@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/store/types.d.ts

@@ -14,7 +14,7 @@
  *    error `fn` threw.
  * 2. **Session-scoped writes lock the session row first.** `lockSession` takes
  *    a row lock (`SELECT … FOR UPDATE`) held until the transaction ends. Effect
- *    intent and outcome, Action transitions, checkpoint settlement and event
+ *    intent and outcome, checkpoint settlement and event
  *    writes for one session are serialized through it. Idempotency comparisons
  *    (`canonical(...)`) run inside the same locked transaction. `event` and the
  *    ownership methods take the lock themselves.
@@ -25,7 +25,7 @@
  *    generation, `streams/basin.ts`), and the cursor is
  *    `base64url("<sessionId>:<seq>")` (see `record/cursor.ts`).
  * 4. **No external I/O inside `fn`.** No model, tool, MCP, sandbox, Restate or
- *    S2 call, and no `fetch`, runs inside a transaction. Wakes and deliveries go
+ *    S2 call, and no `fetch`, runs inside a transaction. Wakes go
  *    through `afterCommit`, and events are delivered to commit listeners after
  *    commit (seam rule 1 and 2).
  * 5. **No nested transactions.** Calling `store.tx` from inside `fn` rejects.
@@ -45,29 +45,28 @@
  * ## Typed queries, no scans
  *
  * There is no generic table scan. Every read the Runtime needs is a typed
- * method on `Tx` (`sessionsWithStatus`, `expiredDeliveries`, `pendingActions`,
- * `effectsForTurn`, `linkedSessions`, `counts`, …) that an implementation can
- * back with an index, and principals, endpoints, vaults and Tenant settings
+ * method on `Tx` (`sessionsWithStatus`, `effectsForTurn`, `linkedSessions`,
+ * `counts`, …) that an implementation can back with an index, and principals,
+ * vaults and Tenant settings
  * have their own methods rather than raw SQL outside the store. Session history
  * is not read from the store: every event is written to the record (Postgres
  * `nylorun_streams.session_events`) in its transaction, the stream relay
  * (`streams/relay/`) feeds Durable Streams from it, and history and SSE read
  * them there (`tenant/session-streams.ts`).
  */
+import type { KeyRole } from "@nylorun/core/compatibility";
 import type { RecordReader } from "../streams/relay/types.js";
-import type { Action, EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
+import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { ArtifactRow, ArtifactVersionRow, ModelBudgetRow, ModelUsageRow, PrincipalRow, ToolCrossingRow, PublishableKeyRow, SigningKeyRow, SubjectUsageRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow } from "./postgres/schema.js";
+import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow } from "./postgres/schema.js";
 /** Tables holding JSON documents keyed by `id`. */
-export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "actions" | "sandboxes" | "links";
+export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "sandboxes" | "links";
 export declare const DOC_TABLES: readonly DocTable[];
 /** Session lifecycle (architecture §10.2). */
 export type SessionStatus = "idle" | "runnable" | "running" | "waiting" | "paused" | "uncertain" | "completed" | "failed" | "cancelled";
 /** Effect states (§10.3), plus the flow host's `queued` and `cancelled`. */
 export type EffectStatus = "pending" | "invoking" | "completed" | "uncertain" | "queued" | "cancelled";
-export type ActionStatus = Action["status"];
-export type ActionKind = Action["kind"];
 export type EffectKind = HostEffect["kind"];
 /**
  * Ownership of a session by a Worker (§10.6). Read with the session; written
@@ -103,8 +102,6 @@ export interface EffectDoc {
     request: HostEffect;
     status: EffectStatus | (string & {});
 }
-/** Actions are stored as the wire `Action`. Indexed: `sessionId`, `turnId`, `agentId`, `status`, `kind`, `deadlineAt`. */
-export type ActionDoc = Action;
 /** A workflow → agent session link, keyed by the linked agent session id. Indexed: `workflowSessionId`. */
 export interface LinkDoc {
     workflowSessionId: string;
