@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/vault/service.js

@@ -12,9 +12,8 @@
  * // Administration: each opens its own transaction and writes its audit rows
  * // in that transaction. Creates and rotations replay by idempotency key.
  * createVault(body: CreateVaultRequest): Promise<VaultInfo>
- * listVaults(ownerUserId: string): Promise<VaultInfo[]>
+ * listVaults(ownerUserId: string | undefined, options?: { installation?: boolean }): Promise<VaultInfo[]>
  * getVault(id: string): Promise<VaultInfo>
- * assertOwner(id: string, ownerUserId: string): Promise<void>
  * deleteVault(id: string): Promise<{ id: string }>
  * createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>
  * listCredentials(vaultId: string): Promise<CredentialInfo[]>
@@ -26,9 +25,14 @@
  * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: { opaque?: boolean }): Promise<void>
  * recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>
  *
- * // Use: opens its own transactions; never call it inside one.
+ * // Use: opens its own transactions; never call it inside one. `CredentialSources`
+ * // (`vault/sources.ts`) wraps it with the operator's credential resolver.
  * authorize(input: { sessionId; vaultIds; credentialSelections; url; serverName? }): Promise<AuthorizeResult>
  *
+ * // MCP OAuth connect (F9 C2, installation vaults only): network calls outside any transaction.
+ * startOAuth(input: { vaultId; server; url; clientId?; redirectUri }): Promise<{ authorizeUrl; expiresAt }>
+ * finishOAuth(input: { state; code?; error? }): Promise<{ vaultId; credentialId }>
+ *
  * // Host model credential: each opens its own transaction.
  * getHostModel(): Promise<HostModelView>
  * listHostProviders(): Promise<{ providers: HostModelProviderInfo[] }>
@@ -40,6 +44,13 @@
  * (`vault/host-model.ts`), which only the Model Gate uses: this service seals the host model's
  * credential but never reads it back.
  *
+ * ## Scopes
+ *
+ * - `user`: one person's vault (owner `ownerUserId`), attachable only to that person's sessions.
+ * - `installation` (`INSTALLATION_OWNER`): the installation's own, created by application keys
+ *   only, attachable to any session. Subject and token callers never see one.
+ * - `host`: the model vault (`HOST_VAULT_ID`), never listed or attached.
+ *
  * ## Transactions and I/O
  *
  * - No network I/O runs inside a transaction. The KEK getter may touch the
@@ -59,14 +70,19 @@
  *   has an audit row. Unreadable ciphertext and refresh failures are audited
  *   in their own transaction before the refusal is returned.
  */
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { INSTALLATION_OWNER } from "@nylorun/core/contracts";
 import { canonical } from "../store/canonical.js";
-import { decryptSecret, encryptSecret, VaultCryptoError, } from "./crypto.js";
+import { decryptSecret, encryptSecret, kekId as kekIdOf, openBytes, sealBytes, VaultCryptoError, } from "./crypto.js";
+import { HttpError } from "../tenant/http.js";
+import { authorizationUrl, discoverOAuthServer, exchangeCode, oauthClient, } from "./oauth.js";
 import { VaultError } from "./error.js";
 import { hostModelCatalog } from "../model/catalog.js";
 import { normalizeVaultUrl } from "./url.js";
 const REFRESH_SKEW_MS = 60_000;
 const REFRESH_TIMEOUT_MS = 30_000;
+/** How long an MCP OAuth connect may take between its start and its callback (F9 C2). */
+export const OAUTH_PENDING_MS = 10 * 60_000;
 export const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
 export class VaultService {
@@ -85,13 +101,17 @@ export class VaultService {
     // --- administration --------------------------------------------------------
     async createVault(body) {
         return this.store.tx((t) => this.replay(t, `create-vault:${body.idempotencyKey}`, body, async () => {
+            const installation = body.scope === "installation";
+            const ownerUserId = installation ? INSTALLATION_OWNER : body.ownerUserId;
+            if (!ownerUserId)
+                throw new VaultError(400, "ownerUserId is required for a user vault");
             const row = {
                 id: randomUUID(),
                 name: body.name,
-                ownerUserId: body.ownerUserId,
+                ownerUserId,
                 metadataJson: body.metadata ? JSON.stringify(body.metadata) : null,
                 createdAt: new Date().toISOString(),
-                scope: "user",
+                scope: installation ? "installation" : "user",
             };
             await t.insertVault(row);
             await this.audit(t, {
@@ -103,20 +123,20 @@ export class VaultService {
             return vaultInfoOf(row);
         }));
     }
-    async listVaults(ownerUserId) {
-        return this.store.tx(async (t) => (await t.vaultsByOwner(ownerUserId)).map(vaultInfoOf));
+    /**
+     * One person's vaults, then (with `installation`) the installation vaults. No owner lists
+     * the installation vaults only.
