@nylorun/runtime 0.16.0-beta → 0.17.0-beta

package/dist/tenant/outbound.d.ts

@@ -42,3 +42,33 @@ export declare function post(target: string, body: string, headers: Record<strin
     signal: AbortSignal;
     maxResponseBytes?: number;
 }): Promise<OutboundResult>;
+/**
+ * A refusal of `guardedFetch`: the Host's policy forbids the URL or every address it resolves
+ * to. Not a `TypeError`, so callers that read a `TypeError` as a CORS failure (the MCP SDK's
+ * discovery) see the refusal instead of trying again.
+ */
+export declare class OutboundRefused extends Error {
+    readonly code = "ENDPOINT_ADDRESS_REFUSED";
+    constructor(message: string);
+}
+/** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
+export declare class OutboundFailed extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+export declare const MAX_FETCH_RESPONSE_BYTES: number;
+/** How long a `guardedFetch` request may take without a signal of its own. */
+export declare const FETCH_TIMEOUT_MS = 30000;
+/**
+ * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
+ * on the address actually connected to, `localhost` rewritten for the local stack, no
+ * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
+ * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
+ * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
+ * other failure with `OutboundFailed`.
+ */
+export declare function guardedFetch(policy: OutboundPolicy, options?: {
+    maxResponseBytes?: number;
+    timeoutMs?: number;
+}): typeof fetch;

