@nylorun/runtime 0.17.0-beta → 0.19.1-beta

package/dist/store/types.d.ts

@@ -14,7 +14,7 @@
  *    error `fn` threw.
  * 2. **Session-scoped writes lock the session row first.** `lockSession` takes
  *    a row lock (`SELECT … FOR UPDATE`) held until the transaction ends. Effect
- *    intent and outcome, Action transitions, checkpoint settlement and event
+ *    intent and outcome, checkpoint settlement and event
  *    writes for one session are serialized through it. Idempotency comparisons
  *    (`canonical(...)`) run inside the same locked transaction. `event` and the
  *    ownership methods take the lock themselves.
@@ -25,7 +25,7 @@
  *    generation, `streams/basin.ts`), and the cursor is
  *    `base64url("<sessionId>:<seq>")` (see `record/cursor.ts`).
  * 4. **No external I/O inside `fn`.** No model, tool, MCP, sandbox, Restate or
- *    S2 call, and no `fetch`, runs inside a transaction. Wakes and deliveries go
+ *    S2 call, and no `fetch`, runs inside a transaction. Wakes go
  *    through `afterCommit`, and events are delivered to commit listeners after
  *    commit (seam rule 1 and 2).
  * 5. **No nested transactions.** Calling `store.tx` from inside `fn` rejects.
@@ -45,29 +45,28 @@
  * ## Typed queries, no scans
  *
  * There is no generic table scan. Every read the Runtime needs is a typed
- * method on `Tx` (`sessionsWithStatus`, `expiredDeliveries`, `pendingActions`,
- * `effectsForTurn`, `linkedSessions`, `counts`, …) that an implementation can
- * back with an index, and principals, endpoints, vaults and Tenant settings
+ * method on `Tx` (`sessionsWithStatus`, `effectsForTurn`, `linkedSessions`,
+ * `counts`, …) that an implementation can back with an index, and principals,
+ * vaults and Tenant settings
  * have their own methods rather than raw SQL outside the store. Session history
  * is not read from the store: every event is written to the record (Postgres
  * `nylorun_streams.session_events`) in its transaction, the stream relay
  * (`streams/relay/`) feeds Durable Streams from it, and history and SSE read
  * them there (`tenant/session-streams.ts`).
  */
+import type { KeyRole } from "@nylorun/core/compatibility";
 import type { RecordReader } from "../streams/relay/types.js";
-import type { Action, EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
+import type { EventPayload, EventType, LiveEvent, SandboxEvent, SandboxEventPayload, SandboxEventType, SandboxKind, SandboxPodDesired, SandboxPodObserved, SessionEventOf } from "@nylorun/core/contracts";
 import type { SandboxManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { ArtifactRow, ArtifactVersionRow, ModelBudgetRow, ModelUsageRow, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow } from "./postgres/schema.js";
+import type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, PrincipalRow, ToolCrossingRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow } from "./postgres/schema.js";
 /** Tables holding JSON documents keyed by `id`. */
-export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "actions" | "sandboxes" | "links";
+export type DocTable = "definitions" | "sessions" | "commands" | "effects" | "sandboxes" | "links";
 export declare const DOC_TABLES: readonly DocTable[];
 /** Session lifecycle (architecture §10.2). */
 export type SessionStatus = "idle" | "runnable" | "running" | "waiting" | "paused" | "uncertain" | "completed" | "failed" | "cancelled";
 /** Effect states (§10.3), plus the flow host's `queued` and `cancelled`. */
 export type EffectStatus = "pending" | "invoking" | "completed" | "uncertain" | "queued" | "cancelled";
-export type ActionStatus = Action["status"];
-export type ActionKind = Action["kind"];
 export type EffectKind = HostEffect["kind"];
 /**
  * Ownership of a session by a Worker (§10.6). Read with the session; written
@@ -103,8 +102,6 @@ export interface EffectDoc {
     request: HostEffect;
     status: EffectStatus | (string & {});
 }
-/** Actions are stored as the wire `Action`. Indexed: `sessionId`, `turnId`, `agentId`, `status`, `kind`, `deadlineAt`. */
-export type ActionDoc = Action;
 /** A workflow → agent session link, keyed by the linked agent session id. Indexed: `workflowSessionId`. */
 export interface LinkDoc {
     workflowSessionId: string;
@@ -192,59 +189,13 @@ export interface BasinGenerations {
     retired: number[];
 }
 export type CommitListener = (commit: Commit) => void;
-/**
- * An Action endpoint: the URL the Runtime delivers one agent's Actions to, and what recent
