@nylorun/runtime 0.17.0-beta → 0.19.1-beta

package/dist/execution/types.d.ts

@@ -27,16 +27,7 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep settles lapsed deliveries and re-wakes
- *   orphaned `runnable` sessions.
- * - **One delivery per Action at a time.** `deliver` runs
- *   `WorkerHandlers.deliver` for the key `<tenantId>:<actionId>` at least once
- *   after it resolves. Two deliveries for one key never overlap; repeated
- *   `deliver` calls may each run it, so the handler reads the Action's state
- *   and does nothing when there is nothing to deliver.
- * - **Retry after `retry`.** A delivery that returns `retry` is run again for
- *   the same key after `retryAfterMs`. This is how an Action endpoint that is
- *   down or busy is retried; the handler throws only on infrastructure errors.
+ *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A
@@ -49,8 +40,6 @@
 export type WakeReason = 
 /** Session commands. */
 "message" | "approve" | "respond"
-/** An Action's outcome was recorded (a delivery's answer or a background result). */
- | "action_result"
 /** A linked agent turn completed, failed or was cancelled. */
  | "linked"
 /** Queued flow effects, pending agent effects reconciled. */
@@ -98,14 +87,6 @@ export interface SandboxResult {
         at: number;
     }[];
 }
-export type DeliverResult = {
-    status: "done";
-}
-/** The Action is still to be delivered; run again for this key after `retryAfterMs`. */
- | {
-    status: "retry";
-    retryAfterMs: number;
-};
 /** What a Worker runs when Durable Session Execution calls it. */
 export interface WorkerHandlers {
     /**
@@ -118,11 +99,6 @@ export interface WorkerHandlers {
     sweep(tenantId: string): Promise<void>;
     /** A durable timer set with `timer` fired. Required when `timer` is used. */
     fire?(tenantId: string, key: string): Promise<void>;
-    /**
-     * Delivers one Action to its Action endpoint. `signal` aborts when the Worker
-     * stops. Throw only on infrastructure errors. Required when `deliver` is used.
-     */
-    deliver?(tenantId: string, actionId: string, signal: AbortSignal): Promise<DeliverResult>;
     /**
      * Reconciles one pod sandbox (F7.2), serialized per sandbox. Throw only on infrastructure
      * errors. Required when `sandbox` is used.
@@ -138,12 +114,6 @@ export interface DurableExecution {
      * implementation can; `fire` must be idempotent either way.
      */
     timer(tenantId: string, key: string, at: Date): Promise<void>;
-    /**
-     * At-least-once: `WorkerHandlers.deliver(tenantId, actionId)` runs after this
-     * resolves, never overlapping another delivery of the same Action. Send it
-     * after the transaction that made the Action pending commits.
-     */
-    deliver(tenantId: string, actionId: string): Promise<void>;
     /**
      * A pod sandbox's reconcile, or one of its timers (F7.2): see "One reconcile per sandbox
      * at a time". Absent where pods are not supported.
@@ -183,7 +153,7 @@ export interface StuckInvocation {
     handler: string;
     /**
      * Object key: `<tenantId>:<sessionId>`, `<tenantId>`, `<tenantId>:<timer key>` or
-     * `<tenantId>:<actionId>`.
+     * `<tenantId>:<sandboxId>`.
      */
     key: string;
     tenantId?: string;
@@ -191,7 +161,7 @@ export interface StuckInvocation {
     lastFailure?: string;
     modifiedAt?: string;
 }
-/** The key one advance (or one delivery, with an Action id) at a time is serialized on. */
+/** The key one advance (or one sandbox reconcile, with a sandbox id) at a time is serialized on. */
 export declare function sessionKey(tenantId: string, sessionId: string): string;
 /** Splits a key made by `sessionKey`. Tenant ids never contain `:`. */
 export declare function parseSessionKey(key: string): {

