@nylorun/runtime 0.30.0-beta → 0.31.0-beta

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.31.0-beta
+
+### Minor Changes
+
+- aaa079f: The Runtime saves agent folders (track T6). `PUT /v1/agent-manifests/{name}` with `Content-Type: application/vnd.nylorun.folder+json` takes a folder by hash (`PutAgentFolderRequestSchema`): the files uploaded first, the Markdown and JSON read back from the definition file store and compiled with `compileAgentFolder`. A folder that does not compile is `422 folder_invalid`, with the compiler's diagnostics by file, line and column in `details.diagnostics`. A save keeps the folder as the version's source: `AgentManifestView.source` summarises it, `GET /v1/agent-manifests/{name}/versions/{v}/source` lists its files and `.../source/files/{path}` returns one. With `?dryRun=true` the plan adds the compiled `manifest`, the `diagnostics` and the `compiler`. A folder whose manifest is unchanged saves no version, and says so (`source_not_saved`). New Host feature `agent-folders`; new error code `folder_invalid`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [9ba6634]
+- Updated dependencies [aaa079f]
+- Updated dependencies
+  - @nylorun/core@0.27.0-beta
+  - @nylorun/harness@0.29.3-beta
+
 ## 0.30.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -21,6 +21,7 @@ export declare const Rejected: z.ZodObject<{
         credential_rejected: "credential_rejected";
         credential_required: "credential_required";
         definition_files_missing: "definition_files_missing";
+        folder_invalid: "folder_invalid";
         harness_mismatch: "harness_mismatch";
         host_rejected: "host_rejected";
         incompatible_host: "incompatible_host";
@@ -517,6 +518,29 @@ export declare const PutAgentManifestRequest: z.ZodObject<{
     }, z.core.$strict>>;
     requestId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+export declare const PutAgentFolderRequest: z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    format: z.ZodLiteral<"nylorun.folder.v2">;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+        contentType: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AgentManifestSource: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodNumber;
+    compiler: z.ZodString;
+    files: z.ZodNumber;
+    bytes: z.ZodNumber;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        size: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const AgentManifestView: z.ZodObject<{
     name: z.ZodString;
     version: z.ZodNumber;
@@ -622,6 +646,11 @@ export declare const AgentManifestView: z.ZodObject<{
     }, z.core.$strict>;
     createdAt: z.ZodString;
     agents: z.ZodNumber;
+    source: z.ZodOptional<z.ZodObject<{
+        compiler: z.ZodString;
+        files: z.ZodNumber;
+        bytes: z.ZodNumber;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const AgentManifestPlan: z.ZodObject<{
     name: z.ZodString;
@@ -654,6 +683,117 @@ export declare const AgentManifestPlan: z.ZodObject<{
         nextStart: z.ZodNumber;
         secrets: z.ZodNumber;
     }, z.core.$strict>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        manifestSchemaVersion: z.ZodLiteral<8>;
+        name: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+        description: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodType<import("@nylorun/core/define").JsonObject, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/define").JsonObject, unknown>>>;
+        harness: z.ZodUnion<readonly [z.ZodType<import("@nylorun/core/contracts").WorkflowHarnessSection, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/contracts").WorkflowHarnessSection, unknown>>, z.ZodType<import("@nylorun/core/contracts").AgentHarnessSection, unknown, z.core.$ZodTypeInternals<import("@nylorun/core/contracts").AgentHarnessSection, unknown>>]>;
+        runtime: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                none: "none";
+                pod: "pod";
+                virtual: "virtual";
+            }>;
+            image: z.ZodOptional<z.ZodString>;
+            resources: z.ZodOptional<z.ZodObject<{
+                cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            storage: z.ZodOptional<z.ZodString>;
+            network: z.ZodOptional<z.ZodObject<{
+                allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            lifecycle: z.ZodOptional<z.ZodObject<{
+                idle: z.ZodOptional<z.ZodString>;
+                deleteAfter: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            setup: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                cwd: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+            files: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                artifactId: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+                version: z.ZodNumber;
+                path: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                path: z.ZodString;
+                files: z.ZodRecord<z.ZodString, z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>;
+            }, z.core.$strict>]>>>;
+            limits: z.ZodOptional<z.ZodObject<{
+                artifacts: z.ZodOptional<z.ZodObject<{
+                    fileBytes: z.ZodOptional<z.ZodNumber>;
+                    totalBytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                skills: z.ZodOptional<z.ZodObject<{
+                    totalBytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                disk: z.ZodOptional<z.ZodObject<{
+                    versionBytes: z.ZodOptional<z.ZodNumber>;
+                    versionEntries: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"environment_secret">;
+                allowedHosts: z.ZodArray<z.ZodString>;
+                inject: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                    format: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"environment_variable">;
+            }, z.core.$strict>, z.ZodObject<{
+                via: z.ZodOptional<z.ZodString>;
+                identity: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                }, z.core.$strict>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"bearer">;
+                url: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                via: z.ZodOptional<z.ZodString>;
+                identity: z.ZodOptional<z.ZodObject<{
+                    header: z.ZodString;
+                }, z.core.$strict>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                description: z.ZodOptional<z.ZodString>;
+                type: z.ZodLiteral<"headers">;
+                url: z.ZodString;
+            }, z.core.$strict>], "type">>>;
+            triggers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                schedule: z.ZodOptional<z.ZodString>;
+                timezone: z.ZodOptional<z.ZodString>;
+                at: z.ZodOptional<z.ZodISODateTime>;
+                webhook: z.ZodOptional<z.ZodEnum<{
+                    "standard-webhooks": "standard-webhooks";
+                }>>;
+                session: z.ZodString;
+                prompt: z.ZodString;
+            }, z.core.$strict>>>;
+            selfWake: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            note: "note";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        file: z.ZodOptional<z.ZodString>;
+        line: z.ZodOptional<z.ZodNumber>;
+        column: z.ZodOptional<z.ZodNumber>;
+        pointer: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    compiler: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const SaveAgentManifestResponse: z.ZodObject<{
     manifest: z.ZodObject<{
@@ -761,12 +901,31 @@ export declare const SaveAgentManifestResponse: z.ZodObject<{
         }, z.core.$strict>;
         createdAt: z.ZodString;
         agents: z.ZodNumber;
+        source: z.ZodOptional<z.ZodObject<{
+            compiler: z.ZodString;
+            files: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     unchanged: z.ZodBoolean;
     warnings: z.ZodArray<z.ZodObject<{
         code: z.ZodString;
         message: z.ZodString;
     }, z.core.$strict>>;
+    diagnostics: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            note: "note";
+            warning: "warning";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        file: z.ZodOptional<z.ZodString>;
+        line: z.ZodOptional<z.ZodNumber>;
+        column: z.ZodOptional<z.ZodNumber>;
+        pointer: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const ListAgentManifestsResponse: z.ZodObject<{
     manifests: z.ZodArray<z.ZodObject<{
@@ -874,6 +1033,11 @@ export declare const ListAgentManifestsResponse: z.ZodObject<{
         }, z.core.$strict>;
         createdAt: z.ZodString;
         agents: z.ZodNumber;
+        source: z.ZodOptional<z.ZodObject<{
+            compiler: z.ZodString;
+            files: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const AgentManifestVersions: z.ZodObject<{

