@nylorun/runtime 0.22.0-beta → 0.24.0-beta

package/dist/artifacts/service.d.ts

@@ -66,7 +66,8 @@ export declare function folderContent(ctx: TenantContext, id: string, version: n
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export declare function deleteArtifact(ctx: TenantContext, id: string, access: ArtifactAccess): Promise<{
     artifactId: string;

package/dist/artifacts/service.js

@@ -52,6 +52,7 @@ export function artifactView(row, versions) {
         name: row.name,
         contentType: row.contentType,
         ...(row.sessionId === null ? {} : { sessionId: row.sessionId }),
+        ...(row.environmentId === null ? {} : { environmentId: row.environmentId }),
         latestVersion: row.latestVersion,
         ...(row.labelsJson === null ? {} : { labels: JSON.parse(row.labelsJson) }),
         createdAt: row.createdAt,
@@ -194,6 +195,7 @@ export async function uploadArtifact(ctx, input, body, access, signal) {
                         : JSON.stringify(input.labels),
                     createdAt,
                     updatedAt: createdAt,
+                    environmentId: null,
                 };
                 version = {
                     artifactId,
@@ -278,11 +280,14 @@ export async function folderContent(ctx, id, version, access) {
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export async function deleteArtifact(ctx, id, access) {
     const keys = await ctx.store.tx(async (t) => {
         const found = await readableArtifact(t, id, access);
+        if (found.environmentId !== null)
+            fail(409, `Artifact ${id} holds Environment ${found.environmentId}'s disk versions: delete them with DELETE /v1/environments/{id}/versions/{version}, or delete the Environment.`);
         if (found.sessionId !== null)
             await lockedSession(t, found.sessionId, access);
         if (found.kind === "folder")

package/dist/artifacts/workspace.d.ts

@@ -22,7 +22,7 @@ export interface WorkspaceSession {
     /** The session that owns the workspace (one hop through `sandboxOwnerId`). */
     readonly ownerId: string;
     /** The sandbox resource the workspace belongs to, when the owner is attached to one. */
-    readonly sandboxId?: string;
+    readonly environmentId?: string;
     /** The session's pinned manifest: its sandbox capability carries the sandbox's spec. */
     readonly manifest: AgentManifest;
 }

package/dist/artifacts/workspace.js

@@ -24,7 +24,7 @@ export function sandboxWorkspaceReader(sandbox) {
                 id: session.ownerId,
                 activeTurnId: session.turnId,
                 manifest: session.manifest,
-                ...(session.sandboxId === undefined ? {} : { sandboxId: session.sandboxId }),
+                ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
             },
         };
     };

package/dist/core/flow-host.d.ts

@@ -1,8 +1,8 @@
 import type { EffectOutcome } from "@nylorun/core/contracts";
 import { type JsonValue, type WorkflowManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
-import type { EffectDoc, Tx, WakeDelivery } from "../store/types.js";
-import { type FlowLimits } from "./limits.js";
+import type { EffectDoc, Tx } from "../store/types.js";
+import { type TurnTiming } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export declare function deriveSessionId(workflowSessionId: string, path: string, ...parts: string[]): string;
 /**
@@ -60,15 +60,13 @@ export type FlowHostSession = {
     status: string;
     activeTurnId: string | null;
     info?: any;
-    vaultIds?: readonly string[];
-    credentialSelections?: readonly unknown[];
     creation?: unknown;
     waits?: unknown;
     lastOutput?: JsonValue;
     /** The turn `status`, `lastOutput` and `error` describe, once it ended. */
     lastTurnId?: string;
     error?: string;
-};
+} & TurnTiming;
 /** How a linked agent turn ended. */
 export type LinkedTurnEnd = {
     readonly turnId: string;
@@ -97,8 +95,6 @@ export type CascadeCancelPlan = {
     /** Linked agent sessions to cancel, deepest path first. */
     readonly agentSessionIds: string[];
 };
-/** Wakes a session after commit (`DurableExecution.wake` through the Tenant context). */
-type Schedule = WakeDelivery;
 /** Effect documents as the flow host writes them. */
 export type FlowEffect = EffectDoc & {
     agentSessionId?: string;
@@ -135,7 +131,6 @@ export declare function wakeLinkedWorkflow(input: {
     readonly failed?: boolean;
     readonly cancelled?: boolean;
     readonly error?: string;
-    readonly schedule: Schedule;
 }): Promise<void>;
 /** Pending workflow `agent` effects with a linked session, for the Tenant sweep. */
 export declare function pendingAgentEffects(t: Tx): Promise<FlowEffect[]>;
@@ -152,7 +147,6 @@ export declare function pendingAgentEffects(t: Tx): Promise<FlowEffect[]>;
 export declare function reconcilePendingAgentEffect(input: {
     readonly t: Tx;
     readonly effectId: string;
-    readonly schedule: Schedule;
 }): Promise<boolean>;
 /** Path depth for deepest-first cancel ordering. */
 export declare function pathDepth(path: string): number;
@@ -222,16 +216,3 @@ export declare function foreignInteractionConflict(input: {
     message: string;
     ownerSessionId: string;
 } | undefined>;
-/**
- * When concurrency slots free, re-enter the workflow so queued effects can start
- * (status stays `queued` until the effect resolver dispatches them). Returns
- * true when a wake was scheduled.
- */
-export declare function wakeForQueuedEffects(input: {
-    readonly t: Tx;
-    readonly workflowSessionId: string;
-    readonly turnId: string;
-    readonly limits: FlowLimits;
-    readonly schedule: Schedule;
-}): Promise<boolean>;
-export {};

