@nylorun/runtime 0.15.2-beta → 0.17.0-beta

package/dist/api/http/routes/sandboxes.js

@@ -0,0 +1,150 @@
+import { z } from "zod";
+import { isSandboxId, PutSandboxRequestSchema } from "@nylorun/core/contracts";
+import { DeleteSandboxResponse, ListSandboxEventsResponse, ListSandboxesResponse, PutSandboxRequest, SandboxView, } from "../../components.js";
+import { fail } from "../../../tenant/http.js";
+import { deleteSandbox, getSandbox, listSandboxes, putSandbox, resetSandbox, sandboxEventsOf, stopSandbox, } from "../../../tenant/sandboxes.js";
+import { readJson } from "../body.js";
+import { tenantRoute } from "../define.js";
+import { jsonResponse } from "../respond.js";
+/** Reading a sandbox: any caller that may use sessions, or change sandboxes. */
+const READ = {
+    credentials: ["application", "subject", "token"],
+    scopes: ["sessions:own", "sandboxes:write"],
+};
+/** Creating or deleting one. */
+const WRITE = {
+    credentials: ["application", "subject", "token"],
+    scopes: ["sandboxes:write"],
+};
+const json = (schema, description) => ({
+    description,
+    content: { "application/json": { schema } },
+});
+const sandboxId = z.object({
+    sandboxId: z
+        .string()
+        .meta({ description: "The sandbox id, percent-encoded: `team-a%2Fproj-42` for `team-a/proj-42`" }),
+});
+/** The path's sandbox id, or a 400 naming the rule. */
+function idOf(value) {
+    if (!isSandboxId(value))
+        return fail(400, "A sandbox id is up to 200 characters: /-separated segments of letters, digits, '.', '_' and '-'");
+    return value;
+}
+/** `label=k=v`, repeated: every one must match. */
+function labelsOf(values) {
+    const labels = {};
+    for (const value of values ?? []) {
+        const at = value.indexOf("=");
+        if (at <= 0)
+            fail(400, `label must be key=value, not ${value}`);
+        labels[value.slice(0, at)] = value.slice(at + 1);
+    }
+    return labels;
+}
+export function sandboxRoutes(api) {
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/sandboxes",
+        tags: ["Sandboxes"],
+        summary: "List sandboxes",
+        description: "Every sandbox with all the labels asked for. A token caller sees only the sandboxes its grants reach.",
+        request: {
+            query: z.object({
+                label: z
+                    .union([z.string(), z.array(z.string())])
+                    .optional()
+                    .meta({ description: "`key=value`; repeat it to require several labels" }),
+            }),
+        },
+        responses: { 200: json(ListSandboxesResponse, "The sandboxes") },
+    }, async (c) => jsonResponse(200, await listSandboxes(c.env.tenant, labelsOf(c.req.queries("label")), c.get("scope"))));
+    tenantRoute(api, WRITE, {
+        method: "put",
+        path: "/v1/sandboxes/{sandboxId}",
+        tags: ["Sandboxes"],
+        summary: "Create or find a sandbox",
+        description: "Creates the sandbox within the Tenant's limits, or answers the one with this id, so get-or-create is one call. Its spec is fixed once it exists; labels, when sent, replace its labels. Kind `pod` needs sandbox pods (`nylorun sandbox enable`): it is created at once, and a PUT on an existing pod sandbox starts it again when it was stopped, or revives it with a longer `lifecycle.ttl`.",
+        request: {
+            params: sandboxId,
+            body: { required: true, content: { "application/json": { schema: PutSandboxRequest } } },
+        },
+        responses: {
+            200: json(SandboxView, "The sandbox"),
+            409: {
+                description: "A sandbox with this id has another spec, the Tenant holds as many sandboxes as it allows (`limit_exceeded`), kind pod without sandbox pods (`sandbox_unavailable`), or a lost pod sandbox (`sandbox_lost`)",
+            },
+        },
+    }, async (c) => {
+        const id = idOf(c.req.param("sandboxId"));
+        const body = PutSandboxRequestSchema.parse(await readJson(c.req.raw));
+        return jsonResponse(200, await putSandbox(c.env.tenant, id, body, c.get("scope")));
+    });
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/sandboxes/{sandboxId}",
+        tags: ["Sandboxes"],
+        summary: "Get a sandbox",
