@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/tenant/host-token.js

@@ -16,7 +16,7 @@
  *
  * The host token is accepted only by the Harness API listener (a connection serving that one
  * sandbox, and `host.renew`); the egress token only by egress-gate, as the proxy credential
- * (`Proxy-Authorization`). Neither is a bearer anywhere else: the Tenant API's bearer check
+ * (`Proxy-Authorization`). Neither is a bearer anywhere else: the Runtime API's bearer check
  * accepts trusted issuers' tokens only, and the gates run tokens only.
  *
  * Verification reads the key row on every call (a revoked key refuses at once) and, with
@@ -26,23 +26,24 @@
 import { randomUUID } from "node:crypto";
 import { errors, importJWK, jwtVerify } from "jose";
 import { tenantTokenIssuer } from "@nylorun/core/contracts";
-import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
+import { clockToleranceSeconds, tokenKeyId } from "./jwt.js";
+import { hostTuning } from "../tuning.js";
 export const HOST_TOKEN_TYP = "nylorun-host+jwt";
 export const HOST_TOKEN_AUD = "nylorun-harness-api";
 export const EGRESS_TOKEN_TYP = "nylorun-egress+jwt";
 export const EGRESS_TOKEN_AUD = "nylorun-egress";
-/** How long a host or egress token lives. The engine renews them before. */
-export const HOST_TOKEN_TTL_SECONDS = 15 * 60;
-const LIFETIME_SLACK_SECONDS = 60;
+/** How long a host or egress token lives (`keys.hostTokenTtlSeconds`). The engine renews them before. */
+export const hostTokenTtlSeconds = () => hostTuning().keys.hostTokenTtlSeconds;
 /**
  * Mints an egress token (the only path that does): the proxy credential egress-gate accepts,
  * with egress-gate's claims (no `sub`). `mintHostTokens` mints one with every host token.
  */
 export async function mintEgressToken(signer, request) {
     const { tenantId, sandboxId, epoch, podUid } = request;
-    const ttl = request.ttl ?? HOST_TOKEN_TTL_SECONDS;
-    if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > HOST_TOKEN_TTL_SECONDS)
-        throw new Error(`An egress token lives 1 to ${HOST_TOKEN_TTL_SECONDS} s, not ${ttl}`);
+    const most = hostTokenTtlSeconds();
+    const ttl = request.ttl ?? most;
+    if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > most)
+        throw new Error(`An egress token lives 1 to ${most} s, not ${ttl}`);
     if (!Number.isSafeInteger(epoch) || epoch < 1)
         throw new Error(`Host epoch ${epoch} is not a positive integer`);
     if (sandboxId === "" || podUid === "")
@@ -68,7 +69,7 @@ export async function mintEgressToken(signer, request) {
 export async function mintHostTokens(signer, host) {
     const tenantId = signer.config.tenantId;
     const iat = Math.floor(Date.now() / 1000);
-    const exp = iat + HOST_TOKEN_TTL_SECONDS;
+    const exp = iat + hostTokenTtlSeconds();
     const [hostToken, egress] = await Promise.all([
         signer.keys.sign({
             typ: HOST_TOKEN_TYP,
@@ -129,7 +130,7 @@ export async function verifyHostToken(store, tenantId, raw, kind, cache = new Ma
             issuer: tenantTokenIssuer(tenantId),
             audience: aud,
             typ,
-            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            clockTolerance: clockToleranceSeconds(),
             requiredClaims: ["iat", "exp", "jti"],
         });
         payload = verified.payload;
@@ -148,7 +149,7 @@ export async function verifyHostToken(store, tenantId, raw, kind, cache = new Ma
         typeof epc !== "number" ||
         !Number.isSafeInteger(epc) ||
         epc < 1 ||
-        exp - iat > HOST_TOKEN_TTL_SECONDS + LIFETIME_SLACK_SECONDS)
+        exp - iat > hostTokenTtlSeconds() + hostTuning().keys.tokenLifetimeSlackSeconds)
         return refused("claims");
     return {
         ok: true,

