@nylorun/runtime 0.27.0-beta → 0.29.0-beta

package/dist/tenant/turn-timing.d.ts

@@ -13,6 +13,8 @@ export interface TurnTiming {
     turnStartedAt?: string;
     /** The trace context the turn's message arrived with (R7.4); it ends with the turn. */
     turnTrace?: unknown;
+    /** What started the turn when not a client (track T4); it ends with the turn. */
+    turnCause?: unknown;
     pausedMs?: number;
     pausedAt?: string;
 }
@@ -25,16 +27,24 @@ export declare function resumeTurn(s: TurnTiming, now?: Date): void;
 /**
  * The facts the event that ends turn `turnId` carries: `durationMs` from its start to now, waits
  * included, so the turn's span holds every crossing in it; `pausedMs`, how long it waited paused
- * (a wait still open ends now, as for a cancel); the session's agent;
+ * (a wait still open ends now, as for a cancel); the session's Agent and the manifest version it runs;
  * and the turn's totals from the usage ledger (one read, as `/v1/tenant/usage` totals a turn;
  * `steps` are the model calls the gate metered). Clears the turn's timing from `s`.
  */
 export declare function endTurn(t: Tx, s: TurnTiming & {
     agentId: string;
+    definition?: {
+        name: string;
+        version: number;
+    };
 }, turnId: string | null, now?: Date): Promise<{
     durationMs?: number;
     pausedMs?: number;
     agentId: string;
+    manifest?: {
+        name: string;
+        version: number;
+    };
     totals?: {
         steps: number;
         tokens: number;

package/dist/tenant/turn-timing.js

@@ -19,7 +19,7 @@ export function resumeTurn(s, now = new Date()) {
 /**
  * The facts the event that ends turn `turnId` carries: `durationMs` from its start to now, waits
  * included, so the turn's span holds every crossing in it; `pausedMs`, how long it waited paused
- * (a wait still open ends now, as for a cancel); the session's agent;
+ * (a wait still open ends now, as for a cancel); the session's Agent and the manifest version it runs;
  * and the turn's totals from the usage ledger (one read, as `/v1/tenant/usage` totals a turn;
  * `steps` are the model calls the gate metered). Clears the turn's timing from `s`.
  */
@@ -30,10 +30,12 @@ export async function endTurn(t, s, turnId, now = new Date()) {
     const facts = {
         ...(elapsed === undefined ? {} : { durationMs: Math.max(0, elapsed), pausedMs: s.pausedMs ?? 0 }),
         agentId: s.agentId,
+        ...(s.definition ? { manifest: { name: s.definition.name, version: s.definition.version } } : {}),
         ...(totals ? { totals: { steps: totals.calls, tokens: totals.tokens, costUsd: totals.costUsd } } : {}),
     };
     delete s.turnStartedAt;
     delete s.pausedMs;
     delete s.turnTrace;
+    delete s.turnCause;
     return facts;
 }

package/dist/tenant/types.d.ts

@@ -74,6 +74,11 @@ export interface TenantConfig {
      * the identity file (`NYLORUN_IDENTITY_FILE`). Absent: none.
      */
     issuers?: import("./issuers.js").TrustedIssuers;
+    /**
+     * The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`, no trailing slash): the base
+     * of webhook URLs and the OAuth resource. Absent: the origin each request reached.
+     */
+    publicUrl?: string;
     logger: Logger;
 }
 export interface Logger {

package/dist/tenant/worker.d.ts

@@ -36,6 +36,8 @@ export interface TenantWorker {
     sweep(): Promise<void>;
     /** Reconciles one pod sandbox (F7.2). Only infrastructure errors throw. */
     sandbox?(sandboxId: string, trigger: SandboxTrigger, signal: AbortSignal): Promise<SandboxResult>;
+    /** A durable timer it armed fired (track T4's triggers). Only infrastructure errors throw. */
+    fire?(key: string): Promise<void>;
 }
 export interface TenantWorkersOptions {
     /** Finds or opens a Tenant that is not registered on this process. */

