@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/tenant/auth.d.ts

@@ -1,15 +1,17 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal, a subject token or a delivery token; anything else is the opaque 404 (D5).
- * An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); a
- * subject token names its subject itself. `authorize` limits both to the routes their scopes
- * allow, decided from the route alone.
+ * principal, a trusted issuer's token or a delivery token; anything else is the opaque 404
+ * (D5). An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`);
+ * an issuer token names its subject itself. `requireScopes` limits them to the routes their
+ * scopes allow, decided from the route alone.
+ *
+ * Browsers: a request with `Origin` may carry an issuer token (CORS is the operator's proxy's),
+ * never an application key or a delivery token, which are server secrets.
  */
 import type { IncomingMessage } from "node:http";
 import { type Action, type SubjectScope } from "@nylorun/core/contracts";
 import type { AuthScope, SessionAccess, TenantContext } from "./context.js";
-import type { BrowserClient } from "./browser.js";
-export declare function authenticate(ctx: TenantContext, request: IncomingMessage, client?: BrowserClient): Promise<AuthScope>;
+export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
 /**
  * What a subject needs for a route: any one of the scopes, nothing grants it (`never`), or
  * any caller may (`any`, public data such as the JWKS). Each route declares it
@@ -17,12 +19,12 @@ export declare function authenticate(ctx: TenantContext, request: IncomingMessag
  */
 export type SubjectAccess = readonly SubjectScope[] | "never" | "any";
 /**
- * A subject, subject token or publishable key reaches a route only with one of the scopes it
- * declares: `403 scope_required`, decided from the route alone before anything is read.
+ * A subject or a token caller reaches a route only with one of the scopes it declares:
+ * `403 scope_required`, decided from the route alone before anything is read.
  */
 export declare function requireScopes(scope: AuthScope, access: SubjectAccess): void;
 export declare function accessOf(scope: AuthScope): SessionAccess | undefined;
-/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+/** The subject whose sessions the request is limited to, if it acts for one. */
 export declare function ownerOf(scope: AuthScope): string | undefined;
 /** The application principal behind the request, acting for a subject or not. */
 export declare function requirePrincipal(scope: AuthScope): string;
@@ -31,4 +33,6 @@ export declare function requirePrincipal(scope: AuthScope): string;
  * is still the Action's is checked by each callback.
  */
 export declare function scoped(scope: AuthScope, action: Action): void;
+/** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
+export declare function mayUseAgent(scope: AuthScope, agentId: string): boolean;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -2,10 +2,9 @@ import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
 import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
 import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
-import { looksLikeToken, verifySubjectToken } from "./tokens.js";
 import { verifyDeliveryToken } from "./delivery-token.js";
-import { tokenType } from "./jwt.js";
-import { readPolicy } from "./access-policy.js";
+import { verifyIssuerToken } from "./issuers.js";
+import { looksLikeToken, tokenType } from "./jwt.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -18,20 +17,10 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request, client) {
+export async function authenticate(ctx, request) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
-        // A publishable key alone: what the policy grants `anon` (nothing by default).
-        if (client && header === undefined) {
-            const { anon } = await ctx.store.tx((t) => readPolicy(t));
-            return {
-                kind: "publishable",
-                keyId: client.keyId,
-                scopes: new Set(anon.scopes),
-                agents: anon.agents === "*" ? "*" : new Set(anon.agents),
-            };
-        }
         ctx.config.logger.warn("credential rejected", {
             reason: "missing_bearer",
         });
@@ -47,24 +36,27 @@ export async function authenticate(ctx, request, client) {
             fail(403, "A delivery token cannot act for a subject");
         return scope;
     }
-    if (looksLikeToken(token)) {
-        const scope = await verifySubjectToken(ctx, token);
-        // Read only after verification, so an unknown token still sees the opaque 404.
+    // A trusted issuer's token (Host feature `trusted-issuers`), from a server or a browser: its
+    // unverified `iss` names an issuer of the identity file, and only that issuer verifies it.
