@nylorun/runtime 0.14.0-beta → 0.15.1-beta

package/dist/api/components.d.ts

@@ -9,7 +9,6 @@ import { type EventType } from "@nylorun/core/contracts";
 export declare const Rejected: z.ZodObject<{
     status: z.ZodLiteral<"rejected">;
     code: z.ZodEnum<{
-        active_work: "active_work";
         connection_missing: "connection_missing";
         host_rejected: "host_rejected";
         incompatible_host: "incompatible_host";
@@ -23,7 +22,6 @@ export declare const Rejected: z.ZodObject<{
         scope_required: "scope_required";
         subject_invalid: "subject_invalid";
         subject_required: "subject_required";
-        tenant_conflict: "tenant_conflict";
         token_expired: "token_expired";
         unsupported_media_type: "unsupported_media_type";
     }>;
@@ -41,68 +39,6 @@ export declare const ProtocolRejected: z.ZodObject<{
         features: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
 }, z.core.$strict>;
-export declare const TenantEnvelope: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    createdAt: z.ZodString;
-    updatedAt: z.ZodString;
-    schemaVersion: z.ZodNumber;
-}, z.core.$strict>;
-export declare const CreateTenantRequest: z.ZodObject<{
-    tenantId: z.ZodString;
-    name: z.ZodString;
-    principalId: z.ZodString;
-    credentialHash: z.ZodString;
-    idempotencyKey: z.ZodString;
-    studioCredentialHash: z.ZodOptional<z.ZodString>;
-    derivedPrincipals: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
-        credentialHash: z.ZodString;
-    }, z.core.$strict>>>;
-}, z.core.$strict>;
-export declare const AdminTenantList: z.ZodArray<z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodNullable<z.ZodString>;
-    state: z.ZodEnum<{
-        open: "open";
-        quarantined: "quarantined";
-    }>;
-    envelope: z.ZodNullable<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        createdAt: z.ZodString;
-        updatedAt: z.ZodString;
-        schemaVersion: z.ZodNumber;
-    }, z.core.$strict>>;
-}, z.core.$strict>>;
-export declare const AdminTenantStatus: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodNullable<z.ZodString>;
-    state: z.ZodEnum<{
-        open: "open";
-        quarantined: "quarantined";
-    }>;
-    envelope: z.ZodNullable<z.ZodObject<{
-        id: z.ZodString;
-        name: z.ZodString;
-        createdAt: z.ZodString;
-        updatedAt: z.ZodString;
-        schemaVersion: z.ZodNumber;
-    }, z.core.$strict>>;
-    quarantine: z.ZodOptional<z.ZodObject<{
-        code: z.ZodEnum<{
-            corrupt: "corrupt";
-            "envelope-invalid": "envelope-invalid";
-            "kek-missing": "kek-missing";
-            "migration-failed": "migration-failed";
-            "open-failed": "open-failed";
-            "open-timeout": "open-timeout";
-            "schema-too-new": "schema-too-new";
-        }>;
-        message: z.ZodString;
-        repair: z.ZodString;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
 export declare const AdminStatus: z.ZodObject<{
     service: z.ZodString;
     version: z.ZodString;
@@ -111,12 +47,12 @@ export declare const AdminStatus: z.ZodObject<{
         max: z.ZodNumber;
         features: z.ZodArray<z.ZodString>;
     }, z.core.$strict>;
-    tenants: z.ZodArray<z.ZodObject<{
-        id: z.ZodString;
+    tenant: z.ZodObject<{
+        id: z.ZodNullable<z.ZodString>;
         name: z.ZodNullable<z.ZodString>;
         state: z.ZodEnum<{
             open: "open";
-            quarantined: "quarantined";
+            unavailable: "unavailable";
         }>;
         envelope: z.ZodNullable<z.ZodObject<{
             id: z.ZodString;
@@ -125,7 +61,21 @@ export declare const AdminStatus: z.ZodObject<{
