@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/tenant/effects.js

@@ -1,10 +1,11 @@
 import { embeddedAgent, flowDelegateManifest, hashManifest, } from "@nylorun/core/define";
 import { countActiveFlowWork, deriveAgentEffectSessionId, isFlowToolEffect, isWorkflowManifest, linkedMessageInput, linkedMessageKey, linkedTurnEnd, settleAgentEffect, } from "../core/flow-host.js";
 import { mayDispatchMore } from "../core/limits.js";
+import { sessionCredentials } from "../vault/sources.js";
 import { isRemoteMcpCall } from "../harness/calls.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
 import { owningSandboxSessionId, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
-import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { withPlatformTools, withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { loadSession, ownedSession, sandboxLookup, sessionOf, } from "./context.js";
 import { fail } from "./http.js";
 import { turnManifestOf } from "./session.js";
@@ -150,12 +151,15 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
             : undefined;
         // A sandbox chosen when the tree was opened reaches every agent in it, with its tools.
         const inherited = inheritedSandbox(sandboxOwnerId === undefined ? undefined : lookup(sandboxOwnerId) ?? workflow, definition);
+        // Without one, an agent with MCP or HTTP tools still reads its stored results (R2b C11).
+        const pinned = inherited?.manifest ? inherited : platformTools(definition.manifest);
         const created = {
             id: agentSessionId,
             agentId: body.agentId,
             ownerUserId: workflow.ownerUserId,
-            manifest: inherited?.manifest ?? definition.manifest,
-            manifestHash: inherited?.manifestHash ?? definition.manifestHash,
+            manifest: pinned?.manifest ?? definition.manifest,
+            manifestHash: pinned?.manifestHash ?? definition.manifestHash,
+            definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             status: "idle",
             activeTurnId: null,
@@ -241,13 +245,24 @@ function inheritedSandbox(owner, definition) {
         throw new Error(sandboxed.message);
     return { spec, manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
 }
+/** A linked agent session's `read_artifact` without a sandbox (R2b C11); undefined for none. */
+function platformTools(manifest) {
+    if (isWorkflowManifest(manifest))
+        return undefined;
+    const pinned = withPlatformTools(manifest);
+    if (pinned === undefined)
+        return undefined;
+    if (!pinned.ok)
+        throw new Error(pinned.message);
+    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
+}
 /**
  * The credential of an MCP server or HTTP tool request made on behalf of a session: from its
- * attached vaults, else the operator's credential resolver (`vault/sources.ts`).
+ * attached vaults (`vault/sources.ts`).
  */
 export async function authorize(ctx, sessionId, request) {
     const s = await loadSession(ctx, sessionId);
-    return ctx.credentials.authorize({ ...s, id: sessionId }, request);
+    return sessionCredentials(ctx.vault, { ...s, id: sessionId }, request);
 }
 /**
  * The definition a flow leaf's session runs. A flow agent embeds its leaves, so they come

package/dist/tenant/ephemeral.d.ts

@@ -2,7 +2,6 @@ import { type PostgresClient } from "../store/postgres/connect.js";
 import type { TrustedIssuerConfig } from "./identity-file.js";
 import { type TrustedIssuers } from "./issuers.js";
 import type { Logger, TenantModelConfig } from "./types.js";
-import type { ResolverConfig } from "../vault/sources.js";
 export interface StartEphemeralRuntimeOptions {
     /**
      * Absolute Host root for `host.json`, the admin key and the Tenant's files (vault key,
@@ -37,11 +36,6 @@ export interface StartEphemeralRuntimeOptions {
      * `createTrustedIssuers`. Default none.
      */
     issuers?: readonly TrustedIssuerConfig[] | TrustedIssuers;
-    /**
-     * The operator's credential resolver (F9 C1): asked for a person's MCP credential when the
-     * session's vaults hold none. Default: none (vaults only).
-     */
-    resolver?: ResolverConfig;
     logger?: Logger;
     /**
      * The Postgres database of the Tenant (one Tenant per database): a pool, which the caller