@@ -192,60 +189,13 @@ export interface BasinGenerations {
     retired: number[];
 }
 export type CommitListener = (commit: Commit) => void;
-/**
- * An Action endpoint: the URL the Runtime delivers one agent's Actions to, and what recent
- * deliveries and the last ping say about it.
- */
-export interface EndpointRow {
-    agentId: string;
-    url: string;
-    implementationVersion: string;
-    manifestHash?: string;
-    timeoutMs: number;
-    maxConcurrent: number;
-    /** Application principal that registered it, when known. */
-    principalId?: string;
-    lastDeliveryAt?: string;
-    lastSuccessAt?: string;
-    lastErrorCode?: string;
-    lastErrorMessage?: string;
-    consecutiveFailures: number;
-    /** What the endpoint reported serving on the last ping. */
-    servedImplementationVersion?: string;
-    servedManifestHash?: string;
-    createdAt: string;
-    updatedAt: string;
-}
-/** The registration part of an endpoint, as `putEndpoint` writes it. */
-export type EndpointRegistrationRow = Pick<EndpointRow, "agentId" | "url" | "implementationVersion" | "manifestHash" | "timeoutMs" | "maxConcurrent" | "principalId" | "updatedAt">;
-/** One observation about an endpoint (`recordEndpointHealth`). */
-export type EndpointHealthUpdate = 
-/** A delivery was answered. */
-{
-    kind: "success";
-    at: string;
-}
-/** A delivery failed: not reached, refused, or lost. */
- | {
-    kind: "failure";
-    at: string;
-    code: string;
-    message: string;
-}
-/** A ping was answered with what the endpoint serves. */
- | {
-    kind: "served";
-    implementationVersion: string;
-    manifestHash?: string;
-};
 /**
  * The rows of the typed tables, inferred from the tables Drizzle defines
  * (`store/postgres/schema.ts`): a principal, a vault and its credentials (secrets sealed in
  * `bytea` columns, never inside a JSON body), the vault's audit and idempotency records, the
- * Tenant's signing keys, a subject's turn bucket, a publishable key, a model call in the usage
- * ledger and a model budget.
+ * Tenant's signing keys, a model call in the usage ledger and a model budget.
  */
-export type { ArtifactRow, ArtifactVersionRow, ModelBudgetRow, ModelUsageRow, ToolCrossingRow, PrincipalRow, PublishableKeyRow, SigningKeyRow, SubjectUsageRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, };
+export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow, };
 /** Which rows of the usage ledger a total covers. */
 export interface ModelUsageQuery {
     scope: "tenant" | "agent" | "turn";
@@ -266,18 +216,11 @@ export interface SessionEffectFilter {
     turnId?: string;
     statuses?: readonly (EffectStatus | (string & {}))[];
 }
-export interface SessionActionFilter {
-    /** Only this turn. Absent means every turn. */
-    turnId?: string;
-    statuses?: readonly ActionStatus[];
-}
 /** Counts used by Tenant status, `summary` and `drain`. */
 export interface StoreCounts {
     sessions: number;
     /** Sessions `running` or `runnable`. */
     runningSessions: number;
-    /** Actions `pending` or `delivering`. */
-    pendingActions: number;
     /** Effects `uncertain`. */
     uncertainEffects: number;
     sandboxes: number;
@@ -440,18 +383,6 @@ export interface Tx {
         fromSeq?: number;
         limit?: number;
     }): Promise<SandboxEvent[]>;
-    /** One agent's `pending` actions, delivered when its endpoint is registered. */
-    pendingActions(agentId: string): Promise<ActionDoc[]>;
-    /** How many of one agent's actions are `delivering` (Action endpoints). */
-    deliveringCount(agentId: string): Promise<number>;
-    /** `pending` actions of agents that have an Action endpoint, by id. */
-    pendingActionsWithEndpoint(limit: number): Promise<ActionDoc[]>;
-    /** `delivering` actions whose deadline is at or before `now`, earliest first. */
-    expiredDeliveries(now: Date, limit: number): Promise<ActionDoc[]>;
-    actionsForSession(sessionId: string, filter?: SessionActionFilter): Promise<ActionDoc[]>;
