@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/api/components.js

@@ -5,14 +5,16 @@
  * global registry.
  */
 import { z } from "zod";
-import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, AdminStatusSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, SandboxPageSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, StartOAuthResponseSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
 export const Rejected = named("Rejected", RejectedResponseSchema);
 export const ProtocolRejected = named("ProtocolRejected", ProtocolRejectedResponseSchema);
-export const AdminStatus = named("AdminStatus", AdminStatusSchema);
-export const HostShutdownResponse = named("HostShutdownResponse", HostShutdownResponseSchema);
+export const OperatorKey = named("OperatorKey", OperatorKeySchema);
+export const ListOperatorKeysResponse = named("ListOperatorKeysResponse", ListOperatorKeysResponseSchema);
+export const PutOperatorKeyResponse = named("PutOperatorKeyResponse", PutOperatorKeyResponseSchema);
+export const DeleteOperatorKeyResponse = named("DeleteOperatorKeyResponse", DeleteOperatorKeyResponseSchema);
 export const SandboxToolOutcome = named("SandboxToolOutcome", SandboxToolOutcomeSchema);
 export const PutSandboxRequest = named("PutSandboxRequest", PutSandboxRequestSchema);
 export const SandboxView = named("SandboxView", SandboxViewSchema);
@@ -23,6 +25,7 @@ export const ArtifactVersionView = named("ArtifactVersionView", ArtifactVersionV
 export const ArtifactView = named("ArtifactView", ArtifactViewSchema);
 export const ListArtifactsResponse = named("ListArtifactsResponse", ListArtifactsResponseSchema);
 export const UploadArtifactResponse = named("UploadArtifactResponse", UploadArtifactResponseSchema);
+export const DefinitionFileView = named("DefinitionFileView", DefinitionFileViewSchema);
 export const DeleteArtifactResponse = named("DeleteArtifactResponse", DeleteArtifactResponseSchema);
 export const CreateArtifactLinkRequest = named("CreateArtifactLinkRequest", CreateArtifactLinkRequestSchema);
 export const ArtifactLink = named("ArtifactLink", ArtifactLinkSchema);
@@ -30,15 +33,8 @@ export const PutTenantArtifactsRequest = named("PutTenantArtifactsRequest", PutT
 export const TenantArtifactsView = named("TenantArtifactsView", TenantArtifactsViewSchema);
 export const ArtifactTree = named("ArtifactTree", ArtifactTreeSchema);
 export const ArtifactDiff = named("ArtifactDiff", ArtifactDiffSchema);
-export const PutEndpointsRequest = named("PutEndpointsRequest", PutEndpointsRequestSchema);
-export const ListEndpointsResponse = named("ListEndpointsResponse", ListEndpointsResponseSchema);
-export const DeleteEndpointResponse = named("DeleteEndpointResponse", DeleteEndpointResponseSchema);
-export const EndpointPingResponse = named("EndpointPingResponse", EndpointPingResponseSchema);
-export const DeliveryHeartbeatResponse = named("DeliveryHeartbeatResponse", DeliveryHeartbeatResponseSchema);
-export const ActionOutcome = named("ActionOutcome", ActionOutcomeSchema);
 export const SessionCommand = named("SessionCommand", SessionCommandSchema);
 export const AcceptedResponse = named("AcceptedResponse", AcceptedResponseSchema);
-export const ActionResultReceipt = named("ActionResultReceipt", ActionResultReceiptSchema);
 export const ListAgentsResponse = named("ListAgentsResponse", ListAgentsResponseSchema);
 export const ListPublicAgentsResponse = named("ListPublicAgentsResponse", ListPublicAgentsResponseSchema);
 export const PutAgentRequest = named("PutAgentRequest", PutAgentRequestSchema);
