@nylorun/runtime 0.17.0-beta → 0.19.0-beta

package/dist/tenant/commands.js

@@ -7,80 +7,26 @@
  *
  * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
  * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
- * (every accepted one writes a new checkpoint segment). An Action's outcome
- * (`recordActionOutcome`, from the deliverer) wakes with
- * `action_result:<turnId>:<actionId>:<generation>`.
+ * (every accepted one writes a new checkpoint segment), except that a workflow's `approve` and
+ * `respond` name `<type>:<turnId>:<interactionId>`: a flow resumes in the same segment.
  *
  * Cancel commits `cancelled` first; the engine host sees it before its next effect and before
  * settlement on any Worker. It then aborts an advance running on this process
  * (`ctx.abortLocal`); reaching an advance on another process is the control stream's job.
  */
 import { randomUUID } from "node:crypto";
-import { createDurableCheckpoint, createFlowCheckpoint, } from "@nylorun/harness/run";
-import { schemaFromJSON, } from "@nylorun/core/define";
-import { commandKey, fenceWorkflowActions, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeForQueuedEffects, wakeLinkedWorkflow, } from "../core/flow-host.js";
+import { createDurableCheckpoint, createFlowCheckpoint, resumeFlowCheckpoint, } from "@nylorun/harness/run";
+import { commandKey, cancelQueuedEffects, flowInteractionOf, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { resolveMessageManifest } from "../core/turn-manifest.js";
 import { canonical } from "../store/canonical.js";
 import { lockedSession, } from "./context.js";
 import { fail } from "./http.js";
 import { accessOf } from "./auth.js";
 import { checkSandboxTurn } from "./sandboxes.js";
-import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
-import { signalActionOutcome, signalSessionCancel } from "./streams.js";
-import { toolIds } from "./transcript.js";
+import { rebaseSessionState, turnManifestOf, variantStore } from "./session.js";
+import { signalSessionCancel } from "./streams.js";
 import { slimModelEffects } from "./slim.js";
 import { resolveMessageParts } from "../artifacts/parts.js";
-/** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
-export function acceptedOutcome(action, outcome) {
-    if (action.kind !== "tool" || !action.outputSchema)
-        return outcome;
-    const value = outcome.value;
-    // Only a result carries output: failures, denials, interactions and deferrals pass as sent.
-    if (!isResultToolValue(value))
-        return outcome;
-    // Endpoints wrap successful tool output as `{ kind: "completed", output }`.
-    // Validate the tool payload, not the outcome envelope.
-    const candidate = completedToolOutput(value);
-    let matches = false;
-    try {
-        matches = schemaFromJSON(action.outputSchema).validate(candidate).ok;
-    }
-    catch {
-        matches = false;
-    }
-    if (matches)
-        return outcome;
-    return {
-        ...outcome,
-        value: {
-            kind: "failed",
-            code: "tool.invalid-output",
-            message: "Tool result does not match the output schema stored on the action",
-        },
-    };
-}
-function completedToolOutput(value) {
-    if (value &&
-        typeof value === "object" &&
-        !Array.isArray(value) &&
-        value.kind === "completed" &&
-        "output" in value) {
-        return value.output;
-    }
-    return value;
-}
-const NON_RESULT_KINDS = new Set([
-    "failed",
-    "denied",
-    "interaction-required",
-    "deferred",
-]);
-function isResultToolValue(value) {
-    return !(!!value &&
-        typeof value === "object" &&
-        !Array.isArray(value) &&
-        NON_RESULT_KINDS.has(value.kind));
-}
 /** A command's identity for idempotency: everything but the request id. */
 const semantic = (value) => {
     const { requestId: _, ...body } = value;
@@ -120,28 +66,12 @@ export async function command(ctx, id, input, scope) {
                 turnId: cancelledTurnId,
             });
             s.status = "cancelled";
-            if (workflowCancel) {
-                await fenceWorkflowActions({
+            if (workflowCancel)
+                await cancelQueuedEffects({
                     t,
                     workflowSessionId: id,
                     turnId: cancelledTurnId,
                 });
-            }
-            else if (cancelledTurnId !== null) {
-                for (const a of await t.actionsForSession(id, {
-                    turnId: cancelledTurnId,
-                    statuses: ["pending", "delivering"],
-                })) {
-                    // Delivered work may already have an external effect. Preserve it for reconciliation.
