@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/tenant/auth.js

@@ -1,11 +1,9 @@
 import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
-import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
+import { parseSubjectHeaders } from "@nylorun/core/contracts";
 import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
-import { looksLikeToken, verifySubjectToken } from "./tokens.js";
-import { verifyDeliveryToken } from "./delivery-token.js";
-import { tokenType } from "./jwt.js";
-import { readPolicy } from "./access-policy.js";
+import { verifyIssuerToken } from "./issuers.js";
+import { looksLikeToken } from "./jwt.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -18,42 +16,31 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request, client) {
+/** Every route that does not say otherwise is a Runtime API route. */
+export const RUNTIME_KEYS = { application: true, management: false };
+export async function authenticate(ctx, request, keys = RUNTIME_KEYS) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
-        // A publishable key alone: what the policy grants `anon` (nothing by default).
-        if (client && header === undefined) {
-            const { anon } = await ctx.store.tx((t) => readPolicy(t));
-            return {
-                kind: "publishable",
-                keyId: client.keyId,
-                scopes: new Set(anon.scopes),
-                agents: anon.agents === "*" ? "*" : new Set(anon.agents),
-            };
-        }
         ctx.config.logger.warn("credential rejected", {
             reason: "missing_bearer",
         });
         return failOpaque();
     }
-    if (looksLikeToken(token) && tokenType(token) === DELIVERY_TOKEN_TYPE) {
-        // Delivery tokens come back from the application's server, never from a browser.
-        if (request.headers.origin !== undefined)
-            fail(403, "Delivery tokens are not accepted from browsers", { code: "origin_rejected" });
-        const scope = await verifyDeliveryToken(ctx, token);
+    // A trusted issuer's token (Host feature `trusted-issuers`), from a server or a browser: its
+    // unverified `iss` names an issuer of the identity file, and only that issuer verifies it.
+    const issuer = ctx.config.issuers?.claimed(token);
+    if (issuer) {
+        const scope = await verifyIssuerToken(ctx, issuer, token);
         if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
             singleHeader(request, SCOPES_HEADER) !== undefined)
-            fail(403, "A delivery token cannot act for a subject");
+            fail(403, "An issuer token cannot act for another subject");
         return scope;
     }
+    // Any other JWT: no issuer of this Host signed it (subject tokens are gone, protocol 7).
     if (looksLikeToken(token)) {
-        const scope = await verifySubjectToken(ctx, token);
-        // Read only after verification, so an unknown token still sees the opaque 404.
-        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
-            singleHeader(request, SCOPES_HEADER) !== undefined)
-            fail(403, "A subject token cannot act for another subject");
-        return scope;
+        ctx.config.logger.warn("credential rejected", { reason: "token_unknown_issuer" });
+        return failOpaque();
     }
     // Application keys never come from a browser or a shipped app: refused before they are even
     // looked up.
@@ -61,10 +48,6 @@ export async function authenticate(ctx, request, client) {
         fail(403, "Application keys are not accepted from browsers", {
             code: "origin_rejected",
         });
-    if (client)
-        fail(400, "Nylorun-Key is for browser and mobile clients, not with a Tenant key", {
-            code: "invalid_request",
-        });
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
     if (!principal) {
@@ -76,6 +59,22 @@ export async function authenticate(ctx, request, client) {
     // Read only after authentication, so an unknown caller sees the opaque 404 either way.
     const subject = singleHeader(request, SUBJECT_HEADER);
     const scopes = singleHeader(request, SCOPES_HEADER);
+    // A management key acts as itself on the Management API; Studio's key does too on a route
+    // that takes no application key. Neither acts for a subject there.
+    const asManagement = principal.role === "management" || (principal.role === "studio" && !keys.application);
+    if (asManagement) {
+        if (!keys.management)
+            fail(403, "A management key reaches only the Management API (/v1/tenant/*)", {
+                code: "key_role_mismatch",
+            });
+        if (subject !== undefined || scopes !== undefined)
+            fail(403, "A management key acts as itself, never for a subject", SUBJECT_INVALID);
+        return { kind: "management", principalId: principal.id };
+    }
+    if (!keys.application)
+        fail(403, "This is the Management API: it takes a management key, not an application key", {
+            code: "key_role_mismatch",
+        });
     if (subject === undefined) {
         if (scopes !== undefined)
             fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
@@ -92,13 +91,11 @@ export async function authenticate(ctx, request, client) {
     };
 }
 /**
- * A subject, subject token or publishable key reaches a route only with one of the scopes it
- * declares: `403 scope_required`, decided from the route alone before anything is read.
+ * A subject or a token caller reaches a route only with one of the scopes it declares:
+ * `403 scope_required`, decided from the route alone before anything is read.
  */
 export function requireScopes(scope, access) {
-    if (scope.kind !== "subject" &&
-        scope.kind !== "token" &&
-        scope.kind !== "publishable")
+    if (scope.kind !== "subject" && scope.kind !== "token")
         return;
     if (access === "any")
         return;
@@ -107,7 +104,8 @@ export function requireScopes(scope, access) {
             code: "scope_required",
             details: { scopes: [] },
         });
-    if (!access.some((name) => scope.scopes.has(name)))
+    const held = scope.scopes;
+    if (!access.some((name) => held.has(name)))
         fail(403, `Scope ${access.join(" or ")} required`, {
             code: "scope_required",
             details: { scopes: access },
@@ -117,6 +115,9 @@ export function accessOf(scope) {
     switch (scope.kind) {
         case "application":
             return undefined;
+        // A management key reaches the Management API only: no session is its.
+        case "management":
+            return fail(404, "Not found");
         case "subject":
             return { owner: scope.subject };
         case "token":
@@ -124,21 +125,16 @@ export function accessOf(scope) {
                 owner: scope.subject,
                 ...(scope.agents === "*" ? {} : { agents: scope.agents }),
             };
-        // A publishable key alone owns nothing: no session or vault is ever reachable.
-        case "publishable":
-        // Nor does a request with no credential, on a route that serves public data.
+        // A request with no credential, on a route that serves public data, owns nothing.
         case "anonymous":
             return fail(404, "Not found");
-        // A delivery token reaches its Action's callbacks, never a session or vault.
-        case "delivery":
-            return fail(404, "Not found");
         default: {
             const unknown = scope;
             return fail(404, `Unknown credential ${String(unknown.kind)}`);
         }
     }
 }
-/** The subject whose sessions and vaults the request is limited to, if it acts for one. */
+/** The subject whose sessions the request is limited to, if it acts for one. */
 export function ownerOf(scope) {
     return accessOf(scope)?.owner;
 }
@@ -148,16 +144,9 @@ export function requirePrincipal(scope) {
         return scope.principalId;
     return fail(403, "Application credential required");
 }
-/**
- * The caller may act on `action`: only the delivery token minted for it. Whether its generation
- * is still the Action's is checked by each callback.
- */
-export function scoped(scope, action) {
-    if (scope.kind === "delivery" &&
-        scope.actionId === action.actionId &&
-        scope.agentId === action.agentId)
-        return;
-    fail(403, "This delivery token is for another Action");
+/** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
+export function mayUseAgent(scope, agentId) {
+    return scope.kind !== "token" || scope.agents === "*" || scope.agents.has(agentId);
 }
 export function requireApplication(scope) {
     if (scope.kind === "application")