+    const issuer = ctx.config.issuers?.claimed(token);
+    if (issuer) {
+        const scope = await verifyIssuerToken(ctx, issuer, token);
         if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
             singleHeader(request, SCOPES_HEADER) !== undefined)
-            fail(403, "A subject token cannot act for another subject");
+            fail(403, "An issuer token cannot act for another subject");
         return scope;
     }
+    // Any other JWT: no issuer of this Host signed it (subject tokens are gone, protocol 7).
+    if (looksLikeToken(token)) {
+        ctx.config.logger.warn("credential rejected", { reason: "token_unknown_issuer" });
+        return failOpaque();
+    }
     // Application keys never come from a browser or a shipped app: refused before they are even
     // looked up.
     if (request.headers.origin !== undefined)
         fail(403, "Application keys are not accepted from browsers", {
             code: "origin_rejected",
         });
-    if (client)
-        fail(400, "Nylorun-Key is for browser and mobile clients, not with a Tenant key", {
-            code: "invalid_request",
-        });
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
     if (!principal) {
@@ -92,13 +84,11 @@ export async function authenticate(ctx, request, client) {
     };
 }
 /**
- * A subject, subject token or publishable key reaches a route only with one of the scopes it
- * declares: `403 scope_required`, decided from the route alone before anything is read.
+ * A subject or a token caller reaches a route only with one of the scopes it declares:
+ * `403 scope_required`, decided from the route alone before anything is read.
  */
 export function requireScopes(scope, access) {
-    if (scope.kind !== "subject" &&
-        scope.kind !== "token" &&
-        scope.kind !== "publishable")
+    if (scope.kind !== "subject" && scope.kind !== "token")
         return;
     if (access === "any")
         return;
@@ -107,7 +97,8 @@ export function requireScopes(scope, access) {
             code: "scope_required",
             details: { scopes: [] },
         });
-    if (!access.some((name) => scope.scopes.has(name)))
+    const held = scope.scopes;
+    if (!access.some((name) => held.has(name)))
         fail(403, `Scope ${access.join(" or ")} required`, {
             code: "scope_required",
             details: { scopes: access },
@@ -124,9 +115,7 @@ export function accessOf(scope) {
                 owner: scope.subject,
                 ...(scope.agents === "*" ? {} : { agents: scope.agents }),
             };
-        // A publishable key alone owns nothing: no session or vault is ever reachable.
-        case "publishable":
-        // Nor does a request with no credential, on a route that serves public data.
+        // A request with no credential, on a route that serves public data, owns nothing.
         case "anonymous":
             return fail(404, "Not found");
         // A delivery token reaches its Action's callbacks, never a session or vault.
@@ -138,7 +127,7 @@ export function accessOf(scope) {
         }
     }
 }
-/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+/** The subject whose sessions the request is limited to, if it acts for one. */
 export function ownerOf(scope) {
     return accessOf(scope)?.owner;
 }
@@ -159,6 +148,10 @@ export function scoped(scope, action) {
         return;
     fail(403, "This delivery token is for another Action");
 }
+/** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
+export function mayUseAgent(scope, agentId) {
+    return scope.kind !== "token" || scope.agents === "*" || scope.agents.has(agentId);
+}
 export function requireApplication(scope) {
     if (scope.kind === "application")
         return scope.principalId;

package/dist/tenant/commands.js

@@ -24,11 +24,12 @@ import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
 import { accessOf } from "./auth.js";
-import { chargeTurn } from "./subject-limits.js";
+import { checkSandboxTurn } from "./sandboxes.js";
 import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
-import { signalSessionCancel } from "./streams.js";
+import { signalActionOutcome, signalSessionCancel } from "./streams.js";
 import { toolIds } from "./transcript.js";
 import { slimModelEffects } from "./slim.js";
+import { resolveMessageParts } from "../artifacts/parts.js";
 /** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
 export function acceptedOutcome(action, outcome) {
     if (action.kind !== "tool" || !action.outputSchema)
@@ -95,7 +96,7 @@ export async function command(ctx, id, input, scope) {
         if (scope.kind === "token" &&
             command.type === "message" &&
             command.manifest !== undefined)
-            fail(403, "A subject token cannot send message.manifest", {
+            fail(403, "A token caller cannot send message.manifest", {
                 code: "scope_required",
             });
         const key = commandKey(id, command.idempotencyKey);
@@ -178,16 +179,25 @@ export async function command(ctx, id, input, scope) {
             if (command.type === "message") {
                 if (!["idle", "completed", "failed", "cancelled"].includes(s.status))
                     fail(409, "Session has active or unresolved work");
-                // After the replay check above, so a retried message is never charged twice.
