@nylorun/runtime 0.16.0-beta → 0.17.0-beta

package/dist/api/http/routes/vaults.js

@@ -1,16 +1,25 @@
 import { z } from "zod";
-import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, } from "@nylorun/core/contracts";
-import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, VaultInfo, } from "../../components.js";
-import { ownerOf } from "../../../tenant/auth.js";
-import { fail } from "../../../tenant/http.js";
+import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, } from "@nylorun/core/contracts";
+import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, StartOAuthRequest, StartOAuthResponse, VaultInfo, } from "../../components.js";
+import { HttpError } from "../../../tenant/http.js";
+import { VaultError } from "../../../vault/error.js";
 import { readJson } from "../body.js";
-import { pathSegments, tenantRoute } from "../define.js";
+import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
-const OWN_VAULTS = {
+/** Every vault route, and starting an MCP OAuth connect: an application key acting for no one. */
+const APPLICATION = { credentials: ["application"], scopes: "never" };
+/**
+ * The OAuth callback: a browser sent back by the authorization server, with no credential and no
+ * protocol header. The `state` it carries is the grant.
+ */
+const CALLBACK = {
     credentials: ["application", "subject", "token"],
-    scopes: ["vaults:own"],
-    browser: true,
+    scopes: "any",
+    anonymous: true,
+    unversioned: true,
 };
+/** Where the authorization server sends the browser back. */
+export const OAUTH_CALLBACK_PATH = "/v1/oauth/callback";
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -21,58 +30,45 @@ const body = (schema) => ({
 });
 const vaultId = z.object({ vaultId: z.string() });
 const credentialId = vaultId.extend({ credentialId: z.string() });
-/**
- * Who a vault route acts for: the subject, or no one in particular (an application key). Below
- * a vault, the vault must be the subject's before anything else.
- */
-async function ownerFor(c) {
-    const { vault } = c.env.tenant;
-    const owner = ownerOf(c.get("scope"));
-    const id = c.req.param("vaultId");
-    if (id !== undefined && owner !== undefined)
-        await vault.assertOwner(id, owner);
-    return owner;
-}
 export function vaultRoutes(api) {
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults",
         tags: ["Vaults"],
         summary: "Create a vault",
+        description: "With `scope: \"installation\"` the installation's own vault, owned by `installation`, which any session may attach; or a vault of one person (`ownerUserId`), which only that person's sessions attach.",
         request: { body: body(CreateVaultRequest) },
         responses: {
             200: json(VaultInfo, "The vault"),
             409: { description: "The idempotency key was used for another vault" },
         },
     }, async (c) => {
-        const owner = await ownerFor(c);
         const request = CreateVaultRequestSchema.parse(await readJson(c.req.raw));
-        if (owner !== undefined && request.ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
         return jsonResponse(200, await c.env.tenant.vault.createVault(request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults",
         tags: ["Vaults"],
-        summary: "List a person's vaults",
+        summary: "List vaults",
+        description: "The installation vaults, after the vaults of `ownerUserId` when it names a person.",
         request: {
             query: z.object({
                 ownerUserId: z
                     .string()
                     .optional()
-                    .meta({ description: "Whose vaults; required with an application key acting for no one" }),
+                    .meta({ description: "Also list this person's vaults" }),
             }),
         },
         responses: { 200: json(ListVaultsResponse, "The vaults") },
     }, async (c) => {
-        const owner = await ownerFor(c);
-        const ownerUserId = c.req.query("ownerUserId") ?? owner ?? fail(400, "ownerUserId is required");
-        if (owner !== undefined && ownerUserId !== owner)
-            fail(403, "ownerUserId must be the subject");
-        return jsonResponse(200, { vaults: await c.env.tenant.vault.listVaults(ownerUserId) });
+        return jsonResponse(200, {
+            vaults: await c.env.tenant.vault.listVaults(c.req.query("ownerUserId"), {
+                installation: true,
+            }),
+        });
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}",
         tags: ["Vaults"],
@@ -80,10 +76,9 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(VaultInfo, "The vault") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.getVault(c.req.param("vaultId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "delete",
         path: "/v1/vaults/{vaultId}",
         tags: ["Vaults"],
@@ -91,30 +86,21 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(DeletedResponse, "Deleted") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.deleteVault(c.req.param("vaultId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults/{vaultId}/credentials",
         tags: ["Vaults"],
         summary: "Add a credential",
-        description: "A bearer token or OAuth tokens, bound to the URLs a tool may send them to. A subject token cannot store OAuth refresh credentials.",
+        description: "A bearer token or OAuth tokens, bound to the URLs a tool may send them to.",
         request: { params: vaultId, body: body(CreateCredentialRequest) },
         responses: { 200: json(CredentialInfo, "The credential, without its secret") },
     }, async (c) => {
-        await ownerFor(c);
         const request = CreateCredentialRequestSchema.parse(await readJson(c.req.raw));
-        // The Runtime calls a refresh credential's token endpoint itself: never for a browser.
-        if (c.get("scope").kind === "token" &&
-            request.auth.type === "oauth" &&
-            request.auth.refresh)
-            fail(403, "A subject token cannot store OAuth refresh credentials", {
-                code: "scope_required",
-            });
         return jsonResponse(200, await c.env.tenant.keys.createCredential(c.req.param("vaultId"), request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}/credentials",
         tags: ["Vaults"],
@@ -122,12 +108,11 @@ export function vaultRoutes(api) {