- * deliveries and the last ping say about it.
- */
-export interface EndpointRow {
-    agentId: string;
-    url: string;
-    implementationVersion: string;
-    manifestHash?: string;
-    timeoutMs: number;
-    maxConcurrent: number;
-    /** Application principal that registered it, when known. */
-    principalId?: string;
-    lastDeliveryAt?: string;
-    lastSuccessAt?: string;
-    lastErrorCode?: string;
-    lastErrorMessage?: string;
-    consecutiveFailures: number;
-    /** What the endpoint reported serving on the last ping. */
-    servedImplementationVersion?: string;
-    servedManifestHash?: string;
-    createdAt: string;
-    updatedAt: string;
-}
-/** The registration part of an endpoint, as `putEndpoint` writes it. */
-export type EndpointRegistrationRow = Pick<EndpointRow, "agentId" | "url" | "implementationVersion" | "manifestHash" | "timeoutMs" | "maxConcurrent" | "principalId" | "updatedAt">;
-/** One observation about an endpoint (`recordEndpointHealth`). */
-export type EndpointHealthUpdate = 
-/** A delivery was answered. */
-{
-    kind: "success";
-    at: string;
-}
-/** A delivery failed: not reached, refused, or lost. */
- | {
-    kind: "failure";
-    at: string;
-    code: string;
-    message: string;
-}
-/** A ping was answered with what the endpoint serves. */
- | {
-    kind: "served";
-    implementationVersion: string;
-    manifestHash?: string;
-};
 /**
  * The rows of the typed tables, inferred from the tables Drizzle defines
  * (`store/postgres/schema.ts`): a principal, a vault and its credentials (secrets sealed in
  * `bytea` columns, never inside a JSON body), the vault's audit and idempotency records, the
  * Tenant's signing keys, a model call in the usage ledger and a model budget.
  */
-export type { ArtifactRow, ArtifactVersionRow, ModelBudgetRow, ModelUsageRow, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow, };
+export type { ArtifactRow, ArtifactVersionRow, DefinitionFileRow, ModelBudgetRow, ModelUsageRow, ModelUsageWrite, ToolCrossingRow, PrincipalRow, SigningKeyRow, VaultAuditRow, VaultCredentialRow, VaultIdempotencyRow, VaultRow, OAuthPendingRow, };
 /** Which rows of the usage ledger a total covers. */
 export interface ModelUsageQuery {
     scope: "tenant" | "agent" | "turn";
@@ -265,18 +216,11 @@ export interface SessionEffectFilter {
     turnId?: string;
     statuses?: readonly (EffectStatus | (string & {}))[];
 }
-export interface SessionActionFilter {
-    /** Only this turn. Absent means every turn. */
-    turnId?: string;
-    statuses?: readonly ActionStatus[];
-}
 /** Counts used by Tenant status, `summary` and `drain`. */
 export interface StoreCounts {
     sessions: number;
     /** Sessions `running` or `runnable`. */
     runningSessions: number;
-    /** Actions `pending` or `delivering`. */
-    pendingActions: number;
     /** Effects `uncertain`. */
     uncertainEffects: number;
     sandboxes: number;
@@ -439,18 +383,6 @@ export interface Tx {
         fromSeq?: number;
         limit?: number;
     }): Promise<SandboxEvent[]>;
-    /** One agent's `pending` actions, delivered when its endpoint is registered. */
-    pendingActions(agentId: string): Promise<ActionDoc[]>;
-    /** How many of one agent's actions are `delivering` (Action endpoints). */
-    deliveringCount(agentId: string): Promise<number>;
-    /** `pending` actions of agents that have an Action endpoint, by id. */
-    pendingActionsWithEndpoint(limit: number): Promise<ActionDoc[]>;
-    /** `delivering` actions whose deadline is at or before `now`, earliest first. */
-    expiredDeliveries(now: Date, limit: number): Promise<ActionDoc[]>;
-    actionsForSession(sessionId: string, filter?: SessionActionFilter): Promise<ActionDoc[]>;
-    actionsWithStatus(statuses: readonly ActionStatus[], filter?: {
-        kinds?: readonly ActionKind[];
-    }): Promise<ActionDoc[]>;
     /** `invoking` effects of one session; takeover turns them `uncertain`. */
     invokingEffects<T extends EffectDoc = EffectDoc>(sessionId: string): Promise<T[]>;
     effectsForSession<T extends EffectDoc = EffectDoc>(sessionId: string, filter?: SessionEffectFilter): Promise<T[]>;
@@ -464,29 +396,19 @@ export interface Tx {
     basinGenerations(): Promise<BasinGenerations>;
     /** Forgets a retired generation once its basin is deleted. */
     forgetRetiredGeneration(generation: number): Promise<void>;