package/dist/tenant/worker.js

@@ -132,6 +132,11 @@ export class TenantWorkers {
             const worker = await this.find(tenantId);
             return worker?.sandbox ? worker.sandbox(sandboxId, trigger, signal) : {};
         },
+        // A timer of a Tenant that is not open here does nothing: the Tenant's sweep arms what is due
+        // once it opens.
+        fire: async (tenantId, key) => {
+            await (await this.find(tenantId))?.fire?.(key);
+        },
     };
     /** Runs one advance under the deadline and the grace period (see the module comment). */
     async bounded(tenantId, sessionId, worker, signal) {

package/dist/traces/map.d.ts

@@ -5,7 +5,7 @@
  *
  * | Row | Span |
  * | --- | --- |
- * | `turn.completed`, `turn.failed`, `turn.cancelled` | `invoke_agent {agentId}`, the turn's root (INTERNAL) |
+ * | `turn.completed`, `turn.failed`, `turn.cancelled` | `invoke_agent {manifest name}`, the turn's root (INTERNAL) |
  * | `message.assistant`, `model.failed`, `context.compacted` | `chat {model}` (CLIENT) |
  * | `tool.completed` | `execute_tool {toolName}` (INTERNAL) |
  * | `node.completed` | `execute_tool {key}`, a flow's HTTP stage (INTERNAL) |

package/dist/traces/map.js

@@ -56,11 +56,17 @@ export function spanOf(row, turn, settings) {
         case "turn.failed":
         case "turn.cancelled": {
             const status = row.type.slice("turn.".length);
+            // The agent the turn ran: its manifest's name (protocol 16), else the Agent's id.
+            const manifest = p.manifest;
+            const agentName = typeof manifest?.name === "string" ? manifest.name : typeof p.agentId === "string" ? p.agentId : undefined;
             const totals = p.totals;
             const error = row.type === "turn.failed" ? (p.error ?? {}) : undefined;
             const attributes = base
                 .str("gen_ai.operation.name", "invoke_agent")
                 .str("gen_ai.agent.id", p.agentId)
+                .str("gen_ai.agent.name", agentName)
+                // The agent manifest version the turn ran (T3): an Agent moves between versions.
+                .int("nylorun.manifest.version", typeof manifest?.version === "number" ? manifest.version : undefined)
                 .str("nylorun.turn.status", status)
                 .int("nylorun.turn.paused_ms", p.pausedMs)
                 .int("nylorun.turn.steps", totals?.steps)
@@ -76,7 +82,7 @@ export function spanOf(row, turn, settings) {
                 traceId: turn.traceId,
                 spanId: turn.spanId,
                 ...(turn.parentSpanId ? { parentSpanId: turn.parentSpanId } : {}),
-                name: typeof p.agentId === "string" ? `invoke_agent ${p.agentId}` : "invoke_agent",
+                name: agentName === undefined ? "invoke_agent" : `invoke_agent ${agentName}`,
                 kind: SPAN_KIND.internal,
                 ...window(row.time, p.durationMs),
                 attributes: attributes.list,

package/dist/tuning.d.ts

@@ -104,6 +104,8 @@ export declare const HostTuningSchema: z.ZodObject<{
         signingKeyRotationGraceMs: z.ZodDefault<z.ZodNumber>;
         retryAfterSeconds: z.ZodDefault<z.ZodNumber>;
         seedLeaseMs: z.ZodDefault<z.ZodNumber>;
+        upgradeIdleMs: z.ZodDefault<z.ZodNumber>;
+        upgradeStartMs: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
     sweep: z.ZodPrefault<z.ZodObject<{
         intervalMs: z.ZodDefault<z.ZodNumber>;
@@ -120,6 +122,11 @@ export declare const HostTuningSchema: z.ZodObject<{
         }, z.core.$strict>>;
         stalePodMs: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    triggers: z.ZodPrefault<z.ZodObject<{
+        lateGraceMs: z.ZodDefault<z.ZodNumber>;
+        intervalCheckFires: z.ZodDefault<z.ZodNumber>;
+        webhookToleranceMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     execution: z.ZodPrefault<z.ZodObject<{
         advanceDeadlineMs: z.ZodDefault<z.ZodNumber>;
         advanceGraceMs: z.ZodDefault<z.ZodNumber>;