         request: { params: vaultId },
         responses: { 200: json(ListCredentialsResponse, "The credentials, without their secrets") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, {
             credentials: await c.env.tenant.vault.listCredentials(c.req.param("vaultId")),
         });
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "get",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -135,10 +120,9 @@ export function vaultRoutes(api) {
         request: { params: credentialId },
         responses: { 200: json(CredentialInfo, "The credential, without its secret") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.getCredential(c.req.param("vaultId"), c.req.param("credentialId")));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "post",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -149,11 +133,10 @@ export function vaultRoutes(api) {
             409: { description: "A credential's type cannot change" },
         },
     }, async (c) => {
-        await ownerFor(c);
         const request = RotateCredentialRequestSchema.parse(await readJson(c.req.raw));
         return jsonResponse(200, await c.env.tenant.keys.rotateCredential(c.req.param("vaultId"), c.req.param("credentialId"), request));
     });
-    tenantRoute(api, OWN_VAULTS, {
+    tenantRoute(api, APPLICATION, {
         method: "delete",
         path: "/v1/vaults/{vaultId}/credentials/{credentialId}",
         tags: ["Vaults"],
@@ -161,7 +144,92 @@ export function vaultRoutes(api) {
         request: { params: credentialId },
         responses: { 200: json(DeletedResponse, "Deleted") },
     }, async (c) => {
-        await ownerFor(c);
         return jsonResponse(200, await c.env.tenant.vault.deleteCredential(c.req.param("vaultId"), c.req.param("credentialId")));
     });
+    tenantRoute(api, APPLICATION, {
+        method: "post",
+        path: "/v1/vaults/{vaultId}/oauth/start",
+        tags: ["Vaults"],
+        summary: "Start an MCP OAuth connect",
+        description: "Signs the installation in to the remote MCP server at `url` (declared as `server`) and stores its OAuth credential, bound to `url`, in this installation vault. The Runtime discovers the server's authorization server (RFC 9728, RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and answers the URL to open in a browser; the sign-in returns to `GET /v1/oauth/callback` within `expiresAt`. The callback URL is `NYLORUN_PUBLIC_URL` + `/v1/oauth/callback`, or this request's own origin when the Host has no public URL. Application keys acting for no one only. `oauth_client_required` when the server offers no registration and no `clientId` was given.",
+        request: { params: vaultId, body: body(StartOAuthRequest) },
+        responses: {
+            200: json(StartOAuthResponse, "Where to send the browser"),
+            502: {
+                description: "The authorization server, or its discovery, failed or refused (`oauth_failed`)",
+            },
+        },
+    }, async (c) => {
+        const request = StartOAuthRequestSchema.parse(await readJson(c.req.raw));
+        const tenant = c.env.tenant;
+        const base = tenant.config.publicUrl ?? new URL(c.req.url).origin;
+        return jsonResponse(200, await tenant.keys.startOAuth({
+            vaultId: c.req.param("vaultId"),
+            server: request.server,
+            url: request.url,
+            ...(request.clientId === undefined ? {} : { clientId: request.clientId }),
+            redirectUri: `${base}${OAUTH_CALLBACK_PATH}`,
+        }));
+    });
+    tenantRoute(api, CALLBACK, {
+        method: "get",
+        path: OAUTH_CALLBACK_PATH,
+        tags: ["Vaults"],
+        summary: "Finish an MCP OAuth connect",
+        description: "Where the authorization server sends the browser back with `code` and `state` (or `error`). Exchanges the code once and stores the credential; answers a small HTML page. Needs no credential and no `Nylorun-Protocol`. A `state` is used once, for ten minutes (`oauth_state_invalid`).",
+        request: {
+            query: z.object({
+                code: z.string().optional(),
+                state: z.string().optional(),
+                error: z.string().optional(),
+            }),
+        },
+        responses: {
+            200: { description: "Connected", content: { "text/html": { schema: z.string() } } },
+            502: { description: "The authorization server refused the code (`oauth_failed`)" },
+        },
+    }, async (c) => {
+        const state = c.req.query("state");
+        const code = c.req.query("code");
+        const error = c.req.query("error");
+        if (!state)
+            return page(400, "Sign-in failed", "The authorization server sent no state. Start the connect again.");
+        try {
+            await c.env.tenant.keys.finishOAuth({
+                state,
+                ...(code === undefined ? {} : { code }),
+                ...(error === undefined ? {} : { error }),
+            });
+        }
+        catch (failure) {
+            if (failure instanceof HttpError || failure instanceof VaultError)
+                return page(failure.status, "Sign-in failed", failure.message);
+            c.env.tenant.config.logger.error("oauth_callback_failed", {
+                error: failure instanceof Error ? failure.name : "unknown",
+            });
+            return page(500, "Sign-in failed", "The connect failed. Start it again.");
+        }
+        return page(200, "Connected", "Connected. You can close this tab.");
+    });
+}
+const ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+const escape = (text) => text.replace(/[&<>"']/g, (char) => ESCAPES[char]);
+/** The callback's answer: a small page that loads nothing, is never cached and leaks no referrer. */
+function page(status, title, message) {
+    const html = `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)} · Nylorun</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;color:#1a1a1a;background:#fff}@media (prefers-color-scheme:dark){body{color:#eee;background:#111}}h1{font-size:1.25rem}</style>
+</head><body><h1>${escape(title)}</h1><p>${escape(message)}</p></body></html>
+`;
+    return new Response(html, {
+        status,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+            "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
+            "x-content-type-options": "nosniff",
+        },
+    });
 }