package/dist/tenant/ephemeral.js

@@ -82,7 +82,6 @@ export async function startEphemeralRuntime(options) {
             sandbox: { backend: sandboxBackend },
             model,
             ...(issuers ? { issuers } : {}),
-            ...(options.resolver ? { resolver: options.resolver } : {}),
             logger: createTenantLogger({
                 tenantId,
                 logPath: tenant.log,
@@ -145,6 +144,7 @@ export async function startEphemeralRuntime(options) {
             config: hostConfig,
             logger,
             coreVersion: coreVersion(),
+            ...(issuers ? { resourceServer: { issuers } } : {}),
         });
         // Opens the Tenant: creates it in the database first when it holds none.
         await host.listen();

package/dist/tenant/http.d.ts

@@ -1,10 +1,12 @@
 /**
  * The Tenant's typed rejections: what a route or the code it calls throws for the client to
- * see (`api/http/respond.ts` answers it), and the opaque 404 for unknown credentials (D5).
+ * see (`api/http/respond.ts` answers it), and the opaque 404 (D5) for what must not be told
+ * apart from nothing: a capability link the Runtime did not sign, a Tenant that is not this
+ * Host's. Credentials are `401` with a challenge since protocol 9 (`resource-server.ts`).
  *
  * Later waves: stable; the streams seam (Wave 2 / Y) keeps using these helpers.
  */
-/** D5 opaque failure for unknown/rejected credentials on Tenant routes. */
+/** D5's opaque failure: a 404 that says nothing of why. */
 export declare const OPAQUE_NOT_FOUND: {
     status: "rejected";
     code: "not_found";

package/dist/tenant/http.js

@@ -1,10 +1,12 @@
 /**
  * The Tenant's typed rejections: what a route or the code it calls throws for the client to
- * see (`api/http/respond.ts` answers it), and the opaque 404 for unknown credentials (D5).
+ * see (`api/http/respond.ts` answers it), and the opaque 404 (D5) for what must not be told
+ * apart from nothing: a capability link the Runtime did not sign, a Tenant that is not this
+ * Host's. Credentials are `401` with a challenge since protocol 9 (`resource-server.ts`).
  *
  * Later waves: stable; the streams seam (Wave 2 / Y) keeps using these helpers.
  */
-/** D5 opaque failure for unknown/rejected credentials on Tenant routes. */
+/** D5's opaque failure: a 404 that says nothing of why. */
 export const OPAQUE_NOT_FOUND = {
     status: "rejected",
     code: "not_found",

package/dist/tenant/identity-file.d.ts

@@ -2,20 +2,22 @@
  * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
  * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
  * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
- * the boot with a message naming the issuer and the field.
+ * the boot with a message naming the issuer and the field. A key the file does not define is
+ * ignored with a warning (`maxLifetime`, gone in protocol 9, among them), so an older file
+ * still boots.
  *
  * ```yaml
  * issuers:
  *   - name: keycloak
  *     issuer: https://sso.acme.dev/realms/eng
- *     audience: nylorun
+ *     audience: https://agents.acme.dev
  *     jwks: https://sso.acme.dev/realms/eng/protocol/openid-connect/certs  # or keys: [<PEM>]
- *     subject: "u:{sub}"                         # scalar claims only
- *     scopes: { claim: nylorun_scopes }          # or { fixed: [sessions:own, agents:read] }
- *     allowedScopes: [agents:read, sessions:own, sandboxes:write, studio]
- *     agents: [support]                          # optional allowlist; absent means all
- *     sandboxes: ["{org_id}/*"]                  # optional grants; absent reaches none
- *     maxLifetime: 15m
+ *     # Optional, with their defaults:
+ *     subject: "{sub}"                           # scalar claims only
+ *     scopes: { claim: scope }                   # or { fixed: [sessions:own, agents:read] }
+ *     allowedScopes: [agents:read, sessions:own, sandboxes:write]   # add studio to grant it
+ *     agents: [support]                          # absent reaches every agent
+ *     sandboxes: ["{org_id}/*"]                  # absent reaches no sandbox
  * ```
  */
 import { type KeyObject } from "node:crypto";
@@ -41,7 +43,7 @@ export interface TrustedIssuerConfig {
     readonly jwks?: string;
     /** Its public keys, given in the file (PEM); or `jwks`. */
     readonly keys?: readonly IssuerKey[];
-    /** The subject template, such as `u:{sub}`: at least one claim reference. */
+    /** The subject template, such as `{sub}` (the default): at least one claim reference. */
     readonly subject: string;
     /** Where its tokens' scopes come from: a claim, or a fixed list. */
     readonly scopes: {
@@ -55,8 +57,6 @@ export interface TrustedIssuerConfig {
     readonly agents?: readonly string[];
     /** Sandbox grant templates, such as `{org_id}/*`; absent reaches no sandbox. */
     readonly sandboxes?: readonly string[];
-    /** The longest `exp - iat` it may sign, in seconds. */
-    readonly maxLifetimeSeconds: number;
 }
 /** A malformed identity file: the message names the issuer and the field. */
 export declare class IdentityFileError extends Error {
@@ -68,8 +68,12 @@ export declare function claimReferences(template: string): string[];
 export declare function renderTemplate(template: string, value: (claim: string) => string | undefined): string | undefined;
 /** A PEM public key an issuer may sign with, and its algorithm; throws a message otherwise. */
 export declare function issuerKey(key: KeyObject, kid?: string): IssuerKey;
+export interface ParseIdentityFileOptions {
+    /** Told of every key the file has but does not define, which is ignored. */
+    readonly warn?: (message: string) => void;
+}
 /**
  * The issuers of an identity file's text. Throws `IdentityFileError` naming the file, the issuer
  * and the field when the file is malformed.
  */
-export declare function parseIdentityFile(text: string, source?: string): TrustedIssuerConfig[];
+export declare function parseIdentityFile(text: string, source?: string, options?: ParseIdentityFileOptions): TrustedIssuerConfig[];

