@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/adapters/sandbox/virtual.js

@@ -7,7 +7,7 @@
 import { mkdirSync, readdirSync, rmSync } from "node:fs";
 import { join, posix } from "node:path";
 import { SANDBOX_WORKSPACE } from "@nylorun/core/define";
-import { SandboxFileTooLargeError } from "../../sandbox/types.js";
+import { SandboxFileTooLargeError, wholeBytes } from "../../sandbox/types.js";
 const ENV = Object.freeze({
     PATH: "/usr/local/bin:/usr/bin:/bin",
     HOME: SANDBOX_WORKSPACE,
@@ -143,7 +143,7 @@ export function virtualBackend(options) {
                     return { entries, truncated: !complete };
                 },
                 async writeFile(path, content) {
-                    await (typeof content === "string" ? fs.writeFile(path, content, "utf8") : fs.writeFile(path, content));
+                    await (typeof content === "string" ? fs.writeFile(path, content, "utf8") : fs.writeFile(path, await wholeBytes(content)));
                 },
                 async stop() { },
             };

package/dist/adapters/streams/s2.d.ts

@@ -11,7 +11,7 @@ export interface S2StreamsOptions {
     basinPrefix?: string;
     /**
      * How long `ensureTenant` waits for a previous deletion of the same basin to
-     * finish. Defaults to two minutes.
+     * finish. Default `streams.s2BasinDeletionWaitMs` (Host tuning, two minutes).
      */
     basinDeletionWaitMs?: number;
 }

package/dist/adapters/streams/s2.js

@@ -59,13 +59,14 @@
 import { AppendInput, AppendRecord, RangeNotSatisfiableError, S2, S2Error, SeqNumMismatchError, } from "@s2-dev/streamstore";
 import { parseBasin, tenantBasinName, validateBasinPrefix } from "../../streams/basin.js";
 import { sleep } from "../../retry.js";
+import { hostTuning, S2_BATCH_MAX_RECORDS } from "../../tuning.js";
 import {} from "../../streams/types.js";
-/** Records per unary read while reading history. */
-const HISTORY_PAGE = 1000;
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
-/** Attempts for an append that loses a `transaction_conflict` race. */
-const CONFLICT_ATTEMPTS = 6;
+/**
+ * Records per unary read while reading history: the most one S2 read returns. Retries are the Host
+ * tuning's `streams.s2Retry`, `s2ConflictAttempts` (an append that loses a `transaction_conflict`
+ * race), `s2ConflictRetryMs` and `s2BasinRetryMs`.
+ */
+const HISTORY_PAGE = S2_BATCH_MAX_RECORDS;
 export function createS2Streams(options = {}) {
     return new S2Streams(options);
 }
@@ -77,7 +78,7 @@ class S2Streams {
     closing = new AbortController();
     constructor(options) {
         this.prefix = validateBasinPrefix(options.basinPrefix ?? "");
-        this.deletionWaitMs = options.basinDeletionWaitMs ?? 120_000;
+        this.deletionWaitMs = options.basinDeletionWaitMs ?? hostTuning().streams.s2BasinDeletionWaitMs;
         this.s2 = new S2({
             accessToken: options.token ?? "s2-lite",
             ...(options.endpoint
@@ -99,7 +100,8 @@ class S2Streams {
             ...(options.matchSeq !== undefined ? { matchSeqNum: options.matchSeq } : {}),
         });
         const handle = this.handle(tenantId, stream);
-        let delay = RETRY_MIN_MS / 4;
+        const { s2ConflictRetryMs, s2ConflictAttempts } = hostTuning().streams;
+        let delay = s2ConflictRetryMs;
         for (let attempt = 1;; attempt += 1) {
             try {
                 const ack = await handle.append(input, { signal: this.closing.signal });
@@ -110,7 +112,7 @@ class S2Streams {
                     return { status: "seq_mismatch", tail: error.expectedSeqNum };
                 // Concurrent appends to one stream can abort each other; the aborted
                 // one wrote nothing, so it is retried.
-                if (!isTransactionConflict(error) || attempt >= CONFLICT_ATTEMPTS)
+                if (!isTransactionConflict(error) || attempt >= s2ConflictAttempts)
                     throw error;
                 await sleep(delay * (1 + Math.random()), this.closing.signal);
                 this.checkOpen();
@@ -143,7 +145,8 @@ class S2Streams {
         this.checkOpen();
         const basin = this.basinName(tenantId);
         const deadline = Date.now() + this.deletionWaitMs;
-        let delay = RETRY_MIN_MS * 5;
+        const tuning = hostTuning().streams;
+        let delay = tuning.s2BasinRetryMs;
         for (;;) {
             try {
                 await this.s2.basins.ensure({
@@ -165,7 +168,7 @@ class S2Streams {
                     throw error;
                 await sleep(delay, this.closing.signal);
                 this.checkOpen();
-                delay = Math.min(delay * 2, RETRY_MAX_MS);
+                delay = Math.min(delay * 2, tuning.s2Retry.maxMs);
             }
         }
     }
@@ -271,7 +274,8 @@ class S2Streams {
         const aborted = anySignal(signal, this.closing.signal);
         const handle = this.handle(tenantId, stream);
         let next = fromSeq;
-        let delay = RETRY_MIN_MS;
+        const { minMs: retryMinMs, maxMs: retryMaxMs } = hostTuning().streams.s2Retry;
+        let delay = retryMinMs;
         try {
             while (!aborted.aborted) {
                 try {
@@ -283,7 +287,7 @@ class S2Streams {
                         if (record.seqNum < next)
                             continue;
                         next = record.seqNum + 1;
-                        delay = RETRY_MIN_MS;
+                        delay = retryMinMs;
                         yield toRecord(record);
                         if (aborted.aborted)
                             return;
@@ -300,7 +304,7 @@ class S2Streams {
                     // S2 unreachable, or a stream being deleted: retry below.
                 }
                 await sleep(delay, aborted);
-                delay = Math.min(delay * 2, RETRY_MAX_MS);
+                delay = Math.min(delay * 2, retryMaxMs);
             }
         }
         finally {