package/dist/tenant/http.d.ts

@@ -1,11 +1,3 @@
-/**
- * The Tenant's typed rejections: what a route or the code it calls throws for the client to
- * see (`api/http/respond.ts` answers it), and the opaque 404 (D5) for what must not be told
- * apart from nothing: a capability link the Runtime did not sign, a Tenant that is not this
- * Host's. Credentials are `401` with a challenge since protocol 9 (`resource-server.ts`).
- *
- * Later waves: stable; the streams seam (Wave 2 / Y) keeps using these helpers.
- */
 /** D5's opaque failure: a 404 that says nothing of why. */
 export declare const OPAQUE_NOT_FOUND: {
     status: "rejected";
@@ -27,6 +19,11 @@ export declare class HttpError extends Error {
     headers?: Readonly<Record<string, string>>);
 }
 export declare const fail: (status: number, message: string, rejection?: Rejection, headers?: Readonly<Record<string, string>>) => never;
+/**
+ * A 409 the client may try again: `code`, and when, in `details.retryAfterSeconds` and
+ * `Retry-After` (`tenant.retryAfterSeconds`, Host tuning).
+ */
+export declare const failRetryLater: (message: string, code: string) => never;
 export declare class OpaqueAuthError extends Error {
     readonly status = 404;
     readonly body: {

package/dist/tenant/http.js

@@ -6,6 +6,7 @@
  *
  * Later waves: stable; the streams seam (Wave 2 / Y) keeps using these helpers.
  */
+import { hostTuning } from "../tuning.js";
 /** D5's opaque failure: a 404 that says nothing of why. */
 export const OPAQUE_NOT_FOUND = {
     status: "rejected",
@@ -28,6 +29,14 @@ export class HttpError extends Error {
 export const fail = (status, message, rejection, headers) => {
     throw new HttpError(status, message, rejection, headers);
 };
+/**
+ * A 409 the client may try again: `code`, and when, in `details.retryAfterSeconds` and
+ * `Retry-After` (`tenant.retryAfterSeconds`, Host tuning).
+ */
+export const failRetryLater = (message, code) => {
+    const seconds = hostTuning().tenant.retryAfterSeconds;
+    return fail(409, message, { code, details: { retryAfterSeconds: seconds } }, { "retry-after": String(seconds) });
+};
 export class OpaqueAuthError extends Error {
     status = 404;
     body = OPAQUE_NOT_FOUND;

