@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/host/stack-config.js

@@ -13,7 +13,17 @@
  * listener (`NYLORUN_GATES_LISTEN_*`), and only one that runs loop parses
  * where to reach the gate (`NYLORUN_GATES_URL`). Both read
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
- * process must never hold a model credential.
+ * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
+ * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
+ * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
+ * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
+ *
+ * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
+ * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
+ * remote MCP servers through the gates service (`NYLORUN_GATES_URL`, with run tokens only), and
+ * keeps its workspaces under `NYLORUN_HARNESS_ROOT`. It refuses to start with a database, the
+ * gates' or keys' credential, or Restate settings. A process running core starts the Harness API
+ * listener when `NYLORUN_HARNESS=remote` (`NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_HARNESS_TOKEN`).
  *
  * Two listen modes:
  * - **local** (no `NYLORUN_LISTEN_*` / `NYLORUN_ALLOWED_HOSTS`): the Host binds
@@ -24,21 +34,31 @@
  *   probes from inside the container.
  *
  * The Postgres, Restate and S2 endpoints are parsed and validated here;
- * `infra/*` builds the clients from them. So is who the Host's Tenant is when its database
- * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`, `NYLORUN_DERIVED_PRINCIPALS`).
+ * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
+ * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`).
  */
-import { DERIVED_PRINCIPAL_ID_PATTERN, isTenantId } from "@nylorun/core/compatibility";
-export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys"];
+import { isTenantId } from "@nylorun/core/compatibility";
+import { blockedAddresses } from "../sandbox/pods/network-gate.js";
+export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
- * trust class of input. keys joins gates (F4.2); egress joins them in a later release.
+ * trust class of input. keys joins gates (F4.2), and egress joins them (F7.2). The harness
+ * (F6.2) runs agent code's neighbours and holds only its own credential: it shares with nothing.
  */
 const SERVICE_GROUPS = [
     ["core", "loop"],
-    ["gates", "keys"],
+    ["gates", "keys", "egress"],
+    ["harness"],
 ];
 /** Where the gates service listens by default. */
 export const DEFAULT_GATES_LISTEN_PORT = 4100;
+/** Where egress-gate listens by default. */
+export const DEFAULT_EGRESS_LISTEN_PORT = 4200;
+/** Where core's Harness API listener listens by default. */
+export const DEFAULT_HARNESS_LISTEN_PORT = 4200;
+/** Where a harness process answers `/health` (loopback only). */
+export const DEFAULT_HARNESS_HEALTH_PORT = 4300;
 /** What a process runs without `--service`: core and loop, as `--role all` did. */
 export const DEFAULT_SERVICES = new Set([
     "core",
@@ -46,8 +66,6 @@ export const DEFAULT_SERVICES = new Set([
 ]);
 /** Services of the blueprint this release doesn't have yet. */
 const LATER_SERVICES = [
-    "egress",
-    "harness",
     "sandboxd",
 ];
 const ROLE_SERVICES = {
@@ -74,7 +92,7 @@ function read(env, name) {
     const trimmed = value.trim();
     return trimmed === "" ? undefined : trimmed;
 }
-const USAGE = "Usage: main.js [--service core,loop|gates]";
+const USAGE = "Usage: main.js [--service core,loop|gates,keys,egress|harness]";
 /** Parses `--service a,b` (or the deprecated `--role`); throws `StackConfigError`. */