package/dist/tenant/outbound.js

@@ -53,18 +53,14 @@ export function refusal(url, policy) {
         return "This Runtime does not call private addresses; expose the endpoint through a public URL (a tunnel, for a local app)";
     return undefined;
 }
-/** POSTs `body` to `url` under `policy`. Never throws; `signal` aborts the request. */
-export async function post(target, body, headers, options) {
-    const { policy, signal } = options;
-    const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
-    const url = new URL(target);
-    const refused = refusal(url, policy);
-    if (refused)
-        return { kind: "not_sent", code: "ENDPOINT_ADDRESS_REFUSED", message: refused };
-    const originalHost = url.host;
+/** `localhost` means the machine that runs Docker (`OutboundPolicy.loopback`). */
+function dockerHost(url, policy) {
     if (policy.loopback === "docker-host" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))
         url.hostname = "host.docker.internal";
-    const lookup = (hostname, lookupOptions, callback) => dnsLookup(hostname, { ...lookupOptions, all: true }, (error, addresses) => {
+}
+/** A DNS lookup that drops private answers when `policy` refuses them: checked on what is connected to. */
+function guardedLookup(policy) {
+    return (hostname, lookupOptions, callback) => dnsLookup(hostname, { ...lookupOptions, all: true }, (error, addresses) => {
         if (error)
             return callback(error, []);
         const allowed = policy.privateAddresses === "refuse"
@@ -76,6 +72,18 @@ export async function post(target, body, headers, options) {
             return callback(null, allowed);
         return callback(null, allowed[0].address, allowed[0].family);
     });
+}
+/** POSTs `body` to `url` under `policy`. Never throws; `signal` aborts the request. */
+export async function post(target, body, headers, options) {
+    const { policy, signal } = options;
+    const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
+    const url = new URL(target);
+    const refused = refusal(url, policy);
+    if (refused)
+        return { kind: "not_sent", code: "ENDPOINT_ADDRESS_REFUSED", message: refused };
+    const originalHost = url.host;
+    dockerHost(url, policy);
+    const lookup = guardedLookup(policy);
     return new Promise((resolve) => {
         let sent = false;
         let settled = false;
@@ -125,3 +133,127 @@ export async function post(target, body, headers, options) {
         request.end(body);
     });
 }
+/**
+ * A refusal of `guardedFetch`: the Host's policy forbids the URL or every address it resolves
+ * to. Not a `TypeError`, so callers that read a `TypeError` as a CORS failure (the MCP SDK's
+ * discovery) see the refusal instead of trying again.
+ */
+export class OutboundRefused extends Error {
+    code = "ENDPOINT_ADDRESS_REFUSED";
+    constructor(message) {
+        super(message);
+        this.name = "OutboundRefused";
+    }
+}
+/** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
+export class OutboundFailed extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "OutboundFailed";
+    }
+}
+/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+export const MAX_FETCH_RESPONSE_BYTES = 1024 * 1024;
+/** How long a `guardedFetch` request may take without a signal of its own. */
+export const FETCH_TIMEOUT_MS = 30_000;
+/**
+ * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
+ * on the address actually connected to, `localhost` rewritten for the local stack, no
+ * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
+ * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
+ * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
+ * other failure with `OutboundFailed`.
+ */
+export function guardedFetch(policy, options = {}) {
+    const limit = options.maxResponseBytes ?? MAX_FETCH_RESPONSE_BYTES;
+    const timeoutMs = options.timeoutMs ?? FETCH_TIMEOUT_MS;
+    const lookup = guardedLookup(policy);
+    const guarded = async (input, init = {}) => {
+        const request = input instanceof Request ? input : undefined;
+        const url = new URL(request ? request.url : String(input));
+        const refused = refusal(url, policy);
+        if (refused)
+            throw new OutboundRefused(refused);
+        const method = (init.method ?? request?.method ?? "GET").toUpperCase();
+        const headers = new Headers(request?.headers);
+        for (const [name, value] of new Headers(init.headers))
+            headers.set(name, value);
+        let body;
+        const source = init.body ?? (request && method !== "GET" && method !== "HEAD" ? await request.arrayBuffer() : undefined);
+        if (source !== undefined && source !== null) {
+            if (typeof source === "string")
+                body = Buffer.from(source, "utf8");
+            else if (source instanceof URLSearchParams) {
+                body = Buffer.from(source.toString(), "utf8");
+                if (!headers.has("content-type"))
+                    headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+            }
+            else if (source instanceof ArrayBuffer)
+                body = Buffer.from(source);
+            else if (ArrayBuffer.isView(source))
+                body = Buffer.from(source.buffer, source.byteOffset, source.byteLength);
+            else
+                throw new OutboundFailed("guardedFetch sends only string, form or byte bodies", "UNSUPPORTED_BODY");
+        }
+        const originalHost = url.host;
+        dockerHost(url, policy);
+        const signal = init.signal ?? request?.signal ?? AbortSignal.timeout(timeoutMs);
+        const outgoing = { host: originalHost };
+        for (const [name, value] of headers)
+            outgoing[name] = value;
+        if (body)
+            outgoing["content-length"] = String(body.byteLength);
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const settle = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                fn();
+            };
+            const failed = (error) => settle(() => reject(error instanceof RefusedAddress
+                ? new OutboundRefused(error.message)
+                : new OutboundFailed(signal.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal.aborted ? "ABORTED" : (error.code ?? error.name))));
+            const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, signal }, (response) => {
+                const status = response.statusCode ?? 0;
+                if (status >= 300 && status < 400 && response.headers.location !== undefined) {
+                    response.resume();
+                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT")));
+                }
+                const chunks = [];
+                let size = 0;
+                response.on("data", (chunk) => {
+                    size += chunk.length;
+                    if (size > limit) {
+                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE")));
+                        response.destroy();
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                response.on("end", () => settle(() => {
+                    const answer = new Headers();
+                    for (const [name, value] of Object.entries(response.headers)) {
+                        if (value === undefined)
+                            continue;
+                        for (const item of Array.isArray(value) ? value : [value])
+                            answer.append(name, item);
+                    }
+                    const noBody = status === 204 || status === 304 || method === "HEAD";
+                    resolve(new Response(noBody ? null : Buffer.concat(chunks), {
+                        status,
+                        statusText: response.statusMessage ?? "",
+                        headers: answer,
+                    }));
+                }));
+                response.on("error", failed);
+                response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
+            });
+            sent.on("error", failed);
+            sent.end(body);
+        });
+    };
+    return guarded;
+}