package/dist/tenant/identity-file.js

@@ -2,31 +2,34 @@
  * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
  * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
  * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
- * the boot with a message naming the issuer and the field.
+ * the boot with a message naming the issuer and the field. A key the file does not define is
+ * ignored with a warning (`maxLifetime`, gone in protocol 9, among them), so an older file
+ * still boots.
  *
  * ```yaml
  * issuers:
  *   - name: keycloak
  *     issuer: https://sso.acme.dev/realms/eng
- *     audience: nylorun
+ *     audience: https://agents.acme.dev
  *     jwks: https://sso.acme.dev/realms/eng/protocol/openid-connect/certs  # or keys: [<PEM>]
- *     subject: "u:{sub}"                         # scalar claims only
- *     scopes: { claim: nylorun_scopes }          # or { fixed: [sessions:own, agents:read] }
- *     allowedScopes: [agents:read, sessions:own, sandboxes:write, studio]
- *     agents: [support]                          # optional allowlist; absent means all
- *     sandboxes: ["{org_id}/*"]                  # optional grants; absent reaches none
- *     maxLifetime: 15m
+ *     # Optional, with their defaults:
+ *     subject: "{sub}"                           # scalar claims only
+ *     scopes: { claim: scope }                   # or { fixed: [sessions:own, agents:read] }
+ *     allowedScopes: [agents:read, sessions:own, sandboxes:write]   # add studio to grant it
+ *     agents: [support]                          # absent reaches every agent
+ *     sandboxes: ["{org_id}/*"]                  # absent reaches no sandbox
  * ```
  */
 import { createPublicKey } from "node:crypto";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
-import { ISSUER_SCOPES, isSandboxGrant, TOKEN_SANDBOX_GRANTS_MAX, } from "@nylorun/core/contracts";
-import { parseSandboxDuration } from "@nylorun/core/define";
+import { ISSUER_SCOPES, isSandboxGrant, TOKEN_SANDBOX_GRANTS_MAX, TOKEN_SCOPES, } from "@nylorun/core/contracts";
 /** The JWT algorithms an issuer may sign with. */
 export const ISSUER_ALGORITHMS = ["RS256", "ES256", "EdDSA"];
-/** The longest `maxLifetime` an issuer may set. */
-const MAX_LIFETIME_SECONDS = 24 * 60 * 60;
+/** An entry's defaults: the `sub` claim, the RFC 9068 `scope` claim, every token scope but `studio`. */
+const DEFAULT_SUBJECT = "{sub}";
+const DEFAULT_SCOPES = { claim: "scope" };
+const DEFAULT_ALLOWED_SCOPES = TOKEN_SCOPES;
 /** At most this many static `keys` per issuer. */
 const MAX_STATIC_KEYS = 16;
 const ISSUER_NAME = /^[a-z][a-z0-9-]{0,31}$/;
@@ -105,12 +108,16 @@ const IssuerEntrySchema = z
     }, "must be an http(s) URL without credentials")
         .optional(),
     keys: z.array(z.string().min(1)).min(1).max(MAX_STATIC_KEYS).optional(),
-    subject: template("subject").refine((value) => claimReferences(value).length > 0, "must reference a claim, as u:{sub}: without one every token is the same person"),
-    scopes: z.union([
+    subject: template("subject")
+        .refine((value) => claimReferences(value).length > 0, "must reference a claim, as {sub}: without one every token is the same person")
+        .default(DEFAULT_SUBJECT),
+    scopes: z
+        .union([
         z.object({ claim: z.string().min(1) }).strict(),
         z.object({ fixed: z.array(IssuerScopeSchema) }).strict(),
-    ], { error: "must be { claim: <name> } or { fixed: [<scope>, ...] }" }),
-    allowedScopes: z.array(IssuerScopeSchema).min(1),
+    ], { error: "must be { claim: <name> } or { fixed: [<scope>, ...] }" })