package/dist/tenant/identity-file.d.ts

@@ -1,6 +1,6 @@
 /**
  * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
- * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
+ * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Runtime API accepts as
  * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
  * the boot with a message naming the issuer and the field. A key the file does not define is
  * ignored with a warning (`maxLifetime`, gone in protocol 9, among them), so an older file
@@ -18,6 +18,12 @@
  *     allowedScopes: [agents:read, sessions:own, environments:write]   # add studio to grant it
  *     agents: [support]                          # absent reaches every agent
  *     environments: ["{org_id}/*"]               # absent reaches no Environment
+ *     jwksFetch:                                 # how the JWKS is fetched and cached
+ *       timeoutMs: 5000                          # one fetch
+ *       maxBytes: 262144                         # the largest JWKS read
+ *       maxKeys: 64                              # keys read from it, in order
+ *       refetchMs: 60000                         # the least time between two fetches for a new kid
+ *       maxAgeMs: 600000                         # cached keys' age before a background refresh
  * ```
  */
 import { type KeyObject } from "node:crypto";
@@ -25,6 +31,21 @@ import { type IssuerScope } from "@nylorun/core/contracts";
 /** The JWT algorithms an issuer may sign with. */
 export declare const ISSUER_ALGORITHMS: readonly ["RS256", "ES256", "EdDSA"];
 export type IssuerAlgorithm = (typeof ISSUER_ALGORITHMS)[number];
+/** How an issuer's JWKS is fetched and cached (`jwksFetch`), each setting with its default. */
+export interface JwksFetchSettings {
+    /** How long one fetch may take. */
+    readonly timeoutMs: number;
+    /** The largest JWKS read; a larger one is a failed fetch. */
+    readonly maxBytes: number;
+    /** The keys read from it, in order; the rest are ignored. */
+    readonly maxKeys: number;
+    /** The least time between two fetches for a `kid` the cache has not seen. */
+    readonly refetchMs: number;
+    /** How old cached keys get before a background refresh. */
+    readonly maxAgeMs: number;
+}
+/** The `jwksFetch` an entry that sets none fetches with. */
+export declare const JWKS_FETCH_DEFAULTS: JwksFetchSettings;
 /** A public key an issuer signs with, and the one algorithm it verifies. */
 export interface IssuerKey {
     readonly key: KeyObject;
@@ -57,6 +78,8 @@ export interface TrustedIssuerConfig {
     readonly agents?: readonly string[];
     /** Environment grant templates, such as `{org_id}/*`; absent reaches no Environment. */
     readonly environments?: readonly string[];
+    /** How its JWKS is fetched; each setting left out is its default (`JWKS_FETCH_DEFAULTS`). */
+    readonly jwksFetch?: Partial<JwksFetchSettings>;
 }
 /** A malformed identity file: the message names the issuer and the field. */
 export declare class IdentityFileError extends Error {

package/dist/tenant/identity-file.js

@@ -1,6 +1,6 @@
 /**
  * The identity file (Host feature `trusted-issuers`, F9 I2): the YAML file
- * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Tenant API accepts as
+ * `NYLORUN_IDENTITY_FILE` names, listing the issuers whose JWTs the Runtime API accepts as
  * bearers. Read once at boot (`host/main.ts`); a change takes a restart. A malformed file stops
  * the boot with a message naming the issuer and the field. A key the file does not define is
  * ignored with a warning (`maxLifetime`, gone in protocol 9, among them), so an older file
@@ -18,23 +18,39 @@
  *     allowedScopes: [agents:read, sessions:own, environments:write]   # add studio to grant it
  *     agents: [support]                          # absent reaches every agent
  *     environments: ["{org_id}/*"]               # absent reaches no Environment
+ *     jwksFetch:                                 # how the JWKS is fetched and cached
+ *       timeoutMs: 5000                          # one fetch
+ *       maxBytes: 262144                         # the largest JWKS read
+ *       maxKeys: 64                              # keys read from it, in order
