@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/gates/http-tool.d.ts

@@ -0,0 +1,86 @@
+import { type HttpToolTarget, type JsonObject, type ToolManifest } from "@nylorun/core/define";
+import type { HostEffect } from "@nylorun/harness/run";
+import { type OutboundPolicy } from "../tenant/outbound.js";
+import type { Logger } from "../tenant/types.js";
+import type { AuthorizeResult } from "../vault/service.js";
+import type { McpCredentialRequest } from "../vault/sources.js";
+import type { TenantVaults } from "./tenant-vaults.js";
+/** How much of a failed answer's body the model sees. */
+export declare const HTTP_ERROR_BODY_CHARS = 2000;
+/** What an HTTP request came to, as a tool outcome. */
+export type HttpOutcome = {
+    readonly kind: "completed";
+    readonly output: unknown;
+} | {
+    readonly kind: "failed";
+    readonly code: string;
+    readonly message: string;
+};
+/**
+ * One declared HTTP tool of a session: what the gate finds it by in the pinned manifest. An
+ * agent's HTTP tool is named by its capability and tool; a flow's HTTP stage or HTTP verifier
+ * by its stage key.
+ */
+export type HttpToolRef = {
+    readonly sessionId: string;
+    /** The agent used as a tool that declares it; absent for the session's root agent. */
+    readonly agentId?: string;
+    readonly capabilityId: string;
+    readonly toolName: string;
+} | {
+    readonly sessionId: string;
+    /** The stage key of a flow's HTTP stage or HTTP verifier. */
+    readonly stage: string;
+};
+/** One call of an HTTP tool. `effectId` is its run-once key, sent as `Idempotency-Key`. */
+export interface HttpToolCall {
+    readonly tool: HttpToolRef;
+    readonly effectId: string;
+    readonly turnId: string;
+    readonly input: unknown;
+}
+/** What `runHttpTool` reads of the Tenant: the session's pinned manifest and its credentials. */
+export interface HttpToolTenant {
+    session(sessionId: string): Promise<{
+        readonly manifest: unknown;
+    } | undefined>;
+    authorize(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
+}
+/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
+export declare function declaredHttpTool(manifest: unknown, agentId: string | undefined, capabilityId: string | undefined, toolName: string | undefined): (ToolManifest & {
+    readonly http: HttpToolTarget;
+}) | undefined;
+/** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
+export declare function declaredFlowHttp(manifest: unknown, stage: string | undefined): import("@nylorun/core/define").FlowHttpTarget | undefined;
+/**
+ * True when `request` calls an HTTP tool the session's `manifest` declares, or runs one of a
+ * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
+ */
+export declare function isHttpToolCall(manifest: unknown, request: HostEffect): boolean;
+/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+export declare function httpToolRefOf(request: HostEffect): HttpToolRef;
+/**
+ * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
+ * the request is an outcome. Rejects only when `signal` aborts, with its reason.
+ */
+export declare function callHttpTarget(target: HttpToolTarget, input: unknown, options: {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly policy: OutboundPolicy;
+    readonly signal: AbortSignal;
+    /** Checked against the answer; a mismatch is `tool.invalid-output`. */
+    readonly outputSchema?: JsonObject;
+}): Promise<HttpOutcome>;
+/**
+ * Runs one HTTP tool call of a session: finds the tool in the pinned manifest, adds its vault
+ * credential, the identity headers and the run-once key, and calls it. Never throws but for an
+ * abort of `signal`. Logs one line per call, never the input, the answer or a credential.
+ */
+export declare function runHttpTool(tenant: HttpToolTenant, call: HttpToolCall, options: {
+    readonly policy: OutboundPolicy;
+    readonly signal: AbortSignal;
+    readonly logger?: Logger;
+}): Promise<HttpOutcome>;
+/** The gates service's HTTP tool calls, with the Tenant's vault (`host/gates.ts`). */
+export declare function gateHttpTools(vaults: TenantVaults, policy: OutboundPolicy, logger: Logger): {
+    call: (tenantId: string | undefined, call: HttpToolCall, signal: AbortSignal) => Promise<HttpOutcome>;
+};

