@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/tenant/context.d.ts

@@ -5,8 +5,7 @@
  *
  * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
  * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
- * commit), deliveries through `t.afterCommit(() => ctx.deliver(actionId))`, and advances through
- * `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
+ * commit), and advances through `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
  * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
  * tx.
  *
@@ -14,7 +13,7 @@
  * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
  */
 import type { SessionHistory } from "./history.js";
-import type { RoleLimits, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
+import type { IssuerScope, SubjectScope, TenantEnvelope } from "@nylorun/core/contracts";
 import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
 import type { AgentManifest, JsonValue, SandboxManifest } from "@nylorun/core/define";
 import type { CredentialSelection } from "@nylorun/core/contracts";
@@ -25,6 +24,7 @@ import type { ModelGate } from "../gates/model-gate.js";
 import type { ToolGate } from "../gates/tool-gate.js";
 import type { Keys } from "../keys/keys.js";
 import type { VaultService } from "../vault/service.js";
+import type { CredentialSources } from "../vault/sources.js";
 import type { McpPool } from "../mcp/pool.js";
 import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
 import type { HarnessApiServer } from "../harness-api/server.js";
@@ -71,7 +71,6 @@ export interface Session {
     creation: unknown;
     vaultIds?: readonly string[];
     credentialSelections?: readonly CredentialSelection[];
-    pluginRoots?: Readonly<Record<string, string>>;
     mcpSnapshot?: McpSnapshot;
     mcpDiagnostics?: readonly McpDiagnostic[];
     /** Session id that keys the shared sandbox; absent means this session owns it. */
@@ -95,22 +94,33 @@ export type AuthScope = {
     principalId: string;
 }
 /**
- * A subject token (Host feature `subject-tokens`): one subject, the role's scopes and agents
- * narrowed by the token, until `expiresAt` (ms) or the subject's epoch moves past `epoch`.
+ * A management key (role `management`), or Studio's key on a Management API route: the
+ * principal acting as itself, never for a subject. It reaches only the Management API
+ * (`/v1/tenant/*`) and `/v1/me`.
+ */
+ | {
+    kind: "management";
+    principalId: string;
+}
+/**
+ * A trusted issuer's token (Host feature `trusted-issuers`, F9-D12): one subject, with the
+ * issuer's scopes, agents and sandbox grants, until `expiresAt` (ms). Only its expiry ends it.
  */
  | {
     kind: "token";
+    /** The identity file's issuer that signed it. */
+    issuer: string;
     subject: string;
-    scopes: ReadonlySet<SubjectScope>;
+    /** The issuer's scopes the token holds, which may add `studio`. */
+    scopes: ReadonlySet<IssuerScope>;
     agents: ReadonlySet<string> | "*";
-    role: string;
-    limits?: RoleLimits;
-    /** The token's `sbx` grants: the sandboxes it reaches. Absent reaches none. */
+    /** The sandboxes it reaches: exact ids or `p/*` prefixes. Absent or empty reaches none. */
     sandboxes?: readonly string[];
-    epoch: number;
     expiresAt: number;
+    /** The token's `jti`, or a hash of it. */
     tokenId: string;
-    keyId: string;
+    /** The issuer key's `kid`, when it has one. */
+    keyId?: string;
 }
 /** An application principal acting for `subject` (`Nylorun-Subject`), narrowed to `scopes`. */
  | {
@@ -122,35 +132,18 @@ export type AuthScope = {
 /** No credential, on a route that serves public data (`RouteAccess.anonymous`). */
  | {
     kind: "anonymous";
-}
-/**
- * A delivery token (Action endpoints): the Runtime's own token for one delivery of one
- * Action, presented back by the Action endpoint on that Action's callbacks only.
- */
- | {
-    kind: "delivery";
-    actionId: string;
-    agentId: string;
-    generation: number;
-    expiresAt: number;
-    tokenId: string;
-    keyId: string;
-}
-/**
- * A publishable key with no bearer (Host feature `browser-access`): what the policy grants
- * `anon`, at most `agents:read`. It owns no session or vault.
- */
- | {
-    kind: "publishable";
-    keyId: string;
-    scopes: ReadonlySet<SubjectScope>;
-    agents: ReadonlySet<string> | "*";
 };
 export interface TenantContext {
+    readonly reads?: import("../reads/types.js").ReadStore;
     readonly config: TenantConfig;
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
     readonly vault: VaultService;
+    /**
+     * A session's MCP credentials, for the in-process MCP pool: its attached vaults, then the
+     * operator's credential resolver (`TenantConfig.resolver`, F9 C1).
+     */
+    readonly credentials: CredentialSources;
     /**
      * The MCP pool of the Tenant's in-process harness. Absent when harnesses run elsewhere
      * (`NYLORUN_HARNESS=remote`): each keeps its own (F6.2).
@@ -168,8 +161,8 @@ export interface TenantContext {
     /** Serves vault-backed model calls (blueprint §15): in this process, or the gates service. */
     readonly modelGate: ModelGate;
     /**
-     * Serves remote MCP servers and Action deliveries (blueprint §12, F4.1): in this process, or
-     * the gates service.
+     * Serves remote MCP servers and HTTP tools (blueprint §12, F4.1): in this process, or the
+     * gates service.
      */
     readonly toolGate: ToolGate;
     /**
@@ -208,7 +201,7 @@ export interface TenantContext {
     readonly work: WorkState;
     /** Live delivery over Durable Streams: one `SessionStream` per observed session, and the streams wiring. */
     readonly sessionStreams: SessionStreams;
-    /** The Tenant's signing keys for subject tokens. */
+    /** The Tenant's signing keys: capability links, run and host tokens. */
     readonly signingKeys: SigningKeys;
     /** The Worker id this process writes as session `owner` (§10.6). */
     readonly workerId: string;
@@ -225,11 +218,6 @@ export interface TenantContext {
      * an advance of that turn (a cancel signal names the turn it cancelled).
      */
     abortLocal(sessionId: string, turnId?: string): void;
-    /**
-     * Seam: deliver an Action to its agent's Action endpoint (`DurableExecution.deliver`). Call it
-     * from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends it.
-     */
-    deliver(actionId: string): Promise<void>;
     /**
      * Sandbox pods (F7.2): the sandboxes service and the Runtime image pods copy the engine from.
      * Absent without a cluster (`nylorun sandbox enable`): kind `pod` is `sandbox_unavailable`.
@@ -248,8 +236,8 @@ export interface TenantContext {
     onSweep(hook: () => Promise<void>): () => void;
 }
 /**
- * What a request acting for a person may reach: that person's sessions and vaults, and, for a
- * subject token, only sessions of the agents its role allows. Undefined means the whole Tenant.
+ * What a request acting for a person may reach: that person's sessions, and, for a token
+ * caller, only sessions of the agents its issuer allows. Undefined means the whole Tenant.
  */
 export interface SessionAccess {
     readonly owner: string;