@@ -47,7 +43,7 @@ export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsRe
 export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
 export const SessionView = named("SessionView", SessionViewSchema);
 export const LiveEvent = named("LiveEvent", LiveEventSchema);
-/** `action.delivery_failed` → `ActionDeliveryFailedEvent`. */
+/** `sandbox.state` → `SandboxStateEvent`. */
 export function eventComponentName(type) {
     return `${type
         .split(/[._]/)
@@ -80,19 +76,21 @@ export const CreateCredentialRequest = named("CreateCredentialRequest", CreateCr
 export const CredentialInfo = named("CredentialInfo", CredentialInfoSchema);
 export const ListCredentialsResponse = named("ListCredentialsResponse", ListCredentialsResponseSchema);
 export const RotateCredentialRequest = named("RotateCredentialRequest", RotateCredentialRequestSchema);
+export const StartOAuthRequest = named("StartOAuthRequest", StartOAuthRequestSchema);
+export const StartOAuthResponse = named("StartOAuthResponse", StartOAuthResponseSchema);
 export const DeletedResponse = named("DeletedResponse", DeletedResponseSchema);
 export const Jwks = named("Jwks", JwksSchema);
-export const CreateTokenRequest = named("CreateTokenRequest", CreateTokenRequestSchema);
-export const CreateTokenResponse = named("CreateTokenResponse", CreateTokenResponseSchema);
-export const AccessPolicyResponse = named("AccessPolicyResponse", AccessPolicyResponseSchema);
-export const PutAccessPolicyRequest = named("PutAccessPolicyRequest", PutAccessPolicyRequestSchema);
 export const SigningKeyList = named("SigningKeyList", SigningKeyListSchema);
 export const SigningKeyView = named("SigningKeyView", SigningKeyViewSchema);
 export const RotateSigningKeysRequest = named("RotateSigningKeysRequest", RotateSigningKeysRequestSchema);
 export const RevokeSigningKeyRequest = named("RevokeSigningKeyRequest", RevokeSigningKeyRequestSchema);
-export const ListPublishableKeysResponse = named("ListPublishableKeysResponse", ListPublishableKeysResponseSchema);
-export const PublishableKey = named("PublishableKey", PublishableKeySchema);
-export const CreatePublishableKeyRequest = named("CreatePublishableKeyRequest", CreatePublishableKeyRequestSchema);
-export const UpdatePublishableKeyRequest = named("UpdatePublishableKeyRequest", UpdatePublishableKeyRequestSchema);
-export const RevokeSubjectRequest = named("RevokeSubjectRequest", RevokeSubjectRequestSchema);
-export const RevokeSubjectResponse = named("RevokeSubjectResponse", RevokeSubjectResponseSchema);
+export const SessionListItem = named("SessionListItem", SessionListItemSchema);
+export const ModelCall = named("ModelCall", ModelCallSchema);
+export const SessionPage = named("SessionPage", SessionPageSchema.extend({ sessions: z.array(SessionListItem) }));
+export const SessionManifestView = named("SessionManifestView", SessionManifestViewSchema);
+export const HistoryPage = named("HistoryPage", HistoryPageSchema.extend({ items: z.array(SessionEvent) }));
+export const SessionUsageTotals = named("SessionUsageTotals", SessionUsageTotalsSchema);
+export const ModelCallsPage = named("ModelCallsPage", ModelCallsPageSchema.extend({ calls: z.array(ModelCall) }));
+export const ModelCallExportPage = named("ModelCallExportPage", ModelCallExportPageSchema.extend({ calls: z.array(ModelCall) }));
+export const SandboxPage = named("SandboxPage", SandboxPageSchema.extend({ sandboxes: z.array(SandboxView) }));
+export const MeResponse = named("MeResponse", MeResponseSchema);