+ *       refetchMs: 60000                         # the least time between two fetches for a new kid
+ *       maxAgeMs: 600000                         # cached keys' age before a background refresh
  * ```
  */
 import { createPublicKey } from "node:crypto";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
-import { ISSUER_SCOPES, isEnvironmentGrant, TOKEN_ENVIRONMENT_GRANTS_MAX, TOKEN_SCOPES, } from "@nylorun/core/contracts";
+import { ISSUER_SCOPES, isEnvironmentGrant, TIMER_MAX_MS, TOKEN_SCOPES, } from "@nylorun/core/contracts";
 /** The JWT algorithms an issuer may sign with. */
 export const ISSUER_ALGORITHMS = ["RS256", "ES256", "EdDSA"];
 /** An entry's defaults: the `sub` claim, the RFC 9068 `scope` claim, every token scope but `studio`. */
 const DEFAULT_SUBJECT = "{sub}";
 const DEFAULT_SCOPES = { claim: "scope" };
 const DEFAULT_ALLOWED_SCOPES = TOKEN_SCOPES;
-/** At most this many static `keys` per issuer. */
-const MAX_STATIC_KEYS = 16;
+/**
+ * An issuer's name, 1–32 characters as an application key's id: an identifier's grammar is the
+ * protocol's (it names the issuer in tokens and principals), so its length is a constant.
+ */
 const ISSUER_NAME = /^[a-z][a-z0-9-]{0,31}$/;
 /** A claim reference in a template: `{claim}`, a top-level claim name without braces. */
 const CLAIM_REFERENCE = /\{([^{}]+)\}/g;
+/** The `jwksFetch` an entry that sets none fetches with. */
+export const JWKS_FETCH_DEFAULTS = Object.freeze({
+    timeoutMs: 5_000,
+    maxBytes: 256 * 1024,
+    maxKeys: 64,
+    refetchMs: 60_000,
+    maxAgeMs: 10 * 60_000,
+});
 /** A malformed identity file: the message names the issuer and the field. */
 export class IdentityFileError extends Error {
     constructor(message) {
@@ -79,10 +95,10 @@ export function issuerKey(key, kid) {
             throw new Error(`a ${key.asymmetricKeyType ?? "secret"} key is not accepted: use RSA (RS256), P-256 (ES256) or Ed25519 (EdDSA)`);
     }
 }
+// The identity file's author writes every template; nothing a caller sends adds to one (B15).
 const template = (what) => z
     .string()
     .min(1)
-    .max(200)
     .refine(bracesBalanced, `${what} may use braces only around a claim name, as {sub}`);
 const IssuerScopeSchema = z.enum(ISSUER_SCOPES, {
     error: (issue) => `${String(issue.input)} is not a scope an issuer may grant (one of ${ISSUER_SCOPES.join(", ")})`,
@@ -107,7 +123,8 @@ const IssuerEntrySchema = z
         }
     }, "must be an http(s) URL without credentials")
         .optional(),
-    keys: z.array(z.string().min(1)).min(1).max(MAX_STATIC_KEYS).optional(),
+    // The file's author writes every key: no count of them is a limit (B15).
+    keys: z.array(z.string().min(1)).min(1).optional(),
     subject: template("subject")
         .refine((value) => claimReferences(value).length > 0, "must reference a claim, as {sub}: without one every token is the same person")
         .default(DEFAULT_SUBJECT),
@@ -123,7 +140,17 @@ const IssuerEntrySchema = z
         .array(template("an Environment grant").refine(
     // A rendered grant must be a grant: checked here with a sample value per claim.
     (value) => isEnvironmentGrant(renderTemplate(value, () => "x")), "must render to an Environment id or a prefix ending in /*, as {org_id}/*"))
-        .max(TOKEN_ENVIRONMENT_GRANTS_MAX)
+        .optional(),
+    jwksFetch: z
+        .object({
+        // A fetch is timed with a JavaScript timer.
+        timeoutMs: z.number().int().positive().max(TIMER_MAX_MS).optional(),
+        maxBytes: z.number().int().positive().optional(),
+        maxKeys: z.number().int().positive().optional(),
+        refetchMs: z.number().int().nonnegative().optional(),
+        maxAgeMs: z.number().int().nonnegative().optional(),
+    })
+        .strict()
         .optional(),
 });
 const IdentityFileSchema = z.object({ issuers: z.array(z.unknown()) });
@@ -211,6 +238,7 @@ export function parseIdentityFile(text, source = "identity file", options = {})
             issuer: value.issuer,
             audience: value.audience,
             ...(value.jwks ? { jwks: value.jwks } : {}),
+            ...(value.jwksFetch ? { jwksFetch: value.jwksFetch } : {}),
             ...(keys ? { keys } : {}),
             subject: value.subject,
             scopes: value.scopes,