 export function parseServices(argv) {
     let service;
@@ -248,11 +266,14 @@ function parseIdentityKeys(env) {
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export function parseStackConfig(env, argv) {
     const { services, deprecatedRole } = parseServices(argv);
+    if (services.has("harness"))
+        return { services, harness: parseHarnessService(env), endpoints: {} };
     // The image sets NYLORUN_LISTEN_*: only the API's processes read them.
     const servesApi = services.has("core") || services.has("loop");
     const listen = servesApi ? parseListen(env) : undefined;
     const operator = servesApi ? parseAdminListen(env) : undefined;
     const gates = services.has("gates") || services.has("keys") ? parseGates(env) : undefined;
+    const egress = services.has("egress") ? parseEgress(env) : undefined;
     // The gates service's clients: the loop's model and tool calls, and core's endpoint pings.
     const modelGate = servesApi ? parseModelGate(env) : undefined;
     // The keys service is the gateway's unless NYLORUN_KEYS_URL names another listener.
@@ -299,43 +320,198 @@ export function parseStackConfig(env, argv) {
     if (restateIdentityKeys)
         endpoints.restateIdentityKeys = restateIdentityKeys;
     const publicUrl = parseUrl(env, "NYLORUN_PUBLIC_URL", http)?.replace(/\/+$/, "");
-    const rawBrowser = read(env, "NYLORUN_BROWSER_ACCESS");
-    if (rawBrowser !== undefined && rawBrowser !== "on" && rawBrowser !== "off")
-        throw new StackConfigError(`NYLORUN_BROWSER_ACCESS must be on or off, not ${rawBrowser}`);
+    const harnessMode = servesApi ? parseHarnessMode(env) : undefined;
+    const sandboxes = servesApi ? parseSandboxes(env) : undefined;
+    // Pods connect to the Harness API listener even when the Tenant runs its own harness.
+    const harnessListener = harnessMode === "remote" || sandboxes
+        ? parseHarnessListener(env, harnessMode === "remote")
+        : undefined;
+    if (harnessListener &&
+        [listen?.port, operator?.port].includes(harnessListener.listen.port))
+        throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT and NYLORUN_ADMIN_LISTEN_PORT");
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
+    const objectStore = parseObjectStore(env);
     return {
         services,
         ...(deprecatedRole ? { deprecatedRole } : {}),
         ...(gates ? { gates } : {}),
+        ...(egress ? { egress } : {}),
         ...(modelGate ? { modelGate } : {}),
         ...(keys ? { keys } : {}),
         ...(rawPacking ? { packing: rawPacking } : {}),
         ...(listen ? { listen } : {}),
         endpoints,
         ...(publicUrl ? { publicUrl } : {}),
-        ...(rawBrowser === undefined ? {} : { browserAccess: rawBrowser === "on" }),
+        ...(harnessMode ? { harnessMode } : {}),
+        ...(harnessListener ? { harnessListener } : {}),
+        ...(sandboxes ? { sandboxes } : {}),
         ...(operator ? { operator } : {}),
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
+        ...(objectStore ? { objectStore } : {}),
     };
 }
+/** S3 bucket names: 3 to 63 lowercase letters, digits, dots and hyphens. */
+const BUCKET = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+/** `StackConfig.objectStore` from `NYLORUN_OBJECT_STORE_*`, or `undefined` without an endpoint. */
+function parseObjectStore(env) {
+    const endpoint = parseUrl(env, "NYLORUN_OBJECT_STORE_ENDPOINT", ["http:", "https:"]);
+    const accessKeyId = read(env, "NYLORUN_OBJECT_STORE_ACCESS_KEY");
+    const secretAccessKey = read(env, "NYLORUN_OBJECT_STORE_SECRET_KEY");
