@nylorun/runtime 0.27.0-beta → 0.28.0-beta

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { EnvironmentManifestSchema, EnvironmentSecretSlotsSchema, DeleteEnvironmentManifestResponseSchema, EnvironmentManifestPlanSchema, EnvironmentManifestVersionsSchema, EnvironmentManifestViewSchema, ListEnvironmentManifestsResponseSchema, PutEnvironmentManifestRequestSchema, PutEnvironmentSecretValueRequestSchema, SaveEnvironmentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, EnvironmentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutEnvironmentSecretRequestSchema, EnvironmentSecretViewSchema, ListEnvironmentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutEnvironmentRequestSchema, EnvironmentViewSchema, EnvironmentSnapshotSchema, RestoreEnvironmentRequestSchema, ForkEnvironmentRequestSchema, EnvironmentForkPlanSchema, ForkEnvironmentResponseSchema, EnvironmentRestoreSchema, EnvironmentVersionsSchema, ListEnvironmentsResponseSchema, DeleteEnvironmentResponseSchema, ListEnvironmentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -16,28 +16,30 @@ export const ListOperatorKeysResponse = named("ListOperatorKeysResponse", ListOp
 export const PutOperatorKeyResponse = named("PutOperatorKeyResponse", PutOperatorKeyResponseSchema);
 export const DeleteOperatorKeyResponse = named("DeleteOperatorKeyResponse", DeleteOperatorKeyResponseSchema);
 export const SandboxToolOutcome = named("SandboxToolOutcome", SandboxToolOutcomeSchema);
-export const PutEnvironmentRequest = named("PutEnvironmentRequest", PutEnvironmentRequestSchema);
-export const EnvironmentView = named("EnvironmentView", EnvironmentViewSchema);
+export const PutAgentRequest = named("PutAgentRequest", PutAgentRequestSchema);
+export const AgentView = named("AgentView", AgentViewSchema);
 export const EnvironmentSecretSlots = named("EnvironmentSecretSlots", EnvironmentSecretSlotsSchema);
-export const EnvironmentManifest = named("EnvironmentManifest", EnvironmentManifestSchema);
-export const PutEnvironmentManifestRequest = named("PutEnvironmentManifestRequest", PutEnvironmentManifestRequestSchema);
-export const EnvironmentManifestView = named("EnvironmentManifestView", EnvironmentManifestViewSchema);
-export const EnvironmentManifestPlan = named("EnvironmentManifestPlan", EnvironmentManifestPlanSchema);
-export const SaveEnvironmentManifestResponse = named("SaveEnvironmentManifestResponse", SaveEnvironmentManifestResponseSchema);
-export const ListEnvironmentManifestsResponse = named("ListEnvironmentManifestsResponse", ListEnvironmentManifestsResponseSchema);
-export const EnvironmentManifestVersions = named("EnvironmentManifestVersions", EnvironmentManifestVersionsSchema);
-export const DeleteEnvironmentManifestResponse = named("DeleteEnvironmentManifestResponse", DeleteEnvironmentManifestResponseSchema);
-export const PutEnvironmentSecretValueRequest = named("PutEnvironmentSecretValueRequest", PutEnvironmentSecretValueRequestSchema);
-export const EnvironmentSnapshot = named("EnvironmentSnapshot", EnvironmentSnapshotSchema);
-export const RestoreEnvironmentRequest = named("RestoreEnvironmentRequest", RestoreEnvironmentRequestSchema);
-export const EnvironmentRestore = named("EnvironmentRestore", EnvironmentRestoreSchema);
-export const ForkEnvironmentRequest = named("ForkEnvironmentRequest", ForkEnvironmentRequestSchema);
-export const EnvironmentForkPlan = named("EnvironmentForkPlan", EnvironmentForkPlanSchema);
-export const ForkEnvironmentResponse = named("ForkEnvironmentResponse", ForkEnvironmentResponseSchema);
-export const EnvironmentVersions = named("EnvironmentVersions", EnvironmentVersionsSchema);
-export const ListEnvironmentsResponse = named("ListEnvironmentsResponse", ListEnvironmentsResponseSchema);
-export const DeleteEnvironmentResponse = named("DeleteEnvironmentResponse", DeleteEnvironmentResponseSchema);
-export const ListEnvironmentEventsResponse = named("ListEnvironmentEventsResponse", ListEnvironmentEventsResponseSchema);
+export const AgentManifest = named("AgentManifest", AgentManifestV8Schema);
+export const PutAgentManifestRequest = named("PutAgentManifestRequest", PutAgentManifestRequestSchema);
+export const AgentManifestView = named("AgentManifestView", AgentManifestViewSchema);
+export const AgentManifestPlan = named("AgentManifestPlan", AgentManifestPlanSchema);
+export const SaveAgentManifestResponse = named("SaveAgentManifestResponse", SaveAgentManifestResponseSchema);
+export const ListAgentManifestsResponse = named("ListAgentManifestsResponse", ListAgentManifestsResponseSchema);
+export const AgentManifestVersions = named("AgentManifestVersions", AgentManifestVersionsSchema);
+export const DeleteAgentManifestResponse = named("DeleteAgentManifestResponse", DeleteAgentManifestResponseSchema);
+export const PutAgentSecretValueRequest = named("PutAgentSecretValueRequest", PutAgentSecretValueRequestSchema);
+export const AgentSnapshot = named("AgentSnapshot", AgentSnapshotSchema);
+export const RestoreAgentRequest = named("RestoreAgentRequest", RestoreAgentRequestSchema);