package/dist/core/flow-host.js

@@ -4,8 +4,8 @@
  * Every function that touches state takes the caller's transaction `t: Tx` and
  * is async. Nothing here publishes, notifies or schedules directly (seam rule
  * 1): events go through `t.event(...)`, which the store publishes after
- * commit, and wakes go through `t.wake(id, wake, schedule)`, the wake outbox, which
- * calls `schedule` after commit. Functions
+ * commit, and wakes go through `t.wake(id, wake)`, the wake outbox, which the store
+ * delivers after commit. Functions
  * that rewrite a session-scoped document lock that session first with
  * `t.lockSession` (a no-op when the caller already holds it).
  *
@@ -24,9 +24,9 @@
  * - `linkedMessageKey(request): string`
  * - `linkedTurnOf(t, agentSessionId, request): Promise<string | undefined>`
  * - `linkedTurnEnd(t, effect, agent): Promise<LinkedTurnEnd | undefined>`
- * - `wakeLinkedWorkflow({ t, agentSessionId, turnId, output?, failed?, cancelled?, error?, schedule }): Promise<void>`
+ * - `wakeLinkedWorkflow({ t, agentSessionId, turnId, output?, failed?, cancelled?, error? }): Promise<void>`
  * - `pendingAgentEffects(t): Promise<FlowEffect[]>`
- * - `reconcilePendingAgentEffect({ t, effectId, schedule }): Promise<boolean>`
+ * - `reconcilePendingAgentEffect({ t, effectId }): Promise<boolean>`
  * - `planCancelCascade({ t, workflowSessionId, turnId }): Promise<CascadeCancelPlan>`
  * - `cancelSiblingWork({ t, workflowSessionId, turnId, siblingPaths?, cancelEffectIds? }): Promise<CancelSiblingResult>`
  * - `cancelQueuedEffects({ t, workflowSessionId, turnId }): Promise<string[]>`
@@ -34,11 +34,10 @@
  * - `flowInteractionOf(waits, workflowSessionId, interactionId): { id; kind } | undefined`
  * - `findInteractionOwner({ t, workflowSessionId, interactionId }): Promise<{ sessionId; path } | undefined>`
  * - `foreignInteractionConflict({ t, workflowSessionId, interactionId }): Promise<{ status: 409; message; ownerSessionId } | undefined>`
- * - `wakeForQueuedEffects({ t, workflowSessionId, turnId, limits, schedule }): Promise<boolean>`
  *
- * `schedule` (a `WakeDelivery`, the Tenant's `ctx.wake`) runs after commit, never inside `t`;
- * `wake` carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key. A
- * wake `schedule` does not deliver stays in the outbox for the Tenant sweep (`Tx.wake`).
+ * A wake carries the reason (`linked`, `flow`) and, where the cause has one, a dedupe key.
+ * The store delivers it after commit, never inside `t`; one it does not deliver stays in the
+ * outbox for the Tenant sweep (`Tx.wake`).
  *
  * An `agent` effect settles only from the linked turn it started. A linked agent session is
  * reused by every iteration of a Loop (its id derives from the workflow and the path), so its
@@ -51,7 +50,7 @@
  */
 import { createHash } from "node:crypto";
 import { isVerdict } from "@nylorun/core/define";
-import { mayDispatchMore } from "./limits.js";
+import { resumeTurn } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export function deriveSessionId(workflowSessionId, path, ...parts) {
     const digest = createHash("sha256")
@@ -140,10 +139,6 @@ export async function recordVerdict(t, request, value) {
         ...(verdict.data !== undefined ? { data: verdict.data } : {}),
     });
 }
-/** Writes the wake to the outbox; `schedule` delivers it after commit. */
-function requestWake(t, schedule, id, wake) {
-    return t.wake(id, wake, schedule);
-}
 /** Active agent turns + tool nodes in flight for one workflow turn. */
 export async function countActiveFlowWork(t, workflowSessionId, turnId) {
     const effects = await t.effectsForTurn(workflowSessionId, turnId);
@@ -243,9 +238,11 @@ export async function wakeLinkedWorkflow(input) {
             }
             : { value: input.output ?? null };
     await settleAgentEffect({ t, effect, outcome });
+    // A workflow paused on its agents' interactions goes on (R7.1, `tenant/turn-timing.ts`).
+    resumeTurn(workflow);
     workflow.status = "runnable";
     await t.put("sessions", workflow.id, workflow);
-    await requestWake(t, input.schedule, workflow.id, {
+    await t.wake(workflow.id, {
         reason: "linked",
         dedupeKey: `linked:${link.turnId}:${link.effectId}`,
     });
@@ -288,7 +285,6 @@ export async function reconcilePendingAgentEffect(input) {
             : end.status === "failed"
                 ? { failed: true, error: end.error }
                 : { cancelled: true, error: end.error }),
-        schedule: input.schedule,
     });
     return true;
 }
@@ -457,25 +453,3 @@ export async function foreignInteractionConflict(input) {
         ownerSessionId: owner.sessionId,
     };
 }
-/**
- * When concurrency slots free, re-enter the workflow so queued effects can start
- * (status stays `queued` until the effect resolver dispatches them). Returns
- * true when a wake was scheduled.
- */
-export async function wakeForQueuedEffects(input) {
-    const { t } = input;
-    if (!mayDispatchMore(await countActiveFlowWork(t, input.workflowSessionId, input.turnId), input.limits))
-        return false;
-    const queued = await t.effectsForTurn(input.workflowSessionId, input.turnId, ["queued"]);
-    if (queued.length === 0)
-        return false;
-    const workflow = await t.lockSession(input.workflowSessionId);
-    if (workflow && workflow.status === "waiting") {
-        workflow.status = "runnable";
-        await t.put("sessions", workflow.id, workflow);
-    }
-    await requestWake(t, input.schedule, input.workflowSessionId, {
-        reason: "flow",
-    });
-    return true;
-}