-    listEndpoints(): Promise<EndpointRow[]>;
-    getEndpoint(agentId: string): Promise<EndpointRow | undefined>;
-    /**
-     * Inserts or updates by `agentId`, keeping `createdAt`. Health is kept, except that a new
-     * `url` starts with none.
-     */
-    putEndpoint(row: EndpointRegistrationRow): Promise<void>;
-    deleteEndpoint(agentId: string): Promise<void>;
-    /** Records one observation. Nothing happens when the endpoint does not exist. */
-    recordEndpointHealth(agentId: string, update: EndpointHealthUpdate): Promise<void>;
     /** Rejects when the id or token hash already exists. */
     insertPrincipal(row: PrincipalRow): Promise<void>;
     principalByTokenHash(tokenHash: string): Promise<PrincipalRow | undefined>;
     principalById(id: string): Promise<PrincipalRow | undefined>;
-    applicationTokenHashes(): Promise<string[]>;
     /** Every principal, ordered by id. */
     listPrincipals(): Promise<PrincipalRow[]>;
     /**
-     * Creates application principal `id` with `tokenHash`, or gives an existing one this hash
-     * (and `createdAt`): its previous key stops authenticating. Rejects when another principal
-     * holds the hash.
+     * Creates principal `id` with `tokenHash` and `role` (default `application`), or gives an
+     * existing one this hash (and `createdAt`): its previous key stops authenticating. Rejects
+     * when another principal holds the hash, and with `PrincipalRoleConflict` when `id` holds
+     * another role.
      */
-    putPrincipal(id: string, tokenHash: string, createdAt: string): Promise<PrincipalRow>;
+    putPrincipal(id: string, tokenHash: string, createdAt: string, role?: KeyRole): Promise<PrincipalRow>;
     /** Deletes principal `id`; false when there was none. */
     deletePrincipal(id: string): Promise<boolean>;
     /** Rejects on a duplicate id, or a second `host` vault. */
@@ -545,7 +467,7 @@ export interface Tx {
     setSigningKeyState(id: string, from: SigningKeyRow["state"], to: SigningKeyRow["state"], at: string): Promise<boolean>;
     countSigningKeys(): Promise<number>;
     /** Appends a row, setting `duplicate` when one with the same `effectKey` exists; returns it. */
-    recordModelUsage(row: Omit<ModelUsageRow, "duplicate">): Promise<ModelUsageRow>;
+    recordModelUsage(row: ModelUsageWrite): Promise<ModelUsageRow>;
     modelUsageTotals(query: ModelUsageQuery): Promise<ModelUsageTotals>;
     /** Every budget, ordered by scope, then scope id. */
     listModelBudgets(): Promise<ModelBudgetRow[]>;
@@ -607,16 +529,25 @@ export interface Tx {
     artifactContentShas(scope: "sessions" | "all" | {
         artifactId: string;
     }): Promise<string[]>;
+    /** The definition file `sha256` (`sha256:<hex>`) names, once its bytes are stored. */
+    definitionFile(sha256: string): Promise<DefinitionFileRow | undefined>;
+    /** Records a stored definition file; false when the Tenant held it already. */
+    insertDefinitionFile(row: DefinitionFileRow): Promise<boolean>;
+    /** Those of `shas` the Tenant holds. */
+    heldDefinitionFiles(shas: readonly string[]): Promise<Set<string>>;
+    /** Records that version `manifestHash` of definition `agentId` names each of `shas`. */
+    insertDefinitionFileUses(agentId: string, manifestHash: string, shas: readonly string[]): Promise<void>;
     getSetting(key: string): Promise<string | undefined>;
     putSetting(key: string, value: string): Promise<void>;
     /**
      * Deletes Tenant state by scope, in this transaction:
-     * - `sessions`: sessions, commands, effects, actions, links, the artifacts of sessions (their blobs are the caller's to delete) and the
+     * - `sessions`: sessions, commands, effects, links, the artifacts of sessions (their blobs are the caller's to delete) and the
      *   Tenant's record rows and log heads. The Tenant moves to the next basin
      *   generation and the current one is retired, so session ids it frees start again in an
      *   empty basin;
      * - `sandboxes`: sandbox records, sandbox resources and their lifecycle streams;
-     * - `all`: both, plus definitions, Action endpoints, user vaults with their credentials,
+     * - `all`: both, plus definitions (and which definition files they use),
+     *   user vaults with their credentials,
      *   the model usage ledger, the model budgets and Tenant-wide artifacts. The host vault, principals, signing keys,
      *   settings, audit and vault idempotency rows stay.
      */