package/dist/api/openapi.js

@@ -68,15 +68,9 @@ function hostRoutes() {
     return registry;
 }
 function tenantSchemes(registry) {
-    registry.registerComponent("securitySchemes", "applicationKey", bearer("An application key of the Tenant, or a key derived from the admin key. With `Nylorun-Subject` and `Nylorun-Scopes`, it acts for that person, narrowed to those scopes."));
-    registry.registerComponent("securitySchemes", "subjectToken", bearer("A subject token (`POST /v1/tokens`): one person and one role of the access policy, for at most 15 minutes.", "JWT"));
+    registry.registerComponent("securitySchemes", "applicationKey", bearer("An application key of the Tenant: an operator key (`PUT /v1/admin/keys/{id}`), or Studio's key, derived from the admin key. With `Nylorun-Subject` and `Nylorun-Scopes`, it acts for that person, narrowed to those scopes. Never accepted from a browser (`Origin`)."));
+    registry.registerComponent("securitySchemes", "issuerToken", bearer("A JWT from a trusted issuer of the Host's identity file (Host feature `trusted-issuers`): one person, with the issuer's scopes, agents and sandbox grants, until it expires. Accepted from servers and browsers alike; CORS is the operator's proxy's.", "JWT"));
     registry.registerComponent("securitySchemes", "deliveryToken", bearer("The delivery token the Runtime signs each Action delivery with (`Nylorun-Signature`), sent back by the Action endpoint. It reaches only that Action's heartbeat, result and sandbox routes, while that delivery is current, for at most 15 minutes.", "JWT"));
-    registry.registerComponent("securitySchemes", "publishableKey", {
-        type: "apiKey",
-        in: "header",
-        name: "Nylorun-Key",
-        description: "A publishable key, sent by a browser page on one of its origins. Public by design: it grants the access policy's anonymous scopes.",
-    });
 }
 let tenant;
 let admin;
@@ -94,7 +88,7 @@ export function tenantDocument() {
         info: {
             title: "Nylorun Runtime: Tenant API",
             version: RUNTIME_VERSION,
-            description: "Agents, sessions and their events, vaults, access and the Tenant's settings. A Runtime serves one Tenant: its URL is the Tenant's, and no request names it. Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials`, `x-nylorun-scopes` (the subject scopes that reach it) and `x-nylorun-browser` fields.",
+            description: "Agents, sessions and their events, vaults, access and the Tenant's settings. A Runtime serves one Tenant: its URL is the Tenant's, and no request names it. Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields.",
             "x-nylorun-protocol": PROTOCOL,
         },
         servers: [
@@ -122,7 +116,7 @@ export function adminDocument() {
         info: {
             title: "Nylorun Runtime: Admin API",
             version: RUNTIME_VERSION,
-            description: "The Host's status, its Tenant's state and shutdown, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
+            description: "The Host's status, its Tenant's state, shutdown and the Tenant's operator keys, with the admin key. Served on the operator listener when the Host has one; the public listener answers these routes with the opaque 404.",
             "x-nylorun-protocol": PROTOCOL,
         },
         servers: [