package/dist/tenant/cause.d.ts

@@ -1,8 +1,8 @@
 /**
  * Why the Host's Tenant could not be opened (tenancy.md §5). A cause is about the Tenant's
  * own data or files (its database is newer than this Runtime, its vault key is missing, the
- * database has an old layout): the Host fails readiness, names the cause in
- * `/v1/admin/status` and the logs, and answers Tenant requests with the opaque 404 until it is
+ * database has an old layout): the Host fails readiness, names the cause in the logs (and
+ * `nylorun-operate status` reads it from the database), and answers Tenant requests with the opaque 404 until it is
  * repaired and the Host restarted. A failure outside the Tenant (Postgres unreachable) is not
  * a cause: it is `TenantUnavailableError`, and the next request tries again.
  */
@@ -12,7 +12,7 @@ export type { TenantCause };
 export declare class TenantOpenError extends Error {
     readonly code: TenantCause["code"];
     readonly repair: string;
-    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    /** The Tenant, when it was read before opening failed. */
     envelope?: TenantEnvelope;
     constructor(fields: TenantCause);
     toCause(): TenantCause;

package/dist/tenant/cause.js

@@ -2,7 +2,7 @@
 export class TenantOpenError extends Error {
     code;
     repair;
-    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    /** The Tenant, when it was read before opening failed. */
     envelope;
     constructor(fields) {
         super(fields.message);