+     */
+    async listVaults(ownerUserId, options = {}) {
+        return this.store.tx(async (t) => {
+            const own = ownerUserId === undefined ? [] : await t.vaultsByOwner(ownerUserId);
+            const shared = options.installation ? await t.installationVaults() : [];
+            return [...own, ...shared].map(vaultInfoOf);
+        });
     }
     async getVault(id) {
         return this.store.tx((t) => this.vaultInfo(t, id));
     }
-    /** Another owner's vault, or the host vault, is the same 404 as a missing one. */
-    async assertOwner(id, ownerUserId) {
-        await this.store.tx(async (t) => {
-            const row = await t.getVault(id);
-            if (!row || row.scope !== "user" || row.ownerUserId !== ownerUserId)
-                throw new VaultError(404, "Vault not found");
-        });
-    }
     async deleteVault(id) {
         return this.store.tx(async (t) => {
             await this.vaultInfo(t, id);
@@ -238,6 +258,9 @@ export class VaultService {
                 throw new VaultError(404, "Vault not found");
             if (vault.scope === "host")
                 throw new VaultError(400, "Host vault cannot be attached to a session");
+            // Any session may use the installation's own vaults (F9-D13).
+            if (vault.scope === "installation")
+                continue;
             if (vault.ownerUserId !== ownerUserId)
                 throw options.opaque
                     ? new VaultError(404, "Vault not found")
@@ -371,6 +394,193 @@ export class VaultService {
             headers: { authorization: `Bearer ${token}` },
         };
     }
+    // --- MCP OAuth connect (F9 C2) ---------------------------------------------
+    /**
+     * Starts signing the installation in to the MCP server at `url`: discovery, a client (the
+     * given id, or one registered now), an S256 PKCE verifier and a `state`, kept for ten minutes
+     * in a pending row (verifier and secret sealed, state hashed). Returns where to send the
+     * browser. Installation vaults only.
+     */
+    async startOAuth(input) {
+        const url = normalizeVaultUrl(input.url);
+        const redirectUri = callbackUrl(input.redirectUri);
+        await this.store.tx(async (t) => {
+            await this.installationVault(t, input.vaultId);
+            await t.deleteExpiredOAuthPending(new Date().toISOString());
+        });
+        const kek = this.kek();
+        const server = await discoverOAuthServer(url, this.fetchImpl);
+        const client = await oauthClient(server, {
+            ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
+            redirectUri,
+            fetchFn: this.fetchImpl,
+        });
+        const state = randomBytes(32).toString("base64url");
+        const { authorizeUrl, codeVerifier } = await authorizationUrl(server, client, { redirectUri, state });
+        const stateHash = hashState(state);
+        const now = Date.now();
+        const expiresAt = new Date(now + OAUTH_PENDING_MS).toISOString();
+        const row = {
+            stateHash,
+            vaultId: input.vaultId,
+            server: input.server,
+            url,
+            tokenEndpoint: server.metadata.token_endpoint,
+            clientId: client.clientId,
+            tokenEndpointAuth: client.tokenEndpointAuth,
+            resource: server.resource ?? null,
+            kekId: "",
+            clientSecret: null,
+            codeVerifier: new Uint8Array(),
+            redirectUri,
+            expiresAt,
+            createdAt: new Date(now).toISOString(),
+        };
+        const verifier = sealBytes(kek, pendingAad(row, "codeVerifier"), Buffer.from(codeVerifier, "utf8"));
+        const secret = client.clientSecret
+            ? sealBytes(kek, pendingAad(row, "clientSecret"), Buffer.from(client.clientSecret, "utf8"))
+            : null;
+        await this.store.tx(async (t) => {
+            await this.installationVault(t, input.vaultId);
+            await t.insertOAuthPending({
+                ...row,
+                kekId: kekIdOf(kek),
+                codeVerifier: verifier,
+                clientSecret: secret,
+            });
+            await this.audit(t, {
+                actor: "application",
+                action: "oauth_start",
+                vaultId: input.vaultId,
+                target: url,
+                outcome: "started",
+            });
+        });
+        return { authorizeUrl, expiresAt };
+    }
+    /**
+     * Finishes a connect from its callback: takes the pending row of `state` (deleted whatever
+     * happens next), exchanges the code, and seals an `oauth` credential bound to the server's
+     * URL in the installation vault, rotating the vault's OAuth credential for that URL when it
+     * has one.