+export const AgentRestore = named("AgentRestore", AgentRestoreSchema);
+export const ForkAgentRequest = named("ForkAgentRequest", ForkAgentRequestSchema);
+export const AgentForkPlan = named("AgentForkPlan", AgentForkPlanSchema);
+export const ForkAgentResponse = named("ForkAgentResponse", ForkAgentResponseSchema);
+export const PutAgentDryRunResponse = named("PutAgentDryRunResponse", PutAgentDryRunResponseSchema);
+export const RestartAgentRequest = named("RestartAgentRequest", RestartAgentRequestSchema);
+export const AgentDiskVersions = named("AgentDiskVersions", AgentDiskVersionsSchema);
+export const ListAgentsResponse = named("ListAgentsResponse", ListAgentsResponseSchema);
+export const DeleteAgentResponse = named("DeleteAgentResponse", DeleteAgentResponseSchema);
+export const ListAgentEventsResponse = named("ListAgentEventsResponse", ListAgentEventsResponseSchema);
 export const ArtifactVersionView = named("ArtifactVersionView", ArtifactVersionViewSchema);
 export const ArtifactView = named("ArtifactView", ArtifactViewSchema);
 export const ArtifactListItem = named("ArtifactListItem", ArtifactListItemSchema);
@@ -58,10 +60,17 @@ export const ArtifactTree = named("ArtifactTree", ArtifactTreeSchema);
 export const ArtifactDiff = named("ArtifactDiff", ArtifactDiffSchema);
 export const SessionCommand = named("SessionCommand", SessionCommandSchema);
 export const AcceptedResponse = named("AcceptedResponse", AcceptedResponseSchema);
-export const ListAgentsResponse = named("ListAgentsResponse", ListAgentsResponseSchema);
-export const ListPublicAgentsResponse = named("ListPublicAgentsResponse", ListPublicAgentsResponseSchema);
-export const PutAgentRequest = named("PutAgentRequest", PutAgentRequestSchema);
-export const PutAgentResponse = named("PutAgentResponse", PutAgentResponseSchema);
+export const QueuedResponse = named("QueuedResponse", QueuedResponseSchema);
+export const TriggerList = named("TriggerList", TriggerListSchema);
+export const MemoryList = named("MemoryList", MemoryListSchema);
+export const MemoryView = named("Memory", MemorySchema);
+export const PutMemoryRequest = named("PutMemoryRequest", PutMemoryRequestSchema);
+export const MemoryVersionPage = named("MemoryVersionPage", MemoryVersionPageSchema);
+export const MemoryVersionDetail = named("MemoryVersionDetail", MemoryVersionDetailSchema);
+export const TriggerRunPage = named("TriggerRunPage", TriggerRunPageSchema);
+export const RunTriggerResponse = named("RunTriggerResponse", RunTriggerResponseSchema);
+export const WebhookSecretResponse = named("WebhookSecretResponse", WebhookSecretResponseSchema);
+export const WebhookAcceptedResponse = named("WebhookAcceptedResponse", WebhookAcceptedResponseSchema);
 export const ListSessionsResponse = named("ListSessionsResponse", ListSessionsResponseSchema);
 export const PutSessionRequest = named("PutSessionRequest", PutSessionRequestSchema);
 export const SessionView = named("SessionView", SessionViewSchema);
@@ -96,9 +105,9 @@ export const ListProvidersResponse = named("ListProvidersResponse", ListProvider
 export const HostModelView = named("HostModelView", HostModelViewSchema);
 export const PutHostModelRequest = named("PutHostModelRequest", PutHostModelRequestSchema);
 export const SelectHostModelRequest = named("SelectHostModelRequest", SelectHostModelRequestSchema);
-export const PutEnvironmentSecretRequest = named("PutEnvironmentSecretRequest", PutEnvironmentSecretRequestSchema);
-export const EnvironmentSecretView = named("EnvironmentSecretView", EnvironmentSecretViewSchema);
-export const ListEnvironmentSecretsResponse = named("ListEnvironmentSecretsResponse", ListEnvironmentSecretsResponseSchema);
+export const PutAgentSecretRequest = named("PutAgentSecretRequest", PutAgentSecretRequestSchema);
+export const AgentSecretView = named("AgentSecretView", AgentSecretViewSchema);
+export const ListAgentSecretsResponse = named("ListAgentSecretsResponse", ListAgentSecretsResponseSchema);
 export const DeletedResponse = named("DeletedResponse", DeletedResponseSchema);
 export const McpPreviewRequest = named("McpPreviewRequest", McpPreviewRequestSchema);
 export const McpPreview = named("McpPreview", McpPreviewSchema);
@@ -117,7 +126,7 @@ export const HistoryPage = named("HistoryPage", HistoryPageSchema.extend({ items
 export const SessionUsageTotals = named("SessionUsageTotals", SessionUsageTotalsSchema);
 export const ModelCallsPage = named("ModelCallsPage", ModelCallsPageSchema.extend({ calls: z.array(ModelCall) }));
 export const ModelCallExportPage = named("ModelCallExportPage", ModelCallExportPageSchema.extend({ calls: z.array(ModelCall) }));
-export const EnvironmentPage = named("EnvironmentPage", EnvironmentPageSchema.extend({ environments: z.array(EnvironmentView) }));
+export const AgentPage = named("AgentPage", AgentPageSchema.extend({ environments: z.array(AgentView) }));
 export const ToolCall = named("ToolCall", ToolCallSchema);
 export const ToolCallsPage = named("ToolCallsPage", ToolCallsPageSchema.extend({ calls: z.array(ToolCall) }));
 export const TurnTrace = named("TurnTrace", TurnTraceSchema);