-    actionsWithStatus(statuses: readonly ActionStatus[], filter?: {
-        kinds?: readonly ActionKind[];
-    }): Promise<ActionDoc[]>;
     /** `invoking` effects of one session; takeover turns them `uncertain`. */
     invokingEffects<T extends EffectDoc = EffectDoc>(sessionId: string): Promise<T[]>;
     effectsForSession<T extends EffectDoc = EffectDoc>(sessionId: string, filter?: SessionEffectFilter): Promise<T[]>;
@@ -465,26 +396,28 @@ export interface Tx {
     basinGenerations(): Promise<BasinGenerations>;
     /** Forgets a retired generation once its basin is deleted. */
     forgetRetiredGeneration(generation: number): Promise<void>;
-    listEndpoints(): Promise<EndpointRow[]>;
-    getEndpoint(agentId: string): Promise<EndpointRow | undefined>;
-    /**
-     * Inserts or updates by `agentId`, keeping `createdAt`. Health is kept, except that a new
-     * `url` starts with none.
-     */
-    putEndpoint(row: EndpointRegistrationRow): Promise<void>;
-    deleteEndpoint(agentId: string): Promise<void>;
-    /** Records one observation. Nothing happens when the endpoint does not exist. */
-    recordEndpointHealth(agentId: string, update: EndpointHealthUpdate): Promise<void>;
     /** Rejects when the id or token hash already exists. */
     insertPrincipal(row: PrincipalRow): Promise<void>;
     principalByTokenHash(tokenHash: string): Promise<PrincipalRow | undefined>;
     principalById(id: string): Promise<PrincipalRow | undefined>;
-    applicationTokenHashes(): Promise<string[]>;
+    /** Every principal, ordered by id. */
+    listPrincipals(): Promise<PrincipalRow[]>;
+    /**
+     * Creates principal `id` with `tokenHash` and `role` (default `application`), or gives an
+     * existing one this hash (and `createdAt`): its previous key stops authenticating. Rejects
+     * when another principal holds the hash, and with `PrincipalRoleConflict` when `id` holds
+     * another role.
+     */
+    putPrincipal(id: string, tokenHash: string, createdAt: string, role?: KeyRole): Promise<PrincipalRow>;
+    /** Deletes principal `id`; false when there was none. */
+    deletePrincipal(id: string): Promise<boolean>;
     /** Rejects on a duplicate id, or a second `host` vault. */
     insertVault(row: VaultRow): Promise<void>;
     getVault(id: string): Promise<VaultRow | undefined>;
     /** User vaults of one owner, ordered by `createdAt`, then id. */
     vaultsByOwner(ownerUserId: string): Promise<VaultRow[]>;
+    /** Installation vaults (any session may attach them), ordered by `createdAt`, then id. */
+    installationVaults(): Promise<VaultRow[]>;
     updateVaultMetadata(id: string, metadataJson: string | null): Promise<void>;
     /** Deletes the vault and its credentials. */
     deleteVault(id: string): Promise<void>;
@@ -510,6 +443,12 @@ export interface Tx {
     getVaultIdempotency(id: string): Promise<VaultIdempotencyRow | undefined>;
     /** Rejects when the id exists. */
     insertVaultIdempotency(row: VaultIdempotencyRow): Promise<void>;
+    /** An MCP OAuth connect's start (F9 C2). Rejects on a duplicate state or an unknown vault. */
+    insertOAuthPending(row: OAuthPendingRow): Promise<void>;
+    /** Deletes and returns the pending connect of `stateHash`, expired or not: each is used once. */
+    takeOAuthPending(stateHash: string): Promise<OAuthPendingRow | undefined>;
+    /** Deletes the pending connects that expired before `now` (ISO); returns how many. */
+    deleteExpiredOAuthPending(now: string): Promise<number>;
     /**
      * Serializes signing key changes: held until the transaction ends. Take it before reading
      * the keys a change depends on, so concurrent first uses or rotations do not collide.
@@ -527,30 +466,8 @@ export interface Tx {
      */
     setSigningKeyState(id: string, from: SigningKeyRow["state"], to: SigningKeyRow["state"], at: string): Promise<boolean>;
     countSigningKeys(): Promise<number>;
-    /** The subject's revocation epoch; 0 when it was never revoked. */
-    subjectEpoch(subject: string): Promise<number>;