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { QueuedResponseSchema, TriggerListSchema, MemoryListSchema, MemorySchema, PutMemoryRequestSchema, MemoryVersionPageSchema, MemoryVersionDetailSchema, TriggerRunPageSchema, RunTriggerResponseSchema, WebhookSecretResponseSchema, WebhookAcceptedResponseSchema, AgentManifestV8Schema, EnvironmentSecretSlotsSchema, DeleteAgentManifestResponseSchema, AgentManifestPlanSchema, AgentManifestVersionsSchema, AgentManifestViewSchema, ListAgentManifestsResponseSchema, PutAgentManifestRequestSchema, PutAgentFolderRequestSchema, AgentManifestSourceSchema, PutAgentSecretValueRequestSchema, SaveAgentManifestResponseSchema, SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, AgentPageSchema, ToolCallSchema, ToolCallsPageSchema, TurnTraceSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, ToolPolicySchema, PutToolPolicyRequestSchema, PutModelInputsRequestSchema, ModelInputsViewSchema, PutTenantEnvironmentsRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, PutAgentSecretRequestSchema, AgentSecretViewSchema, ListAgentSecretsResponseSchema, McpPreviewRequestSchema, McpPreviewSchema, CredentialCoverageRequestSchema, CredentialCoverageSchema, DeletedResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, AgentViewSchema, AgentSnapshotSchema, RestoreAgentRequestSchema, ForkAgentRequestSchema, AgentForkPlanSchema, ForkAgentResponseSchema, PutAgentDryRunResponseSchema, RestartAgentRequestSchema, AgentRestoreSchema, AgentDiskVersionsSchema, ListAgentsResponseSchema, DeleteAgentResponseSchema, ListAgentEventsResponseSchema, ArtifactViewSchema, ArtifactListItemSchema, ArtifactPageSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, PutTenantSkillsRequestSchema, PutTenantLimitsRequestSchema, TenantLimitsViewSchema, TenantArtifactsViewSchema, TenantSkillsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -21,6 +21,8 @@ export const AgentView = named("AgentView", AgentViewSchema);
 export const EnvironmentSecretSlots = named("EnvironmentSecretSlots", EnvironmentSecretSlotsSchema);
 export const AgentManifest = named("AgentManifest", AgentManifestV8Schema);
 export const PutAgentManifestRequest = named("PutAgentManifestRequest", PutAgentManifestRequestSchema);
+export const PutAgentFolderRequest = named("PutAgentFolderRequest", PutAgentFolderRequestSchema);
+export const AgentManifestSource = named("AgentManifestSource", AgentManifestSourceSchema);
 export const AgentManifestView = named("AgentManifestView", AgentManifestViewSchema);
 export const AgentManifestPlan = named("AgentManifestPlan", AgentManifestPlanSchema);
 export const SaveAgentManifestResponse = named("SaveAgentManifestResponse", SaveAgentManifestResponseSchema);