             updatedAt: z.ZodString;
             schemaVersion: z.ZodNumber;
         }, z.core.$strict>>;
-    }, z.core.$strict>>;
+        cause: z.ZodOptional<z.ZodObject<{
+            code: z.ZodEnum<{
+                corrupt: "corrupt";
+                "database-layout-old": "database-layout-old";
+                "envelope-invalid": "envelope-invalid";
+                "kek-missing": "kek-missing";
+                "migration-failed": "migration-failed";
+                "open-failed": "open-failed";
+                "open-timeout": "open-timeout";
+                "schema-too-new": "schema-too-new";
+            }>;
+            message: z.ZodString;
+            repair: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
     aggregate: z.ZodObject<{
         runningSessions: z.ZodNumber;
         inFlightDeliveries: z.ZodNumber;
@@ -2039,6 +1989,66 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         full: "full";
         metadata: "metadata";
     }>;
+} & {
+    type: z.ZodLiteral<"transcript.updated">;
+    payload: z.ZodObject<{
+        keep: z.ZodNumber;
+        entries: z.ZodArray<z.ZodUnknown>;
+        length: z.ZodNumber;
+    }, z.core.$loose>;
+}, z.core.$strip> | z.ZodObject<{
+    schema: z.ZodLiteral<"nylorun.event/2">;
+    eventId: z.ZodString;
+    tenantId: z.ZodString;
+    sessionId: z.ZodString;
+    runId: z.ZodNullable<z.ZodString>;
+    turnId: z.ZodNullable<z.ZodString>;
+    incarnation: z.ZodNumber;
+    epoch: z.ZodNumber;
+    seq: z.ZodNumber;
+    cursor: z.ZodString;
+    time: z.ZodString;
+    schemaVersion: z.ZodNumber;
+    source: z.ZodObject<{
+        kind: z.ZodEnum<{
+            api: "api";
+            controller: "controller";
+            edge: "edge";
+            "egress-gate": "egress-gate";
+            evidence: "evidence";
+            harness: "harness";
+            human: "human";
+            init: "init";
+            loop: "loop";
+            "model-gate": "model-gate";
+            operator: "operator";
+            sandboxd: "sandboxd";
+            supervisor: "supervisor";
+            "tool-gate": "tool-gate";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    evidence: z.ZodEnum<{
+        asserted: "asserted";
+        attested: "attested";
+        claimed: "claimed";
+        measured: "measured";
+        observed: "observed";
+    }>;
+    trace: z.ZodOptional<z.ZodObject<{
+        traceId: z.ZodString;
+        spanId: z.ZodString;
+        parentSpanId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    visibility: z.ZodEnum<{
+        internal: "internal";
+        public: "public";
+        restricted: "restricted";
+    }>;
+    retention: z.ZodEnum<{
+        full: "full";
+        metadata: "metadata";
+    }>;
 } & {
     type: z.ZodLiteral<"turn.cancelled">;
     payload: z.ZodObject<{
@@ -3706,6 +3716,66 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         full: "full";
         metadata: "metadata";
     }>;
+} & {
+    type: z.ZodLiteral<"transcript.updated">;
+    payload: z.ZodObject<{
+        keep: z.ZodNumber;
+        entries: z.ZodArray<z.ZodUnknown>;
+        length: z.ZodNumber;
+    }, z.core.$loose>;
+}, z.core.$strip> | z.ZodObject<{
+    schema: z.ZodLiteral<"nylorun.event/2">;
+    eventId: z.ZodString;
+    tenantId: z.ZodString;
+    sessionId: z.ZodString;
+    runId: z.ZodNullable<z.ZodString>;
+    turnId: z.ZodNullable<z.ZodString>;
+    incarnation: z.ZodNumber;
+    epoch: z.ZodNumber;
+    seq: z.ZodNumber;
+    cursor: z.ZodString;
+    time: z.ZodString;
+    schemaVersion: z.ZodNumber;
+    source: z.ZodObject<{
+        kind: z.ZodEnum<{
+            api: "api";
+            controller: "controller";
+            edge: "edge";