-                    a.status = a.status === "pending" ? "cancelled" : "uncertain";
-                    await t.put("actions", a.actionId, a);
-                    const effect = await t.get("effects", a.actionId);
-                    if (effect) {
-                        effect.status = a.status;
-                        await t.put("effects", a.actionId, effect);
-                    }
-                }
-            }
             if (cancelledTurnId !== null)
                 for (const effect of await t.effectsForTurn(id, cancelledTurnId, ["invoking"])) {
                     effect.status = "uncertain";
@@ -235,6 +165,28 @@ export async function command(ctx, id, input, scope) {
                     }
                 }
             }
+            else if (isWorkflowManifest(s.manifest)) {
+                // Approvals owned by linked agent sessions must be answered there (WF-R52).
+                const conflict = await foreignInteractionConflict({
+                    t,
+                    workflowSessionId: id,
+                    interactionId: command.interactionId,
+                });
+                if (conflict)
+                    fail(409, conflict.message);
+                if (s.status !== "paused" || !s.checkpoint || !s.activeTurnId)
+                    fail(409, "Session is not awaiting a response");
+                // The flow's own interactions: a tool node that asked (`ctx.approve`, `ctx.ask`).
+                const asked = flowInteractionOf(s.waits, id, command.interactionId);
+                if (!asked)
+                    fail(409, "Unknown interaction");
+                else if ((command.type === "approve") !== (asked.kind === "approval"))
+                    fail(409, "Interaction response kind does not match the saved request");
+                // Same segment: the flow replays its journal and runs the tool again with the answer.
+                s.checkpoint = resumeFlowCheckpoint(s.checkpoint, command.interactionId, command.type === "approve"
+                    ? { kind: "approval", approved: command.approved }
+                    : { kind: "response", value: command.value });
+            }
             else {
                 if (s.status !== "paused" || !s.state || !s.activeTurnId)
                     fail(409, "Session is not awaiting a response");
@@ -255,19 +207,6 @@ export async function command(ctx, id, input, scope) {
                         interactionId: command.interactionId,
                         value: command.value,
                     };
-                if (isWorkflowManifest(s.manifest)) {
-                    // Approvals owned by linked agent sessions must be answered there (WF-R52).
-                    const conflict = await foreignInteractionConflict({
-                        t,
-                        workflowSessionId: id,
-                        interactionId: command.interactionId,
-                    });
-                    if (conflict)
-                        fail(409, conflict.message);
-                    // Workflow-owned interactions (tool-node / verify) resume on this session once
-                    // the flow engine supports pause segments; tracer root Loop has none yet.
-                    fail(409, "Workflow sessions do not accept approve/respond on the root without a pending interaction");
-                }
                 s.checkpoint = createDurableCheckpoint({
                     manifest: turnManifestOf(s),
                     sessionId: id,
@@ -280,9 +219,13 @@ export async function command(ctx, id, input, scope) {
             }
             s.status = "runnable";
             s.waits = undefined;
+            // A flow answers each interaction in the same segment: the interaction names the cause.
+            const cause = command.type !== "message" && isWorkflowManifest(s.manifest)
+                ? command.interactionId
+                : s.checkpoint.segment;
             const commandWake = {
                 reason: command.type,
-                dedupeKey: `${command.type}:${s.activeTurnId}:${s.checkpoint.segment}`,
+                dedupeKey: `${command.type}:${s.activeTurnId}:${cause}`,
             };
             t.afterCommit(() => ctx.wake(id, commandWake));
             event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
@@ -326,83 +269,3 @@ export async function command(ctx, id, input, scope) {
     }
     return response;
 }
-/**
- * Completes a delivered Action with `outcome`, in the caller's transaction, which
- * holds the lock of the Action's session `s`: the Action and its effect, the
- * `action.completed` event (and `loop.verified` or `loop.decided`), the wake that resumes the
- * turn, and queued workflow effects. The Action deliverer and the background-result callback
- * both record outcomes here. It sets `s.status`; the caller writes `s`.
