@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/api/http/define.js

@@ -1,14 +1,12 @@
 import { z } from "zod";
 import { PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { authenticate, requireScopes } from "../../tenant/auth.js";
-import { identifyClient } from "../../tenant/browser.js";
 import { fail } from "../../tenant/http.js";
 import { ProtocolRejected, Rejected } from "../components.js";
 const SCHEMES = {
     application: "applicationKey",
     subject: "applicationKey",
-    token: "subjectToken",
-    publishable: "publishableKey",
+    token: "issuerToken",
     delivery: "deliveryToken",
 };
 const rejected = (description) => ({
@@ -29,17 +27,14 @@ export function pathSegments(incoming) {
         }
     });
 }
-/** Who is calling: the browser client and the bearer, as every Tenant request checks them. */
+/** Who is calling: the bearer, as every Tenant request checks it. */
 export async function authenticateCaller(c, 
 /** The route serves public data (`RouteAccess.anonymous`): no credential is needed. */
 anonymous = false) {
-    const { tenant, incoming, outgoing } = c.env;
-    // The client app first: a browser's origin is checked, and CORS headers set, before the
-    // bearer is looked at, so every answer from here on is readable by an allowed page.
-    const client = await identifyClient(tenant, incoming, outgoing);
-    if (anonymous && !client && incoming.headers.authorization === undefined)
+    const { tenant, incoming } = c.env;
+    if (anonymous && incoming.headers.authorization === undefined)
         return { kind: "anonymous" };
-    return await authenticate(tenant, incoming, client);
+    return await authenticate(tenant, incoming);
 }
 const declared = [];
 /** The declared route `method path` is, if any. `{param}` segments match any one segment. */
@@ -53,10 +48,6 @@ function authenticated(access) {
     return async (c, next) => {
         const scope = await authenticateCaller(c, access.anonymous === true);
         requireScopes(scope, access.scopes);
-        if (scope.kind === "publishable" && !access.credentials.includes("publishable"))
-            fail(403, "A publishable key alone reaches only the agent list", {
-                code: "scope_required",
-            });
         // Handlers tell callers apart by kind, and a delivery token is none of theirs: only the
         // routes that list it may see one.
         if (scope.kind === "delivery" && !access.credentials.includes("delivery"))
@@ -68,8 +59,9 @@ function authenticated(access) {
 export function tenantRoute(api, access, route, handler) {
     const takes = (credential) => access.credentials.includes(credential);
     const schemes = [...new Set(access.credentials.map((credential) => SCHEMES[credential]))];
+    const protocol = z.string().meta({ description: `The protocol version, \`${PROTOCOL_VERSION}\`` });
     const headers = z.object({
-        "Nylorun-Protocol": z.string().meta({ description: `The protocol version, \`${PROTOCOL_VERSION}\`` }),
+        "Nylorun-Protocol": access.unversioned ? protocol.optional() : protocol,
         ...(takes("subject")
             ? {
                 "Nylorun-Subject": z
@@ -82,14 +74,6 @@ export function tenantRoute(api, access, route, handler) {
                     .meta({ description: "The subject's space-separated scopes; required with a subject" }),
             }
             : {}),
-        ...(takes("publishable")
-            ? {
-                "Nylorun-Key": z
-                    .string()
-                    .optional()
-                    .meta({ description: "A publishable key, from a browser page on an allowed origin" }),
-            }
-            : {}),
     });
     api.openAPIRegistry.registerPath({
         ...route,
@@ -101,17 +85,19 @@ export function tenantRoute(api, access, route, handler) {
         request: { ...route.request, headers },
         responses: {
             400: rejected("Invalid headers, path, body or cursor"),
-            ...(takes("token") ? { 401: rejected("The subject token expired or was revoked (`token_expired`)") } : {}),
-            403: rejected("Not allowed for this credential, subject scope or origin"),
+            ...(takes("token")
+                ? {
+                    401: rejected("The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)"),
+                }
+                : {}),
+            403: rejected("Not allowed for this credential or subject scope, or an application key from a browser (`origin_rejected`)"),
             404: rejected("Not found, or a credential the Tenant does not know (`not_found`)"),
             426: { description: "`Nylorun-Protocol` missing or unsupported", content: { "application/json": { schema: ProtocolRejected } } },
-            ...(takes("token") ? { 429: rejected("The subject's turn limits are reached (`limit_exceeded`)") } : {}),
             503: rejected("The Tenant's storage or streams are unavailable"),
             ...route.responses,
         },
         "x-nylorun-credentials": access.credentials,
         "x-nylorun-scopes": access.scopes,
-        "x-nylorun-browser": access.browser === true,
     });
     declared.push({
         method: route.method.toUpperCase(),