-    /** The epochs of several subjects; subjects never revoked are absent. */
-    subjectEpochs(subjects: readonly string[]): Promise<Map<string, number>>;
-    /** Adds one to the subject's epoch and returns the new value. */
-    bumpSubjectEpoch(subject: string, at: string): Promise<number>;
-    /**
-     * The subject's turn bucket, created from `initial` when missing, locked until the
-     * transaction ends so concurrent commands of one subject serialize.
-     */
-    lockSubjectUsage(initial: SubjectUsageRow): Promise<SubjectUsageRow>;
-    putSubjectUsage(row: SubjectUsageRow): Promise<void>;
-    /** How many sessions of `ownerUserId` are in one of `statuses`. */
-    countOwnerSessions(ownerUserId: string, statuses: readonly string[]): Promise<number>;
-    /** Rejects on a duplicate id, key or name. */
-    insertPublishableKey(row: PublishableKeyRow): Promise<void>;
-    publishableKeyByKey(key: string): Promise<PublishableKeyRow | undefined>;
-    publishableKey(id: string): Promise<PublishableKeyRow | undefined>;
-    /** All keys, revoked ones included, ordered by `createdAt`, then id. */
-    publishableKeys(): Promise<PublishableKeyRow[]>;
-    /** Returns false when the key does not exist. */
-    updatePublishableKey(id: string, patch: Partial<Pick<PublishableKeyRow, "originsJson" | "revokedAt">>): Promise<boolean>;
     /** Appends a row, setting `duplicate` when one with the same `effectKey` exists; returns it. */
-    recordModelUsage(row: Omit<ModelUsageRow, "duplicate">): Promise<ModelUsageRow>;
+    recordModelUsage(row: ModelUsageWrite): Promise<ModelUsageRow>;
     modelUsageTotals(query: ModelUsageQuery): Promise<ModelUsageTotals>;
     /** Every budget, ordered by scope, then scope id. */
     listModelBudgets(): Promise<ModelBudgetRow[]>;
@@ -612,19 +529,27 @@ export interface Tx {
     artifactContentShas(scope: "sessions" | "all" | {
         artifactId: string;
     }): Promise<string[]>;
+    /** The definition file `sha256` (`sha256:<hex>`) names, once its bytes are stored. */
+    definitionFile(sha256: string): Promise<DefinitionFileRow | undefined>;
+    /** Records a stored definition file; false when the Tenant held it already. */
+    insertDefinitionFile(row: DefinitionFileRow): Promise<boolean>;
+    /** Those of `shas` the Tenant holds. */
+    heldDefinitionFiles(shas: readonly string[]): Promise<Set<string>>;
+    /** Records that version `manifestHash` of definition `agentId` names each of `shas`. */
+    insertDefinitionFileUses(agentId: string, manifestHash: string, shas: readonly string[]): Promise<void>;
     getSetting(key: string): Promise<string | undefined>;
     putSetting(key: string, value: string): Promise<void>;
     /**
      * Deletes Tenant state by scope, in this transaction:
-     * - `sessions`: sessions, commands, effects, actions, links, subject turn
-     *   buckets, the artifacts of sessions (their blobs are the caller's to delete) and the
+     * - `sessions`: sessions, commands, effects, links, the artifacts of sessions (their blobs are the caller's to delete) and the
      *   Tenant's record rows and log heads. The Tenant moves to the next basin
      *   generation and the current one is retired, so session ids it frees start again in an
      *   empty basin;
      * - `sandboxes`: sandbox records, sandbox resources and their lifecycle streams;
-     * - `all`: both, plus definitions, Action endpoints, user vaults with their credentials,
-     *   the model usage ledger, the model budgets and Tenant-wide artifacts. The host vault, principals, signing keys, subject epochs,
-     *   publishable keys, settings, audit and vault idempotency rows stay.
+     * - `all`: both, plus definitions (and which definition files they use),
+     *   user vaults with their credentials,
+     *   the model usage ledger, the model budgets and Tenant-wide artifacts. The host vault, principals, signing keys,
+     *   settings, audit and vault idempotency rows stay.
      */
     reset(scope: ResetScope): Promise<void>;
 }