-                if (scope.kind === "token" && scope.limits)
-                    await chargeTurn(t, scope.subject, scope.limits);
+                // Every turn start on a sandbox: it exists, the token's grants reach it, and no other
+                // session's turn holds it.
+                await checkSandboxTurn(t, s, scope, ctx);
                 s.turnStartState = s.state;
                 // A new turn folds from the latest snapshot: a cancel or failure only reverts this turn.
                 if (s.history?.snapshot !== undefined)
                     s.history = { ...s.history, from: s.history.snapshot };
                 s.activeTurnId = randomUUID();
+                // File parts name artifacts the caller may read; each is pinned to a version now.
+                const parts = "parts" in command
+                    ? await resolveMessageParts(t, command.parts, id, accessOf(scope))
+                    : undefined;
+                const data = "data" in command ? command.data : undefined;
                 if (isWorkflowManifest(s.manifest)) {
-                    const input = "content" in command ? command.content : command.data;
+                    const input = "content" in command
+                        ? command.content
+                        : parts
+                            ? { parts: parts.pinned }
+                            : data;
                     s.checkpoint = createFlowCheckpoint({
                         manifest: s.manifest,
                         sessionId: id,
@@ -214,9 +224,11 @@ export async function command(ctx, id, input, scope) {
                             turnId: s.activeTurnId,
                             input: "content" in command
                                 ? command.content
-                                : typeof command.data === "string"
-                                    ? command.data
-                                    : JSON.stringify(command.data),
+                                : parts
+                                    ? { content: parts.engine }
+                                    : typeof data === "string"
+                                        ? data
+                                        : JSON.stringify(data),
                             state: s.state,
                             info: s.info,
                         });
@@ -334,6 +346,15 @@ export async function recordActionOutcome(t, ctx, s, action, received, options =
         dedupeKey: `action_result:${action.turnId}:${action.actionId}:${action.generation}`,
     };
     t.afterCommit(() => ctx.wake(s.id, resultWake));
+    // A run held while the Action was pending goes on with it in the same lease (F6.2): here, or
+    // on the process whose harness holds it. The wake finds the session settled, or resumes it
+    // by replay when the run had already ended.
+    t.afterCommit(() => {
+        if (ctx.harness.holds(s.id))
+            ctx.harness.resolved(s.id, action.actionId, outcome);
+        else
+            signalActionOutcome(ctx, s.id, action.actionId);
+    });
     const event = await t.event(s.id, s.activeTurnId, "action.completed", {
         actionId: action.actionId,
         ...actionTarget(action),

package/dist/tenant/context.d.ts

@@ -14,7 +14,7 @@
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
 import type { SessionHistory } from "./history.js";
-import type { RoleLimits, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
+import type { IssuerScope, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
 import type { CredentialSelection } from "@nylorun/core/contracts";
@@ -25,14 +25,21 @@ import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
+import type { CredentialSources } from "../vault/sources.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
-import type { SandboxManager } from "../sandbox/manager.js";
+import type { HarnessApiServer } from "../harness-api/server.js";
+import type { WorkspacePort } from "../harness-api/workspace.js";
+import type { SandboxesClient } from "../sandbox/pods/client.js";
+import type { SandboxSignal } from "../execution/types.js";
 import type { TenantConfig } from "./types.js";
 import type { SessionStreams } from "./session-streams.js";
 import type { StuckInvocation, Wake } from "../execution/types.js";
 import type { WorkState } from "./scheduler.js";
 import type { SigningKeys } from "./signing-keys.js";
+import type { BlobStore } from "../blob/index.js";
+import type { WorkspaceReader } from "../artifacts/workspace.js";
+import type { RunGrants } from "./run-grants.js";
 export interface Session {
     id: string;
     agentId: string;
@@ -70,34 +77,43 @@ export interface Session {
     mcpDiagnostics?: readonly McpDiagnostic[];
     /** Session id that keys the shared sandbox; absent means this session owns it. */
     sandboxOwnerId?: string;
+    /**
+     * The sandbox resource the session is attached to (`sandbox: { id }`): its workspace is the
+     * sandbox's, shared with every session attached to it, and it outlives the session.