package/dist/tenant/issuers.d.ts

@@ -1,15 +1,15 @@
 import { type JWTPayload } from "jose";
 import type { AuthScope, TenantContext } from "./context.js";
 import { type TrustedIssuerConfig } from "./identity-file.js";
-/** The byte cap of an issuer's token; Nylorun's own token families keep 4 KiB. */
+/**
+ * The longest issuer token read: a bearer arrives in a request's headers, which Node refuses past
+ * `http.maxHeaderSize` (16 KiB unless `--max-http-header-size` says otherwise). A dependency's
+ * constant, not a limit (B15).
+ */
 export declare const MAX_ISSUER_TOKEN_BYTES: number;
 export interface TrustedIssuersOptions {
     /** Fetches JWKS URLs. Default: the global fetch. */
     fetch?: typeof fetch;
-    /** The least time between two JWKS fetches of one issuer for an unknown `kid`. Default 60 s. */
-    refetchMs?: number;
-    /** How old cached JWKS keys get before a background refresh. Default 10 minutes. */
-    maxAgeMs?: number;
     /** Milliseconds since the epoch. Default `Date.now`. */
     now?: () => number;
 }

package/dist/tenant/issuers.js

@@ -4,11 +4,12 @@
  * A token is one of theirs when its unverified `iss` names a configured issuer; it is then
  * verified like this, and nothing else is tried:
  *
- * - at most 16 KiB (identity providers' tokens often pass Nylorun's 4 KiB), RS256, ES256 or
- *   EdDSA, and no header that could name another key (`jku`, `jwk`, `x5u`, `x5c`, `crit`);
+ * - no longer than a request's headers may be (`http.maxHeaderSize`), RS256, ES256 or EdDSA, and
+ *   no header that could name another key (`jku`, `jwk`, `x5u`, `x5c`, `crit`);
  * - signed by a key of the issuer: its static `keys`, or its JWKS, fetched only from the
  *   configured URL (`redirect: "error"`), cached by `kid`, refetched at most once a minute for
- *   a `kid` it has not seen, and refreshed in the background once the cache is 10 minutes old.
+ *   a `kid` it has not seen, and refreshed in the background once the cache is 10 minutes old
+ *   (the entry's `jwksFetch` settings, these by default).
  *   When the JWKS cannot be fetched, cached keys keep working and a new `kid` is
  *   `401 issuer_unavailable`;
  * - `iss` and `aud` as configured, and `exp` present, with the 30 s clock tolerance of every
@@ -21,22 +22,27 @@
  * (`resource-server.ts`), its reason logged.
  */
 import { createHash, createPublicKey } from "node:crypto";
+import { maxHeaderSize } from "node:http";
 import { decodeJwt, decodeProtectedHeader, errors, jwtVerify } from "jose";
 import { isSubject } from "@nylorun/core/contracts";
 import { HttpError } from "./http.js";
-import { CLOCK_TOLERANCE_SECONDS, looksLikeToken } from "./jwt.js";
+import { clockToleranceSeconds, looksLikeToken } from "./jwt.js";
 import { bearerChallenge, failCredential } from "./resource-server.js";
-import { ISSUER_ALGORITHMS, issuerKey, renderTemplate, } from "./identity-file.js";
-/** The byte cap of an issuer's token; Nylorun's own token families keep 4 KiB. */
-export const MAX_ISSUER_TOKEN_BYTES = 16 * 1024;
+import { ISSUER_ALGORITHMS, issuerKey, JWKS_FETCH_DEFAULTS, renderTemplate, } from "./identity-file.js";
+/**
+ * The longest issuer token read: a bearer arrives in a request's headers, which Node refuses past
+ * `http.maxHeaderSize` (16 KiB unless `--max-http-header-size` says otherwise). A dependency's
+ * constant, not a limit (B15).
+ */
+export const MAX_ISSUER_TOKEN_BYTES = maxHeaderSize;
 /** Subjects the Runtime keeps for itself: never an issuer token's. */
+/**
+ * The longest token id kept as it is, 200 characters as the Runtime's other ids: an identifier's
+ * grammar is the protocol's, so a constant.
+ */
+const TOKEN_ID_MAX = 200;
 const RESERVED = new Set(["host", "installation"]);
 const FORBIDDEN_HEADERS = ["jku", "jwk", "x5u", "x5c", "crit"];
-const JWKS_TIMEOUT_MS = 5000;
-const JWKS_MAX_BYTES = 256 * 1024;
-const JWKS_MAX_KEYS = 64;
-const DEFAULT_REFETCH_MS = 60_000;
-const DEFAULT_MAX_AGE_MS = 10 * 60_000;
 /** A grant's claim value: one Environment id segment, so a claim never widens the template. */
 const GRANT_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** The issuer's public keys: static, or its JWKS's as last fetched. */
@@ -49,11 +55,13 @@ class IssuerKeys {
     okAt = Number.NEGATIVE_INFINITY;
     lastOk;
     inflight;
+    settings;
     constructor(config, options) {
         this.config = config;
         this.options = options;
         for (const key of config.keys ?? [])
             this.unnamed.push(key);
+        this.settings = { ...JWKS_FETCH_DEFAULTS, ...config.jwksFetch };
     }
     /** The keys that may have signed a token with `kid` and `alg`, or `unavailable`. */
     async candidates(kid, alg) {