package/dist/core/provider.d.ts

@@ -9,7 +9,8 @@ export declare function gatewayModel(options: {
     model: string;
 }): ModelProvider;
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export declare function toolFixtureModel(): ModelProvider;

package/dist/core/provider.js

@@ -1,3 +1,4 @@
+import { fixtureAnswer } from "../gates/fixture-model.js";
 export function scriptedModel(output = "Scripted development response") {
     return async () => ({ output: [{ type: "text", text: output }] });
 }
@@ -23,43 +24,10 @@ export function gatewayModel(options) {
     };
 }
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export function toolFixtureModel() {
-    return async (effect) => {
-        const call = effect.input;
-        const last = call.prompt.at(-1);
-        if (last?.kind === "tool-result")
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `Order lookup complete: ${last.content.map((part) => (part.type === "text" ? part.text : JSON.stringify(part))).join(" ")}`,
-                    },
-                ],
-            };
-        const users = call.prompt.filter((p) => p.kind === "message" && p.role === "user");
-        if (users.length > 1)
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `I remember: ${users[0].content.map((part) => (part.type === "text" ? part.text : "")).join(" ")}`,
-                    },
-                ],
-            };
-        if (!call.tools.some((tool) => tool.name === "lookup_order"))
-            return { output: [{ type: "text", text: "Hello from the fixture model." }] };
-        return {
-            output: [
-                {
-                    type: "tool-call",
-                    id: "fixture_lookup",
-                    name: "lookup_order",
-                    args: { orderId: "demo-123" },
-                },
-            ],
-        };
-    };
+    return async (effect, signal) => fixtureAnswer(effect.input, signal);
 }