package/dist/store/types.js

@@ -3,7 +3,6 @@ export const DOC_TABLES = [
     "sessions",
     "commands",
     "effects",
-    "actions",
     "sandboxes",
     "links",
 ];

package/dist/streams/control.d.ts

@@ -6,8 +6,6 @@
 import { type DurableStreams } from "./types.js";
 /** Appends a `session.cancel` signal: the process running the session's advance aborts it. */
 export declare function signalCancel(streams: DurableStreams, basin: string, sessionId: string, turnId?: string): Promise<void>;
-/** Appends an `action.resolved` signal: a run held for the Action goes on with its outcome. */
-export declare function signalActionResolved(streams: DurableStreams, basin: string, sessionId: string, actionId: string): Promise<void>;
 /**
  * Appends a `sessions.reset` signal to the old generation's basin: every process with the
  * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.

package/dist/streams/control.js

@@ -15,11 +15,6 @@ export async function signalCancel(streams, basin, sessionId, turnId) {
     };
     await streams.append(basin, CONTROL_STREAM, [signal]);
 }
-/** Appends an `action.resolved` signal: a run held for the Action goes on with its outcome. */
-export async function signalActionResolved(streams, basin, sessionId, actionId) {
-    const signal = { type: "action.resolved", sessionId, actionId };
-    await streams.append(basin, CONTROL_STREAM, [signal]);
-}
 /**
  * Appends a `sessions.reset` signal to the old generation's basin: every process with the
  * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.

package/dist/streams/types.d.ts

@@ -138,13 +138,4 @@ export interface SessionsResetSignal {
     type: "sessions.reset";
     generation?: number;
 }
-/**
- * An Action of `sessionId` has its outcome (F6.2): the process whose harness holds the
- * session's run while the Action is pending passes it on (`effect.resolved`).
- */
-export interface ActionResolvedSignal {
-    type: "action.resolved";
-    sessionId: string;
-    actionId: string;
-}
-export type ControlSignal = SessionCancelSignal | SessionsResetSignal | ActionResolvedSignal;
+export type ControlSignal = SessionCancelSignal | SessionsResetSignal;

package/dist/tenant/advance.d.ts

@@ -9,12 +9,12 @@ export declare function advance(ctx: TenantContext, id: string, signal: AbortSig
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
  * owner's `invoking` effects become `uncertain` and are never invoked again, except model
- * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
- * G3): those stay `invoking`, and the replay re-sends them. When one belongs
+ * calls when the gate recovers them (P1.2) and remote MCP and HTTP tool calls when the Tool
+ * Gate does (F4.1 G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
 export declare function takeOver(t: Tx, s: Session, options?: {
     recoversModelCalls?: boolean;
-    recoversMcpCalls?: boolean;
+    recoversToolCalls?: boolean;
 }): Promise<string[]>;