package/dist/tenant/principals.d.ts

@@ -2,23 +2,14 @@ import type { InitialPrincipal } from "../store/postgres/tenant.js";
 export type { PrincipalRow } from "../store/types.js";
 /** Principal id of the Studio key derived from the admin key. */
 export declare const STUDIO_PRINCIPAL_ID = "studio";
-/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
-export declare const PROJECT_PRINCIPAL_ID = "project";
-/** The derived principals a Host registers when not told otherwise. */
-export declare const DEFAULT_DERIVED_PRINCIPALS: readonly string[];
 /** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
 export declare function deriveStudioKey(adminKey: string, tenantId: string): string;
-/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
-export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;
-/** Whether `id` may name a derived principal: the client's name, never `studio`. */
-export declare function isDerivedPrincipalId(id: string): boolean;
 /**
- * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
- * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
+ * The principals a Host's Tenant is created with: `studio`, and an application principal when
+ * a key is given (the ephemeral Runtime). Keys are hashed here.
  */
 export declare function hostPrincipals(options: {
     adminKey: string;
-    derived?: readonly string[];
     application?: {
         principalId: string;
         key: string;

package/dist/tenant/principals.js

@@ -1,43 +1,27 @@
 /**
- * The principals the Host gives its Tenant when it creates it (tenancy.md §4, plan P9): the
- * Studio principal and the derived principals, whose keys the admin key derives, so the
- * clients holding the admin key (Studio, `nylorun start`, Babai) store none. The Tenant keeps
- * only their hashes.
+ * The principals the Host gives its Tenant when it creates it (tenancy.md §4): the Studio
+ * principal, whose key the admin key derives, so Studio (and an app embedding it) stores none,
+ * and, for the ephemeral Runtime, one application principal with a key of its own. The Tenant
+ * keeps only their hashes. Every other application key is an operator key
+ * (`PUT /v1/admin/keys/{id}`, `operator-keys.ts`); no other key is derived.
  *
- * The derivations are the ones `@nylorun/admin` computes on the client side
- * (`admin/src/derived-credentials.ts`: `deriveStudioToken`, `deriveTenantKey`); both sides
- * must stay byte for byte the same.
+ * The derivation is the one `@nylorun/admin` computes on the client side
+ * (`admin/src/derived-credentials.ts`: `deriveStudioToken`); both sides must stay byte for byte
+ * the same.
  */
 import { createHmac } from "node:crypto";
-import { DERIVED_PRINCIPAL_ID_PATTERN } from "@nylorun/core/compatibility";
 import { hashToken } from "../core/bearer.js";
 /** Principal id of the Studio key derived from the admin key. */
 export const STUDIO_PRINCIPAL_ID = "studio";
-/** The derived principal Projects use (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). */
-export const PROJECT_PRINCIPAL_ID = "project";
-/** The derived principals a Host registers when not told otherwise. */
-export const DEFAULT_DERIVED_PRINCIPALS = [PROJECT_PRINCIPAL_ID];
 /** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
 export function deriveStudioKey(adminKey, tenantId) {
     return hmac(adminKey, ["nylorun/studio/v1", tenantId]);
 }
-/** The key of derived principal `principalId` on `tenantId`: HMAC-SHA256 of the admin key. */
-export function deriveTenantKey(adminKey, tenantId, principalId) {
-    return hmac(adminKey, ["nylorun/principal/v1", principalId, tenantId]);
-}
-/** Whether `id` may name a derived principal: the client's name, never `studio`. */
-export function isDerivedPrincipalId(id) {
-    return DERIVED_PRINCIPAL_ID_PATTERN.test(id) && id !== STUDIO_PRINCIPAL_ID;
-}
 /**
- * The principals a Host's Tenant is created with: `studio`, each derived principal, and an
- * application principal when a key is given (the ephemeral Runtime). Keys are hashed here.
+ * The principals a Host's Tenant is created with: `studio`, and an application principal when
+ * a key is given (the ephemeral Runtime). Keys are hashed here.
  */
 export function hostPrincipals(options) {
-    const derived = options.derived ?? DEFAULT_DERIVED_PRINCIPALS;
-    for (const id of derived)
-        if (!isDerivedPrincipalId(id))
-            throw new Error(`Derived principal id '${id}' must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be '${STUDIO_PRINCIPAL_ID}'`);
     return (tenantId) => [
         ...(options.application
             ? [
@@ -52,10 +36,6 @@ export function hostPrincipals(options) {
             credentialHash: options.studioCredentialHash ??
                 hashToken(deriveStudioKey(options.adminKey, tenantId)),
         },
-        ...[...new Set(derived)].map((id) => ({
-            id,
-            credentialHash: hashToken(deriveTenantKey(options.adminKey, tenantId, id)),
-        })),
     ];
 }
 /** HMAC-SHA256 (hex) of `parts` joined by NUL bytes, keyed with the admin key. */