package/dist/api/http/app.js

@@ -12,8 +12,10 @@ import { declaredRoute, pathSegments, routeNotFound } from "./define.js";
 import { jsonResponse, rejectionOf } from "./respond.js";
 import { accessRoutes } from "./routes/access.js";
 import { meRoutes } from "./routes/me.js";
-import { environmentRoutes } from "./routes/environments.js";
-import { environmentManifestRoutes } from "./routes/environment-manifests.js";
+import { agentRoutes } from "./routes/agents.js";
+import { triggerRoutes, webhookRoutes } from "./routes/triggers.js";
+import { memoryRoutes } from "./routes/memories.js";
+import { agentManifestRoutes } from "./routes/agent-manifests.js";
 import { artifactRoutes } from "./routes/artifacts.js";
 import { readRoutes } from "./routes/reads.js";
 import { sessionRoutes } from "./routes/sessions.js";
@@ -45,8 +47,11 @@ function build() {
     });
     sessionRoutes(api);
     fileRoutes(api);
-    environmentRoutes(api);
-    environmentManifestRoutes(api);
+    agentRoutes(api);
+    triggerRoutes(api);
+    memoryRoutes(api);
+    webhookRoutes(api);
+    agentManifestRoutes(api);
     artifactRoutes(api);
     tenantRoutes(api);
     keyRoutes(api);