+     */
+    async finishOAuth(input) {
+        const row = await this.store.tx((t) => t.takeOAuthPending(hashState(input.state)));
+        if (!row || Date.parse(row.expiresAt) <= Date.now())
+            throw new HttpError(400, "This sign-in is unknown, already used or expired: start the connect again", { code: "oauth_state_invalid" });
+        const failed = async (error) => {
+            await this.store.tx((t) => this.audit(t, {
+                actor: "application",
+                action: "oauth_connect",
+                vaultId: row.vaultId,
+                target: row.url,
+                outcome: "failed",
+            }));
+            throw error;
+        };
+        if (input.error !== undefined || !input.code)
+            return failed(new HttpError(400, `The authorization server did not grant access (${oauthErrorName(input.error)})`, { code: "oauth_failed" }));
+        const kek = this.kek();
+        let client;
+        let codeVerifier;
+        try {
+            codeVerifier = openSealed(kek, row, "codeVerifier", row.codeVerifier);
+            client = {
+                clientId: row.clientId,
+                tokenEndpointAuth: row.tokenEndpointAuth,
+                ...(row.clientSecret ? { clientSecret: openSealed(kek, row, "clientSecret", row.clientSecret) } : {}),
+            };
+        }
+        catch (error) {
+            if (!(error instanceof VaultCryptoError))
+                throw error;
+            return failed(new HttpError(500, "The sign-in could not be read with this vault key", { code: "oauth_failed" }));
+        }
+        let tokens;
+        try {
+            tokens = await exchangeCode({
+                tokenEndpoint: row.tokenEndpoint,
+                client,
+                code: input.code,
+                codeVerifier,
+                redirectUri: row.redirectUri,
+                ...(row.resource === null ? {} : { resource: row.resource }),
+                fetchFn: this.fetchImpl,
+            });
+        }
+        catch (error) {
+            return failed(error instanceof HttpError ? error : new HttpError(502, "The OAuth code exchange failed", { code: "oauth_failed" }));
+        }
+        if (tokens.token_type.toLowerCase() !== "bearer")
+            return failed(new HttpError(502, `The authorization server issued a ${tokens.token_type} token; MCP needs a bearer token`, {
+                code: "oauth_failed",
+            }));
+        const payload = {
+            accessToken: tokens.access_token,
+            ...(tokens.refresh_token
+                ? {
+                    refreshToken: tokens.refresh_token,
+                    tokenEndpoint: row.tokenEndpoint,
+                    clientId: client.clientId,
+                    tokenEndpointAuth: client.tokenEndpointAuth,
+                    ...(client.clientSecret ? { clientSecret: client.clientSecret } : {}),
+                }
+                : {}),
+        };
+        const now = new Date();
+        const expiresAt = typeof tokens.expires_in === "number" && Number.isFinite(tokens.expires_in)
+            ? new Date(now.getTime() + tokens.expires_in * 1000).toISOString()
+            : null;
+        return this.store.tx(async (t) => {
+            await this.installationVault(t, row.vaultId);
+            const existing = (await t.credentialsForVault(row.vaultId, { type: "oauth" })).find((item) => bindingUrl(item) === row.url);
+            if (existing) {
+                await this.writePayload(t, kek, existing, payload, expiresAt, now.toISOString());
+                await this.audit(t, {
+                    actor: "application",
+                    action: "oauth_connect",
+                    vaultId: row.vaultId,
+                    credentialId: existing.id,
+                    target: row.url,
+                    outcome: "rotated",
+                });
+                return { vaultId: row.vaultId, credentialId: existing.id };
+            }
+            const id = randomUUID();
+            const sealed = encryptSecret(kek, credentialAad(row.vaultId, id, "oauth", row.url), Buffer.from(JSON.stringify(payload), "utf8"));
+            await t.insertCredential({
+                id,
+                vaultId: row.vaultId,
+                name: row.server,
+                type: "oauth",
+                bindingJson: JSON.stringify({ url: row.url }),
+                expiresAt,
+                createdAt: now.toISOString(),
+                rotatedAt: null,
+                ...sealed,
+            });
+            await this.audit(t, {
+                actor: "application",
+                action: "oauth_connect",
+                vaultId: row.vaultId,
+                credentialId: id,
+                target: row.url,
+                outcome: "created",