package/dist/tenant/commands.d.ts

@@ -1,19 +1,3 @@
-import type { Action, ActionOutcome, LiveEvent, SessionCommand } from "@nylorun/core/contracts";
-import type { Tx } from "../store/types.js";
-import { type AuthScope, type Session, type TenantContext } from "./context.js";
-/** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
-export declare function acceptedOutcome(action: Action, outcome: ActionOutcome): ActionOutcome;
+import type { SessionCommand } from "@nylorun/core/contracts";
+import { type AuthScope, type TenantContext } from "./context.js";
 export declare function command(ctx: TenantContext, id: string, input: SessionCommand, scope: AuthScope): Promise<unknown>;
-/**
- * Completes a delivered Action with `outcome`, in the caller's transaction, which
- * holds the lock of the Action's session `s`: the Action and its effect, the
- * `action.completed` event (and `loop.verified` or `loop.decided`), the wake that resumes the
- * turn, and queued workflow effects. The Action deliverer and the background-result callback
- * both record outcomes here. It sets `s.status`; the caller writes `s`.
- */
-export declare function recordActionOutcome(t: Tx, ctx: TenantContext, s: Session, action: Action, received: ActionOutcome, options?: {
-    requestId?: string;
-}): Promise<{
-    event: LiveEvent;
-    receipt: Record<string, unknown>;
-}>;