package/dist/api/gate/routes.d.ts

@@ -3,9 +3,9 @@ import type { ModelCallHandler } from "../../gates/handler.js";
 import { type InflightCalls } from "../../gates/inflight.js";
 import type { McpHandler } from "../../gates/mcp-handler.js";
 import type { ToolCalls } from "../../gates/tool-calls.js";
+import type { HttpOutcome, HttpToolCall } from "../../gates/http-tool.js";
 import type { Keys } from "../../keys/keys.js";
 import type { Logger } from "../../tenant/types.js";
-import { type OutboundPolicy } from "../../tenant/outbound.js";
 import type { RunClaims, RunTokenVerdict } from "../../tenant/run-token.js";
 /** How the gateway checks a run token: its signature and claims, then its lease (G4). */
 export interface RunTokenCheck {
@@ -14,7 +14,7 @@ export interface RunTokenCheck {
     stale(claims: RunClaims): Promise<string | undefined>;
 }
 export interface GatesAppOptions {
-    /** Core's credential (`NYLORUN_GATES_TOKEN`): keys, deliveries, MCP requests outside a run. */
+    /** Core's credential (`NYLORUN_GATES_TOKEN`): keys, MCP requests outside a run. */
     readonly token: string;
     /** Checks run tokens (F5): the credential of model calls and a session's MCP requests. */
     readonly runs: RunTokenCheck;
@@ -28,17 +28,16 @@ export interface GatesAppOptions {
     readonly maxBodyBytes?: number;
     /** Remote MCP servers (F4.1). Without it the MCP routes answer 404. */
     readonly mcp?: McpHandler;
-    /** Keyed MCP calls, which outlive their client and run once (F4.1 G3). Needs `mcp`. */
+    /** HTTP tool calls (R2 M3). Without it the HTTP calls route answers 404. */
+    readonly http?: {
+        call(tenantId: string | undefined, call: HttpToolCall, signal: AbortSignal): Promise<HttpOutcome>;
+    };
+    /** Keyed MCP and HTTP tool calls, which outlive their client and run once (F4.1 G3). */
     readonly toolCalls?: ToolCalls;
     /** The keys service's operations (F4.2). Without it the keys route answers 404. */
     readonly keys?: () => Promise<Keys>;
     /** Logs the keys service's requests and refused credentials. */
     readonly logger?: Logger;
-    /**
-     * How the gate may call Action endpoints (the gateway's own `NYLORUN_ENDPOINT_*`), for
-     * deliveries (F4.1). Without it the delivery route answers 404.
-     */
-    readonly delivery?: OutboundPolicy;
 }
 /** The verified run token of a request on a run route; absent under core's credential. */
 type GateEnv = {