+            });
+            return { vaultId: row.vaultId, credentialId: id };
+        });
+    }
+    /** An installation vault, else the 404 of a missing one (a user vault is a 400). */
+    async installationVault(t, id) {
+        const row = await t.getVault(id);
+        if (!row || row.scope === "host")
+            throw new VaultError(404, "Vault not found");
+        if (row.scope !== "installation")
+            throw new HttpError(400, "MCP OAuth connect stores its credential in an installation vault only", {
+                code: "request_rejected",
+            });
+        return row;
+    }
     // --- host model ----------------------------------------------------------------
     async getHostModel() {
         return this.store.tx((t) => this.hostModelView(t));
@@ -727,6 +937,40 @@ export class VaultService {
         });
     }
 }
+function hashState(state) {
+    return createHash("sha256").update(state, "utf8").digest("hex");
+}
+function pendingAad(row, field) {
+    return Buffer.from(canonical({ table: "oauth_pending", stateHash: row.stateHash, vaultId: row.vaultId, field }), "utf8");
+}
+function openSealed(kek, row, field, sealed) {
+    const plaintext = openBytes(kek, pendingAad(row, field), Buffer.from(sealed), row.kekId);
+    try {
+        return plaintext.toString("utf8");
+    }
+    finally {
+        plaintext.fill(0);
+    }
+}
+/** The callback URL the authorization server sends the browser back to. */
+function callbackUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new VaultError(400, "The OAuth redirect URI is invalid");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+        throw new VaultError(400, "The OAuth redirect URI must be http or https");
+    return url.href;
+}
+/** An authorization server's `error`, safe to show: an OAuth error code, or a stand-in. */
+function oauthErrorName(error) {
+    if (error === undefined)
+        return "no code";
+    return /^[A-Za-z0-9_.-]{1,64}$/.test(error) ? error : "error";
+}
 function isUserCredential(row) {
     return row.type !== "model";
 }

package/dist/vault/sources.d.ts

@@ -0,0 +1,54 @@
+import type { CredentialSelection } from "@nylorun/core/contracts";
+import type { AuthorizeResult, VaultService } from "./service.js";
+/** The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`). */
+export interface ResolverConfig {
+    readonly url: string;
+    readonly token: string;
+}
+/** What the resolver is asked about: the session's row, as stored. */
+export interface CredentialSession {
+    readonly id: string;
+    readonly ownerUserId: string;
+    readonly activeTurnId: string | null;
+    readonly vaultIds?: readonly string[];
+    readonly credentialSelections?: readonly CredentialSelection[];
+}
+/** One MCP request: the declared server's URL, its name and the agent that declares it. */
+export interface McpCredentialRequest {
+    readonly url: string;
+    readonly serverName?: string;
+    /** The agent used as a tool that declares the server; absent for the session's root agent. */
+    readonly agentId?: string;
+}
+export interface CredentialSourcesOptions {
+    readonly vault: Pick<VaultService, "authorize">;
+    /** Absent: the vaults are the only source, as before F9. */
+    readonly resolver?: ResolverConfig;
+    /** Default `globalThis.fetch`. */
+    readonly fetch?: typeof fetch;
+    /** How long the resolver may take. Default 5 s. */
+    readonly timeoutMs?: number;
+    readonly now?: () => number;
+}
+export declare const RESOLVER_TIMEOUT_MS = 5000;
+/** The longest an answer is kept, whatever its `expiresAt`. */
+export declare const RESOLVER_MAX_CACHE_MS: number;
+/** How long an answer without `expiresAt` (and a 404) is kept. */
+export declare const RESOLVER_DEFAULT_CACHE_MS = 60000;
+/** The refusal reason when the resolver could not answer. */
+export declare const CREDENTIAL_UNAVAILABLE = "credential_unavailable";
+export declare class CredentialSources {
+    private readonly vault;
+    private readonly resolver;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    private readonly now;
+    private readonly cache;
+    private readonly pending;
+    constructor(options: CredentialSourcesOptions);
+    /** The credential of one MCP request made for `session`. */
+    authorize(session: CredentialSession, request: McpCredentialRequest): Promise<AuthorizeResult>;
+    private answer;
+    private until;
+    private ask;
+}

package/dist/vault/sources.js

@@ -0,0 +1,185 @@
+/**
+ * Where a session's MCP credential comes from (F9 C1): the session's attached vaults first,
+ * then the operator's credential resolver, an HTTP service on the operator's own network that
+ * holds people's own credentials (OSS never stores them, F9-D7).