package/dist/api/http/routes/access.d.ts

@@ -1,24 +1,8 @@
 /**
- * Access management (Host feature `subject-tokens`), for the application key only: subject
- * tokens, the access policy, signing keys, publishable keys and subject revocation; and the
- * public keys, for any caller that reached the Tenant.
- *
- * Subjects travel in bodies, not paths, because they may be email addresses and request paths
- * are logged.
+ * Signing keys, for the application key only, and the public keys, for any caller that reached
+ * the Tenant: the Runtime signs delivery tokens and capability links with them (protocol 7 has
+ * no subject tokens, access policy, browser keys or revocations).
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { PublishableKey as PublishableKeyBody } from "@nylorun/core/contracts";
-import type { PublishableKeyRow } from "../../../store/types.js";
-import type { TenantContext } from "../../../tenant/context.js";
 import type { TenantEnv } from "../app.js";
 export declare function accessRoutes(api: OpenAPIHono<TenantEnv>): void;
-/** A publishable key as the API shows it. */
-export declare function publishableKeyView(row: PublishableKeyRow): PublishableKeyBody;
-/**
- * Ends every token of `subject` minted so far: bumps its epoch, then ends its open streams
- * here and, through `tenant/control`, on every other process. Running turns continue.
- */
-export declare function revokeSubject(ctx: TenantContext, subject: string): Promise<{
-    subject: string;
-    epoch: number;
-}>;