+        .default(DEFAULT_SCOPES),
+    allowedScopes: z.array(IssuerScopeSchema).min(1).default([...DEFAULT_ALLOWED_SCOPES]),
     agents: z.array(z.string().min(1)).optional(),
     sandboxes: z
         .array(template("a sandbox grant").refine(
@@ -118,17 +125,17 @@ const IssuerEntrySchema = z
     (value) => isSandboxGrant(renderTemplate(value, () => "x")), "must render to a sandbox id or a prefix ending in /*, as {org_id}/*"))
         .max(TOKEN_SANDBOX_GRANTS_MAX)
         .optional(),
-    maxLifetime: z
-        .string()
-        .refine((value) => {
-        const ms = parseSandboxDuration(value);
-        return ms !== undefined && ms >= 1000 && ms <= MAX_LIFETIME_SECONDS * 1000;
-    }, "must be a duration from 1s to 24h, as 15m"),
-})
-    .strict();
-const IdentityFileSchema = z
-    .object({ issuers: z.array(z.unknown()) })
-    .strict();
+});
+const IdentityFileSchema = z.object({ issuers: z.array(z.unknown()) });
+/** The keys an entry and the file define; any other is ignored with a warning. */
+const ENTRY_KEYS = new Set(Object.keys(IssuerEntrySchema.shape));
+const FILE_KEYS = new Set(Object.keys(IdentityFileSchema.shape));
+/** The keys of `value`, an object, that `known` does not define. */
+function unknownKeys(value, known) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? Object.keys(value).filter((key) => !known.has(key))
+        : [];
+}
 function issueText(issues) {
     return issues
         .map((issue) => {
@@ -141,7 +148,11 @@ function issueText(issues) {
  * The issuers of an identity file's text. Throws `IdentityFileError` naming the file, the issuer
  * and the field when the file is malformed.
  */
-export function parseIdentityFile(text, source = "identity file") {
+export function parseIdentityFile(text, source = "identity file", options = {}) {
+    const ignored = (where, keys) => {
+        if (keys.length > 0)
+            options.warn?.(`${source}: ${where}: ignored ${keys.map((key) => `\`${key}\``).join(", ")}, which the identity file does not define`);
+    };
     const fail = (message) => {
         throw new IdentityFileError(`${source}: ${message}`);
     };
@@ -155,6 +166,7 @@ export function parseIdentityFile(text, source = "identity file") {
     const file = IdentityFileSchema.safeParse(raw ?? {});
     if (!file.success)
         return fail(issueText(file.error.issues));
+    ignored("the file", unknownKeys(raw, FILE_KEYS));
     const issuers = [];
     file.data.issuers.forEach((entry, index) => {
         const named = entry && typeof entry === "object" && typeof entry.name === "string"
@@ -164,6 +176,7 @@ export function parseIdentityFile(text, source = "identity file") {
         const parsed = IssuerEntrySchema.safeParse(entry);
         if (!parsed.success)
             return fail(`${where}: ${issueText(parsed.error.issues)}`);
+        ignored(where, unknownKeys(entry, ENTRY_KEYS));
         const value = parsed.data;
         if ((value.jwks === undefined) === (value.keys === undefined))
             return fail(`${where}: jwks or keys: give exactly one of them`);
@@ -195,7 +208,6 @@ export function parseIdentityFile(text, source = "identity file") {
             allowedScopes: [...new Set(value.allowedScopes)],
             ...(value.agents ? { agents: [...new Set(value.agents)] } : {}),
             ...(value.sandboxes ? { sandboxes: value.sandboxes } : {}),
-            maxLifetimeSeconds: Math.floor(parseSandboxDuration(value.maxLifetime) / 1000),
         });
     });
     return issuers;