+            "egress-gate": "egress-gate";
+            evidence: "evidence";
+            harness: "harness";
+            human: "human";
+            init: "init";
+            loop: "loop";
+            "model-gate": "model-gate";
+            operator: "operator";
+            sandboxd: "sandboxd";
+            supervisor: "supervisor";
+            "tool-gate": "tool-gate";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strip>;
+    evidence: z.ZodEnum<{
+        asserted: "asserted";
+        attested: "attested";
+        claimed: "claimed";
+        measured: "measured";
+        observed: "observed";
+    }>;
+    trace: z.ZodOptional<z.ZodObject<{
+        traceId: z.ZodString;
+        spanId: z.ZodString;
+        parentSpanId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    visibility: z.ZodEnum<{
+        internal: "internal";
+        public: "public";
+        restricted: "restricted";
+    }>;
+    retention: z.ZodEnum<{
+        full: "full";
+        metadata: "metadata";
+    }>;
 } & {
     type: z.ZodLiteral<"turn.cancelled">;
     payload: z.ZodObject<{
@@ -5376,6 +5446,66 @@ export declare const SessionItemsResponse: z.ZodObject<{
             full: "full";
             metadata: "metadata";
         }>;
+    } & {
+        type: z.ZodLiteral<"transcript.updated">;
+        payload: z.ZodObject<{
+            keep: z.ZodNumber;
+            entries: z.ZodArray<z.ZodUnknown>;
+            length: z.ZodNumber;
+        }, z.core.$loose>;
+    }, z.core.$strip> | z.ZodObject<{
+        schema: z.ZodLiteral<"nylorun.event/2">;
+        eventId: z.ZodString;
+        tenantId: z.ZodString;
+        sessionId: z.ZodString;
+        runId: z.ZodNullable<z.ZodString>;
+        turnId: z.ZodNullable<z.ZodString>;
+        incarnation: z.ZodNumber;
+        epoch: z.ZodNumber;
+        seq: z.ZodNumber;
+        cursor: z.ZodString;
+        time: z.ZodString;
+        schemaVersion: z.ZodNumber;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<{
+                api: "api";
+                controller: "controller";
+                edge: "edge";
+                "egress-gate": "egress-gate";
+                evidence: "evidence";
+                harness: "harness";
+                human: "human";
+                init: "init";
+                loop: "loop";
+                "model-gate": "model-gate";
+                operator: "operator";
+                sandboxd: "sandboxd";
+                supervisor: "supervisor";
+                "tool-gate": "tool-gate";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>;
+        evidence: z.ZodEnum<{
+            asserted: "asserted";
+            attested: "attested";
+            claimed: "claimed";
+            measured: "measured";
+            observed: "observed";
+        }>;
+        trace: z.ZodOptional<z.ZodObject<{
+            traceId: z.ZodString;
+            spanId: z.ZodString;
+            parentSpanId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        visibility: z.ZodEnum<{
+            internal: "internal";
+            public: "public";
+            restricted: "restricted";
+        }>;
+        retention: z.ZodEnum<{
+            full: "full";
+            metadata: "metadata";
+        }>;
     } & {
         type: z.ZodLiteral<"turn.cancelled">;
         payload: z.ZodObject<{
@@ -7043,6 +7173,66 @@ export declare const SessionItemsResponse: z.ZodObject<{
             full: "full";
             metadata: "metadata";
         }>;
+    } & {
+        type: z.ZodLiteral<"transcript.updated">;
+        payload: z.ZodObject<{
+            keep: z.ZodNumber;
+            entries: z.ZodArray<z.ZodUnknown>;
+            length: z.ZodNumber;
+        }, z.core.$loose>;