package/dist/tenant/run-token.js

@@ -17,7 +17,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { errors, importJWK, jwtVerify } from "jose";
-import { subjectTokenIssuer } from "@nylorun/core/contracts";
+import { tenantTokenIssuer } from "@nylorun/core/contracts";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
 export const RUN_TOKEN_TYP = "nylorun-run+jwt";
 export const RUN_TOKEN_AUD = "nylorun-gates";
@@ -42,7 +42,7 @@ export async function mintRunToken(signer, lease, session) {
     const { token } = await signer.keys.sign({
         typ: RUN_TOKEN_TYP,
         claims: {
-            iss: subjectTokenIssuer(tenantId),
+            iss: tenantTokenIssuer(tenantId),
             aud: RUN_TOKEN_AUD,
             sub: lease.sessionId,
             trn: turnId,
@@ -89,7 +89,7 @@ export async function verifyRunToken(store, tenantId, raw, cache = new Map()) {
     try {
         const verified = await jwtVerify(raw, key, {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(tenantId),
+            issuer: tenantTokenIssuer(tenantId),
             audience: RUN_TOKEN_AUD,
             typ: RUN_TOKEN_TYP,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,

package/dist/tenant/runtime.d.ts

@@ -14,6 +14,7 @@ import type { HarnessChannel, MemoryPortsOptions } from "@nylorun/core/harness-a
 import { type HarnessPeer } from "../harness-api/server.js";
 import { type HostAuthority } from "../sandbox/join.js";
 import type { TenantPods } from "./context.js";
+import { type OperatorKeys } from "./operator-keys.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
@@ -102,6 +103,7 @@ export declare class TenantRuntime implements TenantHandle {
     authorize(sessionId: string, request: {
         url: string;
         serverName?: string;
+        agentId?: string;
     }): Promise<AuthorizeResult>;
     summary(): Promise<TenantSummary>;
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
@@ -118,6 +120,8 @@ export declare class TenantRuntime implements TenantHandle {
     /** Adds a callback to the Tenant sweep. Returns a function that removes it. */
     onSweep(hook: () => Promise<void>): () => void;
     attachHarness(channel: HarnessChannel, peer: HarnessPeer): () => void;
+    /** The Tenant's operator keys (F9 I1), over its store. */
+    operatorKeys(): OperatorKeys;
     close(): Promise<void>;
 }
 /**

package/dist/tenant/runtime.js

@@ -5,6 +5,7 @@ import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
 import { VaultService } from "../vault/service.js";
+import { CredentialSources } from "../vault/sources.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
 import { storeSandboxRecords } from "../sandbox/records.js";
@@ -21,6 +22,7 @@ import { deliverAction } from "./delivery.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
 import { inProcessToolGate } from "../gates/tool-gate.js";
+import { guardedFetch } from "./outbound.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 import { createFsBlobStore } from "../blob/index.js";
@@ -31,6 +33,7 @@ import { localWorkspace, remoteWorkspace, withPodWorkspaces, } from "../harness-
 import { hostAuthority } from "../sandbox/join.js";
 import { reconcileSandbox } from "../sandbox/pods/reconcile.js";
 import { sandboxWorkspaceReader } from "../artifacts/workspace.js";
+import { operatorKeys } from "./operator-keys.js";
 /** Default ownership lease of an advance; the heartbeat renews it every third. */
 const DEFAULT_OWNER_LEASE_MS = 30_000;
 function validateConfig(config) {
@@ -119,7 +122,12 @@ export class TenantRuntime {
             const vault = new VaultService({
                 store: opened,
                 kek: ensureKek,
-                fetch: config.vaultFetch ?? globalThis.fetch,
+                // OAuth refresh and connect follow the Host's address policy (F9 C2).
+                fetch: config.vaultFetch ?? guardedFetch(config.delivery ?? {}),
+            });
+            const credentials = new CredentialSources({
+                vault,
+                ...(config.resolver ? { resolver: config.resolver } : {}),
             });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
@@ -224,6 +232,7 @@ export class TenantRuntime {
                 envelope,
                 store: opened,
                 vault,
+                credentials,
                 ...(mcp ? { mcp } : {}),
                 sandbox,
                 flowLimits,
@@ -359,6 +368,10 @@ export class TenantRuntime {
     attachHarness(channel, peer) {
         return this.ctx.harness.attach(channel, peer);
     }
+    /** The Tenant's operator keys (F9 I1), over its store. */
+    operatorKeys() {
+        return operatorKeys(this.ctx.store);
+    }
     async close() {
         const ctx = this.ctx;
         ctx.closing = true;

