@nylorun/runtime 0.16.0-beta → 0.17.0-beta

package/dist/host/app.js

@@ -1,10 +1,9 @@
 import { Hono } from "hono";
 import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
-import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, PUBLISHABLE_KEY_HEADER, TENANT_HEADER, tenantOfPublishableKey, } from "@nylorun/core/compatibility";
+import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
 import { RUNTIME_VERSION } from "../version.js";
 import { findTenantRoute } from "../api/http/app.js";
 import { tenantDocument } from "../api/openapi.js";
-import { answerPreflight } from "./cors.js";
 import { adminKeyMatches, headerValue, isJsonContentType, jsonResponse, opaqueNotFoundResponse, protocolRejectedResponse, readBearer, pathnameIsLogged, redactRoutePath, rejectedResponse, requestHasBody, } from "./http.js";
 export function createHostApp(options) {
     const { module, logger } = options;
@@ -27,20 +26,18 @@ export function createHostApp(options) {
         }
     });
     app.use(async (c, next) => {
-        const { incoming, outgoing, role } = c.env;
+        const { incoming, role } = c.env;
         if (headerValue(incoming, "origin") !== undefined) {
             const route = pathnameOf(incoming).split("/").filter(Boolean);
-            // Only Tenant routes, and only when the operator allows browsers; the Tenant then
-            // checks the publishable key and its origins before adding any CORS header.
+            // Only Tenant routes of the public listener; the Tenant then accepts only a trusted
+            // issuer's token from a browser. The operator listener never serves browsers.
             const tenantRoute = route[0] === "v1" && route[1] !== "admin";
-            // The operator listener never serves browsers.
-            if (!options.browserAccess || role === "operator" || !tenantRoute)
+            if (role === "operator" || !tenantRoute)
                 return rejectedResponse(403, "origin_rejected", "Browser Origin headers are not accepted");
-            if (incoming.method === "OPTIONS") {
-                c.set("status", answerPreflight(incoming, outgoing, route, browserRoute));
-                return RESPONSE_ALREADY_SENT;
-            }
         }
+        // CORS is the operator's proxy's: an OPTIONS request gets no CORS header.
+        if (incoming.method === "OPTIONS")
+            return new Response(null, { status: 204, headers: { allow: ALLOWED_METHODS } });
         await next();
     });
     app.use(async (c, next) => {
@@ -96,11 +93,7 @@ export function createHostApp(options) {
                 return opaqueNotFoundResponse();
             return await options.admin(c.req.raw, { incoming, outgoing });
         }
-        // Tenant routes: key pattern → protocol → the Tenant → selection → the Tenant's routes.
-        const keyHeader = headerValue(incoming, PUBLISHABLE_KEY_HEADER);
-        const keyTenant = keyHeader === undefined ? undefined : tenantOfPublishableKey(keyHeader);
-        if (keyHeader !== undefined && keyTenant === undefined)
-            return rejectedResponse(400, "invalid_request", `${PUBLISHABLE_KEY_HEADER} header is malformed`);
+        // Tenant routes: protocol → the Tenant → selection → the Tenant's routes.
         const tenantHeader = headerValue(incoming, TENANT_HEADER);
         const named = tenantHeader === undefined || tenantHeader.trim() === "" ? undefined : tenantHeader.trim();
         const protocol = headerValue(incoming, PROTOCOL_HEADER);
@@ -119,9 +112,8 @@ export function createHostApp(options) {
         }
         const { handle } = resolution;
         const tenantId = handle.envelope.id;
-        // A protocol 4 client names the Tenant; a publishable key carries one. Either naming
-        // another Tenant (or a malformed header) reached the wrong installation.
-        if ((named !== undefined && named !== tenantId) || (keyTenant !== undefined && keyTenant !== tenantId))
+        // A protocol 4 client names the Tenant: naming another reached the wrong installation.
+        if (named !== undefined && named !== tenantId)
             return opaqueNotFoundResponse();
         c.set("tenantId", tenantId);
         return await handle.fetch(c.req.raw, { incoming, outgoing });
@@ -154,10 +146,8 @@ export function createHostApp(options) {
     });
     return app;
 }
-/** A route a browser page may call, decided from the route alone (`api/http/define.ts`). */
-function browserRoute(method, segments) {
-    return findTenantRoute(method, segments)?.browser === true;
-}
+/** The methods the Runtime serves, for an `OPTIONS` answer's `Allow`. */
+const ALLOWED_METHODS = "GET, POST, PUT, DELETE, OPTIONS";
 /** The Tenant route a request names, if any; a malformed path names none. */
 function tenantRouteOf(incoming) {
     const segments = [];