+    if (endpoint === undefined) {
+        if (accessKeyId !== undefined || secretAccessKey !== undefined)
+            throw new StackConfigError("NYLORUN_OBJECT_STORE_ACCESS_KEY or _SECRET_KEY is set without NYLORUN_OBJECT_STORE_ENDPOINT: set the S3 endpoint, e.g. http://rustfs:9000");
+        return undefined;
+    }
+    if (accessKeyId === undefined || secretAccessKey === undefined)
+        throw new StackConfigError("NYLORUN_OBJECT_STORE_ACCESS_KEY and NYLORUN_OBJECT_STORE_SECRET_KEY are required with NYLORUN_OBJECT_STORE_ENDPOINT (`nylorun start` sets them)");
+    const bucket = read(env, "NYLORUN_OBJECT_STORE_BUCKET") ?? "nylorun";
+    if (!BUCKET.test(bucket))
+        throw new StackConfigError(`NYLORUN_OBJECT_STORE_BUCKET must be an S3 bucket name (3 to 63 of a-z 0-9 . -), not ${bucket}`);
+    const region = read(env, "NYLORUN_OBJECT_STORE_REGION") ?? "us-east-1";
+    if (!/^[a-z0-9-]+$/.test(region))
+        throw new StackConfigError(`NYLORUN_OBJECT_STORE_REGION is not a region: ${region}`);
+    return { endpoint: endpoint.replace(/\/+$/, ""), bucket, region, accessKeyId, secretAccessKey };
+}
 function parseTenant(env) {
     const id = read(env, "NYLORUN_TENANT_ID");
     if (id !== undefined && !isTenantId(id))
         throw new StackConfigError(`NYLORUN_TENANT_ID must be a Tenant id (tn_ and 26 Crockford characters), not ${id}`);
-    const raw = read(env, "NYLORUN_DERIVED_PRINCIPALS");
-    const derivedPrincipals = raw === undefined ? ["project"] : raw.split(",").map((entry) => entry.trim());
-    for (const principal of derivedPrincipals)
-        if (!DERIVED_PRINCIPAL_ID_PATTERN.test(principal) || principal === "studio")
-            throw new StackConfigError(`NYLORUN_DERIVED_PRINCIPALS has '${principal}': each entry must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be studio`);
+    const identityFile = read(env, "NYLORUN_IDENTITY_FILE");
     return {
         ...(id ? { id } : {}),
         name: read(env, "NYLORUN_TENANT_NAME") ?? "default",
-        derivedPrincipals: [...new Set(derivedPrincipals)],
+        ...(identityFile ? { identityFile } : {}),
     };
 }
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
+/** `NYLORUN_HARNESS`: `in-process` (the default when unset) or `remote`. */
+function parseHarnessMode(env) {
+    const raw = read(env, "NYLORUN_HARNESS");
+    if (raw === undefined)
+        return undefined;
+    if (raw !== "in-process" && raw !== "remote")
+        throw new StackConfigError(`NYLORUN_HARNESS must be in-process or remote, not ${raw}`);
+    return raw;
+}
+function parseHarnessToken(env, why) {
+    const token = read(env, "NYLORUN_HARNESS_TOKEN");
+    if (token === undefined)
+        throw new StackConfigError(`NYLORUN_HARNESS_TOKEN is required ${why} (\`nylorun start\` sets it)`);
+    if (!GATES_TOKEN.test(token))
+        throw new StackConfigError("NYLORUN_HARNESS_TOKEN must be at least 32 bytes as hex");
+    return token;
+}
+/** `StackConfig.sandboxes` from `NYLORUN_SANDBOXES_*`, or undefined without a URL. */
+function parseSandboxes(env) {
+    const url = parseUrl(env, "NYLORUN_SANDBOXES_URL", ["http:", "https:"]);
+    if (url === undefined)
+        return undefined;
+    const token = read(env, "NYLORUN_SANDBOXES_TOKEN");
+    if (token === undefined || token.length < 32)
+        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun sandbox enable` sets both)");
+    const harnessImage = read(env, "NYLORUN_SANDBOX_HARNESS_IMAGE");
+    if (harnessImage === undefined || /\s/.test(harnessImage))