package/dist/tenant/sandboxes.d.ts

@@ -7,9 +7,9 @@
  *   sandbox's id, kind, spec and labels, and the session body names the sandbox it is attached
  *   to (`Session.sandboxId`); deleting a session (a sessions reset) only detaches it.
  * - **Access.** An application key reaches every sandbox, and so does an application key acting
- *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A subject
- *   token reaches only the ids its `sbx` grants match, and changes them only with
- *   `sandboxes:write`; any other id is the 404 of a missing one.
+ *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A token
+ *   caller (a trusted issuer's token) reaches only the ids its grants match, and changes them
+ *   only with `sandboxes:write`; any other id is the 404 of a missing one.
  * - **Serial turns.** One turn at a time per sandbox: a session whose sandbox another attached
  *   session's turn holds is refused (`409 sandbox_busy`), as the session sandbox route is
  *   refused while its session's turn runs. Commands within the workspace keep queueing in the
@@ -31,7 +31,7 @@
 import { type PutSandboxRequest, type SandboxView } from "@nylorun/core/contracts";
 import type { SandboxResource, Tx } from "../store/types.js";
 import type { AuthScope, Session, TenantContext } from "./context.js";
-/** The `sbx` grants that limit `scope`, or undefined when it reaches every sandbox. */
+/** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export declare function sandboxGrantsOf(scope: AuthScope): readonly string[] | undefined;
 /** A sandbox resource, unless it is gone or being deleted. */
 export declare function liveSandbox(t: Tx, id: string, options?: {
@@ -95,7 +95,7 @@ export declare function attachSandbox(t: Tx, id: string, grants: readonly string
 export declare function recordAttachment(t: Tx, sessionId: string, sandboxId: string): Promise<void>;
 /**
  * Checks a turn start on a session attached to a sandbox, in the command's transaction after
- * the session row lock: the sandbox still exists, a subject token's `sbx` grants reach it, and
+ * the session row lock: the sandbox still exists, a token caller's grants reach it, and
  * no other session attached to it has a turn running. Holds the sandbox row's lock until the
  * transaction ends, so two turn starts on one sandbox are decided one after the other.
  *

package/dist/tenant/sandboxes.js

@@ -7,9 +7,9 @@
  *   sandbox's id, kind, spec and labels, and the session body names the sandbox it is attached
  *   to (`Session.sandboxId`); deleting a session (a sessions reset) only detaches it.
  * - **Access.** An application key reaches every sandbox, and so does an application key acting
- *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A subject
- *   token reaches only the ids its `sbx` grants match, and changes them only with
- *   `sandboxes:write`; any other id is the 404 of a missing one.
+ *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A token
+ *   caller (a trusted issuer's token) reaches only the ids its grants match, and changes them
+ *   only with `sandboxes:write`; any other id is the 404 of a missing one.
  * - **Serial turns.** One turn at a time per sandbox: a session whose sandbox another attached
  *   session's turn holds is refused (`409 sandbox_busy`), as the session sandbox route is
  *   refused while its session's turn runs. Commands within the workspace keep queueing in the
@@ -38,7 +38,7 @@ import { expiresAtOf, podLifecycleConfig } from "../sandbox/pods/spec.js";
 import { requirePods } from "../sandbox/placement.js";
 import { parseSandboxDuration } from "@nylorun/core/define";
 import { fail } from "./http.js";
-/** The `sbx` grants that limit `scope`, or undefined when it reaches every sandbox. */
+/** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export function sandboxGrantsOf(scope) {
     return scope.kind === "token" ? (scope.sandboxes ?? []) : undefined;
 }
@@ -435,7 +435,7 @@ export async function recordAttachment(t, sessionId, sandboxId) {
 }
 /**
  * Checks a turn start on a session attached to a sandbox, in the command's transaction after
- * the session row lock: the sandbox still exists, a subject token's `sbx` grants reach it, and
+ * the session row lock: the sandbox still exists, a token caller's grants reach it, and
  * no other session attached to it has a turn running. Holds the sandbox row's lock until the
  * transaction ends, so two turn starts on one sandbox are decided one after the other.
  *