package/dist/host/config-for.d.ts

@@ -16,4 +16,8 @@ export declare function configForFactory(options: {
     model?: TenantConfig["model"];
     /** How Tenants may call Action endpoints (`StackConfig.delivery`). */
     delivery?: TenantConfig["delivery"];
+    /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
+    issuers?: TenantConfig["issuers"];
+    /** `NYLORUN_PUBLIC_URL`: the base of the MCP OAuth callback (F9 C2). */
+    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -17,6 +17,8 @@ export function configForFactory(options) {
             sandbox: { backend: sandboxBackend },
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
+            ...(options.issuers ? { issuers: options.issuers } : {}),
+            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             childEnv: tenantChildEnvironment(baseline, options.hostConfig, tenant),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),

package/dist/host/config.d.ts

@@ -4,12 +4,6 @@ export interface HostConfigFile {
     host: string;
     port: number;
     allowNonLoopback?: boolean;
-    /**
-     * Whether browser requests (an `Origin` with a publishable key) may reach Tenant routes.
-     * Default off for a Host started from host.json; container mode reads
-     * `NYLORUN_BROWSER_ACCESS` instead.
-     */
-    browserAccess?: boolean;
     /**
      * The operator listener's port: the Admin API moves there (on `host`, loopback only), and
      * `port` serves the Tenant API alone. Absent: one port serves both.

package/dist/host/create-host.d.ts

@@ -24,14 +24,7 @@ export interface CreateHostOptions {
      */
     publicUrl?: string;
     /**
-     * Browser access (Host feature `browser-access`): requests with an `Origin` may reach Tenant
-     * routes, where the publishable key's origin allowlist decides. Off by default: every
-     * `Origin` is `403 origin_rejected`, as before. Admin routes, `/health` and `/ready` refuse
-     * `Origin` either way.
-     */
-    browserAccess?: boolean;
-    /**
-     * The operator listener: the Admin API (and the Tenant API, never with browser access) on
+     * The operator listener: the Admin API (and the Tenant API, never to browsers) on
      * its own address, kept off the network that reaches the Tenant API. When set, the main
      * listener is public and answers admin routes with the opaque 404. Absent: one listener
      * serves everything, as before.
@@ -66,8 +59,8 @@ export interface OperatorListen {
     allowedHosts?: readonly string[];
 }
 /**
- * What a listener serves. `combined`: everything (one port). `public`: the Tenant API, with
- * browser access when enabled; admin routes are the opaque 404. `operator`: the Admin API and
+ * What a listener serves. `combined`: everything (one port). `public`: the Tenant API, to
+ * servers and to browsers with a trusted issuer's token; admin routes are the opaque 404. `operator`: the Admin API and
  * the Tenant API, never to browsers.
  */
 export type ListenerRole = "combined" | "public" | "operator";

package/dist/host/create-host.js

@@ -47,6 +47,10 @@ export function createHost(options) {
         status: adminStatusBody,
         shutdown: () => void close(),
         document: adminDocument,
+        operatorKeys: async () => {
+            const resolved = await module.resolve();
+            return resolved.kind === "open" ? resolved.handle.operatorKeys?.() : undefined;
+        },
     });
     const app = createHostApp({
         module,
@@ -55,7 +59,6 @@ export function createHost(options) {
         adminKey: credentials.adminKey,
         coreVersion,
         pid,
-        browserAccess: options.browserAccess === true,
         ...(options.readiness ? { readiness: options.readiness } : {}),
         listening: () => Boolean(server?.listening) && (!operator || Boolean(operatorServer?.listening)),
         closing: () => closing,

package/dist/host/gates.js

@@ -34,7 +34,12 @@ export async function startGates(options) {
     if (!vaults) {
         if (!database || options.hostRoot === undefined)
             throw new Error("startGates needs the Postgres pool and the Host root");
-        vaults = createTenantVaults({ sql: database, hostRoot: options.hostRoot });
+        vaults = createTenantVaults({
+            sql: database,
+            hostRoot: options.hostRoot,
+            ...(gates.resolver ? { resolver: gates.resolver } : {}),
+            ...(options.delivery ? { delivery: options.delivery } : {}),
+        });
     }
     const blobs = options.blobs ??
         (options.hostRoot !== undefined