package/dist/tenant/definition-files.d.ts

@@ -0,0 +1,24 @@
+import { type DefinitionFileView } from "@nylorun/core/contracts";
+import type { BlobStore } from "../blob/index.js";
+import type { Tx } from "../store/types.js";
+import type { TenantContext } from "./context.js";
+/** Where a definition file's bytes are in the Object store. */
+export declare function definitionFileKey(sha256: string): string;
+/** Whether the Tenant holds definition file `file` (`sha256:<hex>`). */
+export declare function hasDefinitionFile(ctx: TenantContext, file: string): Promise<boolean>;
+/**
+ * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ */
+export declare function putDefinitionFile(ctx: TenantContext, file: string, request: {
+    body: ReadableStream<Uint8Array> | null;
+    declaredBytes?: number;
+    contentType?: string;
+}, signal?: AbortSignal): Promise<{
+    status: 200 | 201;
+    view: DefinitionFileView;
+}>;
+/** The definition files `document` names that the Tenant does not hold, in order. */
+export declare function missingDefinitionFiles(t: Tx, document: unknown): Promise<string[]>;
+/** A definition file's bytes, or undefined when the Object store does not have them. */
+export declare function readDefinitionFile(blobs: BlobStore, sha256: string, signal?: AbortSignal): Promise<Uint8Array | undefined>;