package/dist/tuning.js

@@ -177,6 +177,13 @@ export const HostTuningSchema = z
         retryAfterSeconds: count(5),
         /** How long a pending Environment seed holds the disk before another process may take it over. */
         seedLeaseMs: ms(10 * MINUTE),
+        /**
+         * The longest a pod Agent waiting to start on a new version (track T3) stays idle before it
+         * stops, so its next start applies the version: its own `lifecycle.idle` when shorter.
+         */
+        upgradeIdleMs: ms(MINUTE),
+        /** How long a pod may take to start on a new version before it goes back to the one it ran (T3). */
+        upgradeStartMs: ms(10 * MINUTE),
     }),
     /** The Tenant's sweep (`tenant/sweep.ts`): outbox, orphaned sessions, stale pods. */
     sweep: group({
@@ -201,6 +208,18 @@ export const HostTuningSchema = z
         /** How long a pod row may go unchanged before the sweep checks it. */
         stalePodMs: ms(MINUTE),
     }),
+    /** Triggers (track T4, D74): server timing; the Tenant's own bounds are its Runtime limits. */
+    triggers: group({
+        /**
+         * How long after it was due a fire counts as late (the server was down or asleep), and how
+         * overdue an active trigger is before the sweep arms it again.
+         */
+        lateGraceMs: ms(2 * MINUTE),
+        /** How many upcoming fires the save check reads to find a cron's smallest gap. */
+        intervalCheckFires: count(100, 2, 10_000),
+        /** The clock skew a webhook delivery's `webhook-timestamp` may have, either way (D75). */
+        webhookToleranceMs: ms(5 * MINUTE),
+    }),
     /** Durable Session Execution: Restate, or the in-process execution. */
     execution: group({
         /**

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretView, HostModelProviderInfo, HostModelView, PutEnvironmentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -101,16 +101,16 @@ export declare class VaultService {
         dropped: string[];
     }>;
     /**
-     * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
+     * `PUT /v1/agents/{id}/secrets/{name}`: creates or replaces one credential. The same
      * name and type keeps the credential's id and re-seals its value and binding; another type
      * replaces it. Refused (`409 credential_conflict`) when another credential of the vault is
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
     /** The Environment's secrets: names, types and bindings, never values. */
-    listEnvironmentSecrets(environmentId: string): Promise<EnvironmentSecretView[]>;
-    getEnvironmentSecret(environmentId: string, name: string): Promise<EnvironmentSecretView>;
+    listEnvironmentSecrets(environmentId: string): Promise<AgentSecretView[]>;
+    getEnvironmentSecret(environmentId: string, name: string): Promise<AgentSecretView>;
     deleteEnvironmentSecret(environmentId: string, name: string, actor: string): Promise<{
         id: string;
     }>;
@@ -154,9 +154,9 @@ export declare class VaultService {
         url: string;
     }): Promise<AuthorizeResult>;
     /**
-     * What a session that names `request.environmentId` would send for each URL `manifest` names
-     * (`credentialNeeds`), decided as `authorize` decides a call: the credential of the
-     * Environment's vault bound to the URL. Reads no secret, writes no audit row.
+     * What a session on Agent `request.agentId` would send for each URL `manifest` (its manifest
+     * version's loop manifest) names (`credentialNeeds`), decided as `authorize` decides a call:
+     * the credential of the Agent's vault bound to the URL. Reads no secret, writes no audit row.
      */
     coverage(manifest: AgentManifest | WorkflowManifest, request: CredentialCoverageRequest): Promise<CredentialCoverage>;
     getHostModel(): Promise<HostModelView>;
@@ -204,4 +204,9 @@ type HostSecretPayload = {
 };
 export declare function modelBinding(row: VaultCredentialRow): ModelBinding;
 export declare function hostModelAad(provider: string, model: string): Buffer;
+/**
+ * Whether the credential in `row` fills secret slot `slot` (D64): of the slot's type, with its
+ * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
+ */
+export declare function slotHolds(slot: EnvironmentSecretSlot, row: Pick<VaultCredentialRow, "type" | "bindingJson">): boolean;
 export {};