package/dist/artifacts/links.js

@@ -2,14 +2,14 @@
  * Capability links (protocol 6): a short-lived URL that opens one artifact version with no
  * other credential, for UIs, `<img>` tags and sharing. The token in the path is an ES256 JWT
  * (`typ: nylorun-artifact+jwt`) signed with the Tenant's current signing key by the keys
- * service, like subject and delivery tokens: `sub` is the artifact, `ver` the version, `aud`
- * `nylorun-artifact`, and it lives at most `ARTIFACT_LINK_MAX_TTL_SECONDS` (the subject-token
- * maximum, so a key rotation never revokes a live link). A link opens nothing once its artifact
+ * service, like delivery tokens: `sub` is the artifact, `ver` the version, `aud`
+ * `nylorun-artifact`, and it lives at most `ARTIFACT_LINK_MAX_TTL_SECONDS` (`TOKEN_TTL_MAX_SECONDS`,
+ * so a key rotation never revokes a live link). A link opens nothing once its artifact
  * is deleted. A folder's link (F8.2) opens its zip, or with a `path` claim one of its files.
  */
 import { randomUUID } from "node:crypto";
 import { errors, jwtVerify } from "jose";
-import { ARTIFACT_LINK_DEFAULT_TTL_SECONDS, ARTIFACT_LINK_MAX_TTL_SECONDS, ARTIFACT_LINK_TOKEN_TYPE, subjectTokenIssuer, } from "@nylorun/core/contracts";
+import { ARTIFACT_LINK_DEFAULT_TTL_SECONDS, ARTIFACT_LINK_MAX_TTL_SECONDS, ARTIFACT_LINK_TOKEN_TYPE, tenantTokenIssuer, } from "@nylorun/core/contracts";
 import { isArtifactId } from "@nylorun/core/compatibility";
 import { failOpaque, HttpError } from "../tenant/http.js";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "../tenant/jwt.js";
@@ -24,7 +24,7 @@ export async function mintArtifactLink(ctx, link) {
     const { token } = await ctx.keys.sign({
         typ: ARTIFACT_LINK_TOKEN_TYPE,
         claims: {
-            iss: subjectTokenIssuer(ctx.config.tenantId),
+            iss: tenantTokenIssuer(ctx.config.tenantId),
             aud: ARTIFACT_LINK_AUDIENCE,
             sub: link.artifactId,
             ver: link.version,
@@ -57,7 +57,7 @@ export async function verifyArtifactLink(ctx, raw) {
     try {
         const verified = await jwtVerify(raw, await ctx.signingKeys.publicKey(row), {
             algorithms: ["ES256"],
-            issuer: subjectTokenIssuer(ctx.config.tenantId),
+            issuer: tenantTokenIssuer(ctx.config.tenantId),
             audience: ARTIFACT_LINK_AUDIENCE,
             typ: ARTIFACT_LINK_TOKEN_TYPE,
             clockTolerance: CLOCK_TOLERANCE_SECONDS,