package/dist/tenant/issuers.d.ts

@@ -26,7 +26,7 @@ export type IssuerVerdict = {
 /** One configured issuer, with its keys. */
 export interface TrustedIssuer {
     readonly config: TrustedIssuerConfig;
-    /** Checks `raw`'s header and signature, `iss`, `aud`, `exp`, `iat` and its lifetime. */
+    /** Checks `raw`'s header and signature, `iss`, `aud`, `exp` and `iat`. */
     verify(raw: string): Promise<IssuerVerdict>;
 }
 /** The Host's trusted issuers (`TenantConfig.issuers`), built once from the identity file. */
@@ -43,6 +43,7 @@ export type IssuerTokenScope = Extract<AuthScope, {
 /**
  * Verifies a bearer that `issuer` claims (`TrustedIssuers.claimed`). Returns the request's
  * scope; answers `401 token_expired` for an expired token, `401 issuer_unavailable` for a key
- * the Runtime cannot fetch now, and the opaque 404 for everything else.
+ * the Runtime cannot fetch now, and `401 credential_invalid` for everything else. Each carries
+ * a `Bearer` challenge naming `resourceMetadata`, the route's protected resource metadata.
  */
-export declare function verifyIssuerToken(ctx: TenantContext, issuer: TrustedIssuer, raw: string): Promise<IssuerTokenScope>;
+export declare function verifyIssuerToken(ctx: TenantContext, issuer: TrustedIssuer, raw: string, resourceMetadata?: string): Promise<IssuerTokenScope>;

package/dist/tenant/issuers.js

@@ -11,19 +11,21 @@
  *   a `kid` it has not seen, and refreshed in the background once the cache is 10 minutes old.
  *   When the JWKS cannot be fetched, cached keys keep working and a new `kid` is
  *   `401 issuer_unavailable`;
- * - `iss` and `aud` as configured, `exp` and `iat` present, `exp - iat` at most `maxLifetime`,
- *   with the 30 s clock tolerance of every Runtime token;
+ * - `iss` and `aud` as configured, and `exp` present, with the 30 s clock tolerance of every
+ *   Runtime token. How long a token lives is the issuer's to decide (protocol 9 dropped
+ *   `maxLifetime`); an `iat` in the future is still refused;
  * - a subject the template renders from scalar claims, valid and not reserved.
  *
  * The result is the `token` AuthScope (F9-D12) with `issuer`: only its expiry ends it. An
- * expired token is `401 token_expired`; every other refusal is the opaque 404, its reason
- * logged.
+ * expired token is `401 token_expired`; every other refusal is `401 credential_invalid`
+ * (`resource-server.ts`), its reason logged.
  */
 import { createHash, createPublicKey } from "node:crypto";
 import { decodeJwt, decodeProtectedHeader, errors, jwtVerify } from "jose";
 import { isSubject } from "@nylorun/core/contracts";
-import { failOpaque, HttpError } from "./http.js";
+import { HttpError } from "./http.js";
 import { CLOCK_TOLERANCE_SECONDS, looksLikeToken } from "./jwt.js";
+import { bearerChallenge, failCredential } from "./resource-server.js";
 import { ISSUER_ALGORITHMS, issuerKey, renderTemplate, } from "./identity-file.js";
 /** The byte cap of an issuer's token; Nylorun's own token families keep 4 KiB. */
 export const MAX_ISSUER_TOKEN_BYTES = 16 * 1024;
@@ -185,14 +187,12 @@ function trustedIssuer(config, options) {
                         issuer: config.issuer,
                         audience: config.audience,