+     */
+    sandboxId?: string;
     /**
      * The sandbox chosen when the session was opened, resolved against the Tenant's limits, or
      * inherited from the session it shares with. Absent when the session has no sandbox or its
      * definition declares one (`.sandbox()`).
      */
     sandbox?: SandboxManifest;
-    /** Where `sandbox` came from. */
-    sandboxSource?: "default" | "inline" | "shared";
+    /** Where `sandbox` came from: `sandbox` is a sandbox resource's spec. */
+    sandboxSource?: "default" | "inline" | "shared" | "sandbox";
 }
 export type AuthScope = {
     kind: "application";
     principalId: string;
 }
 /**
- * A subject token (Host feature `subject-tokens`): one subject, the role's scopes and agents
- * narrowed by the token, until `expiresAt` (ms) or the subject's epoch moves past `epoch`.
+ * A trusted issuer's token (Host feature `trusted-issuers`, F9-D12): one subject, with the
+ * issuer's scopes, agents and sandbox grants, until `expiresAt` (ms). Only its expiry ends it.
  */
  | {
     kind: "token";
+    /** The identity file's issuer that signed it. */
+    issuer: string;
     subject: string;
-    scopes: ReadonlySet<SubjectScope>;
+    /** The issuer's scopes the token holds, which may add `studio`. */
+    scopes: ReadonlySet<IssuerScope>;
     agents: ReadonlySet<string> | "*";
-    role: string;
-    limits?: RoleLimits;
-    epoch: number;
+    /** The sandboxes it reaches: exact ids or `p/*` prefixes. Absent or empty reaches none. */
+    sandboxes?: readonly string[];
     expiresAt: number;
+    /** The token's `jti`, or a hash of it. */
     tokenId: string;
-    keyId: string;
+    /** The issuer key's `kid`, when it has one. */
+    keyId?: string;
 }
 /** An application principal acting for `subject` (`Nylorun-Subject`), narrowed to `scopes`. */
  | {
@@ -122,24 +138,27 @@ export type AuthScope = {
     expiresAt: number;
     tokenId: string;
     keyId: string;
-}
-/**
- * A publishable key with no bearer (Host feature `browser-access`): what the policy grants
- * `anon`, at most `agents:read`. It owns no session or vault.
- */
- | {
-    kind: "publishable";
-    keyId: string;
-    scopes: ReadonlySet<SubjectScope>;
-    agents: ReadonlySet<string> | "*";
 };
 export interface TenantContext {
     readonly config: TenantConfig;
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
-    readonly mcp: McpPool;
-    readonly sandbox: SandboxManager;
+    /**
+     * A session's MCP credentials, for the in-process MCP pool: its attached vaults, then the
+     * operator's credential resolver (`TenantConfig.resolver`, F9 C1).
+     */
+    readonly credentials: CredentialSources;
+    /**
+     * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
+     * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).
+     */
+    readonly mcp?: McpPool;
+    /**
+     * The workspace capability (F6.2): the Tenant's SandboxManager with an in-process harness,
+     * else the harness that serves workspaces (`harness-api/workspace.ts`).
+     */
+    readonly sandbox: WorkspacePort;
     readonly flowLimits: FlowLimits;
     readonly modelProvider: ModelProvider;
     /** True when the model comes from the Tenant vault selection, served by `modelGate`. */
@@ -157,6 +176,28 @@ export interface TenantContext {
      * `signingKeys`' private key.
      */
     readonly keys: Keys;
+    /**
+     * The Object store's `BlobStore` seam (D35): the Host's `s3` store (RustFS in the local
+     * stack), or the `fs` store under `paths.blobs` without one. Bytes only; Postgres holds what
+     * they mean, and a blob counts once a committed row names its key.
+     */
+    readonly blobs: BlobStore;
+    /**
+     * How core reads a session's sandbox workspace at turn end, to export its outputs (F8.2): over
+     * this process's `sandbox` today; over the Harness API's `workspace.read` from F6.2.