+        description: "Its spec, labels, state and the sessions attached to it (acting for a person, only theirs).",
+        request: { params: sandboxId },
+        responses: { 200: json(SandboxView, "The sandbox") },
+    }, async (c) => jsonResponse(200, await getSandbox(c.env.tenant, idOf(c.req.param("sandboxId")), c.get("scope"))));
+    tenantRoute(api, READ, {
+        method: "get",
+        path: "/v1/sandboxes/{sandboxId}/events",
+        tags: ["Sandboxes"],
+        summary: "Read a sandbox's lifecycle events",
+        description: "`sandbox.created`, `sandbox.attached`, `sandbox.detached` and `sandbox.deleted`, in order, numbered from 0.",
+        request: {
+            params: sandboxId,
+            query: z.object({
+                from: z.string().optional().meta({ description: "The first `seq` to return" }),
+            }),
+        },
+        responses: { 200: json(ListSandboxEventsResponse, "The events") },
+    }, async (c) => {
+        const from = c.req.query("from");
+        if (from !== undefined && !/^\d+$/.test(from))
+            fail(400, "from must be a seq");
+        return jsonResponse(200, await sandboxEventsOf(c.env.tenant, idOf(c.req.param("sandboxId")), c.get("scope"), from === undefined ? undefined : Number(from)));
+    });
+    tenantRoute(api, WRITE, {
+        method: "delete",
+        path: "/v1/sandboxes/{sandboxId}",
+        tags: ["Sandboxes"],
+        summary: "Delete a sandbox",
+        description: "Deletes the sandbox and its files. Sessions attached to it stay attached by id; their next turn is refused until a sandbox with this id exists again.",
+        request: { params: sandboxId },
+        responses: {
+            200: json(DeleteSandboxResponse, "Deleted, or there was none"),
+            409: { description: "A session attached to it has a turn running (`sandbox_busy`)" },
+        },
+    }, async (c) => jsonResponse(200, await deleteSandbox(c.env.tenant, idOf(c.req.param("sandboxId")), c.get("scope"))));
+    for (const [action, summary, description, run] of [
+        [
+            "stop",
+            "Stop a pod sandbox",
+            "Suspends the pod: its volume is kept, and the next turn of a session attached to it (or a PUT) starts it again. Refused during a turn (`sandbox_busy`).",
+            stopSandbox,
+        ],
+        [
+            "reset",
+            "Reset a pod sandbox",
+            "A new pod on a new, empty volume; the old pod and volume are deleted. The way out of `sandbox_lost`. Refused during a turn (`sandbox_busy`).",
+            resetSandbox,
+        ],
+    ])
+        tenantRoute(api, WRITE, {
+            method: "post",
+            path: `/v1/sandboxes/{sandboxId}/${action}`,
+            tags: ["Sandboxes"],
+            summary,
+            description,
+            request: { params: sandboxId },
+            responses: {
+                200: json(SandboxView, "The sandbox"),
+                400: { description: "The sandbox is virtual" },
+                409: { description: "A turn holds it (`sandbox_busy`), or no sandbox pods (`sandbox_unavailable`)" },
+            },
+        }, async (c) => jsonResponse(200, await run(c.env.tenant, idOf(c.req.param("sandboxId")), c.get("scope"))));
+}

package/dist/api/http/routes/sessions.js

@@ -7,7 +7,8 @@ import { sandboxRouteDeps } from "../../../tenant/actions.js";
 import { accessOf, requireApplication } from "../../../tenant/auth.js";
 import { loadSession, sessionOf } from "../../../tenant/context.js";
 import { fail } from "../../../tenant/http.js";
-import { readHistory, requestCursor, streamSessionEvents } from "../../../tenant/session-streams.js";
+import { sandboxGrantsOf } from "../../../tenant/sandboxes.js";
+import { readHistory, requestCursor, streamHolderOf, streamSessionEvents } from "../../../tenant/session-streams.js";
 import { listAgentsPublic, listDefinitions, listSessions, putDefinition, putSession, sessionView, } from "../../../tenant/sessions.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
@@ -15,7 +16,6 @@ import { jsonResponse } from "../respond.js";
 const OWN_SESSIONS = {
     credentials: ["application", "subject", "token"],
     scopes: ["sessions:own"],
-    browser: true,