package/dist/api/a2a/card.d.ts

@@ -1,6 +1,6 @@
 /**
- * The Agent Card of one agent, from its manifest: name, description and one skill, never its
- * instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
+ * The Agent Card of one Agent, from its manifest version: its id as the name, the manifest's
+ * description and one skill, never its instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
  * `supportedInterfaces` is empty: whoever publishes the card (the gateway in v1) adds its own
  * URL, provider and security schemes.
  */
@@ -10,7 +10,8 @@ export interface CardDefinition {
         name?: unknown;
         description?: unknown;
     };
-    readonly implementationVersion: string;
+    /** The manifest version the Agent runs, as `name@version`. */
+    readonly version: string;
 }
 import type { ModelInput } from "@nylorun/core/contracts";
 /**

package/dist/api/a2a/card.js

@@ -1,10 +1,10 @@
 /**
- * The Agent Card of one agent, from its manifest: name, description and one skill, never its
- * instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
+ * The Agent Card of one Agent, from its manifest version: its id as the name, the manifest's
+ * description and one skill, never its instructions, tools or MCP servers. The Runtime does not know where callers reach it, so
  * `supportedInterfaces` is empty: whoever publishes the card (the gateway in v1) adds its own
  * URL, provider and security schemes.
  */
-import { MODEL_IMAGE_TYPES } from "../../artifacts/media-types.js";
+import { MODEL_IMAGE_TYPES } from "@nylorun/core/contracts";
 const MODES = ["text/plain", "application/json"];
 /** The media types a card advertises for each file input a model reads. */
 const INPUT_MODES = {
@@ -39,7 +39,7 @@ export function agentCard(agentId, definition, inputModes = MODES) {
         name,
         description,
         supportedInterfaces: [],
-        version: definition.implementationVersion,
+        version: definition.version,
         capabilities: { streaming: false, pushNotifications: false, extendedAgentCard: false },
         defaultInputModes: [...inputModes],
         defaultOutputModes: MODES,

