
         const named = tenantHeader === undefined || tenantHeader.trim() === "" ? undefined : tenantHeader.trim();
-        if (!protocolAccepted(headerValue(incoming, PROTOCOL_HEADER)))
+        const protocol = headerValue(incoming, PROTOCOL_HEADER);
+        // A capability link is opened without the header; when one is sent, it is checked.
+        if (!protocolAccepted(protocol) &&
+            !(protocol === undefined && tenantRouteOf(incoming)?.unversioned === true))
             return protocolRejectedResponse();
         const resolution = await module.resolve();
         if (resolution.kind !== "open") {
@@ -113,9 +112,8 @@ export function createHostApp(options) {
         }
         const { handle } = resolution;
         const tenantId = handle.envelope.id;
-        // A protocol 4 client names the Tenant; a publishable key carries one. Either naming
-        // another Tenant (or a malformed header) reached the wrong installation.
-        if ((named !== undefined && named !== tenantId) || (keyTenant !== undefined && keyTenant !== tenantId))
+        // A protocol 4 client names the Tenant: naming another reached the wrong installation.
+        if (named !== undefined && named !== tenantId)
             return opaqueNotFoundResponse();
         c.set("tenantId", tenantId);
         return await handle.fetch(c.req.raw, { incoming, outgoing });
@@ -148,9 +146,22 @@ export function createHostApp(options) {
     });
     return app;
 }
-/** A route a browser page may call, decided from the route alone (`api/http/define.ts`). */
-function browserRoute(method, segments) {
-    return findTenantRoute(method, segments)?.browser === true;
+/** The methods the Runtime serves, for an `OPTIONS` answer's `Allow`. */
+const ALLOWED_METHODS = "GET, POST, PUT, DELETE, OPTIONS";
+/** The Tenant route a request names, if any; a malformed path names none. */
+function tenantRouteOf(incoming) {
+    const segments = [];
+    for (const segment of pathnameOf(incoming).split("/").filter(Boolean)) {
+        try {
+            segments.push(decodeURIComponent(segment));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (segments[0] !== "v1" || segments[1] === "admin")
+        return undefined;
+    return findTenantRoute(incoming.method ?? "GET", segments);
 }
 /** The answer's status: a Response's, or the Node response's when it was written there. */
 function statusOf(c) {

package/dist/host/config-for.d.ts

@@ -16,4 +16,8 @@ export declare function configForFactory(options: {
     model?: TenantConfig["model"];
     /** How Tenants may call Action endpoints (`StackConfig.delivery`). */
     delivery?: TenantConfig["delivery"];
+    /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
+    issuers?: TenantConfig["issuers"];
+    /** `NYLORUN_PUBLIC_URL`: the base of the MCP OAuth callback (F9 C2). */
+    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -17,6 +17,8 @@ export function configForFactory(options) {
             sandbox: { backend: sandboxBackend },
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
+            ...(options.issuers ? { issuers: options.issuers } : {}),
+            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             childEnv: tenantChildEnvironment(baseline, options.hostConfig, tenant),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),

package/dist/host/config.d.ts

@@ -4,12 +4,6 @@ export interface HostConfigFile {
     host: string;
     port: number;
     allowNonLoopback?: boolean;
-    /**
-     * Whether browser requests (an `Origin` with a publishable key) may reach Tenant routes.
-     * Default off for a Host started from host.json; container mode reads
-     * `NYLORUN_BROWSER_ACCESS` instead.
-     */
-    browserAccess?: boolean;
     /**
      * The operator listener's port: the Admin API moves there (on `host`, loopback only), and
      * `port` serves the Tenant API alone. Absent: one port serves both.

package/dist/host/create-host.d.ts

@@ -24,14 +24,7 @@ export interface CreateHostOptions {
      */
     publicUrl?: string;
     /**
-     * Browser access (Host feature `browser-access`): requests with an `Origin` may reach Tenant
-     * routes, where the publishable key's origin allowlist decides. Off by default: every
-     * `Origin` is `403 origin_rejected`, as before. Admin routes, `/health` and `/ready` refuse
-     * `Origin` either way.
-     */
-    browserAccess?: boolean;
-    /**
-     * The operator listener: the Admin API (and the Tenant API, never with browser access) on
+     * The operator listener: the Admin API (and the Tenant API, never to browsers) on
      * its own address, kept off the network that reaches the Tenant API. When set, the main
      * listener is public and answers admin routes with the opaque 404. Absent: one listener
      * serves everything, as before.
@@ -66,8 +59,8 @@ export interface OperatorListen {
     allowedHosts?: readonly string[];
 }
 /**
- * What a listener serves. `combined`: everything (one port). `public`: the Tenant API, with
- * browser access when enabled; admin routes are the opaque 404. `operator`: the Admin API and
+ * What a listener serves. `combined`: everything (one port). `public`: the Tenant API, to
+ * servers and to browsers with a trusted issuer's token; admin routes are the opaque 404. `operator`: the Admin API and
  * the Tenant API, never to browsers.
  */
 export type ListenerRole = "combined" | "public" | "operator";