package/dist/execution/types.js

@@ -27,16 +27,7 @@
  *   becomes `uncertain` is settled in the Session Store and `advance` returns
  *   `done`.
  * - **Sweeps.** `armSweep` arms one self-re-arming sweep per Tenant; arming an
- *   armed Tenant is a no-op. The sweep settles lapsed deliveries and re-wakes
- *   orphaned `runnable` sessions.
- * - **One delivery per Action at a time.** `deliver` runs
- *   `WorkerHandlers.deliver` for the key `<tenantId>:<actionId>` at least once
- *   after it resolves. Two deliveries for one key never overlap; repeated
- *   `deliver` calls may each run it, so the handler reads the Action's state
- *   and does nothing when there is nothing to deliver.
- * - **Retry after `retry`.** A delivery that returns `retry` is run again for
- *   the same key after `retryAfterMs`. This is how an Action endpoint that is
- *   down or busy is retried; the handler throws only on infrastructure errors.
+ *   armed Tenant is a no-op. The sweep re-wakes orphaned `runnable` sessions.
  * - **One reconcile per sandbox at a time** (F7.2). `sandbox` runs
  *   `WorkerHandlers.sandbox` for the key `<tenantId>:<sandboxId>` at least once
  *   after a `reconcile` resolves, never overlapping another run for the key. A
@@ -49,13 +40,12 @@ export const WAKE_REASONS = [
     "message",
     "approve",
     "respond",
-    "action_result",
     "linked",
     "flow",
     "recover",
     "rollover",
 ];
-/** The key one advance (or one delivery, with an Action id) at a time is serialized on. */
+/** The key one advance (or one sandbox reconcile, with a sandbox id) at a time is serialized on. */
 export function sessionKey(tenantId, sessionId) {
     return `${tenantId}:${sessionId}`;
 }

package/dist/gates/http-tool.d.ts

@@ -0,0 +1,86 @@
+import { type HttpToolTarget, type JsonObject, type ToolManifest } from "@nylorun/core/define";
+import type { HostEffect } from "@nylorun/harness/run";
+import { type OutboundPolicy } from "../tenant/outbound.js";
+import type { Logger } from "../tenant/types.js";
+import type { AuthorizeResult } from "../vault/service.js";
+import type { McpCredentialRequest } from "../vault/sources.js";
+import type { TenantVaults } from "./tenant-vaults.js";
+/** How much of a failed answer's body the model sees. */
+export declare const HTTP_ERROR_BODY_CHARS = 2000;
+/** What an HTTP request came to, as a tool outcome. */
+export type HttpOutcome = {
+    readonly kind: "completed";
+    readonly output: unknown;
+} | {
+    readonly kind: "failed";
+    readonly code: string;
+    readonly message: string;
+};
+/**
+ * One declared HTTP tool of a session: what the gate finds it by in the pinned manifest. An
+ * agent's HTTP tool is named by its capability and tool; a flow's HTTP stage or HTTP verifier
+ * by its stage key.
+ */
+export type HttpToolRef = {
+    readonly sessionId: string;
+    /** The agent used as a tool that declares it; absent for the session's root agent. */
+    readonly agentId?: string;
+    readonly capabilityId: string;
+    readonly toolName: string;
+} | {
+    readonly sessionId: string;
+    /** The stage key of a flow's HTTP stage or HTTP verifier. */
+    readonly stage: string;
+};
+/** One call of an HTTP tool. `effectId` is its run-once key, sent as `Idempotency-Key`. */
+export interface HttpToolCall {
+    readonly tool: HttpToolRef;
+    readonly effectId: string;
+    readonly turnId: string;
+    readonly input: unknown;
+}
+/** What `runHttpTool` reads of the Tenant: the session's pinned manifest and its credentials. */
+export interface HttpToolTenant {
+    session(sessionId: string): Promise<{
+        readonly manifest: unknown;
+    } | undefined>;
+    authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
+}
+/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
+export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, capabilityId: string | undefined, toolName: string | undefined): (ToolManifest & {
+    readonly http: HttpToolTarget;
+}) | undefined;
+/** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
+export declare function declaredFlowHttp(manifest: unknown, stage: string | undefined): import("@nylorun/core/define").FlowHttpTarget | undefined;
+/**
+ * True when `request` calls an HTTP tool the session's `manifest` declares, or runs one of a
+ * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
+ */
+export declare function isHttpToolCall(manifest: unknown, request: HostEffect): boolean;
+/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+export declare function httpToolRefOf(request: HostEffect): HttpToolRef;
+/**
+ * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
+ * the request is an outcome. Rejects only when `signal` aborts, with its reason.
+ */
+export declare function callHttpTarget(target: HttpToolTarget, input: unknown, options: {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly policy: OutboundPolicy;
+    readonly signal: AbortSignal;
+    /** Checked against the answer; a mismatch is `tool.invalid-output`. */
+    readonly outputSchema?: JsonObject;
+}): Promise<HttpOutcome>;
+/**
+ * Runs one HTTP tool call of a session: finds the tool in the pinned manifest, adds its vault
+ * credential, the identity headers and the run-once key, and calls it. Never throws but for an
+ * abort of `signal`. Logs one line per call, never the input, the answer or a credential.
+ */
+export declare function runHttpTool(tenant: HttpToolTenant, call: HttpToolCall, options: {
+    readonly policy: OutboundPolicy;
+    readonly signal: AbortSignal;
+    readonly logger?: Logger;
+}): Promise<HttpOutcome>;
+/** The gates service's HTTP tool calls, with the Tenant's vault (`host/gates.ts`). */
+export declare function gateHttpTools(vaults: TenantVaults, policy: OutboundPolicy, logger: Logger): {
+    call: (tenantId: string | undefined, call: HttpToolCall, signal: AbortSignal) => Promise<HttpOutcome>;
+};