@@ -75,13 +83,13 @@ class IssuerKeys {
         if (found.length === 0) {
             if (this.inflight)
                 await this.inflight;
-            else if (now - this.fetchedAt >= this.options.refetchMs)
+            else if (now - this.fetchedAt >= this.settings.refetchMs)
                 await this.refresh();
             found = pick();
             if (found.length === 0 && this.lastOk === false)
                 return "unavailable";
         }
-        else if (now - this.okAt >= this.options.maxAgeMs && now - this.fetchedAt >= this.options.refetchMs) {
+        else if (now - this.okAt >= this.settings.maxAgeMs && now - this.fetchedAt >= this.settings.refetchMs) {
             // Old keys keep working while the refresh runs, and when it fails.
             void this.refresh();
         }
@@ -101,19 +109,19 @@ class IssuerKeys {
             const response = await this.options.fetch(this.config.jwks, {
                 redirect: "error",
                 headers: { accept: "application/jwk-set+json, application/json" },
-                signal: AbortSignal.timeout(JWKS_TIMEOUT_MS),
+                signal: AbortSignal.timeout(this.settings.timeoutMs),
             });
             if (!response.ok)
                 throw new Error(`JWKS answered ${response.status}`);
             const text = await response.text();
-            if (Buffer.byteLength(text) > JWKS_MAX_BYTES)
+            if (Buffer.byteLength(text) > this.settings.maxBytes)
                 throw new Error("JWKS is too large");
             const body = JSON.parse(text);
             if (!Array.isArray(body.keys))
                 throw new Error("JWKS has no keys array");
             const byKid = new Map();
             const unnamed = [];
-            for (const jwk of body.keys.slice(0, JWKS_MAX_KEYS)) {
+            for (const jwk of body.keys.slice(0, this.settings.maxKeys)) {
                 const key = jwkKey(jwk);
                 if (!key)
                     continue;
@@ -143,7 +151,8 @@ function jwkKey(jwk) {
         return undefined; // a private key: never trusted as published
     if (entry.alg !== undefined && !ISSUER_ALGORITHMS.includes(entry.alg))
         return undefined;
-    const kid = typeof entry.kid === "string" && entry.kid.length <= 256 ? entry.kid : undefined;
+    // A `kid` longer than a token may be names no token's key.
+    const kid = typeof entry.kid === "string" && entry.kid.length <= MAX_ISSUER_TOKEN_BYTES ? entry.kid : undefined;
     try {
         const key = issuerKey(createPublicKey({ key: jwk, format: "jwk" }), kid);
         return entry.alg === undefined || entry.alg === key.alg ? key : undefined;
@@ -186,12 +195,12 @@ function trustedIssuer(config, options) {
                         algorithms: [candidate.alg],
                         issuer: config.issuer,
                         audience: config.audience,
-                        clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                        clockTolerance: clockToleranceSeconds(),
                         requiredClaims: ["exp"],
                         currentDate: new Date(options.now()),
                     });
                     const now = Math.floor(options.now() / 1000);
-                    if (payload.iat !== undefined && payload.iat > now + CLOCK_TOLERANCE_SECONDS)
+                    if (payload.iat !== undefined && payload.iat > now + clockToleranceSeconds())
                         return refuse("invalid", "issuer_token_future");
                     return { ok: true, payload, ...(kid !== undefined ? { kid } : {}) };
                 }
@@ -212,8 +221,6 @@ function trustedIssuer(config, options) {
 export function createTrustedIssuers(configs, options = {}) {
     const resolved = {
         fetch: options.fetch ?? ((input, init) => globalThis.fetch(input, init)),
-        refetchMs: options.refetchMs ?? DEFAULT_REFETCH_MS,
-        maxAgeMs: options.maxAgeMs ?? DEFAULT_MAX_AGE_MS,
         now: options.now ?? Date.now,
     };
     const issuers = configs.map((config) => trustedIssuer(config, resolved));
@@ -300,7 +307,8 @@ export async function verifyIssuerToken(ctx, issuer, raw, resourceMetadata) {
         // A grant whose claim is missing or not one id segment reaches nothing.
         return rendered === undefined ? [] : [rendered];
     });
-    const jti = typeof payload.jti === "string" && payload.jti.length > 0 && payload.jti.length <= 200
+    // A `jti` longer than an id the Runtime keeps (`TOKEN_ID_MAX`) is replaced by the token's hash.
+    const jti = typeof payload.jti === "string" && payload.jti.length > 0 && payload.jti.length <= TOKEN_ID_MAX
         ? payload.jti
         : createHash("sha256").update(raw).digest("base64url");
     return {