package/dist/api/a2a/endpoint.js

@@ -1,6 +1,5 @@
 import { z } from "zod";
-import { readText } from "../http/body.js";
-import { INLINE_BODY_MAX_BYTES } from "../inbound-files.js";
+import { bodyLimit, readText } from "../http/body.js";
 import { TraceHeaders, tenantRoute } from "../http/define.js";
 import { traceContextOf } from "../../traces/ids.js";
 import { jsonResponse } from "../http/respond.js";
@@ -57,7 +56,7 @@ export function a2aRoutes(api) {
         path: "/v1/a2a/agents/{agentId}",
         tags: TAGS,
         summary: "Call an agent over A2A",
-        description: "A2A 1.0 JSON-RPC, for a subject: `SendMessage` (blocking up to 5 minutes, or `returnImmediately`), `GetTask` and `CancelTask`. A message is text, one data part, or text and `raw` files (at most 20 MiB each, stored as artifacts of the context's session); a file `url` is `ContentTypeNotSupportedError`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors.",
+        description: "A2A 1.0 JSON-RPC, for a subject: `SendMessage` (blocking up to the Runtime limit `a2aWaitMs`, 5 minutes by default, or `returnImmediately`), `GetTask` and `CancelTask`. A message is text, one data part, or text and `raw` files (at most the Runtime limit `inlineFileBytes` each, 20 MiB by default, stored as artifacts of the context's session); a file `url` is `ContentTypeNotSupportedError`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors.",
         externalDocs: A2A_SPECIFICATION,
         request: {
             params: agentId,
@@ -79,7 +78,7 @@ export function a2aRoutes(api) {
         const trace = traceContextOf(c.req.raw.headers);
         return jsonResponse(200, await a2aCall(c.env.tenant, scope, c.req.param("agentId"), {
             // A message may carry files inline.
-            body: () => readText(c.req.raw, INLINE_BODY_MAX_BYTES),
+            body: async () => readText(c.req.raw, await bodyLimit(c.env.tenant, "inline")),
             version: typeof version === "string" ? version : (c.req.query("A2A-Version") ?? null),
             ...(trace ? { trace } : {}),
         }, c.env.outgoing));

package/dist/api/a2a/protocol.js

@@ -109,6 +109,10 @@ export function checkVersion(value) {
     if (`${major}.${minor}` !== A2A_VERSION)
         a2aFail("versionNotSupported", `A2A version ${trimmed === "" ? "0.3" : trimmed} is not supported; send A2A-Version: ${A2A_VERSION}`, { supportedVersions: A2A_VERSION });
 }
+/**
+ * At most 200 characters: an identifier's grammar is the protocol's (B15), the same in every
+ * installation, so its length is a constant, not a setting.
+ */
 const MAX_ID = 200;
 const VISIBLE = /^[\x21-\x7e]+$/;
 function checkId(value, field, required) {

package/dist/api/a2a/routes.d.ts

@@ -1,14 +1,10 @@
 import type { ServerResponse } from "node:http";
 import { type AuthScope, type TenantContext } from "../../tenant/context.js";
 import type { TraceContext } from "../../traces/ids.js";
-/**
- * How long a blocking `SendMessage` waits for the task to end or ask for input. After it, the
- * task is returned `WORKING` and keeps running; the caller polls `GetTask`.
- */
-export declare const A2A_BLOCKING_WAIT_MS: number;
 /**
  * `GET /v1/a2a/agents/:agent/card`: the agent's card, for a caller who may use the agent. Its
- * input modes name the files the Tenant's model reads.
+ * input modes name the files the Tenant's model reads natively: a hint, since any file is
+ * accepted and the agent's harness decides how its model sees it (protocol 15).
  */
 export declare function a2aCard(ctx: TenantContext, scope: AuthScope, agentId: string): Promise<unknown>;
 /**