package/dist/gates/http-tool.js

@@ -0,0 +1,197 @@
+/**
+ * HTTP tools (R2 M3): a tool the manifest describes as one HTTP request, made by the Tool Gate.
+ * The loop names the tool; the gate finds its URL, method and credential in the session's pinned
+ * manifest, as it finds a remote MCP server, so the loop never chooses a URL or a credential.
+ *
+ * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as a
+ * JSON body under the Host's address policy (`tenant/outbound.ts`), a 2xx answer as the output
+ * (JSON, or text when the answer is not JSON and no output schema asks for JSON), and every other
+ * answer, a timeout or a refused address as a failed outcome the model sees. `runHttpTool` adds
+ * what a tool call needs: the declaration, the vault credential and the identity headers.
+ *
+ * A flow's HTTP stages and HTTP verifiers (R2) are called the same way: the ref names the flow
+ * session and the stage key, and the gate finds the target in the pinned workflow manifest. The
+ * `Nylorun-Agent-Id` is the flow agent's.
+ */
+import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
+import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
+/** How much of a failed answer's body the model sees. */
+export const HTTP_ERROR_BODY_CHARS = 2_000;
+/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
+export function declaredHttpTool(manifest, agentId, capabilityId, toolName) {
+    const root = manifest;
+    if (!root || !Array.isArray(root.capabilities))
+        return undefined;
+    const agent = agentId === undefined ? root : delegateManifest(root, agentId);
+    const tool = agent?.capabilities
+        .find((capability) => capability.id === capabilityId)
+        ?.tools?.find((item) => item.name === toolName);
+    return tool?.http ? tool : undefined;
+}
+/** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
+export function declaredFlowHttp(manifest, stage) {
+    return stage !== undefined && isWorkflowManifest(manifest)
+        ? flowHttpTarget(manifest, stage)
+        : undefined;
+}
+/**
+ * True when `request` calls an HTTP tool the session's `manifest` declares, or runs one of a
+ * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
+ */
+export function isHttpToolCall(manifest, request) {
+    if (request.kind !== "tool")
+        return false;
+    if (request.capabilityId === undefined)
+        return declaredFlowHttp(manifest, request.key) !== undefined;
+    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName) !== undefined;
+}
+/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+export function httpToolRefOf(request) {
+    if (request.capabilityId === undefined)
+        return { sessionId: request.sessionId, stage: request.key };
+    return {
+        sessionId: request.sessionId,
+        ...(request.agent ? { agentId: request.agent.id } : {}),
+        capabilityId: request.capabilityId,
+        toolName: request.toolName,
+    };
+}
+/**
+ * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
+ * the request is an outcome. Rejects only when `signal` aborts, with its reason.
+ */
+export async function callHttpTarget(target, input, options) {
+    const timeoutMs = target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS;
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const result = await post(target.url, JSON.stringify(input ?? {}), { ...options.headers }, {
+        policy: options.policy,
+        method: target.method ?? "POST",
+        signal: AbortSignal.any([options.signal, timeout]),
+    });
+    if (options.signal.aborted)
+        throw options.signal.reason;
+    if (timeout.aborted)
+        return failed("http.timeout", `The service did not answer within ${timeoutMs} ms`);
+    switch (result.kind) {
+        case "not_sent":
+            return result.code === "ENDPOINT_ADDRESS_REFUSED"
+                ? failed("http.refused", result.message)
+                : failed("http.unreachable", `The request was not sent: ${result.message}`);
+        case "lost":
+            return failed("http.lost", `The connection was lost after the request was sent, so the call may have run: ${result.message}`);
+        case "too_large":
+            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    const text = result.body.toString("utf8");
+    if (result.status < 200 || result.status > 299) {
+        const body = text.length > HTTP_ERROR_BODY_CHARS ? `${text.slice(0, HTTP_ERROR_BODY_CHARS)}…` : text;
+        return failed("http.status", `The service answered HTTP ${result.status}${body ? `: ${body}` : ""}`);
+    }
+    const type = String(result.headers["content-type"] ?? "");