 };
 const json = (schema, description) => ({
     description,
@@ -46,23 +46,20 @@ async function sessionBelow(ctx, incoming, id, access) {
 }
 export function sessionRoutes(api) {
     tenantRoute(api, {
-        credentials: ["application", "subject", "token", "publishable"],
+        credentials: ["application", "subject", "token"],
         scopes: ["agents:read", "agents:write"],
-        browser: true,
     }, {
         method: "get",
         path: "/v1/agents",
         tags: ["Agents"],
         summary: "List agents",
-        description: "With an application key, every definition, manifest included. With a subject token or a publishable key, only the agents it may use, by name.",
+        description: "With an application key, every definition, manifest included. With a trusted issuer's token, only the agents it may use, by name.",
         responses: {
             200: json(z.union([ListAgentsResponse, ListPublicAgentsResponse]), "The agents"),
         },
     }, async (c) => {
         const scope = c.get("scope");
         const ctx = c.env.tenant;
-        if (scope.kind === "publishable")
-            return jsonResponse(200, await listAgentsPublic(ctx, scope.agents));
         return jsonResponse(200, scope.kind === "token"
             ? await listAgentsPublic(ctx, scope.agents)
             : await listDefinitions(ctx));
@@ -106,8 +103,9 @@ export function sessionRoutes(api) {
         const request = PutSessionRequestSchema.parse(await readJson(c.req.raw));
         // Agent code may trust `info`: only an app server sets it.
         if (scope.kind === "token" && request.info !== undefined)
-            fail(403, "A subject token cannot set session info", { code: "scope_required" });
-        const session = await putSession(ctx, c.req.param("sessionId"), request, accessOf(scope));
+            fail(403, "A token caller cannot set session info", { code: "scope_required" });
+        const grants = sandboxGrantsOf(scope);
+        const session = await putSession(ctx, c.req.param("sessionId"), request, accessOf(scope), grants === undefined ? {} : { sandboxGrants: grants });
         return jsonResponse(200, await ctx.store.tx((t) => sessionView(t, session)));
     });
     tenantRoute(api, OWN_SESSIONS, {
@@ -150,7 +148,7 @@ export function sessionRoutes(api) {
         path: "/v1/sessions/{sessionId}/events",
         tags: ["Sessions"],
         summary: "Follow a session's events",
-        description: "Server-sent events, each with its type as `event` and its cursor as `id`, from the cursor on. Events are on the `nylorun.event/2` envelope, typed by `SessionEvent`; a client ignores a type it does not know. A subject token's stream ends with `event: nylorun.closed` when the token expires or the subject is revoked. A `: keepalive` comment every 15 seconds.",
+        description: "Server-sent events, each with its type as `event` and its cursor as `id`, from the cursor on. Events are on the `nylorun.event/2` envelope, typed by `SessionEvent`; a client ignores a type it does not know. A trusted issuer's token's stream ends with `event: nylorun.closed` when the token expires. A `: keepalive` comment every 15 seconds.",
         request: { params: sessionId, query: resume },
         responses: {
             200: {
@@ -168,9 +166,7 @@ export function sessionRoutes(api) {
         const { incoming, outgoing } = c.env;
         const id = c.req.param("sessionId");
         const cursor = await sessionBelow(ctx, incoming, id, accessOf(scope));
-        await streamSessionEvents(ctx, incoming, outgoing, id, cursor, scope.kind === "token"
-            ? { subject: scope.subject, epoch: scope.epoch, expiresAt: scope.expiresAt }
-            : undefined);
+        await streamSessionEvents(ctx, incoming, outgoing, id, cursor, streamHolderOf(scope));
         return RESPONSE_ALREADY_SENT;
     });
     tenantRoute(api, { credentials: ["application"], scopes: "never" }, {

package/dist/api/http/routes/tenant.js

@@ -10,11 +10,12 @@ import { clearObservers } from "../../../tenant/session-streams.js";
 import { usesFixtureModel } from "../../../tenant/model-setting.js";
 import { resetTenant } from "../../../tenant/reset.js";