package/dist/host/create-host.js

@@ -47,6 +47,10 @@ export function createHost(options) {
         status: adminStatusBody,
         shutdown: () => void close(),
         document: adminDocument,
+        operatorKeys: async () => {
+            const resolved = await module.resolve();
+            return resolved.kind === "open" ? resolved.handle.operatorKeys?.() : undefined;
+        },
     });
     const app = createHostApp({
         module,
@@ -55,7 +59,6 @@ export function createHost(options) {
         adminKey: credentials.adminKey,
         coreVersion,
         pid,
-        browserAccess: options.browserAccess === true,
         ...(options.readiness ? { readiness: options.readiness } : {}),
         listening: () => Boolean(server?.listening) && (!operator || Boolean(operatorServer?.listening)),
         closing: () => closing,

package/dist/host/gates.d.ts

@@ -3,7 +3,8 @@
  * the Tool Gate's routes (`api/gate/routes.ts`), behind the same `Host` check as the Runtime's
  * listeners.
  * It opens no Tenant runtime, no Restate endpoint and no stream relay, and runs no migration;
- * it needs only the Postgres pool and the Host's tenant directory (read-only).
+ * it needs only the Postgres pool and the Host's tenant directory (read-only). Run tokens (F5)
+ * verify against the Tenant's public keys and session rows in that database.
  *
  * Nothing is written while a model call runs, so the server's request timeout sits above the
  * gate's longest call. Closing stops accepting calls, lets running ones finish for up to
@@ -13,11 +14,13 @@ import { type Server } from "node:http";
 import { type InflightCallsOptions } from "../gates/inflight.js";
 import type { openMcpServer } from "../mcp/connect.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
+import { type BlobStore } from "../blob/index.js";
 import type { ModelCallSettings } from "../gates/model-gate.js";
 import { type TenantVaults } from "../gates/tenant-vaults.js";
 import type { PostgresClient } from "../store/postgres/connect.js";
 import type { Logger } from "../tenant/types.js";
-import type { GatesConfig } from "./stack-config.js";
+import type { EgressConfig, GatesConfig } from "./stack-config.js";
+import { type EgressGate, type StartEgressGateOptions } from "../gates/egress.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export declare const GATES_REQUEST_TIMEOUT_MS = 660000;
 export interface StartGatesOptions {
@@ -48,6 +51,11 @@ export interface StartGatesOptions {
      * with the Tenant's vault key. The gateway is then not ready until the key file is there.
      */
     readonly keys?: boolean;
+    /**
+     * The Object store model-gate reads the files a prompt names from (protocol 6): the stack's
+     * `s3` store. Without one, the Tenant's `fs` store under the Host root, when there is one.
+     */
+    readonly blobs?: BlobStore;
 }
 export interface GatesServer {
     /** Where the gate listens, e.g. `http://0.0.0.0:4100`. */
@@ -56,3 +64,20 @@ export interface GatesServer {
     close(): Promise<void>;
 }
 export declare function startGates(options: StartGatesOptions): Promise<GatesServer>;
+export interface StartEgressOptions {
+    readonly egress: EgressConfig;
+    readonly logger: Logger;
+    /** The pool for the Tenant's keys and sandboxes. Required unless `vaults` is given. */
+    readonly database?: PostgresClient;
+    /** The Host root. Required unless `vaults` is given. */
+    readonly hostRoot?: string;
+    /** Replaces the Postgres-backed Tenant (tests). */
+    readonly vaults?: TenantVaults;
+    /** Replaces how sandboxes are read, and the gate's limits and hooks (tests). */
+    readonly gate?: Partial<Omit<StartEgressGateOptions, "listen" | "logger" | "verify">>;
+}
+/**
+ * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
+ * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ */
+export declare function startEgress(options: StartEgressOptions): Promise<EgressGate>;