package/dist/api/a2a/routes.js

@@ -17,31 +17,29 @@
 import { randomUUID } from "node:crypto";
 import { SessionCommandSchema, } from "@nylorun/core/contracts";
 import { commandKey } from "../../core/flow-host.js";
-import { contentTypeFor } from "../../artifacts/media-types.js";
+import { contentTypeFor } from "@nylorun/core/contracts";
 import { discardFiles, inlineFileName, messageParts, } from "../inbound-files.js";
 import { agentCard, inputModesFor } from "./card.js";
 import { A2aError, a2aFail, checkVersion, jsonRpcError, jsonRpcResult, parseEnvelope, parseSendParams, parseTaskParams, } from "./protocol.js";
 import { SETTLED_EVENTS, buildTask, contextSessionId, newContextId, parseTaskId, pendingInteraction, taskIdOf, } from "./tasks.js";
-import { currentModelInputs } from "../../model/catalog.js";
+import { currentModelDescriptor } from "../../model/descriptor.js";
 import { accessOf } from "../../tenant/auth.js";
 import { command } from "../../tenant/commands.js";
-import { loadSession, } from "../../tenant/context.js";
+import { loadSession, reachesAgent, } from "../../tenant/context.js";
+import { agentGrantsOf, liveEnvironment } from "../../tenant/agents.js";
 import { HttpError, fail } from "../../tenant/http.js";
 import { observeSession, readHistory } from "../../tenant/session-streams.js";
 import { putSession } from "../../tenant/sessions.js";
-/**
- * How long a blocking `SendMessage` waits for the task to end or ask for input. After it, the
- * task is returned `WORKING` and keeps running; the caller polls `GetTask`.
- */
-export const A2A_BLOCKING_WAIT_MS = 5 * 60_000;
+import { readRuntimeLimits } from "../../tenant/runtime-limits.js";
 /**
  * `GET /v1/a2a/agents/:agent/card`: the agent's card, for a caller who may use the agent. Its
- * input modes name the files the Tenant's model reads.
+ * input modes name the files the Tenant's model reads natively: a hint, since any file is
+ * accepted and the agent's harness decides how its model sees it (protocol 15).
  */
 export async function a2aCard(ctx, scope, agentId) {
     const definition = await definitionFor(ctx, agentId, accessOf(scope));
-    // The files a caller may send: those the Tenant's model reads now.
-    return agentCard(agentId, definition, inputModesFor(await currentModelInputs(ctx)));
+    // The files the Tenant's model reads now.
+    return agentCard(agentId, definition, inputModesFor((await currentModelDescriptor(ctx))?.inputs));
 }
 /**
  * `POST /v1/a2a/agents/:agent`: one A2A JSON-RPC call, for a subject. JSON-RPC answers (errors
@@ -108,12 +106,22 @@ async function operation(caller, request, signal) {
             return a2aFail("methodNotFound", `Method ${request.method} not found`);
     }
 }
-/** The agent's definition, or a `404` when it is missing or the caller may not use it. */
+/**
+ * What the card of Agent `agentId` says (the manifest version it runs), or a `404` when it is
+ * missing or the caller may not use it. Every caller's session runs on that Agent, with its disk
+ * and vault (D66, D70): an app that serves several audiences makes an Agent for each.
+ */
 async function definitionFor(ctx, agentId, access) {
-    if (access?.agents !== undefined && !access.agents.has(agentId))
+    if (!reachesAgent(access, agentId))
         return fail(404, "Agent not found");
-    const definition = await ctx.store.tx((t) => t.get("definitions", agentId));
-    return definition ?? fail(404, "Agent not found");
+    return ctx.store.tx(async (t) => {
+        const agent = (await liveEnvironment(t, agentId)) ?? fail(404, "Agent not found");
+        const version = await t.agentManifest(agent.manifestName, agent.manifestVersion);
+        return {
+            manifest: { id: agentId, ...(version?.body.description === undefined ? {} : { description: version.body.description }) },
+            version: `${agent.manifestName}@${agent.manifestVersion}`,
+        };
+    });
 }
 const taskNotFound = (taskId) => a2aFail("taskNotFound", "Task not found", { taskId });
 /** The caller's session for a context, or undefined when it does not exist yet. */
@@ -155,11 +163,6 @@ conflict) {
     catch (error) {
         if (!(error instanceof HttpError))
             throw error;
-        // A file the agent's model does not read (`attachment_unsupported`).
-        if (error.status === 422)
-            return a2aFail("contentTypeNotSupported", error.message, {
-                reason: error.rejection.code ?? "request_rejected",
-            });
         if (error.status !== 409)
             throw error;
         if (error.message.startsWith("Idempotency key"))
@@ -174,9 +177,9 @@ async function openContext(caller, sessionId) {
         return existing;
     return putSession(caller.ctx, sessionId, {
         requestId: randomUUID(),
-        agentId: caller.agentId,
+        agent: caller.agentId,
         ownerUserId: caller.access.owner,
-    }, caller.access);
+    }, caller.access, agentGrantsOf(caller.scope) === undefined ? {} : { agentGrants: agentGrantsOf(caller.scope) });
 }
 async function sendMessage(caller, params, signal) {
     const send = parseSendParams(params);
@@ -320,14 +323,16 @@ async function cancelTask(caller, taskId) {
     return (await ownedTask(caller, taskId)).task;
 }
 /**
- * Waits until the turn ends, pauses or has an uncertain effect, the caller hangs up, or
- * `A2A_BLOCKING_WAIT_MS` passes. Follows the session's shared stream from the command's
+ * Waits until the turn ends, pauses or has an uncertain effect, the caller hangs up, or the
+ * Tenant's Runtime limit `a2aWaitMs` passes: after it, the task is returned `WORKING` and keeps
+ * running, and the caller polls `GetTask`. Follows the session's shared stream from the command's
  * cursor, so the events the task is built from are there when it returns. A feed that ends
  * (reset, deleted, closing) ends the wait: the task says what the session says then.
  */
 async function settled(ctx, sessionId, turnId, cursor, signal) {
     const stop = new AbortController();
-    const timer = setTimeout(() => stop.abort(), A2A_BLOCKING_WAIT_MS);
+    const { a2aWaitMs } = await ctx.store.tx((t) => readRuntimeLimits(t));
+    const timer = setTimeout(() => stop.abort(), a2aWaitMs);
     timer.unref();
     const hangup = () => stop.abort();
     signal.addEventListener("abort", hangup, { once: true });