package/dist/tenant/commands.js

@@ -7,81 +7,26 @@
  *
  * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
  * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
- * (every accepted one writes a new checkpoint segment). An Action's outcome
- * (`recordActionOutcome`, from the deliverer) wakes with
- * `action_result:<turnId>:<actionId>:<generation>`.
+ * (every accepted one writes a new checkpoint segment), except that a workflow's `approve` and
+ * `respond` name `<type>:<turnId>:<interactionId>`: a flow resumes in the same segment.
  *
  * Cancel commits `cancelled` first; the engine host sees it before its next effect and before
  * settlement on any Worker. It then aborts an advance running on this process
  * (`ctx.abortLocal`); reaching an advance on another process is the control stream's job.
  */
 import { randomUUID } from "node:crypto";
-import { createDurableCheckpoint, createFlowCheckpoint, } from "@nylorun/harness/run";
-import { schemaFromJSON, } from "@nylorun/core/define";
-import { commandKey, fenceWorkflowActions, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeForQueuedEffects, wakeLinkedWorkflow, } from "../core/flow-host.js";
+import { createDurableCheckpoint, createFlowCheckpoint, resumeFlowCheckpoint, } from "@nylorun/harness/run";
+import { commandKey, cancelQueuedEffects, flowInteractionOf, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { resolveMessageManifest } from "../core/turn-manifest.js";
 import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
 import { accessOf } from "./auth.js";
-import { chargeTurn } from "./subject-limits.js";
 import { checkSandboxTurn } from "./sandboxes.js";
-import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
-import { signalActionOutcome, signalSessionCancel } from "./streams.js";
-import { toolIds } from "./transcript.js";
+import { rebaseSessionState, turnManifestOf, variantStore } from "./session.js";
+import { signalSessionCancel } from "./streams.js";
 import { slimModelEffects } from "./slim.js";
 import { resolveMessageParts } from "../artifacts/parts.js";
-/** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
-export function acceptedOutcome(action, outcome) {
-    if (action.kind !== "tool" || !action.outputSchema)
-        return outcome;
-    const value = outcome.value;
-    // Only a result carries output: failures, denials, interactions and deferrals pass as sent.
-    if (!isResultToolValue(value))
-        return outcome;
-    // Endpoints wrap successful tool output as `{ kind: "completed", output }`.
-    // Validate the tool payload, not the outcome envelope.
-    const candidate = completedToolOutput(value);
-    let matches = false;
-    try {
-        matches = schemaFromJSON(action.outputSchema).validate(candidate).ok;
-    }
-    catch {
-        matches = false;
-    }
-    if (matches)
-        return outcome;
-    return {
-        ...outcome,
-        value: {
-            kind: "failed",
-            code: "tool.invalid-output",
-            message: "Tool result does not match the output schema stored on the action",
-        },
-    };
-}
-function completedToolOutput(value) {
-    if (value &&
-        typeof value === "object" &&
-        !Array.isArray(value) &&
-        value.kind === "completed" &&
-        "output" in value) {
-        return value.output;
-    }
-    return value;
-}
-const NON_RESULT_KINDS = new Set([
-    "failed",
-    "denied",
-    "interaction-required",
-    "deferred",
-]);
-function isResultToolValue(value) {
-    return !(!!value &&
-        typeof value === "object" &&
-        !Array.isArray(value) &&
-        NON_RESULT_KINDS.has(value.kind));
-}
 /** A command's identity for idempotency: everything but the request id. */
 const semantic = (value) => {
     const { requestId: _, ...body } = value;
@@ -97,7 +42,7 @@ export async function command(ctx, id, input, scope) {
         if (scope.kind === "token" &&
             command.type === "message" &&
             command.manifest !== undefined)
-            fail(403, "A subject token cannot send message.manifest", {
+            fail(403, "A token caller cannot send message.manifest", {
                 code: "scope_required",
             });
         const key = commandKey(id, command.idempotencyKey);
@@ -121,28 +66,12 @@ export async function command(ctx, id, input, scope) {
                 turnId: cancelledTurnId,
             });
             s.status = "cancelled";
-            if (workflowCancel) {
-                await fenceWorkflowActions({
+            if (workflowCancel)
+                await cancelQueuedEffects({
                     t,
                     workflowSessionId: id,
                     turnId: cancelledTurnId,
                 });
-            }
-            else if (cancelledTurnId !== null) {
-                for (const a of await t.actionsForSession(id, {
-                    turnId: cancelledTurnId,
-                    statuses: ["pending", "delivering"],
-                })) {
-                    // Delivered work may already have an external effect. Preserve it for reconciliation.
-                    a.status = a.status === "pending" ? "cancelled" : "uncertain";
-                    await t.put("actions", a.actionId, a);
-                    const effect = await t.get("effects", a.actionId);
-                    if (effect) {
-                        effect.status = a.status;
-                        await t.put("effects", a.actionId, effect);
-                    }
-                }
-            }
             if (cancelledTurnId !== null)
                 for (const effect of await t.effectsForTurn(id, cancelledTurnId, ["invoking"])) {
                     effect.status = "uncertain";
@@ -180,12 +109,9 @@ export async function command(ctx, id, input, scope) {
             if (command.type === "message") {
                 if (!["idle", "completed", "failed", "cancelled"].includes(s.status))
                     fail(409, "Session has active or unresolved work");
-                // Every turn start on a sandbox: it exists, the token's `sbx` reaches it, and no other
-                // session's turn holds it. Before the charge, so a refused turn costs nothing.
+                // Every turn start on a sandbox: it exists, the token's grants reach it, and no other
+                // session's turn holds it.
                 await checkSandboxTurn(t, s, scope, ctx);
-                // After the replay check above, so a retried message is never charged twice.
-                if (scope.kind === "token" && scope.limits)
-                    await chargeTurn(t, scope.subject, scope.limits);
                 s.turnStartState = s.state;
                 // A new turn folds from the latest snapshot: a cancel or failure only reverts this turn.
                 if (s.history?.snapshot !== undefined)
@@ -239,6 +165,28 @@ export async function command(ctx, id, input, scope) {
                     }
                 }
             }
+            else if (isWorkflowManifest(s.manifest)) {