+    let output;
+    if (text === "")
+        output = null;
+    else if (/[/+]json\b/i.test(type)) {
+        try {
+            output = JSON.parse(text);
+        }
+        catch {
+            return failed("http.invalid-response", "The answer says it is JSON but does not parse");
+        }
+    }
+    else if (options.outputSchema)
+        return failed("http.invalid-response", `The answer is ${type || "untyped"}, not JSON, and the tool's output schema needs JSON`);
+    else
+        output = text;
+    if (!options.outputSchema)
+        return { kind: "completed", output };
+    const checked = schemaFromJSON(options.outputSchema).validate(output);
+    if (!checked.ok)
+        return failed("tool.invalid-output", checked.issues.map((issue) => issue.message).join("; "));
+    return { kind: "completed", output: checked.value };
+}
+/**
+ * Runs one HTTP tool call of a session: finds the tool in the pinned manifest, adds its vault
+ * credential, the identity headers and the run-once key, and calls it. Never throws but for an
+ * abort of `signal`. Logs one line per call, never the input, the answer or a credential.
+ */
+export async function runHttpTool(tenant, call, options) {
+    const started = Date.now();
+    const { tool } = call;
+    let outcome;
+    try {
+        outcome = await run();
+    }
+    catch (error) {
+        if (options.signal.aborted)
+            throw error;
+        outcome = failed("http.failed", error instanceof Error ? error.message : String(error));
+    }
+    options.logger?.info("http_tool_call", {
+        session: tool.sessionId,
+        ...("stage" in tool
+            ? { stage: tool.stage }
+            : {
+                capability: tool.capabilityId,
+                tool: tool.toolName,
+                ...(tool.agentId === undefined ? {} : { agent: tool.agentId }),
+            }),
+        effect: call.effectId,
+        ms: Date.now() - started,
+        outcome: outcome.kind === "completed" ? "ok" : outcome.code,
+    });
+    return outcome;
+    async function run() {
+        const session = await tenant.session(tool.sessionId);
+        if (!session)
+            return failed("http.undeclared", `Session ${tool.sessionId} not found`);
+        const agentId = "stage" in tool ? undefined : tool.agentId;
+        const declared = "stage" in tool
+            ? declaredFlowHttp(session.manifest, tool.stage)
+            : declaredHttpTool(session.manifest, agentId, tool.capabilityId, tool.toolName);
+        if (!declared)
+            return failed("http.undeclared", "stage" in tool
+                ? `'${tool.stage}' is not an HTTP stage of the flow`
+                : `'${tool.toolName}' is not an HTTP tool of the session`);
+        const { http } = declared;
+        let credential = {};
+        if (http.credential !== undefined) {
+            const authorized = await tenant.authorize(tool.sessionId, {
+                kind: "http",
+                url: http.url,
+                serverName: http.credential,
+                ...(agentId === undefined ? {} : { agentId }),
+            });
+            if (authorized.status === "refused")
+                return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
+            if (authorized.status === "unauthenticated")
+                return failed("http.credential", `The session's vaults hold no credential '${http.credential}' for ${authorized.url}`);
+            credential = authorized.headers;
+        }
+        return callHttpTarget(http, call.input, {
+            headers: {
+                ...credential,
+                [SESSION_ID_HEADER]: tool.sessionId,
+                [TURN_ID_HEADER]: call.turnId,
+                [AGENT_ID_HEADER]: agentId ?? session.manifest.id,
+                "idempotency-key": call.effectId,
+            },
+            policy: options.policy,
+            signal: options.signal,
+            ...(declared.outputSchema === undefined ? {} : { outputSchema: declared.outputSchema }),
+        });
+    }
+}
+/** The gates service's HTTP tool calls, with the Tenant's vault (`host/gates.ts`). */
+export function gateHttpTools(vaults, policy, logger) {
+    return {
+        call: (tenantId, call, signal) => runHttpTool({
+            session: async (sessionId) => (await vaults.open(tenantId)).session(sessionId),
+            authorize: async (sessionId, request) => (await vaults.open(tenantId)).authorizeMcp(sessionId, request),
+        }, call, { policy, signal, logger }),
+    };
+}
+function failed(code, message) {
+    return { kind: "failed", code, message };
+}