package/dist/host/main.js

@@ -9,8 +9,8 @@
  * Execution and Durable Streams from the endpoints; `createHostExecution`
  * builds the process's execution; the Host serves the one Tenant its Postgres
  * database holds (`NYLORUN_DATABASE_URL`, required), and creates it there on
- * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`,
- * `NYLORUN_DERIVED_PRINCIPALS`; tenancy.md §4); with S2, a process running core
+ * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`; tenancy.md §4), trusting the issuers of the identity file
+ * `NYLORUN_IDENTITY_FILE` names (Host feature `trusted-issuers`); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
  * logical replication (one process at a time holds the slot); `/ready` reports
  * the Tenant and the infrastructure checks. With an Object store
@@ -29,6 +29,8 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { hostPaths } from "../tenant/paths.js";
 import { createTenantModule } from "../tenant/module.js";
+import { parseIdentityFile } from "../tenant/identity-file.js";
+import { createTrustedIssuers } from "../tenant/issuers.js";
 import { hostPrincipals } from "../tenant/principals.js";
 import { createPostgresTenantOpener } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
@@ -66,6 +68,21 @@ function coreVersion() {
 function loadJson(path) {
     return JSON.parse(readFileSync(path, "utf8"));
 }
+/**
+ * The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`, Host feature
+ * `trusted-issuers`). A missing or malformed file stops the boot, naming the issuer and field;
+ * an issuer's JWKS is fetched only when a token needs it, so one that is down does not.
+ */
+function loadIssuers(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`NYLORUN_IDENTITY_FILE names ${path}, which cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return createTrustedIssuers(parseIdentityFile(text, path));
+}
 function resolveHostRoot() {
     const fromEnv = process.env.NYLORUN_HOME;
     const root = fromEnv && fromEnv.length > 0 ? fromEnv : resolve(homedir(), ".nylorun");
@@ -124,6 +141,8 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
+        // Never the resolver's URL or token: only whether one is set (F9 C1).
+        resolver: stack.gates?.resolver ? "configured" : "none",
     });
     const database = createDatabase(stack);
     const servers = [];
@@ -195,7 +214,14 @@ export async function main() {
     }
     const config = loadJson(paths.config);
     const credentials = loadJson(paths.credentials);
+    const identityFile = stack.tenant?.identityFile;
+    const issuers = identityFile ? loadIssuers(identityFile) : undefined;
     const logger = createHostLogger();
+    if (issuers)
+        logger.info("trusted_issuers", {
+            file: identityFile,
+            issuers: issuers.issuers.map((issuer) => issuer.config.name),
+        });
     if (stack.deprecatedRole)
         logger.warn("deprecated_flag", {
             flag: "--role",
@@ -225,6 +251,8 @@ export async function main() {
         logger,
         baseline,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
+        ...(issuers ? { issuers } : {}),
+        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.
@@ -290,7 +318,7 @@ export async function main() {
             harnessImage: stack.sandboxes.harnessImage,
         }
         : undefined;
-    const tenantSettings = stack.tenant ?? { name: "default", derivedPrincipals: ["project"] };
+    const tenantSettings = stack.tenant ?? { name: "default" };
     const module = createTenantModule({
         open: createPostgresTenantOpener({
             hostRoot,
@@ -298,10 +326,7 @@ export async function main() {
             create: {
                 ...(tenantSettings.id ? { tenantId: tenantSettings.id } : {}),
                 name: tenantSettings.name,
-                principals: hostPrincipals({
-                    adminKey: credentials.adminKey,
-                    derived: tenantSettings.derivedPrincipals,
-                }),
+                principals: hostPrincipals({ adminKey: credentials.adminKey }),
             },
             configFor,
             logger,
@@ -335,9 +360,6 @@ export async function main() {
         coreVersion: coreVersion(),
         ...(stack.listen ? { listen: stack.listen } : {}),
         ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
-        // Container mode (the local stack) allows browsers unless told not to; a Host started
-        // from host.json only when it says so. Without publishable keys nothing is reachable.
-        browserAccess: stack.browserAccess ?? (stack.listen ? true : config.browserAccess === true),
         // The Admin API on its own listener: from the container environment, or from host.json
         // (loopback, on the same host) when the Host runs outside a container.
         ...(stack.operator