+    }, z.core.$strip> | z.ZodObject<{
+        schema: z.ZodLiteral<"nylorun.event/2">;
+        eventId: z.ZodString;
+        tenantId: z.ZodString;
+        sessionId: z.ZodString;
+        runId: z.ZodNullable<z.ZodString>;
+        turnId: z.ZodNullable<z.ZodString>;
+        incarnation: z.ZodNumber;
+        epoch: z.ZodNumber;
+        seq: z.ZodNumber;
+        cursor: z.ZodString;
+        time: z.ZodString;
+        schemaVersion: z.ZodNumber;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<{
+                api: "api";
+                controller: "controller";
+                edge: "edge";
+                "egress-gate": "egress-gate";
+                evidence: "evidence";
+                harness: "harness";
+                human: "human";
+                init: "init";
+                loop: "loop";
+                "model-gate": "model-gate";
+                operator: "operator";
+                sandboxd: "sandboxd";
+                supervisor: "supervisor";
+                "tool-gate": "tool-gate";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>;
+        evidence: z.ZodEnum<{
+            asserted: "asserted";
+            attested: "attested";
+            claimed: "claimed";
+            measured: "measured";
+            observed: "observed";
+        }>;
+        trace: z.ZodOptional<z.ZodObject<{
+            traceId: z.ZodString;
+            spanId: z.ZodString;
+            parentSpanId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        visibility: z.ZodEnum<{
+            internal: "internal";
+            public: "public";
+            restricted: "restricted";
+        }>;
+        retention: z.ZodEnum<{
+            full: "full";
+            metadata: "metadata";
+        }>;
     } & {
         type: z.ZodLiteral<"turn.cancelled">;
         payload: z.ZodObject<{
@@ -7456,6 +7646,56 @@ export declare const TenantSandboxView: z.ZodObject<{
         }, z.core.$strict>;
     }, z.core.$strict>;
 }, z.core.$strict>;
+export declare const ModelUsageTotals: z.ZodObject<{
+    scope: z.ZodEnum<{
+        agent: "agent";
+        tenant: "tenant";
+        turn: "turn";
+    }>;
+    id: z.ZodOptional<z.ZodString>;
+    period: z.ZodEnum<{
+        day: "day";
+        month: "month";
+        total: "total";
+    }>;
+    since: z.ZodOptional<z.ZodString>;
+    calls: z.ZodNumber;
+    tokens: z.ZodNumber;
+    costUsd: z.ZodNumber;
+}, z.core.$strict>;
+export declare const ModelBudgets: z.ZodObject<{
+    budgets: z.ZodArray<z.ZodObject<{
+        scope: z.ZodEnum<{
+            agent: "agent";
+            tenant: "tenant";
+            turn: "turn";
+        }>;
+        id: z.ZodOptional<z.ZodString>;
+        period: z.ZodOptional<z.ZodEnum<{
+            day: "day";
+            month: "month";
+        }>>;
+        limitUsd: z.ZodOptional<z.ZodNumber>;
+        limitTokens: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const PutModelBudgetsRequest: z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    budgets: z.ZodArray<z.ZodObject<{
+        scope: z.ZodEnum<{
+            agent: "agent";
+            tenant: "tenant";
+            turn: "turn";
+        }>;
+        id: z.ZodOptional<z.ZodString>;
+        period: z.ZodOptional<z.ZodEnum<{
+            day: "day";
+            month: "month";
+        }>>;
+        limitUsd: z.ZodOptional<z.ZodNumber>;
+        limitTokens: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const PutTenantSandboxRequest: z.ZodObject<{
     default: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"none">, z.ZodLiteral<"virtual">, z.ZodObject<{
         image: z.ZodOptional<z.ZodString>;

package/dist/api/components.js

@@ -5,16 +5,12 @@
  * global registry.