- */
-export async function recordActionOutcome(t, ctx, s, action, received, options = {}) {
-    const outcome = acceptedOutcome(action, received);
-    const prior = await t.get("effects", action.actionId);
-    action.status = "completed";
-    await t.put("actions", action.actionId, action);
-    prior.status = "completed";
-    prior.outcome = outcome;
-    s.status = "runnable";
-    const resultWake = {
-        reason: "action_result",
-        dedupeKey: `action_result:${action.turnId}:${action.actionId}:${action.generation}`,
-    };
-    t.afterCommit(() => ctx.wake(s.id, resultWake));
-    // A run held while the Action was pending goes on with it in the same lease (F6.2): here, or
-    // on the process whose harness holds it. The wake finds the session settled, or resumes it
-    // by replay when the run had already ended.
-    t.afterCommit(() => {
-        if (ctx.harness.holds(s.id))
-            ctx.harness.resolved(s.id, action.actionId, outcome);
-        else
-            signalActionOutcome(ctx, s.id, action.actionId);
-    });
-    const event = await t.event(s.id, s.activeTurnId, "action.completed", {
-        actionId: action.actionId,
-        ...actionTarget(action),
-        kind: action.kind,
-        ...(action.kind === "tool" ? toolIds(action.context) : {}),
-        result: outcome.value,
-    });
-    if (action.kind === "verify") {
-        const verdict = outcome.value;
-        if (verdict?.kind !== "failed") {
-            await t.event(s.id, s.activeTurnId, "loop.verified", {
-                path: String(action.context?.loopPath ?? action.path ?? ""),
-                n: Number(action.context?.n ?? 1),
-                pass: Boolean(verdict?.pass),
-                ...(verdict?.feedback !== undefined
-                    ? { feedback: verdict.feedback }
-                    : {}),
-                ...(verdict?.data !== undefined ? { data: verdict.data } : {}),
-            });
-        }
-    }
-    else if (action.kind === "fn" && action.context?.role === "decide") {
-        const decision = outcome.value;
-        await t.event(s.id, s.activeTurnId, "loop.decided", {
-            path: String(action.context?.loopPath ?? action.path ?? ""),
-            n: Number(action.context?.n ?? 1),
-            next: "output" in decision && !("input" in decision)
-                ? "output"
-                : "input",
-            patched: Boolean(decision.agent),
-        });
-    }
-    const receipt = {
-        status: "accepted",
-        turnId: s.activeTurnId,
-        cursor: event.cursor,
-        ...(options.requestId === undefined ? {} : { requestId: options.requestId }),
-    };
-    prior.receipt = receipt;
-    await t.put("effects", action.actionId, prior);
-    if (isWorkflowManifest(s.manifest) && s.activeTurnId) {
-        await wakeForQueuedEffects({
-            t,
-            workflowSessionId: s.id,
-            turnId: s.activeTurnId,
-            limits: ctx.flowLimits,
-            schedule: ctx.wake,
-        });
-    }
-    return { event, receipt };
-}

package/dist/tenant/context.d.ts

@@ -5,8 +5,7 @@
  *
  * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
  * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
- * commit), deliveries through `t.afterCommit(() => ctx.deliver(actionId))`, and advances through
- * `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
+ * commit), and advances through `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
  * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
  * tx.
  *
@@ -72,7 +71,6 @@ export interface Session {
     creation: unknown;
     vaultIds?: readonly string[];
     credentialSelections?: readonly CredentialSelection[];
-    pluginRoots?: Readonly<Record<string, string>>;
     mcpSnapshot?: McpSnapshot;
     mcpDiagnostics?: readonly McpDiagnostic[];
     /** Session id that keys the shared sandbox; absent means this session owns it. */
@@ -95,6 +93,15 @@ export type AuthScope = {
     kind: "application";
     principalId: string;
 }
+/**
+ * A management key (role `management`), or Studio's key on a Management API route: the
+ * principal acting as itself, never for a subject. It reaches only the Management API
+ * (`/v1/tenant/*`) and `/v1/me`.