package/dist/host/stack-config.d.ts

@@ -54,6 +54,14 @@ export interface GatesConfig {
     listen: ContainerListen;
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
+    /**
+     * The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`), asked
+     * for a person's MCP credential when the session's vaults hold none (F9 C1). Absent: vaults only.
+     */
+    resolver?: {
+        url: string;
+        token: string;
+    };
 }
 /** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
 export interface EgressConfig {
@@ -169,11 +177,6 @@ export interface StackConfig {
      * means nothing outside the container.
      */
     publicUrl?: string;
-    /**
-     * `NYLORUN_BROWSER_ACCESS` (`on` or `off`): whether browser requests may reach Tenant
-     * routes. Absent means the Host's default (on in container mode).
-     */
-    browserAccess?: boolean;
     /**
      * The operator listener in container mode (`NYLORUN_ADMIN_LISTEN_PORT`, `…_HOST`,
      * `…_ALLOWED_HOSTS`). Absent: one listener serves the Admin API and the Tenant API.
@@ -221,10 +224,10 @@ export interface TenantSettings {
     /** `NYLORUN_TENANT_NAME`. Default `default`. */
     name: string;
     /**
-     * `NYLORUN_DERIVED_PRINCIPALS`: comma-separated application principals whose keys the admin
-     * key derives (`deriveTenantKey`). Default `project`.
+     * `NYLORUN_IDENTITY_FILE`: the identity file listing the trusted issuers (Host feature
+     * `trusted-issuers`), read once at boot (`host/main.ts`). Absent: no issuer is trusted.
      */
-    derivedPrincipals: readonly string[];
+    identityFile?: string;
 }
 export declare class StackConfigError extends Error {
     constructor(message: string);

package/dist/host/stack-config.js

@@ -15,6 +15,8 @@
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
  * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
  * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
+ * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
+ * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
  *
  * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
  * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
@@ -34,9 +36,9 @@
  * The Postgres, Restate and S2 endpoints are parsed and validated here;
  * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
  * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
- * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`, `NYLORUN_DERIVED_PRINCIPALS`).
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`).
  */
-import { DERIVED_PRINCIPAL_ID_PATTERN, isTenantId } from "@nylorun/core/compatibility";
+import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
@@ -318,9 +320,6 @@ export function parseStackConfig(env, argv) {
     if (restateIdentityKeys)
         endpoints.restateIdentityKeys = restateIdentityKeys;
     const publicUrl = parseUrl(env, "NYLORUN_PUBLIC_URL", http)?.replace(/\/+$/, "");
-    const rawBrowser = read(env, "NYLORUN_BROWSER_ACCESS");
-    if (rawBrowser !== undefined && rawBrowser !== "on" && rawBrowser !== "off")
-        throw new StackConfigError(`NYLORUN_BROWSER_ACCESS must be on or off, not ${rawBrowser}`);
     const harnessMode = servesApi ? parseHarnessMode(env) : undefined;
     const sandboxes = servesApi ? parseSandboxes(env) : undefined;
     // Pods connect to the Harness API listener even when the Tenant runs its own harness.
@@ -344,7 +343,6 @@ export function parseStackConfig(env, argv) {
         ...(listen ? { listen } : {}),
         endpoints,
         ...(publicUrl ? { publicUrl } : {}),
-        ...(rawBrowser === undefined ? {} : { browserAccess: rawBrowser === "on" }),
         ...(harnessMode ? { harnessMode } : {}),
         ...(harnessListener ? { harnessListener } : {}),
         ...(sandboxes ? { sandboxes } : {}),
@@ -380,15 +378,11 @@ function parseTenant(env) {
     const id = read(env, "NYLORUN_TENANT_ID");
     if (id !== undefined && !isTenantId(id))
         throw new StackConfigError(`NYLORUN_TENANT_ID must be a Tenant id (tn_ and 26 Crockford characters), not ${id}`);
-    const raw = read(env, "NYLORUN_DERIVED_PRINCIPALS");
-    const derivedPrincipals = raw === undefined ? ["project"] : raw.split(",").map((entry) => entry.trim());
-    for (const principal of derivedPrincipals)
-        if (!DERIVED_PRINCIPAL_ID_PATTERN.test(principal) || principal === "studio")
-            throw new StackConfigError(`NYLORUN_DERIVED_PRINCIPALS has '${principal}': each entry must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be studio`);
+    const identityFile = read(env, "NYLORUN_IDENTITY_FILE");
     return {
         ...(id ? { id } : {}),
         name: read(env, "NYLORUN_TENANT_NAME") ?? "default",
-        derivedPrincipals: [...new Set(derivedPrincipals)],
+        ...(identityFile ? { identityFile } : {}),
     };
 }
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
@@ -542,11 +536,28 @@ function parseGates(env) {
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
+    const resolver = parseResolver(env);
     return {
         listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
         token,
+        ...(resolver ? { resolver } : {}),
     };
 }
+/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
+function parseResolver(env) {
+    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
+    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
+    if (url === undefined) {
+        if (token !== undefined)
+            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
+        return undefined;
+    }
+    if (token === undefined)
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
+    if (/\s/.test(token))
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
+    return { url, token };
+}
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
     const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 export { openTenantRuntime, type TenantOpenHooks, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, type StartEphemeralRuntimeOptions, type EphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
+export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/index.js