package/dist/core/sandbox-routes.d.ts

@@ -9,32 +9,13 @@ export type SandboxRouteSession = SessionSandboxRef & {
     readonly activeTurnId: string | null;
     readonly status: string;
 };
-/** A session together with a synchronous lookup over its sandbox owner chain. */
-export type SandboxRouteRead = {
-    readonly session: SandboxRouteSession;
-    readonly lookup: (id: string) => SessionSandboxRef | undefined;
-};
 export type SandboxRouteDeps = {
     readonly sandbox: Pick<WorkspacePort, "run">;
-    /** The session (rejects when missing) and its owner chain, read in one transaction. */
-    readonly session: (id: string) => Promise<SandboxRouteRead>;
+    /** The session; rejects when it is missing. */
+    readonly session: (id: string) => Promise<SandboxRouteSession>;
 };
 /**
  * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
  * Refused while the session has an active agent turn.
  */
 export declare function handleSessionSandboxTool(deps: SandboxRouteDeps, sessionId: string, toolName: string, body: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export declare function validateSandboxAttach(body: {
-    ownerUserId: string;
-    sandbox?: unknown;
-}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options?: {
-    opaque?: boolean;
-    inherit?: boolean;
-}): string | undefined;

package/dist/core/sandbox-routes.js

@@ -1,9 +1,9 @@
 /**
- * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`)
- * and the sandbox attach check of `PUT /v1/sessions/:id`.
+ * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`):
+ * a tool run in the sandbox of the session's Environment.
  */
 import { isSandboxToolName, } from "@nylorun/core/define";
-import { capabilityForSandbox, owningSandboxSessionId, sandboxSpecOf, sandboxWorkspaceOf, sandboxSpecsEqual, sessionSandboxSpec, } from "../sandbox/share.js";
+import { capabilityForSandbox, sandboxWorkspaceOf, sessionSandboxSpec, } from "../sandbox/share.js";
 export class SandboxRouteError extends Error {
     status;
     constructor(status, message) {
@@ -12,10 +12,8 @@ export class SandboxRouteError extends Error {
         this.name = "SandboxRouteError";
     }
 }
-function resolveSpec(session, lookup) {
-    const ownerId = owningSandboxSessionId(session, lookup);
-    const owner = ownerId === session.id ? session : lookup(ownerId) ?? session;
-    const spec = sessionSandboxSpec(owner) ?? sessionSandboxSpec(session);
+function resolveSpec(session) {
+    const spec = sessionSandboxSpec(session);
     if (!spec)
         throw new SandboxRouteError(404, "Session has no sandbox");
     return spec;
@@ -34,14 +32,14 @@ function toolInput(body) {
     const { requestId: _r, ...input } = record;
     return input;
 }
-async function runTool(deps, { session, lookup }, tool, input, signal) {
-    const spec = resolveSpec(session, lookup);
-    const workspace = sandboxWorkspaceOf(session, lookup);
+async function runTool(deps, session, tool, input, signal) {
+    const spec = resolveSpec(session);
+    const workspace = sandboxWorkspaceOf(session);
     const ref = {
         id: workspace.ownerId,
         activeTurnId: session.activeTurnId,
         manifest: session.manifest,
-        ...(workspace.sandboxId === undefined ? {} : { sandboxId: workspace.sandboxId }),
+        ...(workspace.environmentId === undefined ? {} : { environmentId: workspace.environmentId }),
     };
     return deps.sandbox.run(ref, capabilityForSandbox(spec), tool, input, signal);
 }
@@ -51,39 +49,8 @@ async function runTool(deps, { session, lookup }, tool, input, signal) {
  */
 export async function handleSessionSandboxTool(deps, sessionId, toolName, body, signal) {
     const read = await deps.session(sessionId);
-    if (read.session.activeTurnId)
+    if (read.activeTurnId)
         throw new SandboxRouteError(409, "Sandbox is unavailable while the session has an active agent turn");
     const tool = parseTool(toolName);
     return runTool(deps, read, tool, toolInput(body), signal);
 }
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export function validateSandboxAttach(body, newManifest, lookup, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options = {}) {
-    const request = body.sandbox;
-    const share = typeof request === "object" && request !== null && "session" in request
-        ? String(request.session)
-        : undefined;
-    if (!share)
-        return undefined;
-    const owner = lookup(share);
-    if (!owner || (options.opaque && owner.ownerUserId !== body.ownerUserId))
-        throw new SandboxRouteError(404, "Sandbox session not found");
-    if (owner.ownerUserId !== body.ownerUserId)
-        throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");
-    const ownerSpec = sessionSandboxSpec(owner);
-    if (!ownerSpec)
-        throw new SandboxRouteError(400, "Target session has no sandbox to share");
-    if (options.inherit)
-        return owningSandboxSessionId(owner, lookup);
-    const newSpec = sandboxSpecOf(newManifest);
-    if (!newSpec)
-        throw new SandboxRouteError(400, "Session must declare a sandbox identical to the shared session");
-    if (!sandboxSpecsEqual(ownerSpec, newSpec))
-        throw new SandboxRouteError(409, "Sandbox specs must be identical to share a sandbox");
-    return owningSandboxSessionId(owner, lookup);
-}