package/dist/artifacts/service.js

@@ -11,7 +11,7 @@
  *   module, after re-checking the Tenant total under the quota lock. Until it commits the object
  *   is garbage, and a failed commit deletes it.
  * - **Access mirrors sessions.** An application principal reaches every artifact. A request acting
- *   for a person (a subject token or subject headers) reaches only artifacts of that person's
+ *   for a person (a trusted issuer's token or subject headers) reaches only artifacts of that person's
  *   sessions; another person's, or a Tenant-wide one, is the same 404 as a missing artifact.
  *
  * Lock order, the same in every write: the session, then the quota lock, then the artifact row.

package/dist/gates/mcp-handler.js

@@ -38,7 +38,11 @@ export function createMcpHandler(options) {
                 const manifest = await declared(vault, server);
                 const connection = await open({
                     server: manifest,
-                    authorize: (url) => vault.authorizeMcp(server.sessionId, { url, serverName: server.serverName }),
+                    authorize: (url) => vault.authorizeMcp(server.sessionId, {
+                        url,
+                        serverName: server.serverName,
+                        ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
+                    }),
                     pluginData: "",
                 });
                 const entry = { connection, lastUsedAt: now(), active: 0 };

package/dist/gates/tenant-vaults.d.ts

@@ -9,10 +9,12 @@
 import type { Credential } from "@earendil-works/pi-ai";
 import type { ModelFailureOutcome } from "@nylorun/core/define";
 import type { PostgresClient } from "../store/postgres/connect.js";
-import { VaultService, type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
+import { type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
+import { CredentialSources, type McpCredentialRequest, type ResolverConfig } from "../vault/sources.js";
 import type { SessionStore } from "../store/types.js";
 import type { Session } from "../tenant/context.js";
 import { type Keys } from "../keys/keys.js";
+import { type OutboundPolicy } from "../tenant/outbound.js";
 /** The Tenant, as a model call needs it. */
 export interface TenantVault {
     readonly tenantId: string;
@@ -26,12 +28,14 @@ export interface TenantVault {
     /** A session, for the remote MCP servers its pinned manifest declares (F4.1). */
     session(sessionId: string): Promise<Session | undefined>;
     /**
-     * The vault authorization of one request to a session's remote MCP server: its credential
-     * from the session's attached vaults, refreshed when due (F4.1).
+     * The authorization of one request to a session's remote MCP server: its credential from the
+     * session's attached vaults, refreshed when due (F4.1), else from the operator's credential
+     * resolver (F9 C1).
      */
     authorizeMcp(sessionId: string, request: {
         url: string;
         serverName: string;
+        agentId?: string;
     }): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
@@ -52,13 +56,18 @@ export interface TenantVaultsOptions {
     readonly sql: PostgresClient;
     /** The Host root; the gate reads `keys/vault-kek` and `tenant/home` under it. */
     readonly hostRoot: string;
+    /** The operator's credential resolver (`NYLORUN_RESOLVER_*`, F9 C1). */
+    readonly resolver?: ResolverConfig;
+    /**
+     * The Host's address policy (`NYLORUN_ENDPOINT_*`): OAuth refresh and MCP OAuth connect call
+     * authorization servers through `guardedFetch` under it (F9 C2).
+     */
+    readonly delivery?: OutboundPolicy;
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop did in its own process before F4.1 (`tenant/effects.ts` `authorize`).
+ * A request to a session's remote MCP server, authorized from the session's attached vaults,
+ * else the operator's credential resolver: what the loop does in its own process
+ * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
  */
-export declare function authorizeSessionMcp(credentials: VaultService, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: {
-    url: string;
-    serverName: string;
-}): Promise<AuthorizeResult>;
+export declare function authorizeSessionMcp(sources: CredentialSources, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -8,8 +8,10 @@ import { tenantPaths } from "../tenant/paths.js";
 import { readVaultKek } from "../vault/kek.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { VaultService } from "../vault/service.js";
+import { CredentialSources } from "../vault/sources.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { SigningKeys } from "../tenant/signing-keys.js";
+import { guardedFetch } from "../tenant/outbound.js";
 /** A call the gate refuses before the provider is called; it answers with `outcome`. */
 export class GateRefusal extends Error {
     outcome;
@@ -33,7 +35,15 @@ export function createTenantVaults(options) {
             return kek;
         };
         const vault = new HostModelVault({ store, kek: readKek });
-        const credentials = new VaultService({ store, kek: readKek, fetch: globalThis.fetch });
+        const credentials = new VaultService({
+            store,
+            kek: readKek,
+            fetch: guardedFetch(options.delivery ?? {}),
+        });
+        const sources = new CredentialSources({
+            vault: credentials,
+            ...(options.resolver ? { resolver: options.resolver } : {}),
+        });
         const keys = inProcessKeys({
             store,
             vault: credentials,
@@ -48,7 +58,7 @@ export function createTenantVaults(options) {
             readHostModel: () => vault.readHostModel(),
             writeHostCredential: (credential) => vault.updateHostCredential(credential),
             session,
-            authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
+            authorizeMcp: (sessionId, request) => authorizeSessionMcp(sources, session, sessionId, request),
             keys: () => keys,
         };
     }
@@ -77,18 +87,13 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop did in its own process before F4.1 (`tenant/effects.ts` `authorize`).
+ * A request to a session's remote MCP server, authorized from the session's attached vaults,
+ * else the operator's credential resolver: what the loop does in its own process
+ * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
  */
-export async function authorizeSessionMcp(credentials, session, sessionId, request) {
+export async function authorizeSessionMcp(sources, session, sessionId, request) {
     const found = await session(sessionId);
     if (!found)
         throw new Error(`Session ${sessionId} not found`);
-    return credentials.authorize({
-        sessionId,
-        vaultIds: found.vaultIds ?? [],
-        credentialSelections: found.credentialSelections ?? [],
-        url: request.url,
-        serverName: request.serverName,
-    });
+    return sources.authorize({ ...found, id: sessionId }, request);
 }