 import { clearWork, drain } from "../../../tenant/scheduler.js";
-import { buildTenantStatus, seedTenantConfig } from "../../../tenant/status.js";
+import { buildTenantStatus, harnessStatusOf, seedTenantConfig } from "../../../tenant/status.js";
 import { tenantReset, streamsStatus, } from "../../../tenant/streams.js";
 import { readJson } from "../body.js";
 import { pathSegments, tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
+import { rearmPodTimers } from "../../../tenant/sandboxes.js";
 const settings = (scopes) => ({
     credentials: scopes === "never" ? ["application"] : ["application", "subject"],
     scopes,
@@ -46,7 +47,36 @@ const budgetView = (row) => ({
 /** `GET /v1/tenant/sandbox`: the backend report and the configuration with defaults applied. */
 async function sandboxView(ctx) {
     const config = await ctx.store.tx((t) => readSandboxConfig(t));
-    return { ...(await ctx.sandbox.report()), config: effectiveSandboxConfig(config) };
+    return {
+        ...(await ctx.sandbox.report()),
+        config: effectiveSandboxConfig(config),
+        cluster: await clusterOf(ctx),
+    };
+}
+/** The Tenant's cluster for pod sandboxes (F7.2), from the sandboxes service; null without one. */
+async function clusterOf(ctx) {
+    if (!ctx.pods)
+        return null;
+    try {
+        const [info, ready] = await Promise.all([ctx.pods.client.info(), ctx.pods.client.ready()]);
+        return {
+            namespace: info.namespace,
+            context: info.context,
+            ready,
+            ...(info.controllerVersion ? { controllerVersion: info.controllerVersion } : {}),
+            ...(info.networkPolicy
+                ? {
+                    networkPolicy: {
+                        enforced: info.networkPolicy.enforced === true,
+                        ...(info.networkPolicy.probedAt ? { probedAt: info.networkPolicy.probedAt } : {}),
+                    },
+                }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
 }
 export function tenantRoutes(api) {
     tenantRoute(api, SETTINGS, {
@@ -70,6 +100,7 @@ export function tenantRoutes(api) {
                 (await vault.getHostModel()).configured,
             ...(ctx.stuckInvocations ? { stuckInvocations: ctx.stuckInvocations } : {}),
             streamsStatus: () => streamsStatus(ctx),
+            harness: harnessStatusOf(ctx),
         }));
     });
     tenantRoute(api, settings("never"), {
@@ -91,6 +122,7 @@ export function tenantRoutes(api) {
             store: ctx.store,
             sandbox: ctx.sandbox,
             paths: ctx.config.paths,
+            blobs: ctx.blobs,
             clearSessionState: () => {
                 clearWork(ctx);
                 clearObservers(ctx.sessionStreams);
@@ -147,6 +179,8 @@ export function tenantRoutes(api) {
         if (errors.length > 0)
             fail(400, errors.join(" "));
         await ctx.store.tx((t) => writeSandboxConfig(t, config));
+        // Pods' idle timers follow the new limits.idle (D36).
+        await rearmPodTimers(ctx);
         return jsonResponse(200, await sandboxView(ctx));
     });
     tenantRoute(api, SETTINGS, {

package/dist/api/http/routes/vaults.d.ts

@@ -1,8 +1,17 @@
 /**
- * Vaults and their credentials (`/v1/vaults/**`): secrets a session's tools use, owned by one
- * person. Acting for a subject reaches only the subject's own vaults, and never on another's
- * behalf.
+ * Vaults and their credentials (`/v1/vaults/**`): secrets a session's tools use. Only an
+ * application key acting for no one (an operator key, Studio) reaches these routes (protocol 7):
+ * a request acting for a subject, or a trusted issuer's token, is `403 scope_required`. The
+ * installation's own vaults (`scope: "installation"`) attach to any session; a vault of one
+ * person (`ownerUserId`) attaches only to that person's sessions. A person's own credentials
+ * come from the operator's credential resolver (`vault/sources.ts`), not from these routes.
+ *
+ * MCP OAuth connect (F9 C2): an application key starts one into an installation vault
+ * (`/oauth/start`); the authorization server sends the browser back to the anonymous, unversioned
+ * `GET /v1/oauth/callback`. Both only route: the gateway's keys module does the OAuth (F9-D14).