package/dist/execution/types.d.ts

@@ -1,12 +1,10 @@
 /**
  * The Durable Session Execution seam (architecture §12.3).
  *
- * Durable Session Execution decides when to look at a session again. It never
- * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
- * key, retries, timers, the sweep chain); the Session Store owns the record (the
- * checkpoint, the effect journal, the events) and the wake outbox that bridges the
- * two. Restate is the supported implementation
+ * Durable Session Execution decides when to look at a session again; `advance` is
+ * safe to repeat (§10.1). What it owns and what the Session Store owns is said once,
+ * under "Durable Session Execution" in `src/CONTEXT.md`. Restate is the supported
+ * implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -19,7 +17,7 @@
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
  *   are sent after the Session Store transaction that caused them commits, never
- *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   inside it: the transaction writes the wake to the outbox (`Tx.wake`), and the
  *   wake is sent after commit, or by the Tenant sweep when that send failed or a
  *   crash cut it off. A wake may therefore be sent more than once, always with the
  *   same `dedupeKey`.
@@ -74,10 +72,14 @@ export type AdvanceResult = {
     retryAfterMs: number;
 };
 /** A pod sandbox's timers. */
-export type SandboxTimer = "idle" | "ttl";
-/** What `DurableExecution.sandbox` asks for: a reconcile, or a timer. */
+export type SandboxTimer = "idle";
+/**
+ * What `DurableExecution.sandbox` asks for: a reconcile, or a timer. A reconcile's `key` merges
+ * repeated sends of one request (the outbox's `signal:<row id>`); without one, every send runs.
+ */
 export type SandboxSignal = {
     kind: "reconcile";
+    key?: string;
 } | {
     kind: "arm";
     timer: SandboxTimer;

package/dist/execution/types.js

@@ -1,12 +1,10 @@
 /**
  * The Durable Session Execution seam (architecture §12.3).
  *
- * Durable Session Execution decides when to look at a session again. It never
- * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
- * key, retries, timers, the sweep chain); the Session Store owns the record (the
- * checkpoint, the effect journal, the events) and the wake outbox that bridges the
- * two. Restate is the supported implementation
+ * Durable Session Execution decides when to look at a session again; `advance` is
+ * safe to repeat (§10.1). What it owns and what the Session Store owns is said once,
+ * under "Durable Session Execution" in `src/CONTEXT.md`. Restate is the supported
+ * implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -19,7 +17,7 @@
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
  *   are sent after the Session Store transaction that caused them commits, never
- *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   inside it: the transaction writes the wake to the outbox (`Tx.wake`), and the
  *   wake is sent after commit, or by the Tenant sweep when that send failed or a
  *   crash cut it off. A wake may therefore be sent more than once, always with the
  *   same `dedupeKey`.