package/dist/api/http/routes/agent-manifests.d.ts

@@ -3,7 +3,8 @@
  * versioned documents Agents are made from, each with a harness and a runtime section. A save
  * moves every Agent that tracks the manifest to the new version; a pinned one stays. Reading needs `agents:read` (or a write scope), saving and deleting
  * `agent-manifests:write`, from any client (Q12). A token caller reaches none: a manifest holds
- * an agent's instructions, tools and servers.
+ * an agent's instructions, tools and servers. A save may send an agent folder by hash instead of
+ * the manifest (track T6): the Runtime compiles it and keeps it as the version's source.
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { TenantEnv } from "../app.js";

package/dist/api/http/routes/agent-manifests.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-import { isAgentManifestName, PutAgentManifestRequestSchema } from "@nylorun/core/contracts";
-import { AgentManifestPlan, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
+import { AGENT_FOLDER_MEDIA_TYPE, contentTypeFor, isAgentManifestName, PutAgentFolderRequestSchema, PutAgentManifestRequestSchema, } from "@nylorun/core/contracts";
+import { AgentManifestPlan, AgentManifestSource, AgentManifestVersions, AgentManifestView, DeleteAgentManifestResponse, ListAgentManifestsResponse, PutAgentFolderRequest, PutAgentManifestRequest, SaveAgentManifestResponse, } from "../../components.js";
 import { requirePrincipal } from "../../../tenant/auth.js";
 import { fail } from "../../../tenant/http.js";
-import { agentManifestVersions, deleteAgentManifest, getAgentManifest, listAgentManifests, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
+import { agentManifestVersions, deleteAgentManifest, getAgentManifest, getAgentManifestSource, listAgentManifests, readAgentManifestSourceFile, saveAgentFolder, saveAgentManifest, } from "../../../tenant/agent-manifests.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
@@ -59,13 +59,19 @@ export function agentManifestRoutes(api) {
         path: "/v1/agent-manifests/{name}",
         tags: ["Agent manifests"],
         summary: "Save an agent manifest",
-        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version: at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document.",
+        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. Every Agent that tracks the manifest moves to the new version: at once, at its pod's next start for a runtime change a pod applies only when it starts, or once a required secret the version adds is set; a pinned one stays, and so does one whose kind, harness or storage the version changes (`agents_behind`). The Runtime checks the harness and runtime sections against each other: a custom harness needs a pod with an image, every credential the harness names is a declared slot of the right type, and the runtime's kind gives the loop the sandbox it needs; every gap is named in one `422 manifest_inconsistent` (`details.gaps`). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes by section, every reason a save would be refused (`errors`, the gaps first), warnings, the Agents it would move (`moves`) and how many stay on older versions (`behind`); nothing is saved. Clients compose the authoring files and drop their `$schema` before they send one document. With `Content-Type: application/vnd.nylorun.folder+json` the body is an agent folder by hash instead (feature `agent-folders`): every file uploaded first with `PUT /v1/files/sha256:<hex>`, the Runtime compiles it with `@nylorun/core/folder`, a folder that does not compile is `422 folder_invalid` (`details.diagnostics`, each with its file, line and column), and the version keeps the folder as its source; the plan adds the compiled `manifest`, the compiler's `diagnostics` and `compiler`.",
         request: {
             params: namePath,
             query: z.object({
                 dryRun: z.enum(["true", "false"]).optional().meta({ description: "`true`: answer the plan and save nothing" }),
             }),
-            body: { required: true, content: { "application/json": { schema: PutAgentManifestRequest } } },
+            body: {
+                required: true,
+                content: {
+                    "application/json": { schema: PutAgentManifestRequest },
+                    [AGENT_FOLDER_MEDIA_TYPE]: { schema: PutAgentFolderRequest },
+                },
+            },
         },
         responses: {