+        throw new StackConfigError("NYLORUN_SANDBOX_HARNESS_IMAGE is required with NYLORUN_SANDBOXES_URL: the Runtime image sandbox pods copy the engine from (`nylorun start` sets it)");
+    return { url: url.replace(/\/+$/, ""), token, harnessImage };
+}
+/**
+ * `StackConfig.harnessListener` from `NYLORUN_HARNESS_LISTEN_*` and `NYLORUN_HARNESS_TOKEN`
+ * (required with `NYLORUN_HARNESS=remote`; optional when only sandbox pods connect).
+ */
+function parseHarnessListener(env, tokenRequired = true) {
+    const host = read(env, "NYLORUN_HARNESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
+    if (/\s|\//.test(host))
+        throw new StackConfigError(`NYLORUN_HARNESS_LISTEN_HOST is not an address: ${host}`);
+    const rawPort = read(env, "NYLORUN_HARNESS_LISTEN_PORT");
+    const port = rawPort === undefined
+        ? DEFAULT_HARNESS_LISTEN_PORT
+        : parsePort("NYLORUN_HARNESS_LISTEN_PORT", rawPort);
+    const rawAllowed = read(env, "NYLORUN_HARNESS_ALLOWED_HOSTS");
+    const explicit = rawAllowed === undefined
+        ? []
+        : rawAllowed
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry !== "")
+            .map((entry) => normalizeAllowedHost("NYLORUN_HARNESS_ALLOWED_HOSTS", entry));
+    if (explicit.length === 0 && !isLoopbackAddress(host))
+        throw new StackConfigError(`NYLORUN_HARNESS_ALLOWED_HOSTS is required when NYLORUN_HARNESS_LISTEN_HOST is ${host}: list the Host headers harnesses send, e.g. runtime:${port}`);
+    const token = tokenRequired || read(env, "NYLORUN_HARNESS_TOKEN") !== undefined
+        ? parseHarnessToken(env, "with NYLORUN_HARNESS=remote: the credential harnesses present")
+        : undefined;
+    return {
+        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
+        ...(token ? { token } : {}),
+    };
+}
+/** What a harness process must not hold: it runs next to agent code. */
+const HARNESS_REFUSED = ["NYLORUN_DATABASE_URL", "NYLORUN_GATES_TOKEN", "NYLORUN_KEYS_URL"];
+/** `StackConfig.harness` from `NYLORUN_HARNESS_*` and `NYLORUN_GATES_URL`. */
+function parseHarnessService(env) {
+    const held = [
+        ...HARNESS_REFUSED.filter((name) => read(env, name) !== undefined),
+        ...Object.keys(env)
+            .filter((name) => name.startsWith("NYLORUN_RESTATE_") && read(env, name) !== undefined)
+            .sort(),
+    ];
+    if (held.length > 0)
+        throw new StackConfigError(`--service harness refuses to start with ${held.join(", ")} set: a harness reaches no database, no gate or keys credential and no Restate`);
+    const pod = read(env, "NYLORUN_SANDBOX_KIND") === "pod";
+    const url = parseUrl(env, "NYLORUN_HARNESS_URL", pod ? ["http:", "https:", "ws:", "wss:"] : ["ws:", "wss:"]);
+    if (url === undefined)
+        throw new StackConfigError("NYLORUN_HARNESS_URL is required for --service harness: core's Harness API, e.g. ws://runtime:4200/nylorun/harness/v1");
+    const gatesUrl = parseUrl(env, "NYLORUN_GATES_URL", ["http:", "https:"]);
+    if (gatesUrl === undefined)
+        throw new StackConfigError("NYLORUN_GATES_URL is required for --service harness: its model and MCP calls go through the gates service, e.g. http://gateway:4100");
+    const root = read(env, "NYLORUN_HARNESS_ROOT") ?? "/harness";
+    if (!root.startsWith("/"))
+        throw new StackConfigError(`NYLORUN_HARNESS_ROOT must be an absolute path, not ${root}`);
+    const rawHealth = read(env, "NYLORUN_HARNESS_HEALTH_PORT");
+    const podHost = pod ? parsePodHost(env, url) : undefined;
+    return {
+        url: podHost ? podHost.wsUrl : url,