package/dist/gates/contract.d.ts

@@ -1,6 +1,6 @@
 /**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
+ * The gates service's wire format (blueprint §15, P1.1). Not in the published OpenAPI documents:
+ * harnesses call it, and its bodies are published in `@nylorun/core/harness-api` (R4.5).
  *
  * `POST /nylorun/v1/model-calls`
  * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
@@ -22,31 +22,10 @@
  * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
  * need not be live: a user cancel makes it stale, and still stops its call.
  */
-import { z } from "zod";
 import type { ModelGateOutcome } from "./model-gate.js";
-export declare const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, type GateErrorBody, type ModelCallBody, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export declare const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export declare const MAX_MODEL_CALL_BYTES: number;
-export declare const ModelCallBodySchema: z.ZodObject<{
-    effectId: z.ZodString;
-    invocationId: z.ZodString;
-    call: z.ZodObject<{
-        prompt: z.ZodArray<z.ZodUnknown>;
-        tools: z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-        }, z.core.$loose>>;
-    }, z.core.$loose>;
-}, z.core.$strict>;
-export type ModelCallBody = z.infer<typeof ModelCallBodySchema>;
 export interface ModelCallResponse {
     readonly outcome: ModelGateOutcome;
 }
-/** An error answer: `{error: {code, message}}`. */
-export interface GateErrorBody {
-    readonly error: {
-        readonly code: "gate_unauthorized" | "gate_forbidden" | "run_stale" | "invalid_request" | "gate_conflict";
-        readonly message: string;
-    };
-}

package/dist/gates/contract.js

@@ -1,38 +1,3 @@
-/**
- * The gates service's wire format (blueprint §15, P1.1). Internal: only the loop calls it, so
- * it is not in the published OpenAPI documents.
- *
- * `POST /nylorun/v1/model-calls`
- * - Headers: `Authorization: Bearer <run token>` (F5, `tenant/run-token.ts`), `Idempotency-Key:
- *   <effect id>`, and optionally `Nylorun-Tenant: <tenant id>`, which must then be the token's
- *   Tenant. Core's credential (`NYLORUN_GATES_TOKEN`) is refused: only a run calls the model.
- * - Body: `ModelCallBody`, at most `MAX_MODEL_CALL_BYTES`. It names no session, turn or agent:
- *   the gate takes them from the token, and refuses a body that names them.
- * - `200 {outcome}` once the call has finished, whether the outcome is a candidate or a
- *   failure; nothing is sent while it runs. `401 gate_unauthorized` for a missing, malformed,
- *   expired or foreign token, `409 run_stale` when the token's lease is no longer the
- *   session's (a cancel, a new turn, a takeover), `400 invalid_request` for a malformed Tenant
- *   header or a bad body, `409 gate_conflict` when a different request already runs under the
- *   same key.
- * - With an `Idempotency-Key` the call outlives its client (P1.2): a re-send with the same key
- *   and body joins it, or gets its outcome for 30 minutes. Without one, a client that goes
- *   away aborts the call.
- *
- * `POST /nylorun/v1/model-calls/{key}/cancel` (same headers): aborts the keyed call; `204`
- * whether or not it exists, `403 gate_forbidden` when it is another session's call. The token
- * need not be live: a user cancel makes it stale, and still stops its call.
- */
-import { z } from "zod";
-export const MODEL_CALLS_PATH = "/nylorun/v1/model-calls";
+export { MAX_MODEL_CALL_BYTES, MODEL_CALLS_PATH, ModelCallBodySchema, } from "@nylorun/core/harness-api";
 /** Header naming the Tenant a call is for: optional, and checked against the gate's Tenant. */
 export const TENANT_HEADER = "nylorun-tenant";
-/** Largest request body the gate reads: one `ModelCall` with its whole projected history. */
-export const MAX_MODEL_CALL_BYTES = 32 * 1024 * 1024;
-export const ModelCallBodySchema = z.strictObject({
-    effectId: z.string().min(1),
-    invocationId: z.string().min(1),
-    call: z.looseObject({
-        prompt: z.array(z.unknown()),
-        tools: z.array(z.looseObject({ name: z.string() })),
-    }),
-});

package/dist/gates/egress-credentials.d.ts

@@ -27,6 +27,13 @@ export interface EgressCredentials {
     /** Tests: the port requests are sent to, instead of 443. */
     readonly upstreamPort?: number;
 }
+/** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
+export declare const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
+/** What one terminated connection did so far (R7.3): requests read, credentials set (ids). */
+export interface EgressTally {
+    requests: number;
+    readonly credentialIds: Set<string>;
+}
 export interface CredentialTerminator {
     /**
      * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
@@ -39,6 +46,8 @@ export interface CredentialTerminator {
             address: string;
             family: number;
         }[];
+        /** Counted as requests are served, read when the connection closes. */
+        readonly tally: EgressTally;
     }): Promise<void>;
 }
 export declare function credentialTerminator(options: {