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { TenantEnv } from "../app.js";
+/** Where the authorization server sends the browser back. */
+export declare const OAUTH_CALLBACK_PATH = "/v1/oauth/callback";
 export declare function vaultRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/vaults.js

@@ -1,16 +1,25 @@
 import { z } from "zod";
-import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, } from "@nylorun/core/contracts";
-import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, VaultInfo, } from "../../components.js";
-import { ownerOf } from "../../../tenant/auth.js";
-import { fail } from "../../../tenant/http.js";
+import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, } from "@nylorun/core/contracts";
+import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, StartOAuthRequest, StartOAuthResponse, VaultInfo, } from "../../components.js";
+import { HttpError } from "../../../tenant/http.js";
+import { VaultError } from "../../../vault/error.js";
 import { readJson } from "../body.js";
-import { pathSegments, tenantRoute } from "../define.js";
+import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
-const OWN_VAULTS = {
+/** Every vault route, and starting an MCP OAuth connect: an application key acting for no one. */
+const APPLICATION = { credentials: ["application"], scopes: "never" };
+/**
+ * The OAuth callback: a browser sent back by the authorization server, with no credential and no
+ * protocol header. The `state` it carries is the grant.
+ */
+const CALLBACK = {
     credentials: ["application", "subject", "token"],
-    scopes: ["vaults:own"],
-    browser: true,
+    scopes: "any",
+    anonymous: true,
+    unversioned: true,
 };
+/** Where the authorization server sends the browser back. */
+export const OAUTH_CALLBACK_PATH = "/v1/oauth/callback";
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -21,58 +30,45 @@ const body = (schema) => ({
 });
 const vaultId = z.object({ vaultId: z.string() });
 const credentialId = vaultId.extend({ credentialId: z.string() });
-/**
- * Who a vault route acts for: the subject, or no one in particular (an application key). Below
- * a vault, the vault must be the subject's before anything else.
- */
-async function ownerFor(c) {
-    const { vault } = c.env.tenant;
-    const owner = ownerOf(c.get("scope"));
-    const id = c.req.param("vaultId");
-    if (id !== undefined && owner !== undefined)
-        await vault.assertOwner(id, owner);
-    return owner;
-}
 export function vaultRoutes(api) {
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults",
         tags: ["Vaults"],
         summary: "Create a vault",
+        description: "With `scope: \"installation\"` the installation's own vault, owned by `installation`, which any session may attach; or a vault of one person (`ownerUserId`), which only that person's sessions attach.",
         request: { body: body(CreateVaultRequest) },
         responses: {
             200: json(VaultInfo, "The vault"),
             409: { description: "The idempotency key was used for another vault" },
         },
     }, async (c) => {
-        const owner = await ownerFor(c);
         const request = CreateVaultRequestSchema.parse(await readJson(c.req.raw));
-        if (owner !== undefined && request.ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
         return jsonResponse(200, await c.env.tenant.vault.createVault(request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults",
         tags: ["Vaults"],
-        summary: "List a person's vaults",
+        summary: "List vaults",
+        description: "The installation vaults, after the vaults of `ownerUserId` when it names a person.",
         request: {
             query: z.object({
                 ownerUserId: z
                     .string()
                     .optional()
-                    .meta({ description: "Whose vaults; required with an application key acting for no one" }),
+                    .meta({ description: "Also list this person's vaults" }),
             }),
         },
         responses: { 200: json(ListVaultsResponse, "The vaults") },
     }, async (c) => {
-        const owner = await ownerFor(c);
-        const ownerUserId = c.req.query("ownerUserId") ?? owner ?? fail(400, "ownerUserId is required");
-        if (owner !== undefined && ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
-        return jsonResponse(200, { vaults: await c.env.tenant.vault.listVaults(ownerUserId) });
+        return jsonResponse(200, {
+            vaults: await c.env.tenant.vault.listVaults(c.req.query("ownerUserId"), {
+                installation: true,
+            }),
+        });
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}",
         tags: ["Vaults"],
@@ -80,10 +76,9 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(VaultInfo, "The vault") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.getVault(c.req.param("vaultId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "delete",
         path: "/v1/vaults/{vaultId}",
         tags: ["Vaults"],
@@ -91,30 +86,21 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(DeletedResponse, "Deleted") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.deleteVault(c.req.param("vaultId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults/{vaultId}/credentials",
         tags: ["Vaults"],
         summary: "Add a credential",
-        description: "A bearer token or OAuth tokens, bound to the URLs a tool may send them to. A subject token cannot store OAuth refresh credentials.",
+        description: "A bearer token or OAuth tokens, bound to the URLs a tool may send them to.",
         request: { params: vaultId, body: body(CreateCredentialRequest) },
         responses: { 200: json(CredentialInfo, "The credential, without its secret") },
     }, async (c) => {
-        await ownerFor(c);
         const request = CreateCredentialRequestSchema.parse(await readJson(c.req.raw));
-        // The Runtime calls a refresh credential's token endpoint itself: never for a browser.