package/dist/store/types.js

@@ -3,7 +3,6 @@ export const DOC_TABLES = [
     "sessions",
     "commands",
     "effects",
-    "actions",
     "sandboxes",
     "links",
 ];

package/dist/streams/control.d.ts

@@ -6,15 +6,8 @@
 import { type DurableStreams } from "./types.js";
 /** Appends a `session.cancel` signal: the process running the session's advance aborts it. */
 export declare function signalCancel(streams: DurableStreams, basin: string, sessionId: string, turnId?: string): Promise<void>;
-/** Appends an `action.resolved` signal: a run held for the Action goes on with its outcome. */
-export declare function signalActionResolved(streams: DurableStreams, basin: string, sessionId: string, actionId: string): Promise<void>;
 /**
  * Appends a `sessions.reset` signal to the old generation's basin: every process with the
  * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.
  */
 export declare function signalSessionsReset(streams: DurableStreams, basin: string, generation: number): Promise<void>;
-/**
- * Appends a `subject.revoked` signal: every process with the Tenant open ends the subject's
- * streams opened with a token older than `epoch`.
- */
-export declare function signalSubjectRevoked(streams: DurableStreams, basin: string, subject: string, epoch: number): Promise<void>;

package/dist/streams/control.js

@@ -15,11 +15,6 @@ export async function signalCancel(streams, basin, sessionId, turnId) {
     };
     await streams.append(basin, CONTROL_STREAM, [signal]);
 }
-/** Appends an `action.resolved` signal: a run held for the Action goes on with its outcome. */
-export async function signalActionResolved(streams, basin, sessionId, actionId) {
-    const signal = { type: "action.resolved", sessionId, actionId };
-    await streams.append(basin, CONTROL_STREAM, [signal]);
-}
 /**
  * Appends a `sessions.reset` signal to the old generation's basin: every process with the
  * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.
@@ -28,11 +23,3 @@ export async function signalSessionsReset(streams, basin, generation) {
     const signal = { type: "sessions.reset", generation };
     await streams.append(basin, CONTROL_STREAM, [signal]);
 }
-/**
- * Appends a `subject.revoked` signal: every process with the Tenant open ends the subject's
- * streams opened with a token older than `epoch`.
- */
-export async function signalSubjectRevoked(streams, basin, subject, epoch) {
-    const signal = { type: "subject.revoked", subject, epoch };
-    await streams.append(basin, CONTROL_STREAM, [signal]);
-}

package/dist/streams/types.d.ts

@@ -7,7 +7,7 @@
  * | Stream | Contents | Written by | Read by |
  * | --- | --- | --- | --- |
  * | `sessions/<sessionId>` | every event of the session, in sequence | the stream relay, from the record | history and session SSE |
- * | `tenant/control` | `session.cancel`, `sessions.reset` and `subject.revoked` signals | API nodes | every process with the Tenant open |
+ * | `tenant/control` | `session.cancel`, `sessions.reset` and `action.resolved` signals | API nodes | every process with the Tenant open |
  *
  * **Basin generations.** A session id is unique within its Tenant's basin generation. A
  * Tenant reset, the only path that frees ids, moves the Tenant to the next generation, so
@@ -138,22 +138,4 @@ export interface SessionsResetSignal {
     type: "sessions.reset";
     generation?: number;
 }
-/**
- * A subject's tokens older than `epoch` were revoked: each process ends that subject's
- * streams opened with them.
- */
-export interface SubjectRevokedSignal {
-    type: "subject.revoked";
-    subject: string;
-    epoch: number;
-}
-/**
- * An Action of `sessionId` has its outcome (F6.2): the process whose harness holds the
- * session's run while the Action is pending passes it on (`effect.resolved`).
- */
-export interface ActionResolvedSignal {
-    type: "action.resolved";
-    sessionId: string;
-    actionId: string;
-}
-export type ControlSignal = SessionCancelSignal | SessionsResetSignal | SubjectRevokedSignal | ActionResolvedSignal;
+export type ControlSignal = SessionCancelSignal | SessionsResetSignal;