+     */
+    readonly workspaces: WorkspaceReader;
+    /**
+     * The run token of each session an advance of this process owns (F5): the credential the
+     * HTTP gate clients present for that session's model and MCP calls (`run-grants.ts`).
+     * Absent when the gates run in this process, which needs no token (G6).
+     */
+    readonly runGrants?: RunGrants;
+    /**
+     * The Harness API server (D37): advances offer their segments here, and the Tenant's
+     * harnesses (the in-process one, or attached ones) run them.
+     */
+    readonly harness: HarnessApiServer;
     /** Set by drain/close; reset clears it again. Stops new advances. */
     closing: boolean;
     /** Set once close has finished releasing resources. */
@@ -165,7 +206,7 @@ export interface TenantContext {
     readonly work: WorkState;
     /** Live delivery over Durable Streams: one `SessionStream` per observed session, and the streams wiring. */
     readonly sessionStreams: SessionStreams;
-    /** The Tenant's signing keys for subject tokens. */
+    /** The Tenant's signing keys: delivery tokens, capability links, run and host tokens. */
     readonly signingKeys: SigningKeys;
     /** The Worker id this process writes as session `owner` (§10.6). */
     readonly workerId: string;
@@ -187,6 +228,16 @@ export interface TenantContext {
      * from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends it.
      */
     deliver(actionId: string): Promise<void>;
+    /**
+     * Sandbox pods (F7.2): the sandboxes service and the Runtime image pods copy the engine from.
+     * Absent without a cluster (`nylorun sandbox enable`): kind `pod` is `sandbox_unavailable`.
+     */
+    readonly pods?: TenantPods;
+    /**
+     * Seam: reconcile a pod sandbox, or arm one of its timers (`DurableExecution.sandbox`). Call
+     * it from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends reconciles.
+     */
+    sandboxSignal(sandboxId: string, signal: SandboxSignal): Promise<void>;
     /** This Tenant's execution invocations that need an operator, for Tenant status. */
     readonly stuckInvocations?: () => Promise<StuckInvocation[]>;
     /** Callbacks the Tenant sweep runs after its own steps (`sweep.ts`). */
@@ -195,8 +246,8 @@ export interface TenantContext {
     onSweep(hook: () => Promise<void>): () => void;
 }
 /**
- * What a request acting for a person may reach: that person's sessions and vaults, and, for a
- * subject token, only sessions of the agents its role allows. Undefined means the whole Tenant.
+ * What a request acting for a person may reach: that person's sessions, and, for a token
+ * caller, only sessions of the agents its issuer allows. Undefined means the whole Tenant.
  */
 export interface SessionAccess {
     readonly owner: string;
@@ -225,3 +276,9 @@ export declare function loadSession(ctx: TenantContext, id: string, access?: Ses
  * the sandbox-sharing helpers, which walk that chain synchronously.
  */
 export declare function sandboxLookup(t: Tx, start: string | undefined): Promise<(id: string) => Session | undefined>;
+/** The sandboxes service a Tenant drives its pod sandboxes with (`TenantContext.pods`). */
+export interface TenantPods {
+    readonly client: SandboxesClient;
+    /** The Runtime image the pods copy the engine from (`NYLORUN_SANDBOX_HARNESS_IMAGE`). */
+    readonly harnessImage: string;
+}

package/dist/tenant/delivery-token.js

@@ -5,13 +5,13 @@
  * Tenant's public keys, and comes back as the bearer of that Action's callbacks (a background
  * result, heartbeats, sandbox tools).
  *
- * A token lives at most `DELIVERY_TOKEN_MAX_TTL_SECONDS`, the subject-token maximum, and key
+ * A token lives at most `DELIVERY_TOKEN_MAX_TTL_SECONDS` (`TOKEN_TTL_MAX_SECONDS`), and key
  * rotation waits at least that long before it revokes the previous key
  * (`signing-keys.ts`), so a rotation never revokes a live token.