package/dist/tenant/definition-files.js

@@ -0,0 +1,103 @@
+/**
+ * Definition files (track R2 M4): the files a definition names by the SHA-256 of their bytes,
+ * today a skill's folder (`SkillManifest.files`). A client uploads each one once
+ * (`PUT /v1/files/sha256:<hex>`); its bytes go to the Object store at
+ * `definitions/sha256/<hex>`, and a `definition_files` row says the Tenant holds it. A
+ * definition naming a file the Tenant does not hold is refused (`definition_files_missing`).
+ * The Runtime reads them to serve the skill tools and to give a sandbox the skills' files.
+ *
+ * Files are never deleted here: `definition_file_uses` records which definition version names
+ * which file, for a later sweep.
+ */
+import { createHash } from "node:crypto";
+import { DEFINITION_FILE_MAX_BYTES, definitionFilesOf, isDefinitionFileHash, } from "@nylorun/core/contracts";
+import { fail } from "./http.js";
+/** Where a definition file's bytes are in the Object store. */
+export function definitionFileKey(sha256) {
+    return `definitions/sha256/${sha256.slice("sha256:".length)}`;
+}
+function checkHash(file) {
+    if (!isDefinitionFileHash(file))
+        fail(400, "A definition file is named sha256:<64 lowercase hex>", { code: "invalid_request" });
+    return file;
+}
+/** Whether the Tenant holds definition file `file` (`sha256:<hex>`). */
+export async function hasDefinitionFile(ctx, file) {
+    const sha256 = checkHash(file);
+    return (await ctx.store.tx((t) => t.definitionFile(sha256))) !== undefined;
+}
+/** The body, at most `DEFINITION_FILE_MAX_BYTES`; past it, `413 limit_exceeded`. */
+async function readBody(body, declared) {
+    const tooLarge = () => fail(413, `A definition file may hold at most ${DEFINITION_FILE_MAX_BYTES} bytes`, {
+        code: "limit_exceeded",
+        details: { limitBytes: DEFINITION_FILE_MAX_BYTES },
+    });
+    if (declared !== undefined && declared > DEFINITION_FILE_MAX_BYTES) {
+        await body?.cancel().catch(() => undefined);
+        tooLarge();
+    }
+    if (body === null)
+        return new Uint8Array();
+    const chunks = [];
+    let size = 0;
+    const reader = body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > DEFINITION_FILE_MAX_BYTES) {
+            await reader.cancel().catch(() => undefined);
+            tooLarge();
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ */
+export async function putDefinitionFile(ctx, file, request, signal) {
+    const sha256 = checkHash(file);
+    const held = await ctx.store.tx((t) => t.definitionFile(sha256));
+    if (held) {
+        await request.body?.cancel().catch(() => undefined);
+        return { status: 200, view: { sha256, size: held.size } };
+    }
+    const bytes = await readBody(request.body, request.declaredBytes);
+    const actual = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    if (actual !== sha256)
+        fail(400, `The body's SHA-256 is ${actual}, not ${sha256}: upload a file at its own hash`, {
+            code: "invalid_request",
+            details: { expected: sha256, actual },
+        });
+    // The key is the content's hash: a concurrent upload of the same file writes the same bytes.
+    await ctx.blobs.put(definitionFileKey(sha256), bytes, {
+        ...(request.contentType === undefined ? {} : { contentType: request.contentType }),
+        ...(signal ? { signal } : {}),
+    });
+    const inserted = await ctx.store.tx((t) => t.insertDefinitionFile({
+        sha256,
+        kind: "skill",
+        size: bytes.byteLength,
+        contentType: request.contentType ?? null,
+        createdAt: new Date().toISOString(),
+    }));
+    return { status: inserted ? 201 : 200, view: { sha256, size: bytes.byteLength } };
+}
+/** The definition files `document` names that the Tenant does not hold, in order. */
+export async function missingDefinitionFiles(t, document) {
+    const named = [...definitionFilesOf(document)].sort();
+    if (named.length === 0)
+        return [];
+    const held = await t.heldDefinitionFiles(named);
+    return named.filter((sha256) => !held.has(sha256));
+}
+/** A definition file's bytes, or undefined when the Object store does not have them. */
+export async function readDefinitionFile(blobs, sha256, signal) {
+    const got = await blobs.get(definitionFileKey(sha256), signal ? { signal } : {});
+    if (!got)
+        return undefined;
+    return new Uint8Array(await new Response(got.body).arrayBuffer());
+}