package/dist/vault/service.js

@@ -18,11 +18,11 @@
  * sealEnvironmentSecretCopies(from, vaultId, slots | null): Promise<SealedSecretCopies>
  * insertEnvironmentSecretCopies(t: Tx, vaultId, from, actor, sealed): Promise<{ copied; dropped }>
  *
- * // Its secrets (`/v1/environments/{id}/secrets`): each opens its own transaction and writes its
+ * // Its secrets (`/v1/agents/{id}/secrets`): each opens its own transaction and writes its
  * // audit rows in it. A put needs the vault key, so callers reach it through `Keys`.
- * putEnvironmentSecret(environmentId, name, body: PutEnvironmentSecretRequest, actor): Promise<EnvironmentSecretView>
- * listEnvironmentSecrets(environmentId): Promise<EnvironmentSecretView[]>
- * getEnvironmentSecret(environmentId, name): Promise<EnvironmentSecretView>
+ * putEnvironmentSecret(environmentId, name, body: PutAgentSecretRequest, actor): Promise<AgentSecretView>
+ * listEnvironmentSecrets(environmentId): Promise<AgentSecretView[]>
+ * getEnvironmentSecret(environmentId, name): Promise<AgentSecretView>
  * deleteEnvironmentSecret(environmentId, name, actor): Promise<{ id: string }>
  *
  * // The shell's variables of a session's sandbox, in the caller's transaction (R2c).
@@ -231,7 +231,7 @@ export class VaultService {
     }
     // --- an Environment's secrets ----------------------------------------------------
     /**
-     * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
+     * `PUT /v1/agents/{id}/secrets/{name}`: creates or replaces one credential. The same
      * name and type keeps the credential's id and re-seals its value and binding; another type
      * replaces it. Refused (`409 credential_conflict`) when another credential of the vault is
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
@@ -333,9 +333,12 @@ export class VaultService {
         if (!vault)
             return {};
         const environment = {};
+        const live = await liveFilter(t, environmentId);
         for (const row of await t.credentialsForVault(vault.id)) {
             if (row.type !== "environment_secret" && row.type !== "environment_variable")
                 continue;
+            if (!live(row))
+                continue;
             const binding = JSON.parse(row.bindingJson);
             if (row.type === "environment_secret")
                 environment[binding.secretName] = ENVIRONMENT_SECRET_SENTINEL;
@@ -398,8 +401,10 @@ export class VaultService {
                 });
                 return { result: { status: "refused", url, credentialIds: [], reason: "vault_missing" } };
             }
+            const live = await liveFilter(t, environmentId);
             const matches = (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
+                .filter(live)
                 .filter((row) => bindingUrl(row) === url)
                 .sort((a, b) => a.id.localeCompare(b.id));
             if (matches.length === 0)
@@ -466,18 +471,19 @@ export class VaultService {
     }
     // --- coverage --------------------------------------------------------------------
     /**
-     * What a session that names `request.environmentId` would send for each URL `manifest` names
-     * (`credentialNeeds`), decided as `authorize` decides a call: the credential of the
-     * Environment's vault bound to the URL. Reads no secret, writes no audit row.
+     * What a session on Agent `request.agentId` would send for each URL `manifest` (its manifest
+     * version's loop manifest) names (`credentialNeeds`), decided as `authorize` decides a call:
+     * the credential of the Agent's vault bound to the URL. Reads no secret, writes no audit row.
      */
     async coverage(manifest, request) {
-        const environmentId = request.environmentId;
+        const environmentId = request.agentId;
         return this.store.tx(async (t) => {
             const credentials = [];
-            if (environmentId !== undefined) {
+            {
                 const vault = await this.environmentVault(t, environmentId);
+                const live = await liveFilter(t, environmentId);
                 for (const row of await t.credentialsForVault(vault.id))
-                    if (isUserCredential(row))
+                    if (isUserCredential(row) && live(row))
                         credentials.push({ row, url: bindingUrl(row) });
             }
             const entries = credentialNeeds(manifest).map((need) => {
@@ -495,7 +501,6 @@ export class VaultService {
             });
             return {
                 agentId: request.agentId,
-                environmentId: environmentId ?? null,
                 complete: entries.every((entry) => entry.status === "covered"),
                 entries,
             };
@@ -634,7 +639,7 @@ export class VaultService {
             ? await t.vaultOfEnvironment(environmentId)
             : undefined;
         if (!vault)
-            throw new VaultError(404, "Environment not found");
+            throw new VaultError(404, "Agent not found");
         return vault;
     }
     async ensureHostVault(t) {