-        if (c.get("scope").kind === "token" &&
-            request.auth.type === "oauth" &&
-            request.auth.refresh)
-            fail(403, "A subject token cannot store OAuth refresh credentials", {
-                code: "scope_required",
-            });
         return jsonResponse(200, await c.env.tenant.keys.createCredential(c.req.param("vaultId"), request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}/credentials",
         tags: ["Vaults"],
@@ -122,12 +108,11 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(ListCredentialsResponse, "The credentials, without their secrets") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, {
             credentials: await c.env.tenant.vault.listCredentials(c.req.param("vaultId")),
         });
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -135,10 +120,9 @@ export function vaultRoutes(api) {
         request: { params: credentialId },
         responses: { 200: json(CredentialInfo, "The credential, without its secret") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.getCredential(c.req.param("vaultId"), c.req.param("credentialId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -149,11 +133,10 @@ export function vaultRoutes(api) {
             409: { description: "A credential's type cannot change" },
         },
     }, async (c) => {
-        await ownerFor(c);
         const request = RotateCredentialRequestSchema.parse(await readJson(c.req.raw));
         return jsonResponse(200, await c.env.tenant.keys.rotateCredential(c.req.param("vaultId"), c.req.param("credentialId"), request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "delete",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -161,7 +144,92 @@ export function vaultRoutes(api) {
         request: { params: credentialId },
         responses: { 200: json(DeletedResponse, "Deleted") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.deleteCredential(c.req.param("vaultId"), c.req.param("credentialId")));
     });
+    tenantRoute(api, APPLICATION, {
+        method: "post",
+        path: "/v1/vaults/{vaultId}/oauth/start",
+        tags: ["Vaults"],
+        summary: "Start an MCP OAuth connect",
+        description: "Signs the installation in to the remote MCP server at `url` (declared as `server`) and stores its OAuth credential, bound to `url`, in this installation vault. The Runtime discovers the server's authorization server (RFC 9728, RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and answers the URL to open in a browser; the sign-in returns to `GET /v1/oauth/callback` within `expiresAt`. The callback URL is `NYLORUN_PUBLIC_URL` + `/v1/oauth/callback`, or this request's own origin when the Host has no public URL. Application keys acting for no one only. `oauth_client_required` when the server offers no registration and no `clientId` was given.",
+        request: { params: vaultId, body: body(StartOAuthRequest) },
+        responses: {
+            200: json(StartOAuthResponse, "Where to send the browser"),
+            502: {
+                description: "The authorization server, or its discovery, failed or refused (`oauth_failed`)",
+            },
+        },
+    }, async (c) => {
+        const request = StartOAuthRequestSchema.parse(await readJson(c.req.raw));
+        const tenant = c.env.tenant;
+        const base = tenant.config.publicUrl ?? new URL(c.req.url).origin;
+        return jsonResponse(200, await tenant.keys.startOAuth({
+            vaultId: c.req.param("vaultId"),
+            server: request.server,
+            url: request.url,
+            ...(request.clientId === undefined ? {} : { clientId: request.clientId }),
+            redirectUri: `${base}${OAUTH_CALLBACK_PATH}`,
+        }));
+    });
+    tenantRoute(api, CALLBACK, {
+        method: "get",
+        path: OAUTH_CALLBACK_PATH,
+        tags: ["Vaults"],
+        summary: "Finish an MCP OAuth connect",
+        description: "Where the authorization server sends the browser back with `code` and `state` (or `error`). Exchanges the code once and stores the credential; answers a small HTML page. Needs no credential and no `Nylorun-Protocol`. A `state` is used once, for ten minutes (`oauth_state_invalid`).",
+        request: {
+            query: z.object({
+                code: z.string().optional(),
+                state: z.string().optional(),
+                error: z.string().optional(),
+            }),
+        },
+        responses: {
+            200: { description: "Connected", content: { "text/html": { schema: z.string() } } },
+            502: { description: "The authorization server refused the code (`oauth_failed`)" },
+        },
+    }, async (c) => {
+        const state = c.req.query("state");
+        const code = c.req.query("code");
+        const error = c.req.query("error");
+        if (!state)
+            return page(400, "Sign-in failed", "The authorization server sent no state. Start the connect again.");