package/dist/tenant/session-streams.d.ts

@@ -20,23 +20,24 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { LiveEvent } from "@nylorun/core/contracts";
-import type { TenantContext } from "./context.js";
+import type { AuthScope, TenantContext } from "./context.js";
 import type { StreamsWiring } from "./streams.js";
-/** Why the Runtime ended a stream a subject token opened. */
-export type StreamEndReason = "token_expired" | "revoked";
+/** Why the Runtime ended a stream a token opened. */
+export type StreamEndReason = "token_expired";
 /** Where an observer's events go: an SSE response, or an in-process reader. */
 export interface ObserverSink {
     write(event: LiveEvent): void;
     /** Ends the stream; with a reason, the client is told why before it ends. */
     end(reason?: StreamEndReason): void;
 }
-/** The subject token a stream was opened with: it ends at expiry or revocation. */
+/** The token a stream was opened with (a trusted issuer's): the stream ends at its expiry. */
 export interface StreamHolder {
     readonly subject: string;
-    readonly epoch: number;
     /** Epoch ms when the token expires. */
     readonly expiresAt: number;
 }
+/** The holder a stream opened with `scope` records: token callers only. */
+export declare function streamHolderOf(scope: AuthScope): StreamHolder | undefined;
 /** One client of a session: the next sequence it needs. */
 interface Observer {
     readonly sink: ObserverSink;
@@ -114,11 +115,6 @@ export declare function served(event: LiveEvent): boolean;
  * the Tenant end too.
  */
 export declare function checkSessionStreams(ctx: TenantContext): Promise<void>;
-/**
- * Ends the streams of `subject` opened with a token older than `epoch` (a revocation), on
- * this process. Other processes do the same on the `subject.revoked` signal.
- */
-export declare function endSubjectStreams(hub: SessionStreams, subject: string, epoch: number): void;
 /** Reset or close: end every session observer and stop every shared read. */
 export declare function clearObservers(hub: SessionStreams): void;
 /** Close: end every session observer. */

package/dist/tenant/session-streams.js

@@ -2,6 +2,12 @@ import { decodeCursor, encodeCursor } from "../record/index.js";
 import { basinOf } from "../streams/basin.js";
 import { sessionStream, } from "../streams/types.js";
 import { fail } from "./http.js";
+/** The holder a stream opened with `scope` records: token callers only. */
+export function streamHolderOf(scope) {
+    if (scope.kind !== "token")
+        return undefined;
+    return { subject: scope.subject, expiresAt: scope.expiresAt };
+}
 export function createSessionStreams() {
     return { wiring: undefined, generation: 0, sessions: new Map() };
 }
@@ -233,7 +239,7 @@ async function join(ctx, sessionId, observer) {
     feed.observers.add(observer);
     return feed;
 }
-/** Ends one observer early (its token expired or was revoked). */
+/** Ends one observer early (its token expired). */
 function endObserver(hub, feed, observer, reason) {
     if (!feed.observers.has(observer))
         return;
@@ -328,24 +334,12 @@ async function stillCurrent(ctx, feed) {
  */
 export async function checkSessionStreams(ctx) {
     const feeds = [...ctx.sessionStreams.sessions.values()];
-    // Also a backstop for lost `subject.revoked` signals: the holders' current epochs.
-    const subjects = new Set();
-    for (const feed of feeds)
-        for (const observer of feed.observers)
-            if (observer.holder)
-                subjects.add(observer.holder.subject);
-    const { exists, epochs, generation } = await ctx.store.tx(async (t) => {
+    const { exists, generation } = await ctx.store.tx(async (t) => {
         const exists = new Set();
         for (const feed of feeds)
             if (await t.get("sessions", feed.sessionId))
                 exists.add(feed.sessionId);
-        return {
-            exists,
-            generation: (await t.basinGenerations()).current,
-            epochs: subjects.size === 0
-                ? new Map()
-                : await t.subjectEpochs([...subjects]),
-        };
+        return { exists, generation: (await t.basinGenerations()).current };
     });
     if (generation !== ctx.sessionStreams.generation)
         ctx.sessionStreams.wiring?.moveTo(generation);
@@ -355,18 +349,6 @@ export async function checkSessionStreams(ctx) {
                 ? { basin: currentBasin(ctx), stream: sessionStream(feed.sessionId) }
                 : undefined))
             endFeed(ctx.sessionStreams, feed);
-    for (const [subject, epoch] of epochs)
-        endSubjectStreams(ctx.sessionStreams, subject, epoch);
-}
-/**
- * Ends the streams of `subject` opened with a token older than `epoch` (a revocation), on
- * this process. Other processes do the same on the `subject.revoked` signal.
- */
-export function endSubjectStreams(hub, subject, epoch) {
-    for (const feed of [...hub.sessions.values()])
-        for (const observer of [...feed.observers])
-            if (observer.holder?.subject === subject && observer.holder.epoch < epoch)
-                endObserver(hub, feed, observer, "revoked");
 }
 function endFeed(hub, feed) {
     feed.read.abort();