             200: json(z.union([SaveAgentManifestResponse, AgentManifestPlan]), "The version saved, or the plan with dryRun"),
@@ -74,16 +80,23 @@ export function agentManifestRoutes(api) {
             },
             412: { description: "If-Match named a version that is no longer the latest (`manifest_changed`)" },
             413: { description: "A skill's files hold more than the manifest's skill limit together (`limit_exceeded`)" },
-            422: { description: "The harness and runtime sections do not fit (`manifest_inconsistent`, `details.gaps`)" },
+            422: {
+                description: "The harness and runtime sections do not fit (`manifest_inconsistent`, `details.gaps`), or an agent folder does not compile (`folder_invalid`, `details.diagnostics`)",
+            },
         },
     }, async (c) => {
         const name = nameOf(c.req.param("name"));
-        const body = PutAgentManifestRequestSchema.parse(await readJson(c));
         const ifMatch = ifMatchOf(c.req.header("if-match"));
-        const options = ifMatch === undefined ? {} : { ifMatch };
-        return jsonResponse(200, c.req.query("dryRun") === "true"
+        const options = { ...(ifMatch === undefined ? {} : { ifMatch }), ...(c.req.query("dryRun") === "true" ? { dryRun: true } : {}) };
+        const media = (c.req.header("content-type") ?? "").split(";")[0].trim().toLowerCase();
+        if (media === AGENT_FOLDER_MEDIA_TYPE) {
+            const folder = PutAgentFolderRequestSchema.parse(await readJson(c));
+            return jsonResponse(200, await saveAgentFolder(c.env.tenant, name, folder, c.get("scope"), options));
+        }
+        const body = PutAgentManifestRequestSchema.parse(await readJson(c));
+        return jsonResponse(200, options.dryRun
             ? await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: true })
-            : await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), options));
+            : await saveAgentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: false }));
     });
     tenantRoute(api, READ, {
         method: "get",
@@ -120,6 +133,45 @@ export function agentManifestRoutes(api) {
         requirePrincipal(c.get("scope"));
         return jsonResponse(200, await getAgentManifest(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version"))));
     });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions/{version}/source",
+        tags: ["Agent manifests"],
+        summary: "Get the folder a version was compiled from",
+        description: "The agent folder the version was saved from (feature `agent-folders`): its compiler, size and every file, sorted by path. A version saved as JSON has none (`404`).",
+        request: { params: namePath.extend({ version: z.string().meta({ description: "The version number" }) }) },
+        responses: { 200: json(AgentManifestSource, "The folder") },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        return jsonResponse(200, await getAgentManifestSource(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version"))));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/agent-manifests/{name}/versions/{version}/source/files/{path}",
+        tags: ["Agent manifests"],
+        summary: "Download one file of a version's folder",
+        description: "Streams the file at `path` (its path in the folder, with `/` percent-encoded as `%2F`) as it was saved.",
+        request: {
+            params: namePath.extend({
+                version: z.string().meta({ description: "The version number" }),
+                path: z.string().meta({ description: "The file's path in the folder, percent-encoded" }),
+            }),
+        },
+        responses: {
+            200: {
+                description: "The file's bytes",
+                content: { "application/octet-stream": { schema: z.string().meta({ format: "binary" }) } },
+            },
+        },
+    }, async (c) => {
+        requirePrincipal(c.get("scope"));
+        const path = c.req.param("path");
+        const file = await readAgentManifestSourceFile(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version")), path);
+        return new Response(file.body, {
+            status: 200,
+            headers: { "content-type": contentTypeFor(path), "content-length": String(file.size) },
+        });
+    });
     tenantRoute(api, WRITE, {
         method: "delete",
         path: "/v1/agent-manifests/{name}",