package/dist/api/gate/routes.js

@@ -1,7 +1,7 @@
 /**
  * The gates service's HTTP routes (blueprint §15, P1.1): the Model Gate's IR endpoint, the Tool
- * Gate's remote MCP and delivery routes (F4.1), the keys service (F4.2), and the health and
- * readiness probes. Internal, so they are not in the published OpenAPI documents. The wire
+ * Gate's remote MCP routes (F4.1) and HTTP tool route (R2 M3), the keys service
+ * (F4.2), and the health and readiness probes. Internal, so they are not in the published OpenAPI documents. The wire
  * formats are `gates/contract.ts` and `gates/tool-contract.ts`.
  *
  * Two credentials (F5, gate trust):
@@ -9,9 +9,8 @@
  * | Route | Accepts | Scope from |
  * | --- | --- | --- |
  * | `POST /nylorun/v1/model-calls`, its cancel | run token | the token |
- * | `POST /nylorun/v1/tool-calls`, its cancel; `mcp/connect`, `mcp/list`, `mcp/close` | run token, or core's | the token; the body only for core's |
+ * | `POST /nylorun/v1/tool-calls`, its cancel; `mcp/connect`, `mcp/list`, `mcp/close`; `http-calls` | run token, or core's | the token; the body only for core's |
  * | `POST /nylorun/v1/keys/:operation` | core's | — |
- * | `POST /nylorun/v1/deliveries` | core's | — |
  *
  * Core's credential is `NYLORUN_GATES_TOKEN`, which only the runtime container holds. A run
  * token (`tenant/run-token.ts`) names one lease of one session's turn: a call under it must
@@ -25,8 +24,7 @@ import { isTenantId } from "@nylorun/core/compatibility";
 import { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, TENANT_HEADER, } from "../../gates/contract.js";
 import { InflightConflict, InflightStale } from "../../gates/inflight.js";
 import { mountKeysRoutes } from "./keys.js";
-import { DELIVERIES_PATH, DELIVERY_HEADERS, DeliveryBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "../../gates/tool-contract.js";
-import { post } from "../../tenant/outbound.js";
+import { HTTP_CALLS_PATH, HttpCallBodySchema, MAX_TOOL_BODY_BYTES, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, McpListBodySchema, McpServerBodySchema, TOOL_CALLS_PATH, ToolCallBodySchema, } from "../../gates/tool-contract.js";
 import { looksLikeToken } from "../../tenant/jwt.js";
 import { adminKeyMatches } from "../../host/http.js";
 import { canonical } from "../../store/canonical.js";
@@ -119,26 +117,30 @@ export function createGatesApp(options) {
         return { ok: true, tenantId, body: parsed.data };
     }
     /**
-     * The MCP server a request names, in its session: a run token's session (a body naming
-     * another is refused), or, under core's credential, the body's.
+     * The MCP server or HTTP tool a request names, in its session: a run token's session (a body
+     * naming another is refused), or, under core's credential, the body's.
      */
-    function serverOf(c, server) {
+    function sessionOf(c, ref, field) {
         const claims = c.get("run");
         if (claims) {
-            if (server.sessionId !== undefined && server.sessionId !== claims.sessionId)
+            if (ref.sessionId !== undefined && ref.sessionId !== claims.sessionId)
                 return {
                     ok: false,
                     response: c.json(gateError("gate_forbidden", "The run token is for another session"), 403),
                 };
-            return { ok: true, server: { ...server, sessionId: claims.sessionId } };
+            return { ok: true, ref: { ...ref, sessionId: claims.sessionId } };
         }
-        if (server.sessionId === undefined)
+        if (ref.sessionId === undefined)
             return {
                 ok: false,
-                response: c.json(invalid("server.sessionId is required with core's credential"), 400),
+                response: c.json(invalid(`${field}.sessionId is required with core's credential`), 400),
             };
-        return { ok: true, server: server };
+        return { ok: true, ref: ref };
     }
+    const serverOf = (c, server) => {
+        const scoped = sessionOf(c, server, "server");
+        return scoped.ok ? { ok: true, server: scoped.ref } : scoped;
+    };
     /** The run a keyed call belongs to, for the in-flight map (G4). */
     const ownerOf = (c) => {
         const claims = c.get("run");
@@ -159,6 +161,7 @@ export function createGatesApp(options) {
             logger,
         });
     const mcp = options.mcp;
+    const toolCalls = options.toolCalls;
     if (mcp) {
         const scoped = run({ live: true, orCore: true });
         app.post(MCP_CONNECT_PATH, scoped, toolBodies, async (c) => {
@@ -190,15 +193,6 @@ export function createGatesApp(options) {
             await mcp.close(server.server);
             return c.body(null, 204);
         });
-        const toolCalls = options.toolCalls;
-        app.post(`${TOOL_CALLS_PATH}/:key/cancel`, run({ live: false, orCore: true }), (c) => {
-            if (tenantOf(c) === false)
-                return badTenant(c);
-            const owner = ownerOf(c);
-            if (toolCalls && !toolCalls.cancel(c.req.param("key"), owner?.sessionId))