package/dist/tenant/sessions.d.ts

@@ -15,7 +15,7 @@ export declare function listDefinitions(ctx: TenantContext): Promise<{
     }[];
 }>;
 /**
- * The agents a subject token or publishable key may see: id, name and description only, never
+ * The agents a token caller may see: id, name and description only, never
  * instructions, tools or MCP servers, and only the agents allowed.
  */
 export declare function listAgentsPublic(ctx: TenantContext, agents: ReadonlySet<string> | "*"): Promise<{
@@ -60,7 +60,7 @@ export declare function putSession(ctx: TenantContext, id: string, body: PutSess
      */
     createOnly?: boolean;
     /**
-     * The sandboxes the caller reaches (a subject token's `sbx`, `sandboxGrantsOf`); undefined
+     * The sandboxes the caller reaches (a token caller's grants, `sandboxGrantsOf`); undefined
      * reaches every one. `sandbox: { id }` must name one of them.
      */
     sandboxGrants?: readonly string[];

package/dist/tenant/sessions.js

@@ -33,7 +33,7 @@ export async function listDefinitions(ctx) {
     };
 }
 /**
- * The agents a subject token or publishable key may see: id, name and description only, never
+ * The agents a token caller may see: id, name and description only, never
  * instructions, tools or MCP servers, and only the agents allowed.
  */
 export async function listAgentsPublic(ctx, agents) {

package/dist/tenant/signing-keys.d.ts

@@ -1,5 +1,6 @@
 /**
- * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * Tenant signing keys for the tokens the Runtime signs itself (delivery tokens, capability
+ * links, run and host tokens). Each key is an ES256 pair: the public JWK is stored
  * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
  * id), like a credential.
  *

package/dist/tenant/signing-keys.js

@@ -1,5 +1,6 @@
 /**
- * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * Tenant signing keys for the tokens the Runtime signs itself (delivery tokens, capability
+ * links, run and host tokens). Each key is an ES256 pair: the public JWK is stored
  * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
  * id), like a credential.
  *
@@ -117,7 +118,6 @@ export class SigningKeys {
         const [previous] = await t.signingKeys(["previous"]);
         if (previous && !force) {
             const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
-            // Delivery tokens may outlive the policy's subject tokens.
             const longest = Math.max(maxTtlSeconds, DELIVERY_TOKEN_MAX_TTL_SECONDS);
             const until = retired + longest * 1000 + ROTATION_GRACE_MS;
             if (until > now.getTime())

package/dist/tenant/streams.d.ts

@@ -17,9 +17,8 @@
  * - **Readers.** History and session SSE read the session's stream
  *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
  *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`,
- *   passes an Action's outcome to a run held here for each `action.resolved` (F6.2),
- *   checks the session streams for each `sessions.reset`, and ends a subject's streams for
- *   each `subject.revoked`.
+ *   passes an Action's outcome to a run held here for each `action.resolved` (F6.2), and
+ *   checks the session streams for each `sessions.reset`.
  *
  * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
  * local development Host (not durable).