package/dist/api/http/routes/access.js

@@ -1,14 +1,8 @@
 import { z } from "zod";
-import { newPublishableKey, newPublishableKeyId } from "@nylorun/core/compatibility";
-import { CreatePublishableKeyRequestSchema, CreateTokenRequestSchema, PutAccessPolicyRequestSchema, RevokeSigningKeyRequestSchema, RevokeSubjectRequestSchema, RotateSigningKeysRequestSchema, UpdatePublishableKeyRequestSchema, } from "@nylorun/core/contracts";
-import { AccessPolicyResponse, CreatePublishableKeyRequest, CreateTokenRequest, CreateTokenResponse, Jwks, ListPublishableKeysResponse, PublishableKey, PutAccessPolicyRequest, RevokeSigningKeyRequest, RevokeSubjectRequest, RevokeSubjectResponse, RotateSigningKeysRequest, SigningKeyList, SigningKeyView, UpdatePublishableKeyRequest, } from "../../components.js";
-import { signalSubjectRevoked } from "../../../streams/control.js";
-import { readPolicy, writePolicy } from "../../../tenant/access-policy.js";
-import { currentBasin, endSubjectStreams } from "../../../tenant/session-streams.js";
+import { RevokeSigningKeyRequestSchema, RotateSigningKeysRequestSchema, TOKEN_TTL_MAX_SECONDS, } from "@nylorun/core/contracts";
+import { Jwks, RevokeSigningKeyRequest, RotateSigningKeysRequest, SigningKeyList, SigningKeyView, } from "../../components.js";
 import { requireApplication } from "../../../tenant/auth.js";
-import { fail } from "../../../tenant/http.js";
 import { publicJwk, signingKeyView } from "../../../tenant/signing-keys.js";
-import { mintToken } from "../../../tenant/tokens.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
@@ -21,21 +15,19 @@ const body = (schema) => ({
     required: true,
     content: { "application/json": { schema } },
 });
-const keyId = z.object({ keyId: z.string() });
 export function accessRoutes(api) {
     tenantRoute(api, {
-        credentials: ["application", "subject", "token", "publishable"],
+        credentials: ["application", "subject", "token"],
         scopes: "any",
-        browser: true,
         // Public keys: an Action endpoint verifies delivery tokens with them and holds no key.
         anonymous: true,
     }, {
         method: "get",
         path: "/v1/access/jwks",
         tags: ["Access"],
-        summary: "Get the public keys subject and delivery tokens are signed with",
-        description: "A JSON Web Key Set, to verify a subject token or a delivery token without calling the " +
-            "Runtime. No credential is needed.",
+        summary: "Get the public keys delivery tokens are signed with",
+        description: "A JSON Web Key Set, to verify a delivery token without calling the Runtime. No " +
+            "credential is needed.",
         responses: { 200: json(Jwks, "The public keys") },
     }, async (c) => {
         // Anonymous: reads the public keys. Only when the current or standby key is missing does
@@ -49,41 +41,6 @@ export function accessRoutes(api) {
         }
         return jsonResponse(200, { keys: rows.map(publicJwk) });
     });
-    tenantRoute(api, APPLICATION, {
-        method: "post",
-        path: "/v1/tokens",
-        tags: ["Access"],
-        summary: "Mint a subject token",
-        description: "A token for one person and one role of the access policy, for their browser or app to call the Runtime with. At most 15 minutes.",
-        request: { body: body(CreateTokenRequest) },
-        responses: { 200: json(CreateTokenResponse, "The token, its scopes and expiry") },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        return jsonResponse(200, await mintToken(c.env.tenant, CreateTokenRequestSchema.parse(await readJson(c.req.raw))));
-    });
-    tenantRoute(api, APPLICATION, {
-        method: "get",
-        path: "/v1/access/policy",
-        tags: ["Access"],
-        summary: "Get the access policy",
-        responses: { 200: json(AccessPolicyResponse, "Roles, the anonymous grant and token lifetime") },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        return jsonResponse(200, { policy: await c.env.tenant.store.tx((t) => readPolicy(t)) });
-    });
-    tenantRoute(api, APPLICATION, {
-        method: "put",
-        path: "/v1/access/policy",
-        tags: ["Access"],
-        summary: "Set the access policy",
-        request: { body: body(PutAccessPolicyRequest) },
-        responses: { 200: json(AccessPolicyResponse, "The policy now in force") },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        const request = PutAccessPolicyRequestSchema.parse(await readJson(c.req.raw));
-        await c.env.tenant.store.tx((t) => writePolicy(t, request.policy));
-        return jsonResponse(200, { policy: request.policy });
-    });
     tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/access/signing-keys",
@@ -106,7 +63,7 @@ export function accessRoutes(api) {
         path: "/v1/access/signing-keys/rotate",
         tags: ["Access"],
         summary: "Rotate the signing keys",
-        description: "The standby key signs from now on; the current one still verifies tokens it signed. `force` also ends every outstanding token.",
+        description: "The standby key signs from now on; the current one still verifies tokens it signed. `force` also ends every outstanding delivery token and capability link.",
         request: { body: body(RotateSigningKeysRequest) },
         responses: {
             200: json(SigningKeyList, "The keys after rotation"),
@@ -116,8 +73,11 @@ export function accessRoutes(api) {
         requireApplication(c.get("scope"));
         const ctx = c.env.tenant;
         const request = RotateSigningKeysRequestSchema.parse(await readJson(c.req.raw));
-        const maxTtlSeconds = await ctx.store.tx(async (t) => (await readPolicy(t)).tokens.maxTtlSeconds);
-        const keys = await ctx.keys.rotateSigningKeys({ maxTtlSeconds, force: request.force === true });
+        // The longest any token the Runtime signs lives (delivery tokens, capability links).
+        const keys = await ctx.keys.rotateSigningKeys({
+            maxTtlSeconds: TOKEN_TTL_MAX_SECONDS,
+            force: request.force === true,
+        });
         ctx.config.logger.info("signing keys rotated", { force: request.force === true });
         return jsonResponse(200, { keys });
     });
@@ -139,126 +99,6 @@ export function accessRoutes(api) {
         ctx.config.logger.info("signing key revoked", { kid: row.id });
         return jsonResponse(200, signingKeyView(row));
     });
-    tenantRoute(api, APPLICATION, {
-        method: "get",