+        ...(podHost
+            ? { pod: podHost.config }
+            : { token: parseHarnessToken(env, "for --service harness: the credential core's Harness API accepts") }),
+        gatesUrl: gatesUrl.replace(/\/+$/, ""),
+        root,
+        healthPort: rawHealth === undefined
+            ? DEFAULT_HARNESS_HEALTH_PORT
+            : parsePort("NYLORUN_HARNESS_HEALTH_PORT", rawHealth),
+    };
+}
+/**
+ * The engine in a pod sandbox: the pod's identity and its join file, from the variables the
+ * sandboxes service renders into the pod. `NYLORUN_HARNESS_URL` is the listener's address on the
+ * Docker host (`http://<host>:<port>`); the WebSocket URL adds the Harness API path.
+ */
+function parsePodHost(env, url) {
+    const need = (name) => {
+        const value = read(env, name);
+        if (value === undefined)
+            throw new StackConfigError(`${name} is required for the engine in a sandbox pod (NYLORUN_SANDBOX_KIND=pod)`);
+        return value;
+    };
+    if (read(env, "NYLORUN_HARNESS_TOKEN") !== undefined)
+        throw new StackConfigError("A sandbox pod's engine holds no NYLORUN_HARNESS_TOKEN: it joins with its join token");
+    const base = new URL(url);
+    const secure = base.protocol === "https:" || base.protocol === "wss:";
+    const origin = `${secure ? "https" : "http"}://${base.host}`;
+    const egress = read(env, "NYLORUN_EGRESS_PROXY");
+    return {
+        wsUrl: `${secure ? "wss" : "ws"}://${base.host}/nylorun/harness/v1`,
+        config: {
+            sandboxId: need("NYLORUN_SANDBOX_ID"),
+            podUid: need("NYLORUN_POD_UID"),
+            joinFile: need("NYLORUN_SANDBOX_JOIN_FILE"),
+            httpUrl: origin,
+            ...(egress ? { egressProxy: egress.replace(/\/+$/, "") } : {}),
+            blocked: blockedAddresses(env),
+        },
+    };
+}
 /** `StackConfig.gates` from `NYLORUN_GATES_*`. */
 function parseGates(env) {
     const host = read(env, "NYLORUN_GATES_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
@@ -360,11 +536,37 @@ function parseGates(env) {
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
+    const resolver = parseResolver(env);
     return {
         listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
         token,
+        ...(resolver ? { resolver } : {}),
     };
 }
+/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
+function parseResolver(env) {
+    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
+    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
+    if (url === undefined) {
+        if (token !== undefined)
+            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
+        return undefined;
+    }
+    if (token === undefined)
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
+    if (/\s/.test(token))
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
+    return { url, token };
+}
+/** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
+function parseEgress(env) {
+    const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
+    if (/\s|\//.test(host))
+        throw new StackConfigError(`NYLORUN_EGRESS_LISTEN_HOST is not an address: ${host}`);
+    const rawPort = read(env, "NYLORUN_EGRESS_LISTEN_PORT");
+    const port = rawPort === undefined ? DEFAULT_EGRESS_LISTEN_PORT : parsePort("NYLORUN_EGRESS_LISTEN_PORT", rawPort);
+    return { listen: { host, port } };
+}
 /** `StackConfig.modelGate` from `NYLORUN_GATES_URL` and `NYLORUN_GATES_TOKEN`. */
 function parseModelGate(env) {
     const url = parseUrl(env, "NYLORUN_GATES_URL", ["http:", "https:"]);