  */
 import { createHash, randomUUID } from "node:crypto";
 import { errors, jwtVerify } from "jose";
-import { DELIVERY_TOKEN_MAX_TTL_SECONDS, DELIVERY_TOKEN_TYPE, subjectTokenIssuer, } from "@nylorun/core/contracts";
+import { DELIVERY_TOKEN_MAX_TTL_SECONDS, DELIVERY_TOKEN_TYPE, tenantTokenIssuer, } from "@nylorun/core/contracts";
 import { failOpaque, HttpError } from "./http.js";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
 /** base64url SHA-256 of a request body: the token's `bdy` claim. */
@@ -34,7 +34,7 @@ export async function mintDeliveryToken(ctx, options) {
             agt: delivery.agentId,
             gen: delivery.kind === "action" ? delivery.generation : 0,
             bdy: bodyHash(options.body),
-            iss: subjectTokenIssuer(ctx.config.tenantId),
+            iss: tenantTokenIssuer(ctx.config.tenantId),
             aud: options.audience,
             sub: delivery.kind === "action" ? delivery.actionId : "ping",
             iat,
@@ -62,7 +62,7 @@ export async function verifyDeliveryToken(ctx, raw) {
     try {
         const verified = await jwtVerify(raw, await ctx.signingKeys.publicKey(row), {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(ctx.config.tenantId),
+            issuer: tenantTokenIssuer(ctx.config.tenantId),
             typ: DELIVERY_TOKEN_TYPE,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,
             requiredClaims: ["sub", "aud", "iat", "exp", "jti"],

package/dist/tenant/effects.d.ts

@@ -1,18 +1,27 @@
+/**
+ * Core's side of effects: `resolveNewFlowEffect` journals and dispatches new workflow effects
+ * (linked agent sessions, tool nodes, fn, verify); the takeover helpers say which calls their
+ * gate recovers. Also vault authorization for MCP servers. The journal of a run's effects is
+ * `harness-api/record.ts`; a harness readies the session's MCP servers itself (`session.mcp`).
+ *
+ * Every journal write runs in a transaction that locks the effect's session first and checks
+ * the advance's ownership epoch (`ownedSession`): after another Worker takes over, the next
+ * write throws `ownership.lost` and nothing is written. The model, MCP, sandbox and vault
+ * calls run between transactions, never inside one.
+ */
+import type { ActionOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
+import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
-import type { ModelProvider } from "../core/provider.js";
-/** What one advance's segment decides for all its effects. */
-export interface SegmentOptions {
-    /** Overrides the Tenant's model (the fixture-model Tenant setting, `model-setting.ts`). */
-    model?: ModelProvider;
-}
 /**
- * Call the model for one effect. A provider failure comes back as a failure outcome
- * (Model Calls §6), whichever provider serves the call; only an abort throws, and the
- * advance decides what the abort means.
+ * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
+ * while it has not. The linked session may still show an earlier iteration's turn.
  */
-export declare function invokeModel(ctx: TenantContext, request: HostEffect, signal: AbortSignal, model?: ModelProvider): Promise<unknown>;
+export declare function linkedOutcome(t: Tx, effect: {
+    request: HostEffect;
+    agentSessionId?: string;
+}, agent: Session | undefined): Promise<ActionOutcome | undefined>;
 /**
  * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
  * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
@@ -27,13 +36,14 @@ export declare function isRemoteMcpEffect(s: Session, request: HostEffect): bool
  * the running call or gets its outcome, instead of becoming `uncertain`.
  */
 export declare function recoversModelCalls(ctx: TenantContext): boolean;
-export declare function resolveEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease, segment?: SegmentOptions): Promise<EffectResolution>;
 /** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
-/** Discover the session's MCP tools once, or reconnect and refresh diagnostics. */
-export declare function prepareMcp(ctx: TenantContext, lease: Lease, signal: AbortSignal): Promise<void>;
-/** Vault authorization for an MCP server request made on behalf of a session. */
+/**
+ * The credential of an MCP server request made on behalf of a session: from its attached vaults,
+ * else the operator's credential resolver (`vault/sources.ts`).
+ */
 export declare function authorize(ctx: TenantContext, sessionId: string, request: {
     url: string;
     serverName?: string;
+    agentId?: string;
 }): Promise<AuthorizeResult>;