package/dist/api/ag-ui/endpoint.js

@@ -2,7 +2,6 @@ import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { z } from "zod";
 import { EventSchemas, MessageSchema, RunAgentInputSchema } from "@ag-ui/core/schemas";
 import { readJson } from "../http/body.js";
-import { INLINE_BODY_MAX_BYTES } from "../inbound-files.js";
 import { TraceHeaders, tenantRoute } from "../http/define.js";
 import { traceContextOf } from "../../traces/ids.js";
 import { jsonResponse } from "../http/respond.js";
@@ -51,7 +50,7 @@ export function agUiRoutes(api) {
         path: "/v1/ag-ui/agents/{agentId}",
         tags: TAGS,
         summary: "Run an agent",
-        description: "For a person, named by a trusted issuer's token or by `Nylorun-Subject`. The thread is one session per person, agent and thread, created on its first run with `forwardedProps.nylorun.session`. The trailing user message starts a turn (its id is the idempotency key); its media parts are files: bytes sent inline (`data`, at most 20 MiB each) are stored as artifacts of the session, a `file` source with provider `nylorun` names an artifact, and a URL is refused. `resume` answers interrupts. A busy session, or a file the model does not read, is a `RUN_ERROR` in the stream.",
+        description: "For a person, named by a trusted issuer's token or by `Nylorun-Subject`. The thread is one session per person, agent and thread, created on its first run with `forwardedProps.nylorun.session`. The trailing user message starts a turn (its id is the idempotency key); its media parts are files: bytes sent inline (`data`, at most 20 MiB each) are stored as artifacts of the session, a `file` source with provider `nylorun` names an artifact, and a URL is refused. `resume` answers interrupts. A busy session is a `RUN_ERROR` in the stream; any file type is accepted, and the agent's harness decides how its model sees it.",
         request: {
             params: agentId,
             body: {
@@ -65,7 +64,7 @@ export function agUiRoutes(api) {
         const { scope, subject, access } = callerOf(c);
         await startRun(c.env.tenant, scope, c.req.param("agentId"), { subject, access }, 
         // A message may carry files inline.
-        await readJson(c.req.raw, INLINE_BODY_MAX_BYTES), c.env.outgoing, traceContextOf(c.req.raw.headers));
+        await readJson(c, "inline"), c.env.outgoing, traceContextOf(c.req.raw.headers));
         return RESPONSE_ALREADY_SENT;
     });
     tenantRoute(api, FOR_A_PERSON, {