@@ -749,18 +754,18 @@ function bindingUrl(row) {
 /** Where a credential is, for coverage: never its value. */
 function coverageCredential(environmentId, row) {
     const via = JSON.parse(row.bindingJson).via;
-    return { environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
+    return { agentId: environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
 }
 /** One coverage entry, with the sentence that says what the session would do. */
 function coverageEntry(need, url, credential, environmentId, invalid) {
     const required = need.kind === "http";
     const where = environmentId === undefined
-        ? "Without an Environment, no credential is sent"
-        : `Environment ${environmentId} holds no credential for this URL`;
+        ? "Without an Agent, no credential is sent"
+        : `Agent ${environmentId} holds no credential for this URL`;
     const message = invalid !== undefined
         ? `No credential can be bound to this URL (${invalid}).`
         : credential !== undefined
-            ? `Sends '${credential.name}' from Environment ${credential.environmentId}${credential.via ? ` through ${credential.via}` : ""}.`
+            ? `Sends '${credential.name}' from Agent ${credential.agentId}${credential.via ? ` through ${credential.via}` : ""}.`
             : required
                 ? `${where}: each call fails with http.credential.`
                 : `${where}: the server is called without one, which only a public server accepts.`;
@@ -1027,6 +1032,45 @@ async function environmentSecretsFor(t, environmentId, host) {
     const vault = await t.vaultOfEnvironment(environmentId);
     if (!vault)
         return [];
+    const live = await liveFilter(t, environmentId);
     return (await t.credentialsForVault(vault.id)).filter((row) => row.type === "environment_secret" &&
+        live(row) &&
         (credentialBinding(row).allowedHosts ?? []).includes(lower));
 }
+/**
+ * Whether the credential in `row` fills secret slot `slot` (D64): of the slot's type, with its
+ * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
+ */
+export function slotHolds(slot, row) {
+    if (row.type !== slot.type)
+        return false;
+    const binding = JSON.parse(row.bindingJson);
+    if (slot.type === "environment_variable")
+        return true;
+    if (slot.type === "environment_secret") {
+        const hosts = (list) => canonical([...(list ?? [])].map((host) => host.toLowerCase()).sort());
+        const inject = slot.inject ? { header: slot.inject.header, format: slot.inject.format } : null;
+        return hosts(slot.allowedHosts) === hosts(binding.allowedHosts) && canonical(inject) === canonical(binding.inject ?? null);
+    }
+    try {
+        return normalizeVaultUrl(slot.url) === binding.url;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Which of Agent `environmentId`'s credentials are live (track T3, D73): with secret slots in the
+ * runtime it applies, only those that fill a slot of the name (`slotHolds`). Another stays in the
+ * vault, dormant: a slot the version dropped, or one whose binding changed until it gets a value
+ * again. Without slots, every one.
+ */
+async function liveFilter(t, environmentId) {
+    const slots = (await t.environment(environmentId))?.applied.secrets;
+    if (slots === undefined)
+        return () => true;
+    return (row) => {
+        const slot = slots[row.name];
+        return slot !== undefined && slotHolds(slot, row);
+    };
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.27.0-beta";
+export declare const RUNTIME_VERSION = "0.29.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.27.0-beta";
+export const RUNTIME_VERSION = "0.29.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.27.0-beta",
+  "version": "0.29.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,17 +61,18 @@
   "dependencies": {
     "@ag-ui/core": "~1.0.2",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
-    "@earendil-works/pi-ai": "0.99.1",
-    "@hono/node-server": "^2.1.3",
+    "@earendil-works/pi-ai": "1.2.0",
+    "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.23.0-beta",
-    "@nylorun/harness": "0.28.0-beta",
-    "@restatedev/restate-sdk": "1.17.2",
-    "@restatedev/restate-sdk-clients": "1.17.2",
+    "@nylorun/core": "0.25.0-beta",
+    "@nylorun/harness": "0.29.1-beta",
+    "@restatedev/restate-sdk": "1.17.3",
+    "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",
     "aws4fetch": "1.0.20",
-    "drizzle-orm": "^0.45.3",
+    "croner": "^9.1.0",
+    "drizzle-orm": "^0.45.4",
     "hono": "^4.13.13",
     "jose": "^6.2.12",
     "just-bash": "3.6.0",
@@ -80,18 +81,18 @@
     "postgres": "^3.4.9",
     "ws": "^8.22.0",
     "yaml": "^2.9.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
     "@ag-ui/client": "1.0.2",
-    "@scalar/openapi-parser": "^0.29.11",
-    "@types/node": "^26.6.4",
+    "@scalar/openapi-parser": "^0.29.13",
+    "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",
     "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.4"
   }
 }