package/dist/tenant/effects.d.ts

@@ -1,18 +1,20 @@
 /**
  * Core's side of effects: `resolveNewFlowEffect` journals and dispatches new workflow effects
- * (linked agent sessions, tool nodes, fn, verify); the takeover helpers say which calls their
- * gate recovers. Also vault authorization for MCP servers. The journal of a run's effects is
- * `harness-api/record.ts`; a harness readies the session's MCP servers itself (`session.mcp`).
+ * (linked agent sessions; a tool node without `http` fails, as it would run the developer's
+ * code); the takeover helpers say which calls their gate recovers. Also vault authorization
+ * for MCP servers and HTTP tools. The journal of a run's effects is `harness-api/record.ts`; a
+ * harness readies the session's MCP servers itself (`session.mcp`).
  *
  * Every journal write runs in a transaction that locks the effect's session first and checks
  * the advance's ownership epoch (`ownedSession`): after another Worker takes over, the next
- * write throws `ownership.lost` and nothing is written. The model, MCP, sandbox and vault
+ * write throws `ownership.lost` and nothing is written. The model, MCP, HTTP, sandbox and vault
  * calls run between transactions, never inside one.
  */
-import type { ActionOutcome } from "@nylorun/core/contracts";
+import type { EffectOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
 import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
+import type { McpCredentialRequest } from "../vault/sources.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
 /**
  * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
@@ -21,25 +23,25 @@ import { type Lease, type Session, type TenantContext } from "./context.js";
 export declare function linkedOutcome(t: Tx, effect: {
     request: HostEffect;
     agentSessionId?: string;
-}, agent: Session | undefined): Promise<ActionOutcome | undefined>;
+}, agent: Session | undefined): Promise<EffectOutcome | undefined>;
 /**
- * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
- * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
- * the running call or gets its answer, instead of becoming `uncertain`.
+ * True when this Tenant's remote MCP and HTTP tool calls outlive the process that sent them
+ * (the gates service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent
+ * and joins the running call or gets its answer, instead of becoming `uncertain`.
  */
-export declare function recoversMcpCalls(ctx: TenantContext): boolean;
-/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
-export declare function isRemoteMcpEffect(s: Session, request: HostEffect): boolean;
+export declare function recoversToolCalls(ctx: TenantContext): boolean;
+/** True when `request` calls a tool of a declared MCP server (every one is remote) or an HTTP tool. */
+export declare function isGateToolEffect(s: Session, request: HostEffect): boolean;
 /**
  * True when this Tenant's vault-backed model calls outlive the process that sent them (the
  * gates service, P1.2): after a takeover or a shutdown, the journaled call is re-sent and joins
  * the running call or gets its outcome, instead of becoming `uncertain`.
  */
 export declare function recoversModelCalls(ctx: TenantContext): boolean;
-/** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
+/** Journal and dispatch a new flow effect (agent or tool node). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
-/** Vault authorization for an MCP server request made on behalf of a session. */
-export declare function authorize(ctx: TenantContext, sessionId: string, request: {
-    url: string;
-    serverName?: string;
-}): Promise<AuthorizeResult>;
+/**
+ * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
+ * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ */
+export declare function authorize(ctx: TenantContext, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;