@@ -1,5 +1,7 @@
 export { openTenantRuntime, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, } from "./tenant/issuers.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, } from "./host/environment.js";

package/dist/keys/client.js

@@ -12,10 +12,18 @@ import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
 /** Signing and vault writes are short; anything slower is a gateway in trouble. */
 const KEYS_TIMEOUT_MS = 30_000;
+/**
+ * MCP OAuth connect calls the authorization server several times (discovery, registration, the
+ * code exchange), each bounded by `guardedFetch`'s 30 s: these wait longer.
+ */
+const SLOW_OPERATIONS = {
+    startOAuth: 120_000,
+    finishOAuth: 60_000,
+};
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
-    const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
     function call(operation, args) {
+        const timeoutMs = Math.max(options.timeoutMs ?? KEYS_TIMEOUT_MS, SLOW_OPERATIONS[operation] ?? 0);
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");

package/dist/keys/keys.d.ts

@@ -1,7 +1,7 @@
 import type { CreateCredentialRequest, CredentialInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { VaultService } from "../vault/service.js";
+import type { FinishOAuthInput, StartOAuthInput, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -26,9 +26,19 @@ export interface Keys {
     }): Promise<SigningKeyView[]>;
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
+    /** Starts an MCP OAuth connect into an installation vault (`VaultService.startOAuth`). */
+    startOAuth(input: StartOAuthInput): Promise<{
+        authorizeUrl: string;
+        expiresAt: string;
+    }>;
+    /** Finishes one from its callback (`VaultService.finishOAuth`). */
+    finishOAuth(input: FinishOAuthInput): Promise<{
+        vaultId: string;
+        credentialId: string;
+    }>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "startOAuth", "finishOAuth"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -5,6 +5,10 @@
  * delivery tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
+ * MCP OAuth connect (F9-D14) runs here too: discovery, registration, the code exchange and the
+ * credential it seals, so the plaintext tokens, the PKCE verifier and any client secret never
+ * reach the runtime container; core only routes the start and the callback.
+ *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
@@ -20,6 +24,8 @@ export const KEYS_OPERATIONS = [
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
+    "startOAuth",
+    "finishOAuth",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
@@ -28,6 +34,8 @@ export function inProcessKeys(options) {
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
+        startOAuth: (input) => vault.startOAuth(input),
+        finishOAuth: (input) => vault.finishOAuth(input),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));

package/dist/mcp/connect.js

@@ -162,7 +162,8 @@ function authorizedFetch(server, authorize) {
             headers.set(key, value);
         new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
         if (result.status === "authorized")
-            headers.set("authorization", result.headers.authorization);
+            for (const [key, value] of Object.entries(result.headers))
+                headers.set(key, value);
         return fetch(target, { ...init, headers, redirect: "error" });
     };
 }

package/dist/mcp/pool.d.ts

@@ -19,6 +19,7 @@ export declare class McpPool {
         readonly authorize: (sessionId: string, request: {
             url: string;
             serverName: string;
+            agentId?: string;
         }) => Promise<AuthorizeResult>;
         /** Default `DEFAULT_MCP_IDLE_MS`. */
         readonly idleMs?: number;

package/dist/mcp/pool.js

@@ -192,6 +192,7 @@ export class McpPool {
                     : (url) => this.options.authorize(input.sessionId, {
                         url,
                         serverName: declared.server.name,
+                        ...ownerOf(declared),
                     }),
             });
             return { ok: true, connection };