                         clockTolerance: CLOCK_TOLERANCE_SECONDS,
-                        requiredClaims: ["iat", "exp"],
+                        requiredClaims: ["exp"],
                         currentDate: new Date(options.now()),
                     });
                     const now = Math.floor(options.now() / 1000);
-                    if (payload.iat > now + CLOCK_TOLERANCE_SECONDS)
+                    if (payload.iat !== undefined && payload.iat > now + CLOCK_TOLERANCE_SECONDS)
                         return refuse("invalid", "issuer_token_future");
-                    if (payload.exp - payload.iat > config.maxLifetimeSeconds)
-                        return refuse("invalid", "issuer_token_lifetime");
                     return { ok: true, payload, ...(kid !== undefined ? { kid } : {}) };
                 }
                 catch (error) {
@@ -260,25 +260,31 @@ function scopesOf(config, payload) {
 /**
  * Verifies a bearer that `issuer` claims (`TrustedIssuers.claimed`). Returns the request's
  * scope; answers `401 token_expired` for an expired token, `401 issuer_unavailable` for a key
- * the Runtime cannot fetch now, and the opaque 404 for everything else.
+ * the Runtime cannot fetch now, and `401 credential_invalid` for everything else. Each carries
+ * a `Bearer` challenge naming `resourceMetadata`, the route's protected resource metadata.
  */
-export async function verifyIssuerToken(ctx, issuer, raw) {
+export async function verifyIssuerToken(ctx, issuer, raw, resourceMetadata) {
     const { config } = issuer;
     const rejected = (reason) => {
         ctx.config.logger.warn("credential rejected", { reason, issuer: config.name });
-        return failOpaque();
+        return failCredential("invalid", resourceMetadata);
     };
     const verdict = await issuer.verify(raw);
     if (!verdict.ok) {
         if (verdict.refused === "expired") {
             ctx.config.logger.warn("issuer token refused", { reason: verdict.reason, issuer: config.name });
-            throw new HttpError(401, "The token has expired", { code: "token_expired" }, { "www-authenticate": 'Bearer error="invalid_token"' });
+            throw new HttpError(401, "The token has expired", { code: "token_expired" }, {
+                "www-authenticate": bearerChallenge({
+                    error: "invalid_token",
+                    description: "The access token expired",
+                    resourceMetadata,
+                }),
+            });
         }
         if (verdict.refused === "unavailable") {
             ctx.config.logger.warn("issuer token refused", { reason: verdict.reason, issuer: config.name });
-            throw new HttpError(401, `The keys of issuer ${config.name} cannot be fetched now; try again later`, {
-                code: "issuer_unavailable",
-            });
+            // The token may be fine: no error code, so a client retries rather than signs in again.
+            throw new HttpError(401, `The keys of issuer ${config.name} cannot be fetched now; try again later`, { code: "issuer_unavailable" }, { "www-authenticate": bearerChallenge({ resourceMetadata }) });
         }
         return rejected(verdict.reason);
     }