package/dist/api/http/body.d.ts

@@ -5,6 +5,8 @@ export type BodyKind = "json" | "inline";
 export declare function bodyLimit(tenant: TenantContext, kind?: BodyKind): Promise<number>;
 /** The body as text; past `maxBytes`, `413 Request too large`. */
 export declare function readText(request: Request, maxBytes: number): Promise<string>;
+/** The body's bytes; past `maxBytes`, `413` with code `limit_exceeded`. */
+export declare function readBytes(request: Request, maxBytes: number, limit: string): Promise<Buffer>;
 /** The body of a Tenant route's request as JSON, before any schema. */
 export declare function readJson(c: {
     readonly req: {

package/dist/api/http/body.js

@@ -33,6 +33,26 @@ export async function readText(request, maxBytes) {
     }
     return Buffer.concat(chunks).toString("utf8");
 }
+/** The body's bytes; past `maxBytes`, `413` with code `limit_exceeded`. */
+export async function readBytes(request, maxBytes, limit) {
+    if (request.body === null)
+        return Buffer.alloc(0);
+    const chunks = [];
+    let bytes = 0;
+    const reader = request.body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        bytes += value.byteLength;
+        if (bytes > maxBytes) {
+            await reader.cancel();
+            fail(413, `The body is over ${maxBytes} bytes, the Runtime limit ${limit}`, { code: "limit_exceeded" });
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks);
+}
 /** The body of a Tenant route's request as JSON, before any schema. */
 export async function readJson(c, kind = "json") {
     const text = await readText(c.req.raw, await bodyLimit(c.env.tenant, kind));

package/dist/api/http/routes/agent-manifests.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Agent manifests (`/v1/agent-manifests/**`, protocol 16): save, read, list and delete the named,
+ * versioned documents Agents are made from, each with a harness and a runtime section. A save
+ * never changes an Agent. Reading needs `agents:read` (or a write scope), saving and deleting
+ * `agent-manifests:write`, from any client (Q12). A token caller reaches none: a manifest holds
+ * an agent's instructions, tools and servers.
+ */
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+export declare function agentManifestRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/agent-manifests.js