+        try {
+            await c.env.tenant.keys.finishOAuth({
+                state,
+                ...(code === undefined ? {} : { code }),
+                ...(error === undefined ? {} : { error }),
+            });
+        }
+        catch (failure) {
+            if (failure instanceof HttpError || failure instanceof VaultError)
+                return page(failure.status, "Sign-in failed", failure.message);
+            c.env.tenant.config.logger.error("oauth_callback_failed", {
+                error: failure instanceof Error ? failure.name : "unknown",
+            });
+            return page(500, "Sign-in failed", "The connect failed. Start it again.");
+        }
+        return page(200, "Connected", "Connected. You can close this tab.");
+    });
+}
+const ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+const escape = (text) => text.replace(/[&<>"']/g, (char) => ESCAPES[char]);
+/** The callback's answer: a small page that loads nothing, is never cached and leaks no referrer. */
+function page(status, title, message) {
+    const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)} · Nylorun</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;color:#1a1a1a;background:#fff}@media (prefers-color-scheme:dark){body{color:#eee;background:#111}}h1{font-size:1.25rem}</style>
+</head><body><h1>${escape(title)}</h1><p>${escape(message)}</p></body></html>
+`;
+    return new Response(html, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+            "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
+            "x-content-type-options": "nosniff",
+        },
+    });
 }

package/dist/api/openapi.js

@@ -68,15 +68,9 @@ function hostRoutes() {
     return registry;
 }
 function tenantSchemes(registry) {
-    registry.registerComponent("securitySchemes", "applicationKey", bearer("An application key of the Tenant, or a key derived from the admin key. With `Nylorun-Subject` and `Nylorun-Scopes`, it acts for that person, narrowed to those scopes."));
-    registry.registerComponent("securitySchemes", "subjectToken", bearer("A subject token (`POST /v1/tokens`): one person and one role of the access policy, for at most 15 minutes.", "JWT"));
+    registry.registerComponent("securitySchemes", "applicationKey", bearer("An application key of the Tenant: an operator key (`PUT /v1/admin/keys/{id}`), or Studio's key, derived from the admin key. With `Nylorun-Subject` and `Nylorun-Scopes`, it acts for that person, narrowed to those scopes. Never accepted from a browser (`Origin`)."));
+    registry.registerComponent("securitySchemes", "issuerToken", bearer("A JWT from a trusted issuer of the Host's identity file (Host feature `trusted-issuers`): one person, with the issuer's scopes, agents and sandbox grants, until it expires. Accepted from servers and browsers alike; CORS is the operator's proxy's.", "JWT"));
     registry.registerComponent("securitySchemes", "deliveryToken", bearer("The delivery token the Runtime signs each Action delivery with (`Nylorun-Signature`), sent back by the Action endpoint. It reaches only that Action's heartbeat, result and sandbox routes, while that delivery is current, for at most 15 minutes.", "JWT"));
-    registry.registerComponent("securitySchemes", "publishableKey", {
-        type: "apiKey",
-        in: "header",
-        name: "Nylorun-Key",
-        description: "A publishable key, sent by a browser page on one of its origins. Public by design: it grants the access policy's anonymous scopes.",
-    });
 }
 let tenant;
 let admin;
@@ -94,7 +88,7 @@ export function tenantDocument() {
         info: {
             title: "Nylorun Runtime: Tenant API",
             version: RUNTIME_VERSION,
-            description: "Agents, sessions and their events, vaults, access and the Tenant's settings. A Runtime serves one Tenant: its URL is the Tenant's, and no request names it. Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials`, `x-nylorun-scopes` (the subject scopes that reach it) and `x-nylorun-browser` fields.",
+            description: "Agents, sessions and their events, vaults, access and the Tenant's settings. A Runtime serves one Tenant: its URL is the Tenant's, and no request names it. Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields.",
             "x-nylorun-protocol": PROTOCOL,
         },
         servers: [
@@ -122,7 +116,7 @@ export function adminDocument() {
         info: {
             title: "Nylorun Runtime: Admin API",
             version: RUNTIME_VERSION,
-            description: "The Host's status, its Tenant's state and shutdown, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
+            description: "The Host's status, its Tenant's state, shutdown and the Tenant's operator keys, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
             "x-nylorun-protocol": PROTOCOL,
         },
         servers: [