package/dist/streams/types.js

@@ -7,7 +7,7 @@
  * | Stream | Contents | Written by | Read by |
  * | --- | --- | --- | --- |
  * | `sessions/<sessionId>` | every event of the session, in sequence | the stream relay, from the record | history and session SSE |
- * | `tenant/control` | `session.cancel`, `sessions.reset` and `subject.revoked` signals | API nodes | every process with the Tenant open |
+ * | `tenant/control` | `session.cancel`, `sessions.reset` and `action.resolved` signals | API nodes | every process with the Tenant open |
  *
  * **Basin generations.** A session id is unique within its Tenant's basin generation. A
  * Tenant reset, the only path that frees ids, moves the Tenant to the next generation, so

package/dist/tenant/advance.d.ts

@@ -9,12 +9,12 @@ export declare function advance(ctx: TenantContext, id: string, signal: AbortSig
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
  * owner's `invoking` effects become `uncertain` and are never invoked again, except model
- * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
- * G3): those stay `invoking`, and the replay re-sends them. When one belongs
+ * calls when the gate recovers them (P1.2) and remote MCP and HTTP tool calls when the Tool
+ * Gate does (F4.1 G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
 export declare function takeOver(t: Tx, s: Session, options?: {
     recoversModelCalls?: boolean;
-    recoversMcpCalls?: boolean;
+    recoversToolCalls?: boolean;
 }): Promise<string[]>;

package/dist/tenant/advance.js

@@ -42,8 +42,7 @@
 import { runDurable, runFlowDurable, } from "@nylorun/harness/run";
 import { aggregateWaits, cancelSiblingWork, isWorkflowManifest, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { isOwnershipLost, ownedTx } from "../store/ownership.js";
-import { linkedAgentOutput } from "./session.js";
-import { isRemoteMcpEffect, recoversMcpCalls, recoversModelCalls } from "./effects.js";
+import { isGateToolEffect, recoversModelCalls, recoversToolCalls } from "./effects.js";
 import { slimModelEffects } from "./slim.js";
 import { applyUpdates, leanState, transcriptShadow, withTranscript, } from "./history.js";
 import { command } from "./commands.js";
@@ -232,7 +231,7 @@ async function takeOwnership(ctx, id) {
         if (taken.takeover)
             await takeOver(t, s, {
                 recoversModelCalls: recoversModelCalls(ctx),
-                recoversMcpCalls: recoversMcpCalls(ctx),
+                recoversToolCalls: recoversToolCalls(ctx),
             });
         if (!s.checkpoint || !["running", "runnable"].includes(s.status)) {
             await t.releaseOwnership(id, lease.owner, lease.epoch);
@@ -246,8 +245,8 @@ async function takeOwnership(ctx, id) {
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
  * owner's `invoking` effects become `uncertain` and are never invoked again, except model
- * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
- * G3): those stay `invoking`, and the replay re-sends them. When one belongs
+ * calls when the gate recovers them (P1.2) and remote MCP and HTTP tool calls when the Tool
+ * Gate does (F4.1 G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
@@ -257,7 +256,7 @@ export async function takeOver(t, s, options = {}) {
         // Still running at the gate, or finished there: the replay re-sends it (P1.2).
         if (options.recoversModelCalls && effect.request.kind === "model")
             continue;
-        if (options.recoversMcpCalls && isRemoteMcpEffect(s, effect.request))
+        if (options.recoversToolCalls && isGateToolEffect(s, effect.request))
             continue;
         effect.status = "uncertain";
         effect.error ??= "The Worker running this effect stopped before its outcome was recorded";
@@ -390,7 +389,7 @@ async function wakeWorkflowOf(ctx, t, agent, turnId, type, payload) {
             agentSessionId: agent.id,
             turnId,
             output: type === "turn.completed"
-                ? linkedAgentOutput(agent, payload.output)
+                ? payload.output ?? null
                 : undefined,
             failed: type === "turn.failed",
             error: type === "turn.failed"
@@ -526,9 +525,13 @@ async function settle(ctx, lease, s, result, updates = [], cursor) {
                 ? {
                     interactions: (result.result.pending ?? []).map((call) => ({
                         invocationId: call.invocationId,
+                        ...(typeof call.callId === "string" ? { callId: call.callId } : {}),
                         interaction: call.interaction,
                         wait: call.wait,
                         status: call.status,
+                        // A flow's tool node that asked.
+                        ...(typeof call.path === "string" ? { path: call.path } : {}),
+                        ...(typeof call.toolName === "string" ? { toolName: call.toolName } : {}),
                     })),
                 }
                 : result.status === "failed"