-                return c.json(gateError("gate_forbidden", "The call is another session's"), 403);
-            return c.body(null, 204);
-        });
         app.post(TOOL_CALLS_PATH, scoped, toolBodies, async (c) => {
             const request = await read(c, ToolCallBodySchema);
             if (!request.ok)
@@ -213,7 +207,7 @@ export function createGatesApp(options) {
                 // Keyed: the call runs under its own signal, once, and outlives this request (G3). The
                 // hash covers the session, so a re-send joins only its own session's call.
                 const answer = key && toolCalls
-                    ? await untilAborted(toolCalls.run(request.tenantId, key, createHash("sha256").update(canonical(body)).digest("hex"), body, ownerOf(c)), signal)
+                    ? await untilAborted(toolCalls.run(request.tenantId, key, createHash("sha256").update(canonical(body)).digest("hex"), (own) => mcp.call(request.tenantId, body, own), ownerOf(c)), signal)
                     : await mcp.call(request.tenantId, body, signal);
                 if (signal.aborted)
                     return new Response(null, { status: 499 });
@@ -229,39 +223,51 @@ export function createGatesApp(options) {
             }
         });
     }
-    const policy = options.delivery;
-    if (policy) {
-        app.post(DELIVERIES_PATH, core, toolBodies, async (c) => {
-            const request = await read(c, DeliveryBodySchema);
+    const http = options.http;
+    if (http) {
+        app.post(HTTP_CALLS_PATH, run({ live: true, orCore: true }), toolBodies, async (c) => {
+            const request = await read(c, HttpCallBodySchema);
             if (!request.ok)
                 return request.response;
-            const { url, body, headers, timeoutMs } = request.body;
-            const forwarded = {};
-            for (const [name, value] of Object.entries(headers)) {
-                if (!DELIVERY_HEADERS.has(name.toLowerCase()))
-                    return c.json(invalid(`A delivery may not carry the header ${name}`), 400);
-                forwarded[name] = value;
-            }
-            const signal = c.req.raw.signal;
-            const result = await post(url, body, forwarded, {
-                policy,
-                signal: AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]),
-            });
-            if (signal.aborted)
-                return new Response(null, { status: 499 });
-            const answer = {
-                result: result.kind === "response"
-                    ? {
-                        kind: "response",
-                        status: result.status,
-                        headers: result.headers,
-                        body: result.body.toString("base64"),
-                    }
-                    : result,
+            const tool = sessionOf(c, request.body.tool, "tool");
+            if (!tool.ok)
+                return tool.response;
+            // A run token's turn is the call's: it names the request's `Nylorun-Turn-Id`.
+            const call = {
+                ...request.body,
+                tool: tool.ref,
+                turnId: c.get("run")?.turnId ?? request.body.turnId,
             };
-            return c.json(answer);
+            const signal = c.req.raw.signal;
+            const key = c.req.header("idempotency-key");
+            try {
+                // Keyed: runs once under its own signal and outlives this request, as an MCP call.
+                const answer = key && toolCalls
+                    ? await untilAborted(toolCalls.run(request.tenantId, key, createHash("sha256").update(canonical(call)).digest("hex"), async (own) => ({ ok: true, result: await http.call(request.tenantId, call, own) }), ownerOf(c)), signal)
+                    : { ok: true, result: await http.call(request.tenantId, call, signal) };
+                if (signal.aborted)
+                    return new Response(null, { status: 499 });
+                return c.json(answer);
+            }
+            catch (error) {
+                const refused = refusedJoin(c, error);
+                if (refused)
+                    return refused;
+                if (signal.aborted)
+                    return new Response(null, { status: 499 });
+                throw error;
+            }
         });
     }
+    if (mcp || http)
+        app.post(`${TOOL_CALLS_PATH}/:key/cancel`, run({ live: false, orCore: true }), (c) => {
+            if (tenantOf(c) === false)
+                return badTenant(c);
+            const owner = ownerOf(c);
+            if (toolCalls && !toolCalls.cancel(c.req.param("key"), owner?.sessionId))
+                return c.json(gateError("gate_forbidden", "The call is another session's"), 403);
+            return c.body(null, 204);
+        });
     app.post(`${MODEL_CALLS_PATH}/:key/cancel`, run({ live: false }), (c) => {
         // Optional, as on a call: the gate serves one Tenant, so the key alone names the call.
         if (tenantOf(c) === false)