-        path: "/v1/access/publishable-keys",
-        tags: ["Access"],
-        summary: "List publishable keys",
-        responses: { 200: json(ListPublishableKeysResponse, "The keys, revoked ones included") },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        return jsonResponse(200, {
-            keys: (await c.env.tenant.store.tx((t) => t.publishableKeys())).map(publishableKeyView),
-        });
-    });
-    tenantRoute(api, APPLICATION, {
-        method: "post",
-        path: "/v1/access/publishable-keys",
-        tags: ["Access"],
-        summary: "Create a publishable key",
-        description: "A key a browser page on one of the origins sends as `Nylorun-Key`. Public by design; it grants the policy's anonymous scopes.",
-        request: { body: body(CreatePublishableKeyRequest) },
-        responses: {
-            200: json(PublishableKey, "The key"),
-            409: { description: "A key with this name exists" },
-        },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        const ctx = c.env.tenant;
-        const request = CreatePublishableKeyRequestSchema.parse(await readJson(c.req.raw));
-        const row = {
-            id: newPublishableKeyId(),
-            key: newPublishableKey(ctx.config.tenantId),
-            name: request.name,
-            originsJson: JSON.stringify(request.origins),
-            createdAt: new Date().toISOString(),
-            revokedAt: null,
-        };
-        await ctx.store.tx(async (t) => {
-            if ((await t.publishableKeys()).some((other) => other.name === request.name))
-                fail(409, `A publishable key named ${request.name} exists`);
-            await t.insertPublishableKey(row);
-        });
-        ctx.config.logger.info("publishable key created", { keyId: row.id });
-        return jsonResponse(200, publishableKeyView(row));
-    });
-    for (const method of ["put", "delete"])
-        tenantRoute(api, APPLICATION, {
-            method,
-            path: "/v1/access/publishable-keys/{keyId}",
-            tags: ["Access"],
-            summary: method === "put" ? "Set a publishable key's origins" : "Revoke a publishable key",
-            request: {
-                params: keyId,
-                ...(method === "put" ? { body: body(UpdatePublishableKeyRequest) } : {}),
-            },
-            responses: {
-                200: json(PublishableKey, method === "put" ? "The key" : "The key, revoked (again: unchanged)"),
-            },
-        }, async (c) => {
-            requireApplication(c.get("scope"));
-            const ctx = c.env.tenant;
-            const id = c.req.param("keyId");
-            const patch = method === "put"
-                ? {
-                    originsJson: JSON.stringify(UpdatePublishableKeyRequestSchema.parse(await readJson(c.req.raw)).origins),
-                }
-                : { revokedAt: new Date().toISOString() };
-            const row = await ctx.store.tx(async (t) => {
-                const existing = (await t.publishableKey(id)) ?? fail(404, "Publishable key not found");
-                // Revoking twice keeps the first time.
-                if (method === "delete" && existing.revokedAt !== null)
-                    return existing;
-                await t.updatePublishableKey(id, patch);
-                return { ...existing, ...patch };
-            });
-            ctx.config.logger.info(method === "put" ? "publishable key updated" : "publishable key revoked", { keyId: row.id });
-            return jsonResponse(200, publishableKeyView(row));
-        });
-    tenantRoute(api, APPLICATION, {
-        method: "post",
-        path: "/v1/access/revocations",
-        tags: ["Access"],
-        summary: "Revoke a subject",
-        description: "Ends every token minted for the subject so far, and their open streams on every process. Turns in progress continue.",
-        request: { body: body(RevokeSubjectRequest) },
-        responses: { 200: json(RevokeSubjectResponse, "The subject's new epoch") },
-    }, async (c) => {
-        requireApplication(c.get("scope"));
-        const request = RevokeSubjectRequestSchema.parse(await readJson(c.req.raw));
-        return jsonResponse(200, await revokeSubject(c.env.tenant, request.subject));
-    });
-}
-/** A publishable key as the API shows it. */
-export function publishableKeyView(row) {
-    return {
-        id: row.id,
-        name: row.name,
-        key: row.key,
-        origins: JSON.parse(row.originsJson),
-        createdAt: row.createdAt,
-        revokedAt: row.revokedAt,
-    };
-}
-/**
- * Ends every token of `subject` minted so far: bumps its epoch, then ends its open streams
- * here and, through `tenant/control`, on every other process. Running turns continue.
- */
-export async function revokeSubject(ctx, subject) {
-    const epoch = await ctx.store.tx(async (t) => {
-        const next = await t.bumpSubjectEpoch(subject, new Date().toISOString());
-        t.afterCommit(async () => {
-            endSubjectStreams(ctx.sessionStreams, subject, next);
-            const streams = ctx.sessionStreams.wiring?.streams;
-            if (streams)
-                await signalSubjectRevoked(streams, currentBasin(ctx), subject, next).catch((error) => ctx.config.logger.warn("subject revocation signal failed", {
-                    message: error instanceof Error ? error.message : String(error),
-                }));
-        });
-        return next;
-    });
-    ctx.config.logger.info("subject revoked", { epoch });
-    return { subject, epoch };
 }
 /** True when the Tenant has a current and a standby signing key. */
 function complete(rows) {

package/dist/api/http/routes/actions.js

@@ -57,7 +57,6 @@ export function actionRoutes(api) {
     tenantRoute(api, {
         credentials: ["application", "subject", "token"],
         scopes: ["sessions:own"],
-        browser: true,
     }, {
         method: "post",
         path: "/v1/sessions/{sessionId}/commands",

package/dist/api/http/routes/artifacts.d.ts

@@ -0,0 +1,11 @@
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+/**
+ * One `bytes=` range of a file of `size` bytes: what to send, `"unsatisfiable"`, or undefined
+ * to send the whole file (no header, several ranges, or one the Runtime ignores).
+ */
+export declare function parseRange(header: string | undefined, size: number): {
+    start: number;
+    end: number;
+} | "unsatisfiable" | undefined;
+export declare function artifactRoutes(api: OpenAPIHono<TenantEnv>): void;