  */
 import { z } from "zod";
-import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, SessionCommandSchema, AdminStatusSchema, AdminTenantListSchema, AdminTenantStatusSchema, CreateTenantRequestSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, TenantEnvelopeSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { JwksSchema, CreateTokenRequestSchema, CreateTokenResponseSchema, AccessPolicyResponseSchema, PutAccessPolicyRequestSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, ListPublishableKeysResponseSchema, PublishableKeySchema, CreatePublishableKeyRequestSchema, UpdatePublishableKeyRequestSchema, RevokeSubjectRequestSchema, RevokeSubjectResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, ActionResultReceiptSchema, DeleteEndpointResponseSchema, DeliveryHeartbeatResponseSchema, ActionOutcomeSchema, EndpointPingResponseSchema, ListEndpointsResponseSchema, PutEndpointsRequestSchema, SandboxToolOutcomeSchema, SessionCommandSchema, AdminStatusSchema, HostShutdownResponseSchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
 export const Rejected = named("Rejected", RejectedResponseSchema);
 export const ProtocolRejected = named("ProtocolRejected", ProtocolRejectedResponseSchema);
-export const TenantEnvelope = named("TenantEnvelope", TenantEnvelopeSchema);
-export const CreateTenantRequest = named("CreateTenantRequest", CreateTenantRequestSchema);
-export const AdminTenantList = named("AdminTenantList", AdminTenantListSchema);
-export const AdminTenantStatus = named("AdminTenantStatus", AdminTenantStatusSchema);
 export const AdminStatus = named("AdminStatus", AdminStatusSchema);
 export const HostShutdownResponse = named("HostShutdownResponse", HostShutdownResponseSchema);
 export const SandboxToolOutcome = named("SandboxToolOutcome", SandboxToolOutcomeSchema);
@@ -53,6 +49,9 @@ export const SeedTenantConfigRequest = named("SeedTenantConfigRequest", SeedTena
 export const SeedTenantConfigResponse = named("SeedTenantConfigResponse", SeedTenantConfigResponseSchema);
 export const HostModelCatalog = named("HostModelCatalog", HostModelCatalogSchema);
 export const TenantSandboxView = named("TenantSandboxView", TenantSandboxViewSchema);
+export const ModelUsageTotals = named("ModelUsageTotals", ModelUsageTotalsSchema);
+export const ModelBudgets = named("ModelBudgets", ModelBudgetsSchema);
+export const PutModelBudgetsRequest = named("PutModelBudgetsRequest", PutModelBudgetsRequestSchema);
 export const PutTenantSandboxRequest = named("PutTenantSandboxRequest", PutTenantSandboxRequestSchema);
 export const ListProvidersResponse = named("ListProvidersResponse", ListProvidersResponseSchema);
 export const HostModelView = named("HostModelView", HostModelViewSchema);

package/dist/api/gate/keys.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `keys` service's route on the gateway's listener (F4.2, `contract.ts`): one operation of
+ * `Keys` per request, run with the vault key of the gateway's Tenant. Errors keep their status,
+ * code and details. Logs the operation and its outcome, never an argument or a result.