package/dist/api/http/routes/environment-manifests.d.ts

@@ -1,9 +0,0 @@
-/**
- * Environment manifests (`/v1/environment-manifests/**`, protocol 14, D63): save, read, list and
- * delete the named, versioned definitions Environments are made from. A save never changes an
- * Environment. Reading needs what reading an Environment needs; saving and deleting need
- * `environments:write`, from any client (Q12).
- */
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { TenantEnv } from "../app.js";
-export declare function environmentManifestRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/environment-manifests.js

@@ -1,118 +0,0 @@
-import { z } from "zod";
-import { isEnvironmentManifestName, PutEnvironmentManifestRequestSchema } from "@nylorun/core/contracts";
-import { DeleteEnvironmentManifestResponse, EnvironmentManifestPlan, EnvironmentManifestVersions, EnvironmentManifestView, ListEnvironmentManifestsResponse, PutEnvironmentManifestRequest, SaveEnvironmentManifestResponse, } from "../../components.js";
-import { fail } from "../../../tenant/http.js";
-import { deleteEnvironmentManifest, environmentManifestVersions, getEnvironmentManifest, listEnvironmentManifests, saveEnvironmentManifest, } from "../../../tenant/environment-manifests.js";
-import { readJson } from "../body.js";
-import { tenantRoute } from "../define.js";
-import { jsonResponse } from "../respond.js";
-const READ = {
-    credentials: ["application", "subject", "token"],
-    scopes: ["sessions:own", "environments:write"],
-};
-const WRITE = {
-    credentials: ["application", "subject", "token"],
-    scopes: ["environments:write"],
-};
-const json = (schema, description) => ({
-    description,
-    content: { "application/json": { schema } },
-});
-const namePath = z.object({
-    name: z.string().meta({ description: "The environment manifest's name, such as `analyst-box`" }),
-});
-function nameOf(value) {
-    if (!isEnvironmentManifestName(value))
-        return fail(400, "An environment manifest's name is 1-64 letters, digits, '.', '_' and '-', starting with a letter or digit");
-    return value;
-}
-function versionOf(value) {
-    const version = Number(value);
-    if (!Number.isInteger(version) || version < 1)
-        return fail(400, "version is a positive integer");
-    return version;
-}
-/** `If-Match: <version>` (or `"<version>"`), when sent. */
-function ifMatchOf(value) {
-    if (value === undefined || value.trim() === "")
-        return undefined;
-    const version = Number(value.trim().replace(/^W\//, "").replace(/^"|"$/g, ""));
-    if (!Number.isInteger(version) || version < 0)
-        return fail(400, "If-Match is the version you read: a whole number, 0 for none yet");
-    return version;
-}
-export function environmentManifestRoutes(api) {
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests",
-        tags: ["Environment manifests"],
-        summary: "List environment manifests",
-        description: "Each manifest's latest version, by name, with how many Environments were made from it.",
-        responses: { 200: json(ListEnvironmentManifestsResponse, "The manifests") },
-    }, async (c) => jsonResponse(200, await listEnvironmentManifests(c.env.tenant)));
-    tenantRoute(api, WRITE, {
-        method: "put",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Save an environment manifest",
-        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. No Environment changes: an Environment keeps the version it was made from, and a fork moves it to another (D63). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes, every reason a save would be refused (`errors`), warnings, and how many Environments stay on older versions; nothing is saved. Clients drop a file's `$schema` before they send it.",
-        request: {
-            params: namePath,
-            query: z.object({