package/dist/host/admin-api.d.ts

@@ -1,12 +1,14 @@
 /**
- * The Admin API (`/v1/admin/**`): the Host's status and shutdown, for a caller with the admin
- * key. A Host serves one Tenant, so there are no Tenant routes: the status names the Tenant
- * and, when it could not be opened, why (tenancy.md §9). The Host checks the listener, the
- * protocol and the admin key first (`app.ts`); what gets here is authorized. Routes are
- * declared once, for serving and for the OpenAPI document.
+ * The Admin API (`/v1/admin/**`): the Host's status and shutdown, and the Tenant's operator
+ * keys (F9 I1), for a caller with the admin key. A Host serves one Tenant, so there are no
+ * Tenant routes: the status names the Tenant and, when it could not be opened, why
+ * (tenancy.md §9). The Host checks the listener, the protocol and the admin key first
+ * (`app.ts`); what gets here is authorized. Routes are declared once, for serving and for the
+ * OpenAPI document.
  */
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { AdminStatus } from "@nylorun/core/contracts";
+import type { OperatorKeys } from "../tenant/operator-keys.js";
 import type { NodeBindings } from "../tenant/types.js";
 export interface AdminApiOptions {
     /** `GET /v1/admin/status`. */
@@ -15,6 +17,11 @@ export interface AdminApiOptions {
     shutdown(): void;
     /** `GET /v1/admin/openapi.json`: this API's OpenAPI document (`api/openapi.ts`). */
     document?(): unknown;
+    /**
+     * The open Tenant's operator keys (`/v1/admin/keys`); undefined while the Tenant is not open.
+     * Rejects with `TenantUnavailableError` (503) when it cannot be reached.
+     */
+    operatorKeys?(): Promise<OperatorKeys | undefined>;
 }
 type AdminEnv = {
     Bindings: NodeBindings;