package/dist/api/ag-ui/routes.js

@@ -13,8 +13,8 @@
  *
  * Each thread maps to one session per subject, agent and thread. The message id is the
  * idempotency key, a message's media parts become file parts (bytes sent inline are stored as
- * artifacts of the session, `../inbound-files.ts`; a file the model does not read is a
- * `RUN_ERROR`), approvals become interrupts resumed through `resume`, and the last AG-UI
+ * artifacts of the session, `../inbound-files.ts`; any type goes, and the harness decides how
+ * the model sees it), approvals become interrupts resumed through `resume`, and the last AG-UI
  * event made from each Runtime event carries its cursor as the SSE id. A run's session is
  * created on its first run with the options in `forwardedProps.nylorun.session` and never
  * changed afterwards. A stream opened with an issuer token ends at the token's expiry with
@@ -36,8 +36,8 @@ import { fail, HttpError } from "../../tenant/http.js";
 import { observeSession, readHistory, StreamClosed, streamHolderOf, } from "../../tenant/session-streams.js";
 import { putSession, sessionView } from "../../tenant/sessions.js";
 import { mayUseAgent } from "../../tenant/auth.js";
-import { environmentGrantsOf } from "../../tenant/environments.js";
-const HEARTBEAT_MS = 15_000;
+import { agentGrantsOf } from "../../tenant/agents.js";
+import { hostTuning } from "../../tuning.js";
 const TERMINAL = new Set([
     "turn.completed",
     "turn.paused",
@@ -111,10 +111,7 @@ function sessionOptions(input, scope) {
         ?.nylorun?.session;
     if (raw === undefined)
         return {};
-    const parsed = PutSessionRequestSchema.pick({
-        info: true,
-        environment: true,
-    })
+    const parsed = PutSessionRequestSchema.pick({ info: true })
         .strict()
         .safeParse(raw);
     if (!parsed.success)
@@ -203,7 +200,7 @@ async function stream(response, translator, source, preface = []) {
         if (!response.writableEnded && !response.write(text))
             response.destroy();
     };
-    const heartbeat = setInterval(() => write(SSE_HEARTBEAT), HEARTBEAT_MS);
+    const heartbeat = setInterval(() => write(SSE_HEARTBEAT), hostTuning().api.agUiHeartbeatMs);
     heartbeat.unref();
     try {
         write(sseFrame(translator.started()));
@@ -282,12 +279,12 @@ trace) {
     const id = sessionIdFor(caller.subject, agentId, input.threadId);
     await putSession(ctx, id, {
         requestId: randomUUID(),
-        agentId,
+        agent: agentId,
         ownerUserId: caller.subject,
         ...sessionOptions(input, scope),
     }, caller.access, {
         createOnly: true,
-        ...(environmentGrantsOf(scope) === undefined ? {} : { environmentGrants: environmentGrantsOf(scope) }),
+        ...(agentGrantsOf(scope) === undefined ? {} : { agentGrants: agentGrantsOf(scope) }),
     });
     const translator = new RunTranslator(input.threadId, input.runId);
     let cursor;