package/dist/tenant/advance.js

@@ -42,8 +42,7 @@
 import { runDurable, runFlowDurable, } from "@nylorun/harness/run";
 import { aggregateWaits, cancelSiblingWork, isWorkflowManifest, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { isOwnershipLost, ownedTx } from "../store/ownership.js";
-import { linkedAgentOutput } from "./session.js";
-import { isRemoteMcpEffect, recoversMcpCalls, recoversModelCalls } from "./effects.js";
+import { isGateToolEffect, recoversModelCalls, recoversToolCalls } from "./effects.js";
 import { slimModelEffects } from "./slim.js";
 import { applyUpdates, leanState, transcriptShadow, withTranscript, } from "./history.js";
 import { command } from "./commands.js";
@@ -232,7 +231,7 @@ async function takeOwnership(ctx, id) {
         if (taken.takeover)
             await takeOver(t, s, {
                 recoversModelCalls: recoversModelCalls(ctx),
-                recoversMcpCalls: recoversMcpCalls(ctx),
+                recoversToolCalls: recoversToolCalls(ctx),
             });
         if (!s.checkpoint || !["running", "runnable"].includes(s.status)) {
             await t.releaseOwnership(id, lease.owner, lease.epoch);
@@ -246,8 +245,8 @@ async function takeOwnership(ctx, id) {
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
  * owner's `invoking` effects become `uncertain` and are never invoked again, except model
- * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
- * G3): those stay `invoking`, and the replay re-sends them. When one belongs
+ * calls when the gate recovers them (P1.2) and remote MCP and HTTP tool calls when the Tool
+ * Gate does (F4.1 G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
@@ -257,7 +256,7 @@ export async function takeOver(t, s, options = {}) {
         // Still running at the gate, or finished there: the replay re-sends it (P1.2).
         if (options.recoversModelCalls && effect.request.kind === "model")
             continue;
-        if (options.recoversMcpCalls && isRemoteMcpEffect(s, effect.request))
+        if (options.recoversToolCalls && isGateToolEffect(s, effect.request))
             continue;
         effect.status = "uncertain";
         effect.error ??= "The Worker running this effect stopped before its outcome was recorded";
@@ -390,7 +389,7 @@ async function wakeWorkflowOf(ctx, t, agent, turnId, type, payload) {
             agentSessionId: agent.id,
             turnId,
             output: type === "turn.completed"
-                ? linkedAgentOutput(agent, payload.output)
+                ? payload.output ?? null
                 : undefined,
             failed: type === "turn.failed",
             error: type === "turn.failed"
@@ -526,9 +525,13 @@ async function settle(ctx, lease, s, result, updates = [], cursor) {
                 ? {
                     interactions: (result.result.pending ?? []).map((call) => ({
                         invocationId: call.invocationId,
+                        ...(typeof call.callId === "string" ? { callId: call.callId } : {}),
                         interaction: call.interaction,
                         wait: call.wait,
                         status: call.status,
+                        // A flow's tool node that asked.
+                        ...(typeof call.path === "string" ? { path: call.path } : {}),
+                        ...(typeof call.toolName === "string" ? { toolName: call.toolName } : {}),
                     })),
                 }
                 : result.status === "failed"