+ *
+ * Both authorize sites call this: the gateway (`gates/tenant-vaults.ts`, remote MCP servers in
+ * the gates service) and the Tenant (`tenant/effects.ts`, the in-process MCP pool).
+ *
+ * ## The resolver contract
+ *
+ * Asked only when the attached vaults hold no credential for the URL (the vault's
+ * `unauthenticated`), and only for a person's session (never a reserved owner):
+ *
+ * ```text
+ * POST <resolver url>
+ * Authorization: Bearer <resolver token>
+ * { "owner": "u:priya", "session": "s_…", "turn": "t_…" | null,
+ *   "target": { "kind": "mcp", "server": "github", "agent": "support", "url": "https://…/mcp" } }
+ *
+ * 200 { "headers": { "authorization": "Bearer …" }, "expiresAt"?: "<ISO time>" } → authorized
+ * 404                                         → unauthenticated (the call goes without one)
+ * anything else, a bad body, or no answer in 5 s → refused: credential_unavailable
+ * ```
+ *
+ * `owner` and `turn` come from the session row, never from the harness. Because authorize runs
+ * on every MCP HTTP request, answers (200 and 404) are cached per (owner, url): until
+ * `expiresAt`, at most 5 minutes, and 60 s without one. Concurrent misses for one key share one
+ * request. Failures are not cached. The resolver's URL is the operator's, so private addresses
+ * are allowed; redirects are refused.
+ */
+import { isSubject } from "@nylorun/core/contracts";
+export const RESOLVER_TIMEOUT_MS = 5_000;
+/** The longest an answer is kept, whatever its `expiresAt`. */
+export const RESOLVER_MAX_CACHE_MS = 5 * 60_000;
+/** How long an answer without `expiresAt` (and a 404) is kept. */
+export const RESOLVER_DEFAULT_CACHE_MS = 60_000;
+/** The refusal reason when the resolver could not answer. */
+export const CREDENTIAL_UNAVAILABLE = "credential_unavailable";
+/** RFC 9110 field names. */
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+/** Headers the MCP transport owns; a resolver may not set them. */
+const RESERVED_HEADERS = new Set([
+    "host",
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+    "connection",
+    "accept",
+    "mcp-session-id",
+    "mcp-protocol-version",
+]);
+export class CredentialSources {
+    vault;
+    resolver;
+    fetchImpl;
+    timeoutMs;
+    now;
+    cache = new Map();
+    pending = new Map();
+    constructor(options) {
+        this.vault = options.vault;
+        this.resolver = options.resolver;
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        this.timeoutMs = options.timeoutMs ?? RESOLVER_TIMEOUT_MS;
+        this.now = options.now ?? Date.now;
+    }
+    /** The credential of one MCP request made for `session`. */
+    async authorize(session, request) {
+        const result = await this.vault.authorize({
+            sessionId: session.id,
+            vaultIds: session.vaultIds ?? [],
+            credentialSelections: session.credentialSelections ?? [],
+            url: request.url,
+            ...(request.serverName === undefined ? {} : { serverName: request.serverName }),
+        });
+        if (result.status !== "unauthenticated" || !this.resolver)
+            return result;
+        // `host` and `installation` are no one: there is no person to resolve for.