+                // Approvals owned by linked agent sessions must be answered there (WF-R52).
+                const conflict = await foreignInteractionConflict({
+                    t,
+                    workflowSessionId: id,
+                    interactionId: command.interactionId,
+                });
+                if (conflict)
+                    fail(409, conflict.message);
+                if (s.status !== "paused" || !s.checkpoint || !s.activeTurnId)
+                    fail(409, "Session is not awaiting a response");
+                // The flow's own interactions: a tool node that asked (`ctx.approve`, `ctx.ask`).
+                const asked = flowInteractionOf(s.waits, id, command.interactionId);
+                if (!asked)
+                    fail(409, "Unknown interaction");
+                else if ((command.type === "approve") !== (asked.kind === "approval"))
+                    fail(409, "Interaction response kind does not match the saved request");
+                // Same segment: the flow replays its journal and runs the tool again with the answer.
+                s.checkpoint = resumeFlowCheckpoint(s.checkpoint, command.interactionId, command.type === "approve"
+                    ? { kind: "approval", approved: command.approved }
+                    : { kind: "response", value: command.value });
+            }
             else {
                 if (s.status !== "paused" || !s.state || !s.activeTurnId)
                     fail(409, "Session is not awaiting a response");
@@ -259,19 +207,6 @@ export async function command(ctx, id, input, scope) {
                         interactionId: command.interactionId,
                         value: command.value,
                     };
-                if (isWorkflowManifest(s.manifest)) {
-                    // Approvals owned by linked agent sessions must be answered there (WF-R52).
-                    const conflict = await foreignInteractionConflict({
-                        t,
-                        workflowSessionId: id,
-                        interactionId: command.interactionId,
-                    });
-                    if (conflict)
-                        fail(409, conflict.message);
-                    // Workflow-owned interactions (tool-node / verify) resume on this session once
-                    // the flow engine supports pause segments; tracer root Loop has none yet.
-                    fail(409, "Workflow sessions do not accept approve/respond on the root without a pending interaction");
-                }
                 s.checkpoint = createDurableCheckpoint({
                     manifest: turnManifestOf(s),
                     sessionId: id,
@@ -284,9 +219,13 @@ export async function command(ctx, id, input, scope) {
             }
             s.status = "runnable";
             s.waits = undefined;
+            // A flow answers each interaction in the same segment: the interaction names the cause.
+            const cause = command.type !== "message" && isWorkflowManifest(s.manifest)
+                ? command.interactionId
+                : s.checkpoint.segment;
             const commandWake = {
                 reason: command.type,
-                dedupeKey: `${command.type}:${s.activeTurnId}:${s.checkpoint.segment}`,
+                dedupeKey: `${command.type}:${s.activeTurnId}:${cause}`,
             };
             t.afterCommit(() => ctx.wake(id, commandWake));
             event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
@@ -330,83 +269,3 @@ export async function command(ctx, id, input, scope) {
     }
     return response;
 }
-/**
- * Completes a delivered Action with `outcome`, in the caller's transaction, which
- * holds the lock of the Action's session `s`: the Action and its effect, the
- * `action.completed` event (and `loop.verified` or `loop.decided`), the wake that resumes the
- * turn, and queued workflow effects. The Action deliverer and the background-result callback
- * both record outcomes here. It sets `s.status`; the caller writes `s`.
- */
-export async function recordActionOutcome(t, ctx, s, action, received, options = {}) {
-    const outcome = acceptedOutcome(action, received);
-    const prior = await t.get("effects", action.actionId);
-    action.status = "completed";
-    await t.put("actions", action.actionId, action);
-    prior.status = "completed";
-    prior.outcome = outcome;
-    s.status = "runnable";
-    const resultWake = {
-        reason: "action_result",
-        dedupeKey: `action_result:${action.turnId}:${action.actionId}:${action.generation}`,
-    };
-    t.afterCommit(() => ctx.wake(s.id, resultWake));
-    // A run held while the Action was pending goes on with it in the same lease (F6.2): here, or
-    // on the process whose harness holds it. The wake finds the session settled, or resumes it
-    // by replay when the run had already ended.
-    t.afterCommit(() => {
-        if (ctx.harness.holds(s.id))
-            ctx.harness.resolved(s.id, action.actionId, outcome);
-        else
-            signalActionOutcome(ctx, s.id, action.actionId);
-    });
-    const event = await t.event(s.id, s.activeTurnId, "action.completed", {
-        actionId: action.actionId,
-        ...actionTarget(action),
-        kind: action.kind,
-        ...(action.kind === "tool" ? toolIds(action.context) : {}),
-        result: outcome.value,
-    });
-    if (action.kind === "verify") {
-        const verdict = outcome.value;
-        if (verdict?.kind !== "failed") {
-            await t.event(s.id, s.activeTurnId, "loop.verified", {
-                path: String(action.context?.loopPath ?? action.path ?? ""),
-                n: Number(action.context?.n ?? 1),
-                pass: Boolean(verdict?.pass),
-                ...(verdict?.feedback !== undefined
-                    ? { feedback: verdict.feedback }
-                    : {}),
-                ...(verdict?.data !== undefined ? { data: verdict.data } : {}),
-            });
-        }
-    }
-    else if (action.kind === "fn" && action.context?.role === "decide") {
-        const decision = outcome.value;
-        await t.event(s.id, s.activeTurnId, "loop.decided", {
-            path: String(action.context?.loopPath ?? action.path ?? ""),
-            n: Number(action.context?.n ?? 1),
-            next: "output" in decision && !("input" in decision)
-                ? "output"
-                : "input",
-            patched: Boolean(decision.agent),
-        });
-    }
-    const receipt = {
-        status: "accepted",
-        turnId: s.activeTurnId,
-        cursor: event.cursor,
-        ...(options.requestId === undefined ? {} : { requestId: options.requestId }),
-    };
-    prior.receipt = receipt;
-    await t.put("effects", action.actionId, prior);
-    if (isWorkflowManifest(s.manifest) && s.activeTurnId) {
-        await wakeForQueuedEffects({
-            t,
-            workflowSessionId: s.id,
-            turnId: s.activeTurnId,
-            limits: ctx.flowLimits,
-            schedule: ctx.wake,
-        });
-    }
-    return { event, receipt };
-}