package/dist/tenant/auth.d.ts

@@ -1,17 +1,27 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal, a trusted issuer's token or a delivery token; anything else is the opaque 404
+ * principal or a trusted issuer's token; anything else is the opaque 404
  * (D5). An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`);
  * an issuer token names its subject itself. `requireScopes` limits them to the routes their
  * scopes allow, decided from the route alone.
  *
  * Browsers: a request with `Origin` may carry an issuer token (CORS is the operator's proxy's),
- * never an application key or a delivery token, which are server secrets.
+ * never an application key, which is a server secret.
  */
 import type { IncomingMessage } from "node:http";
-import { type Action, type SubjectScope } from "@nylorun/core/contracts";
+import { type SubjectScope } from "@nylorun/core/contracts";
 import type { AuthScope, SessionAccess, TenantContext } from "./context.js";
-export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
+/**
+ * Which keys a route takes (protocol 8): an application key (alone or acting for a subject) on
+ * the Runtime API, a management key on the Management API. `/v1/me` takes both.
+ */
+export interface KeyAccess {
+    readonly application: boolean;
+    readonly management: boolean;
+}
+/** Every route that does not say otherwise is a Runtime API route. */
+export declare const RUNTIME_KEYS: KeyAccess;
+export declare function authenticate(ctx: TenantContext, request: IncomingMessage, keys?: KeyAccess): Promise<AuthScope>;
 /**
  * What a subject needs for a route: any one of the scopes, nothing grants it (`never`), or
  * any caller may (`any`, public data such as the JWKS). Each route declares it
@@ -28,11 +38,6 @@ export declare function accessOf(scope: AuthScope): SessionAccess | undefined;
 export declare function ownerOf(scope: AuthScope): string | undefined;
 /** The application principal behind the request, acting for a subject or not. */
 export declare function requirePrincipal(scope: AuthScope): string;
-/**
- * The caller may act on `action`: only the delivery token minted for it. Whether its generation
- * is still the Action's is checked by each callback.
- */
-export declare function scoped(scope: AuthScope, action: Action): void;
 /** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
 export declare function mayUseAgent(scope: AuthScope, agentId: string): boolean;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -1,10 +1,9 @@
 import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
-import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
+import { parseSubjectHeaders } from "@nylorun/core/contracts";
 import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
-import { verifyDeliveryToken } from "./delivery-token.js";
 import { verifyIssuerToken } from "./issuers.js";
-import { looksLikeToken, tokenType } from "./jwt.js";
+import { looksLikeToken } from "./jwt.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -17,7 +16,9 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request) {
+/** Every route that does not say otherwise is a Runtime API route. */
+export const RUNTIME_KEYS = { application: true, management: false };
+export async function authenticate(ctx, request, keys = RUNTIME_KEYS) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
@@ -26,16 +27,6 @@ export async function authenticate(ctx, request) {
         });
         return failOpaque();
     }
-    if (looksLikeToken(token) && tokenType(token) === DELIVERY_TOKEN_TYPE) {
-        // Delivery tokens come back from the application's server, never from a browser.
-        if (request.headers.origin !== undefined)
-            fail(403, "Delivery tokens are not accepted from browsers", { code: "origin_rejected" });
-        const scope = await verifyDeliveryToken(ctx, token);
-        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
-            singleHeader(request, SCOPES_HEADER) !== undefined)
-            fail(403, "A delivery token cannot act for a subject");
-        return scope;
-    }
     // A trusted issuer's token (Host feature `trusted-issuers`), from a server or a browser: its
     // unverified `iss` names an issuer of the identity file, and only that issuer verifies it.
     const issuer = ctx.config.issuers?.claimed(token);
@@ -68,6 +59,22 @@ export async function authenticate(ctx, request) {
     // Read only after authentication, so an unknown caller sees the opaque 404 either way.
     const subject = singleHeader(request, SUBJECT_HEADER);
     const scopes = singleHeader(request, SCOPES_HEADER);
+    // A management key acts as itself on the Management API; Studio's key does too on a route
+    // that takes no application key. Neither acts for a subject there.
+    const asManagement = principal.role === "management" || (principal.role === "studio" && !keys.application);
+    if (asManagement) {
+        if (!keys.management)
+            fail(403, "A management key reaches only the Management API (/v1/tenant/*)", {
+                code: "key_role_mismatch",
+            });
+        if (subject !== undefined || scopes !== undefined)
+            fail(403, "A management key acts as itself, never for a subject", SUBJECT_INVALID);
+        return { kind: "management", principalId: principal.id };
+    }
+    if (!keys.application)
+        fail(403, "This is the Management API: it takes a management key, not an application key", {
+            code: "key_role_mismatch",
+        });
     if (subject === undefined) {
         if (scopes !== undefined)
             fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
@@ -108,6 +115,9 @@ export function accessOf(scope) {
     switch (scope.kind) {
         case "application":
             return undefined;
+        // A management key reaches the Management API only: no session is its.
+        case "management":
+            return fail(404, "Not found");
         case "subject":
             return { owner: scope.subject };
         case "token":
@@ -118,9 +128,6 @@ export function accessOf(scope) {
         // A request with no credential, on a route that serves public data, owns nothing.
         case "anonymous":
             return fail(404, "Not found");
-        // A delivery token reaches its Action's callbacks, never a session or vault.
-        case "delivery":
-            return fail(404, "Not found");
         default: {
             const unknown = scope;
             return fail(404, `Unknown credential ${String(unknown.kind)}`);
@@ -137,17 +144,6 @@ export function requirePrincipal(scope) {
         return scope.principalId;
     return fail(403, "Application credential required");
 }
-/**
- * The caller may act on `action`: only the delivery token minted for it. Whether its generation
- * is still the Action's is checked by each callback.
- */
-export function scoped(scope, action) {
-    if (scope.kind === "delivery" &&
-        scope.actionId === action.actionId &&
-        scope.agentId === action.agentId)
-        return;
-    fail(403, "This delivery token is for another Action");
-}
 /** True when a token caller may reach `agentId` (its issuer's allowlist). Other callers always may. */
 export function mayUseAgent(scope, agentId) {
     return scope.kind !== "token" || scope.agents === "*" || scope.agents.has(agentId);