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 export { openTenantRuntime, type TenantOpenHooks, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, type StartEphemeralRuntimeOptions, type EphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
+export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/index.js

@@ -1,5 +1,7 @@
 export { openTenantRuntime, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, } from "./tenant/issuers.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, } from "./host/environment.js";

package/dist/keys/client.js

@@ -12,10 +12,18 @@ import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
 /** Signing and vault writes are short; anything slower is a gateway in trouble. */
 const KEYS_TIMEOUT_MS = 30_000;
+/**
+ * MCP OAuth connect calls the authorization server several times (discovery, registration, the
+ * code exchange), each bounded by `guardedFetch`'s 30 s: these wait longer.
+ */
+const SLOW_OPERATIONS = {
+    startOAuth: 120_000,
+    finishOAuth: 60_000,
+};
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
-    const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
     function call(operation, args) {
+        const timeoutMs = Math.max(options.timeoutMs ?? KEYS_TIMEOUT_MS, SLOW_OPERATIONS[operation] ?? 0);
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");

package/dist/keys/keys.d.ts

@@ -1,7 +1,7 @@
 import type { CreateCredentialRequest, CredentialInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { VaultService } from "../vault/service.js";
+import type { FinishOAuthInput, StartOAuthInput, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -26,9 +26,19 @@ export interface Keys {
     }): Promise<SigningKeyView[]>;
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
+    /** Starts an MCP OAuth connect into an installation vault (`VaultService.startOAuth`). */
+    startOAuth(input: StartOAuthInput): Promise<{
+        authorizeUrl: string;
+        expiresAt: string;
+    }>;
+    /** Finishes one from its callback (`VaultService.finishOAuth`). */
+    finishOAuth(input: FinishOAuthInput): Promise<{
+        vaultId: string;
+        credentialId: string;
+    }>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "startOAuth", "finishOAuth"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -5,6 +5,10 @@
  * delivery tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
+ * MCP OAuth connect (F9-D14) runs here too: discovery, registration, the code exchange and the
+ * credential it seals, so the plaintext tokens, the PKCE verifier and any client secret never
+ * reach the runtime container; core only routes the start and the callback.
+ *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
@@ -20,6 +24,8 @@ export const KEYS_OPERATIONS = [
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
+    "startOAuth",
+    "finishOAuth",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
@@ -28,6 +34,8 @@ export function inProcessKeys(options) {
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
+        startOAuth: (input) => vault.startOAuth(input),
+        finishOAuth: (input) => vault.finishOAuth(input),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));

package/dist/mcp/connect.js

@@ -162,7 +162,8 @@ function authorizedFetch(server, authorize) {
             headers.set(key, value);
         new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
         if (result.status === "authorized")
-            headers.set("authorization", result.headers.authorization);
+            for (const [key, value] of Object.entries(result.headers))
+                headers.set(key, value);
         return fetch(target, { ...init, headers, redirect: "error" });
     };
 }

package/dist/mcp/pool.d.ts

@@ -19,6 +19,7 @@ export declare class McpPool {
         readonly authorize: (sessionId: string, request: {
             url: string;
             serverName: string;
+            agentId?: string;
         }) => Promise<AuthorizeResult>;
         /** Default `DEFAULT_MCP_IDLE_MS`. */
         readonly idleMs?: number;

package/dist/mcp/pool.js

@@ -192,6 +192,7 @@ export class McpPool {
                     : (url) => this.options.authorize(input.sessionId, {
                         url,
                         serverName: declared.server.name,
+                        ...ownerOf(declared),
                     }),
             });
             return { ok: true, connection };

package/dist/mcp/snapshot.d.ts

@@ -1,5 +1,6 @@
 import type { JsonObject } from "@nylorun/core/define";
-import type { AgentManifest } from "@nylorun/core/define";
+import { type AgentManifest } from "@nylorun/core/define";
+import type { DurableSessionTool, HostEffect } from "@nylorun/harness/run";
 export interface McpToolRecord {
     /** The agent used as a tool that declares the server; absent for the session's root agent. */
     readonly agentId?: string;
@@ -27,3 +28,9 @@ export interface McpDiagnostic {
 }
 export declare function modelToolName(serverName: string, serverToolName: string): string;
 export declare function declaredToolNames(manifest: AgentManifest): Set<string>;
+/** The tools of a snapshot, as the engine advertises them. */
+export declare function sessionToolsOf(snapshot: McpSnapshot | undefined): readonly DurableSessionTool[] | undefined;
+/** The snapshot's record of an MCP tool call, or undefined when the call is not an MCP tool. */
+export declare function mcpToolOf(snapshot: McpSnapshot | undefined, request: Pick<HostEffect, "agent" | "capabilityId" | "toolName">): McpToolRecord | undefined;
+/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
+export declare function manifestFor(manifest: AgentManifest, agent: HostEffect["agent"]): AgentManifest | undefined;