package/dist/tenant/outbound.d.ts

@@ -58,9 +58,19 @@ export declare class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export declare class OutboundFailed extends Error {
     readonly code: string;
-    constructor(message: string, code: string);
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    readonly sent: boolean;
+    constructor(message: string, code: string, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent?: boolean);
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export declare const MAX_FETCH_RESPONSE_BYTES: number;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export declare const FETCH_TIMEOUT_MS = 30000;
@@ -68,9 +78,8 @@ export declare const FETCH_TIMEOUT_MS = 30000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams

package/dist/tenant/outbound.js

@@ -1,6 +1,6 @@
 /**
  * The Runtime's requests to developer URLs: HTTP tools (`gates/http-tool.ts`) and, through
- * `guardedFetch`, remote MCP servers and OAuth: one request, no redirects, a bounded answer, and
+ * `guardedFetch`, remote MCP servers: one request, no redirects, a bounded answer, and
  * the Host's address policy checked on the address actually connected to, so a DNS answer cannot
  * steer a request somewhere the Host forbids.
  *
@@ -153,13 +153,20 @@ export class OutboundRefused extends Error {
 /** A request `guardedFetch` sent that failed: refused connection, reset, timeout, redirect. */
 export class OutboundFailed extends Error {
     code;
-    constructor(message, code) {
+    sent;
+    constructor(message, code, 
+    /**
+     * The request was sent in full before it failed, as `post()`'s `lost` (R2b C7): the server
+     * may have acted on it. False for a failure to resolve or connect.
+     */
+    sent = false) {
         super(message);
         this.code = code;
+        this.sent = sent;
         this.name = "OutboundFailed";
     }
 }
-/** The largest answer `guardedFetch` reads. OAuth metadata and tokens are small. */
+/** The largest answer `guardedFetch` reads. */
 export const MAX_FETCH_RESPONSE_BYTES = 1024 * 1024;
 /** How long a `guardedFetch` request may take without a signal of its own. */
 export const FETCH_TIMEOUT_MS = 30_000;
@@ -167,9 +174,8 @@ export const FETCH_TIMEOUT_MS = 30_000;
  * A `fetch` under the Host's address policy (F9 C2): the literal-IP and DNS checks of `post`
  * on the address actually connected to, `localhost` rewritten for the local stack, no
  * redirects (`redirect: "error"`; a 3xx answer rejects), a bounded answer and a 30 s timeout
- * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
- * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
- * other failure with `OutboundFailed`.
+ * unless the caller passes a signal. A refused URL or address rejects with `OutboundRefused`,
+ * any other failure with `OutboundFailed`.
  *
  * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
  * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
@@ -217,6 +223,9 @@ export function guardedFetch(policy, options = {}) {
             outgoing["content-length"] = String(body.byteLength);
         return await new Promise((resolve, reject) => {
             let settled = false;
+            // Set when the request is fully sent, as `post()` does: a failure after it may follow
+            // the server acting on the request.
+            let delivered = false;
             const settle = (fn) => {
                 if (settled)
                     return;
@@ -225,12 +234,12 @@ export function guardedFetch(policy, options = {}) {
             };
             const failed = (error) => settle(() => reject(error instanceof RefusedAddress
                 ? new OutboundRefused(error.message)
-                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name))));
+                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name), delivered)));
             const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, ...(signal ? { signal } : {}) }, (response) => {
                 const status = response.statusCode ?? 0;
                 if (status >= 300 && status < 400 && response.headers.location !== undefined) {
                     response.resume();
-                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT")));
+                    return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT", true)));
                 }
                 const noBody = status === 204 || status === 304 || method === "HEAD";
                 const answer = (body) => {
@@ -258,7 +267,7 @@ export function guardedFetch(policy, options = {}) {
                 response.on("data", (chunk) => {
                     size += chunk.length;
                     if (size > limit) {
-                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE")));
+                        settle(() => reject(new OutboundFailed(`The answer from ${originalHost} is larger than ${limit} bytes`, "TOO_LARGE", true)));
                         response.destroy();
                         return;
                     }
@@ -268,6 +277,9 @@ export function guardedFetch(policy, options = {}) {
                 response.on("error", failed);
                 response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
             });
+            sent.on("finish", () => {
+                delivered = true;
+            });
             sent.on("error", failed);
             sent.end(body);
         });

package/dist/tenant/reset.d.ts

@@ -15,7 +15,7 @@ export interface ResetTenantContext {
 /**
  * Reset Tenant durable state for `scope` (A17).
  * Caller must have already drained (`activeWork`). Deletes store state in one
- * transaction (`Tx.reset`), then does the filesystem rename+delete for sandboxes /
- * log as needed. The host vault (model credentials), principals and settings stay.
+ * transaction (`Tx.reset`), which also signals a sessions reset to every process on the
+ * control bus, then does the filesystem rename+delete for sandboxes / log as needed. The host vault (model credentials), principals and settings stay.
  */
 export declare function resetTenant(ctx: ResetTenantContext, scope: ResetScope): Promise<void>;

package/dist/tenant/reset.js

@@ -33,8 +33,8 @@ function replaceDirectory(dir) {
 /**
  * Reset Tenant durable state for `scope` (A17).
  * Caller must have already drained (`activeWork`). Deletes store state in one
- * transaction (`Tx.reset`), then does the filesystem rename+delete for sandboxes /
- * log as needed. The host vault (model credentials), principals and settings stay.
+ * transaction (`Tx.reset`), which also signals a sessions reset to every process on the
+ * control bus, then does the filesystem rename+delete for sandboxes / log as needed. The host vault (model credentials), principals and settings stay.
  */
 export async function resetTenant(ctx, scope) {
     const clearSessions = scope === "sessions" || scope === "all";
@@ -53,6 +53,12 @@ export async function resetTenant(ctx, scope) {
         // Folders' content-addressed files: those no remaining folder names (F8.2).
         const content = clearSessions ? await t.artifactContentShas(scoped) : [];
         await t.reset(scope);
+        // Every process moves its session streams to the new basin generation (control.ts).
+        if (clearSessions)
+            await t.signal({
+                type: "sessions.reset",
+                generation: (await t.basinGenerations()).current,
+            });
         const kept = await t.referencedArtifactContent(content);
         for (const sha of content)
             if (!kept.has(sha))