+ */
+ | {
+    kind: "management";
+    principalId: string;
+}
 /**
  * A trusted issuer's token (Host feature `trusted-issuers`, F9-D12): one subject, with the
  * issuer's scopes, agents and sandbox grants, until `expiresAt` (ms). Only its expiry ends it.
@@ -125,21 +132,9 @@ export type AuthScope = {
 /** No credential, on a route that serves public data (`RouteAccess.anonymous`). */
  | {
     kind: "anonymous";
-}
-/**
- * A delivery token (Action endpoints): the Runtime's own token for one delivery of one
- * Action, presented back by the Action endpoint on that Action's callbacks only.
- */
- | {
-    kind: "delivery";
-    actionId: string;
-    agentId: string;
-    generation: number;
-    expiresAt: number;
-    tokenId: string;
-    keyId: string;
 };
 export interface TenantContext {
+    readonly reads?: import("../reads/types.js").ReadStore;
     readonly config: TenantConfig;
     readonly envelope: TenantEnvelope;
     readonly store: SessionStore;
@@ -166,8 +161,8 @@ export interface TenantContext {
     /** Serves vault-backed model calls (blueprint §15): in this process, or the gates service. */
     readonly modelGate: ModelGate;
     /**
-     * Serves remote MCP servers and Action deliveries (blueprint §12, F4.1): in this process, or
-     * the gates service.
+     * Serves remote MCP servers and HTTP tools (blueprint §12, F4.1): in this process, or the
+     * gates service.
      */
     readonly toolGate: ToolGate;
     /**
@@ -206,7 +201,7 @@ export interface TenantContext {
     readonly work: WorkState;
     /** Live delivery over Durable Streams: one `SessionStream` per observed session, and the streams wiring. */
     readonly sessionStreams: SessionStreams;
-    /** The Tenant's signing keys: delivery tokens, capability links, run and host tokens. */
+    /** The Tenant's signing keys: capability links, run and host tokens. */
     readonly signingKeys: SigningKeys;
     /** The Worker id this process writes as session `owner` (§10.6). */
     readonly workerId: string;
@@ -223,11 +218,6 @@ export interface TenantContext {
      * an advance of that turn (a cancel signal names the turn it cancelled).
      */
     abortLocal(sessionId: string, turnId?: string): void;
-    /**
-     * Seam: deliver an Action to its agent's Action endpoint (`DurableExecution.deliver`). Call it
-     * from `t.afterCommit`. Dropped while the Tenant is closing; the sweep re-sends it.
-     */
-    deliver(actionId: string): Promise<void>;
     /**
      * Sandbox pods (F7.2): the sandboxes service and the Runtime image pods copy the engine from.
      * Absent without a cluster (`nylorun sandbox enable`): kind `pod` is `sandbox_unavailable`.

package/dist/tenant/definition-files.d.ts

@@ -0,0 +1,24 @@
+import { type DefinitionFileView } from "@nylorun/core/contracts";
+import type { BlobStore } from "../blob/index.js";
+import type { Tx } from "../store/types.js";
+import type { TenantContext } from "./context.js";
+/** Where a definition file's bytes are in the Object store. */
+export declare function definitionFileKey(sha256: string): string;
+/** Whether the Tenant holds definition file `file` (`sha256:<hex>`). */
+export declare function hasDefinitionFile(ctx: TenantContext, file: string): Promise<boolean>;
+/**
+ * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ */
+export declare function putDefinitionFile(ctx: TenantContext, file: string, request: {
+    body: ReadableStream<Uint8Array> | null;
+    declaredBytes?: number;
+    contentType?: string;
+}, signal?: AbortSignal): Promise<{
+    status: 200 | 201;
+    view: DefinitionFileView;
+}>;
+/** The definition files `document` names that the Tenant does not hold, in order. */
+export declare function missingDefinitionFiles(t: Tx, document: unknown): Promise<string[]>;
+/** A definition file's bytes, or undefined when the Object store does not have them. */
+export declare function readDefinitionFile(blobs: BlobStore, sha256: string, signal?: AbortSignal): Promise<Uint8Array | undefined>;

package/dist/tenant/definition-files.js

@@ -0,0 +1,103 @@
+/**
+ * Definition files (track R2 M4): the files a definition names by the SHA-256 of their bytes,
+ * today a skill's folder (`SkillManifest.files`). A client uploads each one once
+ * (`PUT /v1/files/sha256:<hex>`); its bytes go to the Object store at
+ * `definitions/sha256/<hex>`, and a `definition_files` row says the Tenant holds it. A
+ * definition naming a file the Tenant does not hold is refused (`definition_files_missing`).