@@ -0,0 +1,135 @@
+import { z } from "zod";
+import { isAgentManifestName, PutAgentManifestRequestSchema } from "@nylorun/core/contracts";
+import { AgentManifestPlan, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
+import { requirePrincipal } from "../../../tenant/auth.js";
+import { fail } from "../../../tenant/http.js";
+import { agentManifestVersions, deleteAgentManifest, getAgentManifest, listAgentManifests, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
+import { readJson } from "../body.js";
+import { tenantRoute } from "../define.js";
+import { jsonResponse } from "../respond.js";
+const READ = {
+    credentials: ["application", "subject"],
+    scopes: ["agents:read", "agents:write", "agent-manifests:write"],
+};
+const WRITE = {
+    credentials: ["application", "subject"],
+    scopes: ["agent-manifests:write"],
+};
+const json = (schema, description) => ({
+    description,
+    content: { "application/json": { schema } },
+});
+const namePath = z.object({
+    name: z.string().meta({ description: "The agent manifest's name, such as `triage`" }),
+});
+function nameOf(value) {
+    if (!isAgentManifestName(value))
+        return fail(400, "An agent manifest's name is 1-64 letters, digits, '.', '_' and '-', starting with a letter or digit");
+    return value;
+}
+function versionOf(value) {
+    const version = Number(value);
+    if (!Number.isInteger(version) || version < 1)
+        return fail(400, "version is a positive integer");
+    return version;
+}
+/** `If-Match: <version>` (or `"<version>"`), when sent. */
+function ifMatchOf(value) {
+    if (value === undefined || value.trim() === "")
+        return undefined;
+    const version = Number(value.trim().replace(/^W\//, "").replace(/^"|"$/g, ""));
+    if (!Number.isInteger(version) || version < 0)
+        return fail(400, "If-Match is the version you read: a whole number, 0 for none yet");
+    return version;
+}
+export function agentManifestRoutes(api) {
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests",
+        tags: ["Agent manifests"],
+        summary: "List agent manifests",
+        description: "Each manifest's latest version, by name, with how many Agents were made from it.",
+        responses: { 200: json(ListAgentManifestsResponse, "The manifests") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await listAgentManifests(c.env.tenant));
+    });
+    tenantRoute(api, WRITE, {
+        method: "put",
+        path: "/v1/agent-manifests/{name}",
+        tags: ["Agent manifests"],
+        summary: "Save an agent manifest",
+        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version (track T3): at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document.",
+        request: {
+            params: namePath,
+            query: z.object({
+                dryRun: z.enum(["true", "false"]).optional().meta({ description: "`true`: answer the plan and save nothing" }),
+            }),
+            body: { required: true, content: { "application/json": { schema: PutAgentManifestRequest } } },
+        },
+        responses: {
+            200: json(z.union([SaveAgentManifestResponse, AgentManifestPlan]), "The version saved, or the plan with dryRun"),
+            400: {
+                description: "The manifest breaks the Tenant's limits, has a tool that runs code, or names files the Runtime does not hold (`definition_files_missing`)",
+            },
+            412: { description: "If-Match named a version that is no longer the latest (`manifest_changed`)" },
+            413: { description: "A skill's files hold more than the manifest's skill limit together (`limit_exceeded`)" },
+            422: { description: "The harness and runtime sections do not fit (`manifest_inconsistent`, `details.gaps`)" },
+        },
+    }, async (c) => {
+        const name = nameOf(c.req.param("name"));
+        const body = PutAgentManifestRequestSchema.parse(await readJson(c));
+        const ifMatch = ifMatchOf(c.req.header("if-match"));
+        const options = ifMatch === undefined ? {} : { ifMatch };
+        return jsonResponse(200, c.req.query("dryRun") === "true"
+            ? await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: true })
+            : await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), options));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}",
+        tags: ["Agent manifests"],
+        summary: "Get an agent manifest",
+        description: "Its latest version.",
+        request: { params: namePath },
+        responses: { 200: json(AgentManifestView, "The latest version") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await getAgentManifest(c.env.tenant, nameOf(c.req.param("name"))));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions",
+        tags: ["Agent manifests"],
+        summary: "List an agent manifest's versions",
+        description: "Every version, newest first, with who saved it and how many Agents were made from it.",
+        request: { params: namePath },
+        responses: { 200: json(AgentManifestVersions, "The versions") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await agentManifestVersions(c.env.tenant, nameOf(c.req.param("name"))));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions/{version}",
+        tags: ["Agent manifests"],
+        summary: "Get one version of an agent manifest",
+        request: { params: namePath.extend({ version: z.string().meta({ description: "The version number" }) }) },
+        responses: { 200: json(AgentManifestView, "The version") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await getAgentManifest(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version"))));
+    });
+    tenantRoute(api, WRITE, {
+        method: "delete",
+        path: "/v1/agent-manifests/{name}",
+        tags: ["Agent manifests"],
+        summary: "Delete an agent manifest",
+        description: "Deletes every version. Refused while any Agent was made from one (`409 manifest_in_use`).",
+        request: { params: namePath },
+        responses: {
+            200: json(DeleteAgentManifestResponse, "Deleted, or there was none"),
+            409: { description: "An Agent was made from one of its versions (`manifest_in_use`)" },
+        },
+    }, async (c) => jsonResponse(200, await deleteAgentManifest(c.env.tenant, nameOf(c.req.param("name")))));
+}

package/dist/api/http/routes/agents.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Agents (`/v1/agents/**`, protocol 16; Environments from protocol 11, D55, D56): make one from a
+ * saved agent manifest or find it by id, read it, list them by label, state or manifest, read its
+ * lifecycle stream, stop, reset, fork and delete it, work its disk versions, and write its vault's
+ * secrets. Ids may hold `/`, sent percent-encoded as one path segment (`users%2Falice%2Ftriage`).
+ * A token caller reaches only the ids its Agent grants match, and changes them only with
+ * `agents:write`. Secret values are write-only: no route reads one back.
+ */
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+export declare function agentRoutes(api: OpenAPIHono<TenantEnv>): void;