-                dryRun: z.enum(["true", "false"]).optional().meta({ description: "`true`: answer the plan and save nothing" }),
-            }),
-            body: { required: true, content: { "application/json": { schema: PutEnvironmentManifestRequest } } },
-        },
-        responses: {
-            200: json(z.union([SaveEnvironmentManifestResponse, EnvironmentManifestPlan]), "The version saved, or the plan with dryRun"),
-            400: { description: "The manifest breaks the Tenant's limits or names files the Runtime cannot use" },
-            412: { description: "If-Match named a version that is no longer the latest (`manifest_changed`)" },
-        },
-    }, async (c) => {
-        const name = nameOf(c.req.param("name"));
-        const body = PutEnvironmentManifestRequestSchema.parse(await readJson(c));
-        const ifMatch = ifMatchOf(c.req.header("if-match"));
-        const options = ifMatch === undefined ? {} : { ifMatch };
-        return jsonResponse(200, c.req.query("dryRun") === "true"
-            ? await saveEnvironmentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: true })
-            : await saveEnvironmentManifest(c.env.tenant, name, body, c.get("scope"), options));
-    });
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Get an environment manifest",
-        description: "Its latest version.",
-        request: { params: namePath },
-        responses: { 200: json(EnvironmentManifestView, "The latest version") },
-    }, async (c) => jsonResponse(200, await getEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")))));
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}/versions",
-        tags: ["Environment manifests"],
-        summary: "List an environment manifest's versions",
-        description: "Every version, newest first, with who saved it and how many Environments were made from it.",
-        request: { params: namePath },
-        responses: { 200: json(EnvironmentManifestVersions, "The versions") },
-    }, async (c) => jsonResponse(200, await environmentManifestVersions(c.env.tenant, nameOf(c.req.param("name")))));
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}/versions/{version}",
-        tags: ["Environment manifests"],
-        summary: "Get one version of an environment manifest",
-        request: { params: namePath.extend({ version: z.string().meta({ description: "The version number" }) }) },
-        responses: { 200: json(EnvironmentManifestView, "The version") },
-    }, async (c) => jsonResponse(200, await getEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version")))));
-    tenantRoute(api, WRITE, {
-        method: "delete",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Delete an environment manifest",
-        description: "Deletes every version. Refused while any Environment was made from one (`409 manifest_in_use`).",
-        request: { params: namePath },
-        responses: {
-            200: json(DeleteEnvironmentManifestResponse, "Deleted, or there was none"),
-            409: { description: "An Environment was made from one of its versions (`manifest_in_use`)" },
-        },
-    }, async (c) => jsonResponse(200, await deleteEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")))));
-}

package/dist/api/http/routes/environments.d.ts

@@ -1,11 +0,0 @@
-/**
- * Environments (`/v1/environments/**`, protocol 11, D55, D56): create, find or change one by id,
- * read it, list them by label, read its lifecycle stream, stop, reset and delete it, and write
- * its vault's secrets. Ids may hold `/`, sent percent-encoded as one path segment
- * (`users%2Falice%2Fweb`). A token caller reaches only the ids its Environment grants match,
- * and changes them only with `environments:write`. Secret values are write-only: no route reads
- * one back.
- */
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { TenantEnv } from "../app.js";
-export declare function environmentRoutes(api: OpenAPIHono<TenantEnv>): void;