+ * The Runtime reads them to serve the skill tools and to give a sandbox the skills' files.
+ *
+ * Files are never deleted here: `definition_file_uses` records which definition version names
+ * which file, for a later sweep.
+ */
+import { createHash } from "node:crypto";
+import { DEFINITION_FILE_MAX_BYTES, definitionFilesOf, isDefinitionFileHash, } from "@nylorun/core/contracts";
+import { fail } from "./http.js";
+/** Where a definition file's bytes are in the Object store. */
+export function definitionFileKey(sha256) {
+    return `definitions/sha256/${sha256.slice("sha256:".length)}`;
+}
+function checkHash(file) {
+    if (!isDefinitionFileHash(file))
+        fail(400, "A definition file is named sha256:<64 lowercase hex>", { code: "invalid_request" });
+    return file;
+}
+/** Whether the Tenant holds definition file `file` (`sha256:<hex>`). */
+export async function hasDefinitionFile(ctx, file) {
+    const sha256 = checkHash(file);
+    return (await ctx.store.tx((t) => t.definitionFile(sha256))) !== undefined;
+}
+/** The body, at most `DEFINITION_FILE_MAX_BYTES`; past it, `413 limit_exceeded`. */
+async function readBody(body, declared) {
+    const tooLarge = () => fail(413, `A definition file may hold at most ${DEFINITION_FILE_MAX_BYTES} bytes`, {
+        code: "limit_exceeded",
+        details: { limitBytes: DEFINITION_FILE_MAX_BYTES },
+    });
+    if (declared !== undefined && declared > DEFINITION_FILE_MAX_BYTES) {
+        await body?.cancel().catch(() => undefined);
+        tooLarge();
+    }
+    if (body === null)
+        return new Uint8Array();
+    const chunks = [];
+    let size = 0;
+    const reader = body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > DEFINITION_FILE_MAX_BYTES) {
+            await reader.cancel().catch(() => undefined);
+            tooLarge();
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * Stores the bytes of definition file `file`: `201` when they are new, `200` when the Tenant
+ * holds them already (the body is not read). Bytes that do not hash to `file` are a `400`.
+ */
+export async function putDefinitionFile(ctx, file, request, signal) {
+    const sha256 = checkHash(file);
+    const held = await ctx.store.tx((t) => t.definitionFile(sha256));
+    if (held) {
+        await request.body?.cancel().catch(() => undefined);
+        return { status: 200, view: { sha256, size: held.size } };
+    }
+    const bytes = await readBody(request.body, request.declaredBytes);
+    const actual = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    if (actual !== sha256)
+        fail(400, `The body's SHA-256 is ${actual}, not ${sha256}: upload a file at its own hash`, {
+            code: "invalid_request",
+            details: { expected: sha256, actual },
+        });
+    // The key is the content's hash: a concurrent upload of the same file writes the same bytes.
+    await ctx.blobs.put(definitionFileKey(sha256), bytes, {
+        ...(request.contentType === undefined ? {} : { contentType: request.contentType }),
+        ...(signal ? { signal } : {}),
+    });
+    const inserted = await ctx.store.tx((t) => t.insertDefinitionFile({
+        sha256,
+        kind: "skill",
+        size: bytes.byteLength,
+        contentType: request.contentType ?? null,
+        createdAt: new Date().toISOString(),
+    }));
+    return { status: inserted ? 201 : 200, view: { sha256, size: bytes.byteLength } };
+}
+/** The definition files `document` names that the Tenant does not hold, in order. */
+export async function missingDefinitionFiles(t, document) {
+    const named = [...definitionFilesOf(document)].sort();
+    if (named.length === 0)
+        return [];
+    const held = await t.heldDefinitionFiles(named);
+    return named.filter((sha256) => !held.has(sha256));
+}
+/** A definition file's bytes, or undefined when the Object store does not have them. */
+export async function readDefinitionFile(blobs, sha256, signal) {
+    const got = await blobs.get(definitionFileKey(sha256), signal ? { signal } : {});
+    if (!got)
+        return undefined;
+    return new Uint8Array(await new Response(got.body).arrayBuffer());
+}

package/dist/tenant/effects.d.ts

@@ -1,18 +1,20 @@
 /**
  * Core's side of effects: `resolveNewFlowEffect` journals and dispatches new workflow effects
- * (linked agent sessions, tool nodes, fn, verify); the takeover helpers say which calls their
- * gate recovers. Also vault authorization for MCP servers. The journal of a run's effects is
- * `harness-api/record.ts`; a harness readies the session's MCP servers itself (`session.mcp`).