package/dist/mcp/snapshot.js

@@ -1,3 +1,4 @@
+import { delegateManifest } from "@nylorun/core/define";
 export function modelToolName(serverName, serverToolName) {
     return `${serverName}__${serverToolName}`;
 }
@@ -8,3 +9,30 @@ export function declaredToolNames(manifest) {
             names.add(tool.name);
     return names;
 }
+/** The tools of a snapshot, as the engine advertises them. */
+export function sessionToolsOf(snapshot) {
+    if (!snapshot?.mcpTools.length)
+        return undefined;
+    return snapshot.mcpTools.map((tool) => ({
+        ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
+        capabilityId: tool.capabilityId,
+        name: tool.name,
+        ...(tool.description === undefined
+            ? {}
+            : { description: tool.description }),
+        inputSchema: tool.inputSchema,
+        ...(tool.outputSchema === undefined
+            ? {}
+            : { outputSchema: tool.outputSchema }),
+    }));
+}
+/** The snapshot's record of an MCP tool call, or undefined when the call is not an MCP tool. */
+export function mcpToolOf(snapshot, request) {
+    return snapshot?.mcpTools.find((tool) => tool.agentId === request.agent?.id &&
+        tool.capabilityId === request.capabilityId &&
+        tool.name === request.toolName);
+}
+/** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
+export function manifestFor(manifest, agent) {
+    return agent ? delegateManifest(manifest, agent.id) : manifest;
+}

package/dist/media.d.ts

@@ -1,29 +1,10 @@
+/**
+ * Image checks for code that handles image bytes itself (an image tool in an Action endpoint):
+ * the supported types, the size cap and a signature check. Storing images is the job of file
+ * artifacts (`artifacts/`, protocol 6), which replaced `MediaStore`.
+ */
 export declare const IMAGE_MEDIA_TYPES: readonly string[];
 export declare const MAX_IMAGE_BYTES: number;
-export interface MediaAsset {
-    readonly id: string;
-    readonly mediaType: string;
-    readonly bytes: number;
-    readonly kind: "input" | "generated";
-}
-/** Opaque reference retained by Harness and resolved by the configured media adapter. */
-export interface MediaReference {
-    readonly agentId: string;
-    readonly assetId: string;
-}
 export declare function decodeImageBase64(mediaType: string, base64: string): Uint8Array;
 /** Verify the asserted media type and lightweight file signature for a supported image. */
 export declare function validateImageBytes(mediaType: string, bytes: Uint8Array): void;
-export interface RuntimeMedia {
-    saveInput(agentId: string, sessionId: string, mediaType: string, base64: string): Promise<MediaAsset>;
-    saveGenerated(agentId: string, sessionId: string, mediaType: string, bytes: Uint8Array): Promise<MediaAsset>;
-    dataUrl(reference: MediaReference, sessionId: string): Promise<{
-        readonly asset: MediaAsset;
-        readonly url: string;
-    } | undefined>;
-    latestInput(agentId: string, sessionId: string): Promise<MediaAsset | undefined>;
-    read(agentId: string, sessionId: string, assetId: string): Promise<{
-        asset: MediaAsset;
-        bytes: Uint8Array;
-    } | undefined>;
-}

package/dist/media.js

@@ -1,3 +1,8 @@
+/**
+ * Image checks for code that handles image bytes itself (an image tool in an Action endpoint):
+ * the supported types, the size cap and a signature check. Storing images is the job of file
+ * artifacts (`artifacts/`, protocol 6), which replaced `MediaStore`.
+ */
 export const IMAGE_MEDIA_TYPES = Object.freeze([
     "image/jpeg",
     "image/png",

package/dist/model/pi-model.d.ts

@@ -1,6 +1,6 @@
 import { type Credential } from "@earendil-works/pi-ai";
 import type { RuntimeModelAdapter } from "../contracts.js";
-import type { RuntimeMedia } from "../adapters/media.js";
+import { type FileResolver } from "../artifacts/files.js";
 import type { HostModelSecret } from "../vault/service.js";
 export interface ModelPreview {
     readonly invocationId: string;
@@ -20,7 +20,11 @@ export interface ModelCallSettings {
 export interface PiModelOptions {
     readonly root?: string;
     readonly onPreview?: (preview: ModelPreview) => void;
-    readonly media?: Pick<RuntimeMedia, "dataUrl">;
+    /**
+     * Resolves the files a prompt names (media parts whose reference is an artifact version) to
+     * their bytes. Model-gate passes one over the Tenant's artifacts (`artifactFiles`).
+     */
+    readonly files?: FileResolver;
     readonly readHostModel?: () => HostModelSecret | undefined | Promise<HostModelSecret | undefined>;
     readonly writeHostCredential?: (credential: Credential) => void | Promise<void>;
     readonly settings?: ModelCallSettings;