package/dist/tenant/jwt.d.ts

@@ -1,5 +1,11 @@
-export declare const MAX_TOKEN_BYTES = 4096;
-export declare const CLOCK_TOLERANCE_SECONDS = 30;
+/**
+ * The longest token read: a token arrives in a request's headers (a bearer) or its URL (a
+ * capability link), which Node refuses past `http.maxHeaderSize` (16 KiB unless
+ * `--max-http-header-size` says otherwise). A dependency's constant, not a limit (B15).
+ */
+export declare const MAX_TOKEN_BYTES: number;
+/** The clock skew accepted when a token's times are checked (`keys.clockToleranceSeconds`). */
+export declare const clockToleranceSeconds: () => number;
 /** True when `bearer` has the shape of a JWT; application keys never do. */
 export declare function looksLikeToken(bearer: string): boolean;
 /** The `typ` of a JWT-shaped bearer, or `undefined` when its header cannot be read. */

package/dist/tenant/jwt.js

@@ -3,10 +3,18 @@
  * the Tenant's ES256 JWTs, recognised by shape, told apart by their `typ`, and refused before
  * any key is read when the header is not one the Runtime issues.
  */
+import { maxHeaderSize } from "node:http";
 import { decodeProtectedHeader } from "jose";
 import { SIGNING_KEY_ID_PATTERN } from "@nylorun/core/compatibility";
-export const MAX_TOKEN_BYTES = 4096;
-export const CLOCK_TOLERANCE_SECONDS = 30;
+import { hostTuning } from "../tuning.js";
+/**
+ * The longest token read: a token arrives in a request's headers (a bearer) or its URL (a
+ * capability link), which Node refuses past `http.maxHeaderSize` (16 KiB unless
+ * `--max-http-header-size` says otherwise). A dependency's constant, not a limit (B15).
+ */
+export const MAX_TOKEN_BYTES = maxHeaderSize;
+/** The clock skew accepted when a token's times are checked (`keys.clockToleranceSeconds`). */
+export const clockToleranceSeconds = () => hostTuning().keys.clockToleranceSeconds;
 const JWT_SHAPE = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
 const FORBIDDEN_HEADERS = ["jku", "jwk", "x5u", "x5c", "x5t", "crit"];
 /** True when `bearer` has the shape of a JWT; application keys never do. */