+ * (linked agent sessions; a tool node without `http` fails, as it would run the developer's
+ * code); the takeover helpers say which calls their gate recovers. Also vault authorization
+ * for MCP servers and HTTP tools. The journal of a run's effects is `harness-api/record.ts`; a
+ * harness readies the session's MCP servers itself (`session.mcp`).
  *
  * Every journal write runs in a transaction that locks the effect's session first and checks
  * the advance's ownership epoch (`ownedSession`): after another Worker takes over, the next
- * write throws `ownership.lost` and nothing is written. The model, MCP, sandbox and vault
+ * write throws `ownership.lost` and nothing is written. The model, MCP, HTTP, sandbox and vault
  * calls run between transactions, never inside one.
  */
-import type { ActionOutcome } from "@nylorun/core/contracts";
+import type { EffectOutcome } from "@nylorun/core/contracts";
 import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
 import type { Tx } from "../store/types.js";
 import type { AuthorizeResult } from "../vault/service.js";
+import type { McpCredentialRequest } from "../vault/sources.js";
 import { type Lease, type Session, type TenantContext } from "./context.js";
 /**
  * The outcome of a flow `agent` effect once the linked turn it started ended, or undefined
@@ -21,29 +23,25 @@ import { type Lease, type Session, type TenantContext } from "./context.js";
 export declare function linkedOutcome(t: Tx, effect: {
     request: HostEffect;
     agentSessionId?: string;
-}, agent: Session | undefined): Promise<ActionOutcome | undefined>;
+}, agent: Session | undefined): Promise<EffectOutcome | undefined>;
 /**
- * True when this Tenant's remote MCP calls outlive the process that sent them (the gates
- * service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent and joins
- * the running call or gets its answer, instead of becoming `uncertain`.
+ * True when this Tenant's remote MCP and HTTP tool calls outlive the process that sent them
+ * (the gates service, F4.1 G3): after a takeover or a shutdown, the journaled call is re-sent
+ * and joins the running call or gets its answer, instead of becoming `uncertain`.
  */
-export declare function recoversMcpCalls(ctx: TenantContext): boolean;
-/** True when `request` calls a tool of a remote (`streamable-http` or `sse`) MCP server. */
-export declare function isRemoteMcpEffect(s: Session, request: HostEffect): boolean;
+export declare function recoversToolCalls(ctx: TenantContext): boolean;
+/** True when `request` calls a tool of a declared MCP server (every one is remote) or an HTTP tool. */
+export declare function isGateToolEffect(s: Session, request: HostEffect): boolean;
 /**
  * True when this Tenant's vault-backed model calls outlive the process that sent them (the
  * gates service, P1.2): after a takeover or a shutdown, the journaled call is re-sent and joins
  * the running call or gets its outcome, instead of becoming `uncertain`.
  */
 export declare function recoversModelCalls(ctx: TenantContext): boolean;
-/** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
+/** Journal and dispatch a new flow effect (agent or tool node). */
 export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
 /**
- * The credential of an MCP server request made on behalf of a session: from its attached vaults,
- * else the operator's credential resolver (`vault/sources.ts`).
+ * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
+ * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
  */
-export declare function authorize(ctx: TenantContext, sessionId: string, request: {
-    url: string;
-    serverName?: string;
-    agentId?: string;
-}): Promise<AuthorizeResult>;
+export declare function authorize(ctx: TenantContext, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;