package/dist/api/http/app.d.ts

@@ -1,3 +1,9 @@
+/**
+ * The Tenant API as a Hono app: one for every open Tenant, which arrives with each request as
+ * the `tenant` binding. Every route is declared once (`define.ts`) in `routes/`, `../ag-ui/`
+ * and `../a2a/`. A request no route matches exactly is authenticated like any other, then
+ * answered `404 Route not found`.
+ */
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { AuthScope, TenantContext } from "../../tenant/context.js";
 import type { NodeBindings } from "../../tenant/types.js";

package/dist/api/http/app.js

@@ -1,16 +1,23 @@
+/**
+ * The Tenant API as a Hono app: one for every open Tenant, which arrives with each request as
+ * the `tenant` binding. Every route is declared once (`define.ts`) in `routes/`, `../ag-ui/`
+ * and `../a2a/`. A request no route matches exactly is authenticated like any other, then
+ * answered `404 Route not found`.
+ */
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
-import { fail } from "../../tenant/http.js";
 import { a2aRoutes } from "../a2a/endpoint.js";
 import { agUiRoutes } from "../ag-ui/endpoint.js";
-import { authenticateCaller, declaredRoute, pathSegments } from "./define.js";
+import { declaredRoute, pathSegments, routeNotFound } from "./define.js";
 import { jsonResponse, rejectionOf } from "./respond.js";
 import { accessRoutes } from "./routes/access.js";
-import { endpointRoutes } from "./routes/endpoints.js";
-import { actionRoutes } from "./routes/actions.js";
+import { meRoutes } from "./routes/me.js";
 import { sandboxRoutes } from "./routes/sandboxes.js";
 import { artifactRoutes } from "./routes/artifacts.js";
+import { readRoutes } from "./routes/reads.js";
 import { sessionRoutes } from "./routes/sessions.js";
+import { fileRoutes } from "./routes/files.js";
+import { keyRoutes } from "./routes/keys.js";
 import { tenantRoutes } from "./routes/tenant.js";
 import { vaultRoutes } from "./routes/vaults.js";
 let app;
@@ -23,31 +30,29 @@ export function findTenantRoute(method, segments) {
     tenantApi();
     return declaredRoute(method, segments);
 }
-/** No route: authenticated first, so an unknown credential stays the opaque 404. */
-async function notFound(c) {
-    await authenticateCaller(c);
-    return fail(404, "Route not found");
-}
 function build() {
     const api = new OpenAPIHono();
-    // Hono serves HEAD with the GET route; the Tenant API has no HEAD routes.
-    api.use(async (c, next) => (c.req.method === "HEAD" ? await notFound(c) : await next()));
+    // Hono serves HEAD with the GET route; only the declared HEAD routes answer one.
+    api.use(async (c, next) => c.req.method === "HEAD" && !declaredRoute("HEAD", pathSegments(c.env.incoming))
+        ? await routeNotFound(c)
+        : await next());
     // A malformed path is rejected before anything else reads it.
     api.use(async (c, next) => {
         pathSegments(c.env.incoming);
         await next();
     });
-    actionRoutes(api);
-    endpointRoutes(api);
     sessionRoutes(api);
+    fileRoutes(api);
     sandboxRoutes(api);
     artifactRoutes(api);
     tenantRoutes(api);
+    keyRoutes(api);
     vaultRoutes(api);
     accessRoutes(api);
+    meRoutes(api);
     agUiRoutes(api);
     a2aRoutes(api);
-    api.notFound(notFound);
+    api.notFound(routeNotFound);
     api.onError((error, c) => {
         const { outgoing } = c.env;
         // Once a response has started, the rejection can only end it.
@@ -58,5 +63,6 @@ function build() {
         const rejection = rejectionOf(error);
         return jsonResponse(rejection.status, rejection.body, rejection.headers);
     });
+    readRoutes(api);
     return api;
 }

package/dist/api/http/define.d.ts

@@ -2,29 +2,32 @@
  * How a Tenant API route is declared: once, with who may call it, for serving and for the
  * OpenAPI document.
  *