package/dist/tenant/cause.d.ts

@@ -1,8 +1,8 @@
 /**
  * Why the Host's Tenant could not be opened (tenancy.md §5). A cause is about the Tenant's
  * own data or files (its database is newer than this Runtime, its vault key is missing, the
- * database has an old layout): the Host fails readiness, names the cause in
- * `/v1/admin/status` and the logs, and answers Tenant requests with the opaque 404 until it is
+ * database has an old layout): the Host fails readiness, names the cause in the logs (and
+ * `nylorun-operate status` reads it from the database), and answers Tenant requests with the opaque 404 until it is
  * repaired and the Host restarted. A failure outside the Tenant (Postgres unreachable) is not
  * a cause: it is `TenantUnavailableError`, and the next request tries again.
  */
@@ -12,7 +12,7 @@ export type { TenantCause };
 export declare class TenantOpenError extends Error {
     readonly code: TenantCause["code"];
     readonly repair: string;
-    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    /** The Tenant, when it was read before opening failed. */
     envelope?: TenantEnvelope;
     constructor(fields: TenantCause);
     toCause(): TenantCause;

package/dist/tenant/cause.js

@@ -2,7 +2,7 @@
 export class TenantOpenError extends Error {
     code;
     repair;
-    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    /** The Tenant, when it was read before opening failed. */
     envelope;
     constructor(fields) {
         super(fields.message);

package/dist/tenant/commands.d.ts

@@ -1,19 +1,3 @@
-import type { Action, ActionOutcome, LiveEvent, SessionCommand } from "@nylorun/core/contracts";
-import type { Tx } from "../store/types.js";
-import { type AuthScope, type Session, type TenantContext } from "./context.js";
-/** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
-export declare function acceptedOutcome(action: Action, outcome: ActionOutcome): ActionOutcome;
+import type { SessionCommand } from "@nylorun/core/contracts";
+import { type AuthScope, type TenantContext } from "./context.js";
 export declare function command(ctx: TenantContext, id: string, input: SessionCommand, scope: AuthScope): Promise<unknown>;
-/**
- * Completes a delivered Action with `outcome`, in the caller's transaction, which
- * holds the lock of the Action's session `s`: the Action and its effect, the
- * `action.completed` event (and `loop.verified` or `loop.decided`), the wake that resumes the
- * turn, and queued workflow effects. The Action deliverer and the background-result callback
- * both record outcomes here. It sets `s.status`; the caller writes `s`.
- */
-export declare function recordActionOutcome(t: Tx, ctx: TenantContext, s: Session, action: Action, received: ActionOutcome, options?: {
-    requestId?: string;
-}): Promise<{
-    event: LiveEvent;
-    receipt: Record<string, unknown>;
-}>;