package/dist/tenant/auth.d.ts

@@ -1,15 +1,27 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal, a subject token or a delivery token; anything else is the opaque 404 (D5).
- * An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); a
- * subject token names its subject itself. `authorize` limits both to the routes their scopes
- * allow, decided from the route alone.
+ * principal or a trusted issuer's token; anything else is the opaque 404
+ * (D5). An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`);
+ * an issuer token names its subject itself. `requireScopes` limits them to the routes their
+ * scopes allow, decided from the route alone.
+ *
+ * Browsers: a request with `Origin` may carry an issuer token (CORS is the operator's proxy's),
+ * never an application key, which is a server secret.
  */
 import type { IncomingMessage } from "node:http";
-import { type Action, type SubjectScope } from "@nylorun/core/contracts";
+import { type SubjectScope } from "@nylorun/core/contracts";
 import type { AuthScope, SessionAccess, TenantContext } from "./context.js";
-import type { BrowserClient } from "./browser.js";
-export declare function authenticate(ctx: TenantContext, request: IncomingMessage, client?: BrowserClient): Promise<AuthScope>;
+/**
+ * Which keys a route takes (protocol 8): an application key (alone or acting for a subject) on
+ * the Runtime API, a management key on the Management API. `/v1/me` takes both.
+ */
+export interface KeyAccess {
+    readonly application: boolean;
+    readonly management: boolean;
+}
+/** Every route that does not say otherwise is a Runtime API route. */
+export declare const RUNTIME_KEYS: KeyAccess;
+export declare function authenticate(ctx: TenantContext, request: IncomingMessage, keys?: KeyAccess): Promise<AuthScope>;
 /**
  * What a subject needs for a route: any one of the scopes, nothing grants it (`never`), or
  * any caller may (`any`, public data such as the JWKS). Each route declares it
@@ -17,18 +29,15 @@ export declare function authenticate(ctx: TenantContext, request: IncomingMessag
  */
 export type SubjectAccess = readonly SubjectScope[] | "never" | "any";
 /**
- * A subject, subject token or publishable key reaches a route only with one of the scopes it
- * declares: `403 scope_required`, decided from the route alone before anything is read.
+ * A subject or a token caller reaches a route only with one of the scopes it declares:
+ * `403 scope_required`, decided from the route alone before anything is read.
  */
 export declare function requireScopes(scope: AuthScope, access: SubjectAccess): void;
 export declare function accessOf(scope: AuthScope): SessionAccess | undefined;
-/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+/** The subject whose sessions the request is limited to, if it acts for one. */
 export declare function ownerOf(scope: AuthScope): string | undefined;
 /** The application principal behind the request, acting for a subject or not. */
 export declare function requirePrincipal(scope: AuthScope): string;
-/**
- * The caller may act on `action`: only the delivery token minted for it. Whether its generation
- * is still the Action's is checked by each callback.
- */
-export declare function scoped(scope: AuthScope, action: Action): void;
+/** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
+export declare function mayUseAgent(scope: AuthScope, agentId: string): boolean;
 export declare function requireApplication(scope: AuthScope): string;