- * `RouteAccess` says which credentials a route takes, which subject scopes reach it and
- * whether browsers may call it: the one statement of who may call a route. The document shows
- * it as the operation's `security`, its `Nylorun-*` headers and `x-nylorun-*` fields; the Host
- * answers browser preflights from it (`findTenantRoute`). Serving runs the Tenant's checks in
- * order: the browser client, the bearer, the subject's scopes, then the handler, which parses
- * its body.
+ * `RouteAccess` says which credentials a route takes and which subject scopes reach it: the one
+ * statement of who may call a route. The document shows it as the operation's `security`, its
+ * `Nylorun-*` headers and `x-nylorun-*` fields. Serving runs the Tenant's checks in order: the
+ * bearer, the subject's scopes, then the handler, which parses its body. The Runtime sends no
+ * CORS headers: a browser reaches it through the operator's proxy, with a trusted issuer's
+ * token.
  */
 import type { IncomingMessage } from "node:http";
 import type { OpenAPIHono, RouteConfig } from "@hono/zod-openapi";
 import type { Context, Handler } from "hono";
 import type { SubjectScope } from "@nylorun/core/contracts";
+import { type KeyAccess } from "../../tenant/auth.js";
 import type { AuthScope } from "../../tenant/context.js";
 import type { TenantEnv } from "./app.js";
-export type Credential = "application" | "subject" | "token" | "publishable" | "delivery";
+/**
+ * A route's credentials. `application` and `subject` are an application key, alone or acting
+ * for a person; `management` a management key (the Management API, protocol 8); `token` a
+ * trusted issuer's JWT.
+ */
+export type Credential = "application" | "subject" | "management" | "token";
 export interface RouteAccess {
     readonly credentials: readonly Credential[];
     /** The subject scopes that reach the route: any one of them, none (`never`), or all (`any`). */
     readonly scopes: readonly SubjectScope[] | "never" | "any";
-    /** A browser page may call it: its preflight is allowed. */
-    readonly browser?: boolean;
     /**
-     * Public data: a request with no credential at all (no `Authorization`, no `Nylorun-Key`) is
-     * served too. A credential that is sent is still checked, so a wrong one stays the opaque 404.
+     * Public data: a request with no credential at all (no `Authorization`) is served too. A credential that is sent is still checked, so a wrong one stays the opaque 404.
      */
     readonly anonymous?: boolean;
     /**
@@ -40,10 +43,16 @@ export interface RouteAccess {
 }
 /** The route's path segments, decoded, as the Tenant's checks read them. */
 export declare function pathSegments(incoming: IncomingMessage): string[];
-/** Who is calling: the browser client and the bearer, as every Tenant request checks them. */
+/** Who is calling: the bearer, as every Tenant request checks it. */
 export declare function authenticateCaller(c: Context<TenantEnv>, 
 /** The route serves public data (`RouteAccess.anonymous`): no credential is needed. */
-anonymous?: boolean): Promise<AuthScope>;
+anonymous?: boolean, 
+/** The keys the route takes; a Runtime API route's by default. */
+keys?: KeyAccess): Promise<AuthScope>;
+/** No route: authenticated first, so an unknown credential stays the opaque 404. */
+export declare function routeNotFound(c: Context<TenantEnv>): Promise<Response>;
+/** Which keys a route's credentials take. */
+export declare function keyAccess(access: RouteAccess): KeyAccess;
 /** The declared route `method path` is, if any. `{param}` segments match any one segment. */
 export declare function declaredRoute(method: string, segments: readonly string[]): RouteAccess | undefined;
 export declare function tenantRoute(api: OpenAPIHono<TenantEnv>, access: RouteAccess, route: RouteConfig, handler: Handler<TenantEnv>): void;