package/dist/host/gates.js

@@ -3,7 +3,8 @@
  * the Tool Gate's routes (`api/gate/routes.ts`), behind the same `Host` check as the Runtime's
  * listeners.
  * It opens no Tenant runtime, no Restate endpoint and no stream relay, and runs no migration;
- * it needs only the Postgres pool and the Host's tenant directory (read-only).
+ * it needs only the Postgres pool and the Host's tenant directory (read-only). Run tokens (F5)
+ * verify against the Tenant's public keys and session rows in that database.
  *
  * Nothing is written while a model call runs, so the server's request timeout sits above the
  * gate's longest call. Closing stops accepting calls, lets running ones finish for up to
@@ -18,9 +19,13 @@ import { createMcpHandler, GATE_MCP_IDLE_MS } from "../gates/mcp-handler.js";
 import { createToolCalls } from "../gates/tool-calls.js";
 import { existsSync } from "node:fs";
 import { tenantPaths } from "../tenant/paths.js";
+import { staleRun, verifyRunToken } from "../tenant/run-token.js";
+import { createFsBlobStore } from "../blob/index.js";
 import { createTenantVaults } from "../gates/tenant-vaults.js";
 import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
+import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
+import { verifyEgressToken } from "../sandbox/egress-token.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export const GATES_REQUEST_TIMEOUT_MS = 660_000;
 export async function startGates(options) {
@@ -29,8 +34,17 @@ export async function startGates(options) {
     if (!vaults) {
         if (!database || options.hostRoot === undefined)
             throw new Error("startGates needs the Postgres pool and the Host root");
-        vaults = createTenantVaults({ sql: database, hostRoot: options.hostRoot });
+        vaults = createTenantVaults({
+            sql: database,
+            hostRoot: options.hostRoot,
+            ...(gates.resolver ? { resolver: gates.resolver } : {}),
+            ...(options.delivery ? { delivery: options.delivery } : {}),
+        });
     }
+    const blobs = options.blobs ??
+        (options.hostRoot !== undefined
+            ? createFsBlobStore({ root: tenantPaths(options.hostRoot).blobs })
+            : undefined);
     const inflight = createInflightCalls(options.inflight);
     const mcpIdleMs = options.mcpIdleMs ?? GATE_MCP_IDLE_MS;
     const mcp = createMcpHandler({
@@ -49,13 +63,24 @@ export async function startGates(options) {
     sweep.unref();
     const prune = setInterval(() => void toolCalls.prune(), 60 * 60_000);
     prune.unref();
+    // Run tokens verify against the Tenant's public keys and session rows (F5): the same
+    // database the ledger and `tool_crossings` use.
+    const publicKeys = new Map();
     const app = createGatesApp({
         token: gates.token,
+        runs: {
+            async verify(raw) {
+                const vault = await vaults.open();
+                return verifyRunToken(vault.store, vault.tenantId, raw, publicKeys);
+            },
+            stale: async (claims) => staleRun((await vaults.open()).store, claims),
+        },
         inflight,
         modelGate: createModelCallHandler({
             vaults,
             logger,
             ...(options.settings ? { settings: options.settings } : {}),
+            ...(blobs ? { blobs } : {}),
         }),
         ready: async () => {
             // The keys service needs the vault key, which `nylorun start` writes; it never creates one.
@@ -125,3 +150,28 @@ export async function startGates(options) {
         },
     };
 }
+/**
+ * egress-gate (`--service egress`, F7.2): pods' CONNECT proxy, verifying egress tokens against the
+ * Tenant's public keys and reading its sandboxes from the same database as the gates.
+ */
+export async function startEgress(options) {
+    const { database } = options;
+    let vaults = options.vaults;
+    if (!vaults) {
+        if (!database || options.hostRoot === undefined)
+            throw new Error("startEgress needs the Postgres pool and the Host root");
+        vaults = createTenantVaults({ sql: database, hostRoot: options.hostRoot });
+    }
+    const tenant = vaults;
+    const publicKeys = new Map();
+    return startEgressGate({
+        listen: options.egress.listen,
+        logger: options.logger,
+        async verify(raw) {
+            const vault = await tenant.open();
+            return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
+        },
+        sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        ...options.gate,
+    });
+}

package/dist/host/http.d.ts

@@ -43,7 +43,10 @@ export declare function isJsonContentType(value: string | undefined): boolean;
 export declare function requestHasBody(request: IncomingMessage): boolean;
 /** `/health` and `/ready` are polled; the request log leaves them out. */
 export declare function pathnameIsLogged(rawUrl: string | undefined): boolean;
-/** Redact path parameters after `/v1/sessions/` for Host logs. */
+/**
+ * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
+ * (a credential) after `/v1/artifact-links/`.
+ */
 export declare function redactRoutePath(pathname: string): string;
 /** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */
 export declare function adminKeyMatches(presented: string | undefined, adminKey: string): boolean;

package/dist/host/http.js

@@ -135,13 +135,18 @@ export function pathnameIsLogged(rawUrl) {
     const pathname = new URL(rawUrl, "http://runtime.local").pathname;
     return pathname !== "/health" && pathname !== "/ready";
 }
-/** Redact path parameters after `/v1/sessions/` for Host logs. */
+/**
+ * Redact path parameters after `/v1/sessions/` for Host logs, and a capability link's token
+ * (a credential) after `/v1/artifact-links/`.
+ */
 export function redactRoutePath(pathname) {
     const parts = pathname.split("/");
     // ["", "v1", "sessions", "<id>", ...]
     if (parts[1] === "v1" && parts[2] === "sessions" && parts.length > 3) {
         return `/v1/sessions/:id${parts.length > 4 ? "/…" : ""}`;
     }
+    if (parts[1] === "v1" && parts[2] === "artifact-links" && parts.length > 3)
+        return "/v1/artifact-links/:token";
     return pathname;
 }
 /** Constant-time comparison of SHA-256 digests of the presented and stored admin keys. */