+        if (!isSubject(session.ownerUserId))
+            return result;
+        const answer = await this.answer(session, request, result.url);
+        if (answer.kind === "failed")
+            return { status: "refused", url: result.url, credentialIds: [], reason: CREDENTIAL_UNAVAILABLE };
+        if (answer.kind === "none")
+            return result;
+        return { status: "authorized", url: result.url, headers: { ...answer.headers } };
+    }
+    async answer(session, request, url) {
+        const key = JSON.stringify([session.ownerUserId, url]);
+        const cached = this.cache.get(key);
+        if (cached) {
+            if (cached.until > this.now())
+                return cached.answer;
+            this.cache.delete(key);
+        }
+        let pending = this.pending.get(key);
+        if (!pending) {
+            pending = this.ask(session, request, url)
+                .then((answer) => {
+                if (answer.kind !== "failed") {
+                    const until = this.until(answer);
+                    if (until > this.now())
+                        this.cache.set(key, { answer, until });
+                }
+                return answer;
+            })
+                .finally(() => this.pending.delete(key));
+            this.pending.set(key, pending);
+        }
+        return pending;
+    }
+    until(answer) {
+        const now = this.now();
+        const cap = now + RESOLVER_MAX_CACHE_MS;
+        if (answer.kind === "headers" && answer.expiresAt !== undefined)
+            return Math.min(answer.expiresAt, cap);
+        return now + RESOLVER_DEFAULT_CACHE_MS;
+    }
+    async ask(session, request, url) {
+        const resolver = this.resolver;
+        const body = {
+            owner: session.ownerUserId,
+            session: session.id,
+            turn: session.activeTurnId ?? null,
+            target: {
+                kind: "mcp",
+                ...(request.serverName ? { server: request.serverName } : {}),
+                ...(request.agentId ? { agent: request.agentId } : {}),
+                url,
+            },
+        };
+        try {
+            const response = await this.fetchImpl(resolver.url, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${resolver.token}`,
+                    "content-type": "application/json",
+                    accept: "application/json",
+                },
+                body: JSON.stringify(body),
+                redirect: "error",
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+            if (response.status === 404) {
+                await response.body?.cancel().catch(() => undefined);
+                return { kind: "none" };
+            }
+            if (response.status !== 200) {
+                await response.body?.cancel().catch(() => undefined);
+                return { kind: "failed" };
+            }
+            return parseAnswer(await response.json(), this.now());
+        }
+        catch {
+            return { kind: "failed" };
+        }
+    }
+}
+function parseAnswer(value, now) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return { kind: "failed" };
+    const { headers, expiresAt } = value;
+    if (!headers || typeof headers !== "object" || Array.isArray(headers))
+        return { kind: "failed" };
+    const entries = Object.entries(headers);
+    if (entries.length === 0)
+        return { kind: "failed" };
+    const out = {};
+    for (const [name, item] of entries) {
+        if (!HEADER_NAME.test(name) || RESERVED_HEADERS.has(name.toLowerCase()))
+            return { kind: "failed" };
+        if (typeof item !== "string" || item === "" || /[\r\n\0]/.test(item))
+            return { kind: "failed" };
+        out[name.toLowerCase()] = item;
+    }
+    if (expiresAt === undefined || expiresAt === null)
+        return { kind: "headers", headers: out };
+    if (typeof expiresAt !== "string")
+        return { kind: "failed" };
+    const at = Date.parse(expiresAt);
+    if (Number.isNaN(at))
+        return { kind: "failed" };
+    // An answer that has already expired is used once and not kept.
+    return { kind: "headers", headers: out, expiresAt: Math.max(at, now) };
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.15.2-beta";
+export declare const RUNTIME_VERSION = "0.17.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.15.2-beta";
+export const RUNTIME_VERSION = "0.17.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.15.2-beta",
+  "version": "0.17.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,16 +59,17 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@ag-ui/core": "~1.0.0",
+    "@ag-ui/core": "~1.0.1",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@earendil-works/pi-ai": "0.99.1",
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@nylorun/core": "0.11.0-beta",
-    "@nylorun/harness": "0.21.2-beta",
-    "@restatedev/restate-sdk": "1.16.9",
-    "@s2-dev/streamstore": "0.27.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@nylorun/core": "0.13.0-beta",
+    "@nylorun/harness": "0.22.1-beta",
+    "@restatedev/restate-sdk": "1.17.2",
+    "@s2-dev/streamstore": "0.28.0",
+    "aws4fetch": "1.0.20",
     "drizzle-orm": "^0.45.3",
     "hono": "^4.13.12",
     "jose": "^6.2.12",
@@ -76,17 +77,20 @@
     "pg": "8.23.1",
     "pg-logical-replication": "2.5.0",
     "postgres": "^3.4.9",
+    "ws": "^8.22.0",
+    "yaml": "^2.9.1",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
-    "@ag-ui/client": "1.0.0",
+    "@ag-ui/client": "1.0.1",
     "@scalar/openapi-parser": "^0.29.9",
     "@types/node": "^26.5.0",
     "@types/pg": "^8.23.1",
+    "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.2"
   }
 }