package/dist/api/http/define.js

@@ -1,15 +1,13 @@
 import { z } from "zod";
 import { PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { authenticate, requireScopes } from "../../tenant/auth.js";
-import { identifyClient } from "../../tenant/browser.js";
 import { fail } from "../../tenant/http.js";
 import { ProtocolRejected, Rejected } from "../components.js";
 const SCHEMES = {
     application: "applicationKey",
     subject: "applicationKey",
-    token: "subjectToken",
-    publishable: "publishableKey",
-    delivery: "deliveryToken",
+    management: "managementKey",
+    token: "issuerToken",
 };
 const rejected = (description) => ({
     description,
@@ -29,17 +27,32 @@ export function pathSegments(incoming) {
         }
     });
 }
-/** Who is calling: the browser client and the bearer, as every Tenant request checks them. */
+/** Who is calling: the bearer, as every Tenant request checks it. */
 export async function authenticateCaller(c, 
 /** The route serves public data (`RouteAccess.anonymous`): no credential is needed. */
-anonymous = false) {
-    const { tenant, incoming, outgoing } = c.env;
-    // The client app first: a browser's origin is checked, and CORS headers set, before the
-    // bearer is looked at, so every answer from here on is readable by an allowed page.
-    const client = await identifyClient(tenant, incoming, outgoing);
-    if (anonymous && !client && incoming.headers.authorization === undefined)
+anonymous = false, 
+/** The keys the route takes; a Runtime API route's by default. */
+keys) {
+    const { tenant, incoming } = c.env;
+    if (anonymous && incoming.headers.authorization === undefined)
         return { kind: "anonymous" };
-    return await authenticate(tenant, incoming, client);
+    return await authenticate(tenant, incoming, keys);
+}
+/** No route: authenticated first, so an unknown credential stays the opaque 404. */
+export async function routeNotFound(c) {
+    // Any known key, of either API, learns only that there is no such route.
+    await authenticateCaller(c, false, { application: true, management: true });
+    return fail(404, "Route not found");
+}
+/** Which keys a route's credentials take. */
+export function keyAccess(access) {
+    const takes = (credential) => access.credentials.includes(credential);
+    // Only a Management API route turns an application key away for its role; elsewhere the
+    // route's own checks answer as they always have.
+    return {
+        application: takes("application") || takes("subject") || !takes("management"),
+        management: takes("management"),
+    };
 }
 const declared = [];
 /** The declared route `method path` is, if any. `{param}` segments match any one segment. */
@@ -51,16 +64,8 @@ export function declaredRoute(method, segments) {
 }
 function authenticated(access) {
     return async (c, next) => {
-        const scope = await authenticateCaller(c, access.anonymous === true);
+        const scope = await authenticateCaller(c, access.anonymous === true, keyAccess(access));
         requireScopes(scope, access.scopes);
-        if (scope.kind === "publishable" && !access.credentials.includes("publishable"))
-            fail(403, "A publishable key alone reaches only the agent list", {
-                code: "scope_required",
-            });
-        // Handlers tell callers apart by kind, and a delivery token is none of theirs: only the
-        // routes that list it may see one.
-        if (scope.kind === "delivery" && !access.credentials.includes("delivery"))
-            fail(403, "A delivery token reaches only its Action's callbacks");
         c.set("scope", scope);
         await next();
     };
@@ -83,14 +88,6 @@ export function tenantRoute(api, access, route, handler) {
                     .meta({ description: "The subject's space-separated scopes; required with a subject" }),
             }
             : {}),
-        ...(takes("publishable")
-            ? {
-                "Nylorun-Key": z
-                    .string()
-                    .optional()
-                    .meta({ description: "A publishable key, from a browser page on an allowed origin" }),
-            }
-            : {}),
     });
     api.openAPIRegistry.registerPath({
         ...route,
@@ -102,22 +99,29 @@ export function tenantRoute(api, access, route, handler) {
         request: { ...route.request, headers },
         responses: {
             400: rejected("Invalid headers, path, body or cursor"),
-            ...(takes("token") ? { 401: rejected("The subject token expired or was revoked (`token_expired`)") } : {}),
-            403: rejected("Not allowed for this credential, subject scope or origin"),
+            ...(takes("token")
+                ? {
+                    401: rejected("The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)"),
+                }
+                : {}),
+            403: rejected(takes("management")
+                ? "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject"
+                : "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)"),
             404: rejected("Not found, or a credential the Tenant does not know (`not_found`)"),
             426: { description: "`Nylorun-Protocol` missing or unsupported", content: { "application/json": { schema: ProtocolRejected } } },
-            ...(takes("token") ? { 429: rejected("The subject's turn limits are reached (`limit_exceeded`)") } : {}),
             503: rejected("The Tenant's storage or streams are unavailable"),
             ...route.responses,
         },
         "x-nylorun-credentials": access.credentials,
         "x-nylorun-scopes": access.scopes,
-        "x-nylorun-browser": access.browser === true,
-    });
-    declared.push({
-        method: route.method.toUpperCase(),
-        segments: route.path.split("/").filter(Boolean),
-        access,
     });
-    api.on(route.method.toUpperCase(), route.path.replaceAll(/\/{(.+?)}/g, "/:$1"), authenticated(access), handler);
+    const method = route.method.toUpperCase();
+    declared.push({ method, segments: route.path.split("/").filter(Boolean), access });
+    const path = route.path.replaceAll(/\/{(.+?)}/g, "/:$1");
+    // Hono answers a HEAD request with the GET route: a HEAD route is served there, and a GET of
+    // its path is no route.
+    if (method === "HEAD")
+        api.on("GET", path, async (c, next) => (c.req.method === "HEAD" ? await next() : await routeNotFound(c)), authenticated(access), handler);
+    else
+        api.on(method, path, authenticated(access), handler);
 }

package/dist/api/http/routes/access.d.ts

@@ -1,24 +1,8 @@
 /**
- * Access management (Host feature `subject-tokens`), for the application key only: subject
- * tokens, the access policy, signing keys, publishable keys and subject revocation; and the
- * public keys, for any caller that reached the Tenant.
- *
- * Subjects travel in bodies, not paths, because they may be email addresses and request paths
- * are logged.
+ * Signing keys, for a management key, and the public keys, for any caller that reached the
+ * Tenant: the Runtime signs capability links, run and host tokens with them (protocol 7 has no
+ * subject tokens, access policy, browser keys or revocations).
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { PublishableKey as PublishableKeyBody } from "@nylorun/core/contracts";
-import type { PublishableKeyRow } from "../../../store/types.js";
-import type { TenantContext } from "../../../tenant/context.js";
 import type { TenantEnv } from "../app.js";
 export declare function accessRoutes(api: OpenAPIHono<TenantEnv>): void;
-/** A publishable key as the API shows it. */
-export declare function publishableKeyView(row: PublishableKeyRow): PublishableKeyBody;
-/**
- * Ends every token of `subject` minted so far: bumps its epoch, then ends its open streams
- * here and, through `tenant/control`, on every other process. Running turns continue.
- */
-export declare function revokeSubject(ctx: TenantContext, subject: string): Promise<{
-    subject: string;
-    epoch: number;
-}>;