package/dist/host/admin-api.js

@@ -1,13 +1,14 @@
 /**
- * The Admin API (`/v1/admin/**`): the Host's status and shutdown, for a caller with the admin
- * key. A Host serves one Tenant, so there are no Tenant routes: the status names the Tenant
- * and, when it could not be opened, why (tenancy.md §9). The Host checks the listener, the
- * protocol and the admin key first (`app.ts`); what gets here is authorized. Routes are
- * declared once, for serving and for the OpenAPI document.
+ * The Admin API (`/v1/admin/**`): the Host's status and shutdown, and the Tenant's operator
+ * keys (F9 I1), for a caller with the admin key. A Host serves one Tenant, so there are no
+ * Tenant routes: the status names the Tenant and, when it could not be opened, why
+ * (tenancy.md §9). The Host checks the listener, the protocol and the admin key first
+ * (`app.ts`); what gets here is authorized. Routes are declared once, for serving and for the
+ * OpenAPI document.
  */
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { z } from "zod";
-import { AdminStatus as AdminStatusBody, HostShutdownResponse, ProtocolRejected, Rejected, } from "../api/components.js";
+import { AdminStatus as AdminStatusBody, DeleteOperatorKeyResponse, HostShutdownResponse, ListOperatorKeysResponse, PutOperatorKeyResponse, ProtocolRejected, Rejected, } from "../api/components.js";
 import { serveRoute } from "../api/route.js";
 import { jsonResponse, rejectedResponse } from "./http.js";
 const json = (schema, description) => ({
@@ -54,6 +55,68 @@ export function createAdminApi(options) {
         c.env.outgoing.once("finish", () => options.shutdown());
         return jsonResponse(200, { status: "shutting_down" });
     });
+    const keyId = z.object({
+        id: z.string().meta({ description: "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio`" }),
+    });
+    const keysOf = async () => (await options.operatorKeys?.()) ??
+        rejectedResponse(503, "request_rejected", "The Tenant is not open: see /v1/admin/status");
+    serveRoute(api, adminRoute({
+        method: "get",
+        path: "/v1/admin/keys",
+        summary: "List the Tenant's keys",
+        description: "Every application key of the Tenant by name, with its role and when it was issued. Keys themselves are never shown again.",
+        responses: {
+            200: json(ListOperatorKeysResponse, "The keys, by id"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async () => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        return jsonResponse(200, { keys: await keys.list() });
+    });
+    serveRoute(api, adminRoute({
+        method: "put",
+        path: "/v1/admin/keys/{id}",
+        summary: "Create or rotate a key",
+        description: "Issues a new key named `id` and returns it this once. A key of that name is replaced: the old one stops authenticating at once. `studio` is refused.",
+        request: { params: keyId },
+        responses: {
+            200: json(PutOperatorKeyResponse, "The new key, shown once"),
+            400: rejected("Not a key name, or `studio`"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async (c) => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        const put = await keys.put(c.req.param("id") ?? "");
+        return "reason" in put ? refusedResponse(put) : jsonResponse(200, put);
+    });
+    serveRoute(api, adminRoute({
+        method: "delete",
+        path: "/v1/admin/keys/{id}",
+        summary: "Delete a key",
+        description: "The key stops authenticating at once. `studio` is refused.",
+        request: { params: keyId },
+        responses: {
+            200: json(DeleteOperatorKeyResponse, "The key is deleted"),
+            400: rejected("Not a key name, or `studio`"),
+            404: rejected("No key of that name; or an unknown admin key, or the public listener"),
+            503: rejected("The Tenant is not open"),
+        },
+    }), async (c) => {
+        const keys = await keysOf();
+        if (keys instanceof Response)
+            return keys;
+        const id = c.req.param("id") ?? "";
+        const deleted = await keys.delete(id);
+        if (typeof deleted !== "boolean")
+            return refusedResponse(deleted);
+        return deleted
+            ? jsonResponse(200, { id, deleted: true })
+            : rejectedResponse(404, "not_found", `No key ${id}`);
+    });
     serveRoute(api, adminRoute({
         method: "get",
         path: "/v1/admin/openapi.json",
@@ -72,3 +135,6 @@ export function createAdminApi(options) {
 function notFound() {
     return rejectedResponse(404, "not_found", "Route not found");
 }
+function refusedResponse(refusal) {
+    return rejectedResponse(400, refusal.reason === "invalid" ? "invalid_request" : "request_rejected", refusal.message);
+}

package/dist/host/app.d.ts

@@ -20,7 +20,6 @@ export interface HostAppOptions {
     adminKey: string;
     coreVersion: string;
     pid: number;
-    browserAccess: boolean;
     readiness?: () => Promise<{
         ok: boolean;
         checks: Record<string, boolean>;