+ */
+import type { Hono, MiddlewareHandler } from "hono";
+import type { Logger } from "../../tenant/types.js";
+import { type Keys } from "../../keys/keys.js";
+export declare function mountKeysRoutes(app: Hono, options: {
+    readonly authorized: MiddlewareHandler;
+    /** The gateway's Tenant's keys; rejects when the Tenant is not ready. */
+    readonly keys: () => Promise<Keys>;
+    readonly logger: Logger;
+}): void;

package/dist/api/gate/keys.js

@@ -0,0 +1,59 @@
+import { bodyLimit } from "hono/body-limit";
+import { HttpError } from "../../tenant/http.js";
+import { VaultError } from "../../vault/error.js";
+import { KEYS_PATH, MAX_KEYS_BODY_BYTES } from "../../keys/contract.js";
+import { KEYS_OPERATIONS } from "../../keys/keys.js";
+export function mountKeysRoutes(app, options) {
+    app.post(`${KEYS_PATH}/:operation`, options.authorized, bodyLimit({
+        maxSize: MAX_KEYS_BODY_BYTES,
+        onError: (c) => c.json({ error: { code: "invalid_request", message: "The body is too large" } }, 400),
+    }), async (c) => {
+        const operation = c.req.param("operation");
+        if (!KEYS_OPERATIONS.includes(operation))
+            return c.json({ error: { code: "invalid_request", message: `Unknown keys operation ${operation}` } }, 404);
+        let args;
+        try {
+            args = (await c.req.json()).args;
+        }
+        catch {
+            args = undefined;
+        }
+        if (!Array.isArray(args))
+            return c.json({ error: { code: "invalid_request", message: "The body must be {args: [...]}" } }, 400);
+        const started = Date.now();
+        let answer;
+        try {
+            const keys = await options.keys();
+            const run = keys[operation];
+            answer = { result: (await run.apply(keys, args)) ?? null };
+        }
+        catch (error) {
+            answer = { error: errorOf(error) };
+        }
+        options.logger.info("keys_request", {
+            operation,
+            ms: Date.now() - started,
+            outcome: "result" in answer ? "ok" : String(answer.error.status),
+        });
+        return c.json(answer);
+    });
+}
+function errorOf(error) {
+    if (error instanceof VaultError)
+        return { kind: "vault", status: error.status, message: error.message };
+    if (error instanceof HttpError)
+        return {
+            kind: "http",
+            status: error.status,
+            message: error.message,
+            ...(error.rejection.code === undefined ? {} : { code: error.rejection.code }),
+            ...(error.rejection.details === undefined ? {} : { details: error.rejection.details }),
+        };
+    // A request error the route would answer 400 for, or an internal failure.
+    const zod = error?.name === "ZodError";
+    return {
+        kind: "http",
+        status: zod ? 400 : 500,
+        message: zod ? error.message : "The keys service failed",
+    };
+}

package/dist/api/gate/routes.d.ts

@@ -0,0 +1,34 @@
+import { Hono } from "hono";
+import type { ModelCallHandler } from "../../gates/handler.js";
+import { type InflightCalls } from "../../gates/inflight.js";
+import type { McpHandler } from "../../gates/mcp-handler.js";
+import type { ToolCalls } from "../../gates/tool-calls.js";
+import type { Keys } from "../../keys/keys.js";
+import type { Logger } from "../../tenant/types.js";
+import { type OutboundPolicy } from "../../tenant/outbound.js";
+export interface GatesAppOptions {
+    /** The bearer every model call must present (`NYLORUN_GATES_TOKEN`). */
+    readonly token: string;
+    /** Serves an authenticated, well-formed call. */
+    readonly modelGate: ModelCallHandler;
+    /** Keyed calls, which outlive their client (P1.2). */
+    readonly inflight: InflightCalls;
+    /** Whether the gate's dependencies answer (Postgres). */
+    readonly ready: () => Promise<boolean>;
+    /** Largest body read. Default `MAX_MODEL_CALL_BYTES`. */
+    readonly maxBodyBytes?: number;
+    /** Remote MCP servers (F4.1). Without it the MCP routes answer 404. */
+    readonly mcp?: McpHandler;
+    /** Keyed MCP calls, which outlive their client and run once (F4.1 G3). Needs `mcp`. */
+    readonly toolCalls?: ToolCalls;
+    /** The keys service's operations (F4.2). Without it the keys route answers 404. */
+    readonly keys?: () => Promise<Keys>;
+    /** Logs the keys service's requests. */
+    readonly logger?: Logger;
+    /**
+     * How the gate may call Action endpoints (the gateway's own `NYLORUN_ENDPOINT_*`), for
+     * deliveries (F4.1). Without it the delivery route answers 404.
+     */
+    readonly delivery?: OutboundPolicy;
+}
+export declare function createGatesApp(options: GatesAppOptions): Hono;