package/dist/api/openapi.js

@@ -119,6 +119,8 @@ const RUNTIME_TAGS = [
             "GET /v1/agent-manifests/{name}",
             "GET /v1/agent-manifests/{name}/versions",
             "GET /v1/agent-manifests/{name}/versions/{version}",
+            "GET /v1/agent-manifests/{name}/versions/{version}/source",
+            "GET /v1/agent-manifests/{name}/versions/{version}/source/files/{path}",
             "DELETE /v1/agent-manifests/{name}",
         ],
     },

package/dist/host/http.js

@@ -1,6 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { jsonResponse } from "../api/http/respond.js";
 import { HOST_PROTOCOL, } from "@nylorun/core/compatibility";
+import { AGENT_FOLDER_MEDIA_TYPE } from "@nylorun/core/contracts";
 export const OPAQUE_NOT_FOUND = {
     status: "rejected",
     code: "not_found",
@@ -113,7 +114,8 @@ export function isJsonContentType(value) {
     if (value === undefined)
         return false;
     const media = value.split(";")[0].trim().toLowerCase();
-    return media === "application/json";
+    // An agent folder by hash (track T6) is JSON too.
+    return media === "application/json" || media === AGENT_FOLDER_MEDIA_TYPE;
 }
 /** True when the request carries a body (Content-Length > 0 or chunked). */
 export function requestHasBody(request) {

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.30.0-beta",
+    "version": "0.31.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -33,7 +33,8 @@
         "tool-policy",
         "traces",
         "artifact-reads",
-        "gateway-credentials"
+        "gateway-credentials",
+        "agent-folders"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -122,6 +123,7 @@
               "manifest_not_found",
               "manifest_in_use",
               "manifest_changed",
+              "folder_invalid",
               "internal_error"
             ]
           },