package/dist/gates/mcp-handler.d.ts

@@ -1,5 +1,6 @@
 import { openMcpServer, type McpToolPage } from "../mcp/connect.js";
 import { type McpServerRef } from "../mcp/pool.js";
+import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { McpAnswer } from "./tool-contract.js";
 import { type TenantVaults } from "./tenant-vaults.js";
@@ -13,6 +14,8 @@ export interface McpHandlerOptions {
     readonly now?: () => number;
     /** Tests replace how a server is opened. */
     readonly open?: typeof openMcpServer;
+    /** How the gate reaches remote servers (`NYLORUN_ENDPOINT_*`). Default: no limits. */
+    readonly delivery?: OutboundPolicy;
 }
 export interface McpHandler {
     connect(tenantId: string | undefined, server: McpServerRef): Promise<McpAnswer<null>>;

package/dist/gates/mcp-handler.js

@@ -22,8 +22,6 @@ export function createMcpHandler(options) {
         const found = findServer(session.manifest, server.agentId, server.capabilityId, server.serverName);
         if (!found)
             throw new NotDeclared(`MCP server '${server.serverName}' is not declared`);
-        if (found.server.type === "stdio")
-            throw new NotDeclared(`MCP server '${server.serverName}' is a stdio server, which runs beside the loop`);
         return found.server;
     }
     async function connection(tenantId, server) {
@@ -43,7 +41,7 @@ export function createMcpHandler(options) {
                         serverName: server.serverName,
                         ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
                     }),
-                    pluginData: "",
+                    policy: options.delivery ?? {},
                 });
                 const entry = { connection, lastUsedAt: now(), active: 0 };
                 live.set(key, entry);

package/dist/gates/meter.d.ts

@@ -1,4 +1,4 @@
-import type { ModelBudgetRow, ModelUsageRow, ModelUsageTotals, SessionStore } from "../store/types.js";
+import type { ModelBudgetRow, ModelUsageWrite, ModelUsageTotals, SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
 import type { ModelGateOutcome, ModelGateRequest } from "./model-gate.js";
 export interface Meter {
@@ -14,7 +14,7 @@ export interface MeterOptions {
 }
 export declare function createMeter(options: MeterOptions): Meter;
 /** The ledger row of an outcome that carries usage; undefined for a failure. */
-export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): Omit<ModelUsageRow, "duplicate"> | undefined;
+export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): ModelUsageWrite | undefined;
 /**
  * Why the budget refuses another call, or undefined. Calls in flight count at the scope's
  * average cost per recorded call.

package/dist/gates/meter.js

@@ -107,6 +107,12 @@ export function usageRow(request, outcome, at) {
     return {
         id: randomUUID(),
         effectKey: request.effectId,
+        tokensReported: typeof outcome.evidence?.extras?.tokensReported === "boolean"
+            ? outcome.evidence.extras.tokensReported
+            : null,
+        costKnown: typeof outcome.evidence?.extras?.costKnown === "boolean"
+            ? outcome.evidence.extras.costKnown
+            : null,
         sessionId: request.sessionId,
         turnId: request.turnId,
         agentId: request.agentId,

package/dist/gates/tenant-vaults.d.ts

@@ -25,18 +25,14 @@ export interface TenantVault {
     readHostModel(): Promise<HostModelSecret | undefined>;
     /** Writes back a credential pi-ai refreshed (OAuth). */
     writeHostCredential(credential: Credential): Promise<void>;
-    /** A session, for the remote MCP servers its pinned manifest declares (F4.1). */
+    /** A session, for the remote MCP servers and HTTP tools its pinned manifest declares. */
     session(sessionId: string): Promise<Session | undefined>;
     /**
-     * The authorization of one request to a session's remote MCP server: its credential from the
-     * session's attached vaults, refreshed when due (F4.1), else from the operator's credential
-     * resolver (F9 C1).
+     * The authorization of one request to a session's remote MCP server or HTTP tool: its
+     * credential from the session's attached vaults, refreshed when due (F4.1), else from the
+     * operator's credential resolver (F9 C1).
      */
-    authorizeMcp(sessionId: string, request: {
-        url: string;
-        serverName: string;
-        agentId?: string;
-    }): Promise<AuthorizeResult>;
+    authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
 }