package/dist/tenant/limits.d.ts

@@ -0,0 +1,90 @@
+/**
+ * What artifacts, skills and disk versions may hold: the Tenant's limits (`artifacts.config`,
+ * `skills.config` here, and the Runtime limits `diskVersion*` of `limits.config`), and an
+ * Environment's, which its manifest sets (`limits`). A limit the manifest leaves out is the
+ * Tenant's as it is when the limit is checked, and none is ever above the Tenant's: a manifest
+ * asking for more is refused when the Environment is made, and a Tenant that lowers a limit
+ * later lowers it for every Environment.
+ *
+ * Also the shape a manifest and an Environment's labels must fit, which the Tenant's Runtime
+ * limits set (`manifestShapeIssues`, `labelIssues`), checked when they are put rather than by
+ * their schemas (B15).
+ */
+import { type EnvironmentFile, type EnvironmentLimits, type EnvironmentSecretSlots, type EnvironmentSetupCommand, type RuntimeLimits, type TenantSkillsConfig, type ToolRule } from "@nylorun/core/contracts";
+import { type ArtifactLimits } from "../artifacts/config.js";
+export declare const SKILLS_CONFIG_SETTING = "skills.config";
+export interface SkillLimits {
+    readonly totalBytes: number;
+}
+/** What one version of an Environment's disk may hold. */
+export interface DiskLimits {
+    readonly versionBytes: number;
+    readonly versionEntries: number;
+}
+/** The limits an Environment's artifacts, skills and disk versions are held to. */
+export interface StorageLimits {
+    readonly artifacts: ArtifactLimits;
+    readonly skills: SkillLimits;
+    readonly disk: DiskLimits;
+}
+interface SettingsReader {
+    getSetting(key: string): Promise<string | undefined>;
+}
+interface SettingsWriter extends SettingsReader {
+    putSetting(key: string, value: string): Promise<void>;
+}
+/** The skill limits in force: the Tenant's, with the default for what it leaves unset. */
+export declare function effectiveSkillLimits(config: TenantSkillsConfig): SkillLimits;
+export declare function readSkillsConfig(t: SettingsReader): Promise<TenantSkillsConfig>;
+export declare function readSkillLimits(t: SettingsReader): Promise<SkillLimits>;
+export declare function writeSkillsConfig(t: SettingsWriter, config: TenantSkillsConfig): Promise<void>;
+/** The Tenant's artifact, skill and disk version limits. */
+export declare function readTenantLimits(t: SettingsReader): Promise<StorageLimits>;
+/** The limits in force for an Environment whose manifest sets `set`: each within the Tenant's. */
+export declare function limitsInForce(tenant: StorageLimits, set: EnvironmentLimits | undefined): StorageLimits;
+/** Why a manifest's `limits` cannot be made: each limit above the Tenant's. */
+export declare function limitIssues(set: EnvironmentLimits | undefined, tenant: StorageLimits): string[];
+/**
+ * Why `labels` cannot be set: more than the Tenant's Runtime limit `count` names
+ * (`environmentLabels` or `artifactLabels`), or a key or a value longer than `labelKeyChars` or
+ * `labelValueChars`.
+ */
+export declare function labelIssues(labels: Readonly<Record<string, string>> | undefined, limits: RuntimeLimits, count?: "environmentLabels" | "artifactLabels"): string[];
+/** The parts of a manifest whose shape the Tenant's Runtime limits set. */
+export interface ManifestShape {
+    readonly description?: string | undefined;
+    readonly setup?: readonly EnvironmentSetupCommand[] | undefined;
+    readonly files?: readonly EnvironmentFile[] | undefined;
+    readonly secrets?: EnvironmentSecretSlots | undefined;
+}
+/**
+ * Why a secret write does not fit the Tenant's Runtime limits: an `environment_secret`'s or an
+ * `environment_variable`'s value past `secretValueChars`, or more hosts than `secretHosts`.
+ */
+export declare function secretRequestIssues(request: {
+    readonly type: string;
+    readonly value?: unknown;
+    readonly allowedHosts?: readonly string[];
+}, limits: RuntimeLimits): string[];
+/**
+ * Why a tool policy does not fit the Tenant's Runtime limits: more rules than `toolRules`, a
+ * selector or a `when` path past `toolRuleFieldChars`, a `reason` or a `matches` past
+ * `toolRuleTextChars`.
+ */
+export declare function toolPolicyIssues(rules: readonly ToolRule[], limits: RuntimeLimits): string[];
+/** Why a set of model budgets does not fit: more than the Tenant's Runtime limit `modelBudgets`. */
+export declare function budgetIssues(budgets: readonly unknown[], limits: RuntimeLimits): string[];
+/**
+ * Why an agent's `requires` does not fit: more secrets than an Environment's manifest may declare
+ * slots for (the Runtime limit `environmentSecretSlots`).
+ */
+export declare function requiresIssues(requires: {
+    readonly secrets?: readonly string[];
+} | undefined, limits: RuntimeLimits): string[];
+/**
+ * Why a manifest (inline, or saved) does not fit the Tenant's Runtime limits: its description,
+ * its setup commands, their lengths and timeouts, its input file entries and the files of each,
+ * and its secret slots, their descriptions and hosts.
+ */
+export declare function manifestShapeIssues(manifest: ManifestShape, limits: RuntimeLimits): string[];
+export {};