package/dist/gates/tool-calls.d.ts

@@ -1,6 +1,6 @@
 /**
- * Keyed remote MCP calls in the gates service (F4.1 G3). A call sent with an `Idempotency-Key`
- * (the loop's effect id) runs once:
+ * Keyed tool calls in the gates service (F4.1 G3): remote MCP calls and HTTP tool calls (R2 M3).
+ * A call sent with an `Idempotency-Key` (the loop's effect id) runs once:
  *
  * - While it runs, and for 30 minutes after, a re-send joins it or gets its answer from memory
  *   (`inflight.ts`), as model calls do (P1.2). So a runtime that dies or shuts down mid-call
@@ -13,28 +13,21 @@
  * A cancel aborts the call and leaves its row without an answer. Settled rows are deleted a day
  * later (`prune`).
  */
-import type { McpServerRef } from "../mcp/pool.js";
 import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
-import type { McpHandler } from "./mcp-handler.js";
 import type { TenantVaults } from "./tenant-vaults.js";
 import type { McpAnswer } from "./tool-contract.js";
 /** How long a settled crossing is kept. */
 export declare const TOOL_CROSSING_TTL_MS: number;
+/** A tool call's answer: an MCP `CallToolResult`, or an HTTP tool's outcome. */
 export type ToolCallAnswer = McpAnswer<Record<string, unknown>>;
-export interface ToolCallRequest {
-    readonly server: McpServerRef;
-    readonly effectId: string;
-    readonly name: string;
-    readonly arguments: Record<string, unknown>;
-}
 export interface ToolCalls {
     /**
-     * Runs, joins or answers the call under `key`. Rejects with `InflightConflict` when a
-     * different request already ran under it, and as `InflightCalls.run` does for `owner`, the
-     * run that sends it (F5).
+     * Runs `call` under `key`, joins the call running under it, or answers it from its crossing.
+     * Rejects with `InflightConflict` when a different request (`hash`) already ran under it, and
+     * as `InflightCalls.run` does for `owner`, the run that sends it (F5).
      */
-    run(tenantId: string | undefined, key: string, hash: string, request: ToolCallRequest, owner?: InflightOwner): Promise<ToolCallAnswer>;
+    run(tenantId: string | undefined, key: string, hash: string, call: (signal: AbortSignal) => Promise<ToolCallAnswer>, owner?: InflightOwner): Promise<ToolCallAnswer>;
     /**
      * Aborts the call under `key`; it is never run again under that key. With `sessionId`, false
      * when the running call is another session's (nothing is aborted).
@@ -47,7 +40,6 @@ export interface ToolCalls {
 }
 export interface ToolCallsOptions {
     readonly vaults: TenantVaults;
-    readonly mcp: McpHandler;
     readonly logger: Logger;
     readonly inflight?: InflightCallsOptions;
     readonly now?: () => number;

package/dist/gates/tool-calls.js

@@ -5,16 +5,16 @@ const LOST = {
     ok: false,
     error: {
         uncertain: true,
-        message: "The gateway stopped while this MCP call ran; the call may have reached the server, so it is not run again",
+        message: "The gateway stopped while this tool call ran; the call may have reached its server, so it is not run again",
     },
 };
 export function createToolCalls(options) {
-    const { vaults, mcp, logger } = options;
+    const { vaults, logger } = options;
     const now = options.now ?? Date.now;
     const inflight = createInflightCalls(options.inflight);
     const iso = () => new Date(now()).toISOString();
     return {
-        async run(tenantId, key, hash, request, owner) {
+        async run(tenantId, key, hash, call, owner) {
             if (inflight.has(key))
                 return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
             const vault = await vaults.open(tenantId);
@@ -35,7 +35,7 @@ export function createToolCalls(options) {
                 // Another gateway process wrote it between the read and now: never run it twice.
                 if (!started)
                     return LOST;
-                const answer = await mcp.call(tenantId, request, signal);
+                const answer = await call(signal);
                 // A cancel or a shutdown: the call may have reached the server; the row stays open.
                 if (signal.aborted)
                     throw signal.reason ?? new Error("aborted");

package/dist/gates/tool-client.d.ts

@@ -4,7 +4,7 @@ export interface HttpToolGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;
     /**
-     * `NYLORUN_GATES_TOKEN`: core's credential, for deliveries and MCP requests outside a run. A
+     * `NYLORUN_GATES_TOKEN`: core's credential, for MCP requests outside a run. A
      * harness has none (F6.2): its requests outside a run carry the session's last run token, or
      * nothing, and the gate refuses them.
      */