package/dist/gates/http-tool.js

@@ -0,0 +1,197 @@
+/**
+ * HTTP tools (R2 M3): a tool the manifest describes as one HTTP request, made by the Tool Gate.
+ * The loop names the tool; the gate finds its URL, method and credential in the session's pinned
+ * manifest, as it finds a remote MCP server, so the loop never chooses a URL or a credential.
+ *
+ * `callHttpTarget` is the request and its answer, for any declared HTTP target: the input as a
+ * JSON body under the Host's address policy (`tenant/outbound.ts`), a 2xx answer as the output
+ * (JSON, or text when the answer is not JSON and no output schema asks for JSON), and every other
+ * answer, a timeout or a refused address as a failed outcome the model sees. `runHttpTool` adds
+ * what a tool call needs: the declaration, the vault credential and the identity headers.
+ *
+ * A flow's HTTP stages and HTTP verifiers (R2) are called the same way: the ref names the flow
+ * session and the stage key, and the gate finds the target in the pinned workflow manifest. The
+ * `Nylorun-Agent-Id` is the flow agent's.
+ */
+import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
+import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
+/** How much of a failed answer's body the model sees. */
+export const HTTP_ERROR_BODY_CHARS = 2_000;
+/** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
+export function declaredHttpTool(manifest, agentId, capabilityId, toolName) {
+    const root = manifest;
+    if (!root || !Array.isArray(root.capabilities))
+        return undefined;
+    const agent = agentId === undefined ? root : delegateManifest(root, agentId);
+    const tool = agent?.capabilities
+        .find((capability) => capability.id === capabilityId)
+        ?.tools?.find((item) => item.name === toolName);
+    return tool?.http ? tool : undefined;
+}
+/** The HTTP stage or HTTP verifier at stage key `stage` of a flow session's `manifest`. */
+export function declaredFlowHttp(manifest, stage) {
+    return stage !== undefined && isWorkflowManifest(manifest)
+        ? flowHttpTarget(manifest, stage)
+        : undefined;
+}
+/**
+ * True when `request` calls an HTTP tool the session's `manifest` declares, or runs one of a
+ * flow's HTTP stages or HTTP verifiers (a flow `tool` effect, named by its stage key).
+ */
+export function isHttpToolCall(manifest, request) {
+    if (request.kind !== "tool")
+        return false;
+    if (request.capabilityId === undefined)
+        return declaredFlowHttp(manifest, request.key) !== undefined;
+    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName) !== undefined;
+}
+/** The ref a `tool` effect calls the Tool Gate with: its agent's HTTP tool, or its flow stage. */
+export function httpToolRefOf(request) {
+    if (request.capabilityId === undefined)
+        return { sessionId: request.sessionId, stage: request.key };
+    return {
+        sessionId: request.sessionId,
+        ...(request.agent ? { agentId: request.agent.id } : {}),
+        capabilityId: request.capabilityId,
+        toolName: request.toolName,
+    };
+}
+/**
+ * Sends `input` to `target` and reads the answer. Never throws: everything that can happen to
+ * the request is an outcome. Rejects only when `signal` aborts, with its reason.
+ */
+export async function callHttpTarget(target, input, options) {
+    const timeoutMs = target.timeoutMs ?? HTTP_TOOL_DEFAULT_TIMEOUT_MS;
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const result = await post(target.url, JSON.stringify(input ?? {}), { ...options.headers }, {
+        policy: options.policy,
+        method: target.method ?? "POST",
+        signal: AbortSignal.any([options.signal, timeout]),
+    });
+    if (options.signal.aborted)
+        throw options.signal.reason;
+    if (timeout.aborted)
+        return failed("http.timeout", `The service did not answer within ${timeoutMs} ms`);
+    switch (result.kind) {
+        case "not_sent":
+            return result.code === "ENDPOINT_ADDRESS_REFUSED"
+                ? failed("http.refused", result.message)
+                : failed("http.unreachable", `The request was not sent: ${result.message}`);
+        case "lost":
+            return failed("http.lost", `The connection was lost after the request was sent, so the call may have run: ${result.message}`);
+        case "too_large":
+            return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${MAX_RESPONSE_BYTES} bytes`);
+    }
+    const text = result.body.toString("utf8");
+    if (result.status < 200 || result.status > 299) {
+        const body = text.length > HTTP_ERROR_BODY_CHARS ? `${text.slice(0, HTTP_ERROR_BODY_CHARS)}…` : text;
+        return failed("http.status", `The service answered HTTP ${result.status}${body ? `: ${body}` : ""}`);
+    }
+    const type = String(result.headers["content-type"] ?? "");
+    let output;
+    if (text === "")
+        output = null;
+    else if (/[/+]json\b/i.test(type)) {
+        try {
+            output = JSON.parse(text);
+        }
+        catch {
+            return failed("http.invalid-response", "The answer says it is JSON but does not parse");
+        }
+    }
+    else if (options.outputSchema)
+        return failed("http.invalid-response", `The answer is ${type || "untyped"}, not JSON, and the tool's output schema needs JSON`);
+    else
+        output = text;
+    if (!options.outputSchema)
+        return { kind: "completed", output };
+    const checked = schemaFromJSON(options.outputSchema).validate(output);
+    if (!checked.ok)
+        return failed("tool.invalid-output", checked.issues.map((issue) => issue.message).join("; "));
+    return { kind: "completed", output: checked.value };
+}
+/**
+ * Runs one HTTP tool call of a session: finds the tool in the pinned manifest, adds its vault
+ * credential, the identity headers and the run-once key, and calls it. Never throws but for an
+ * abort of `signal`. Logs one line per call, never the input, the answer or a credential.
+ */
+export async function runHttpTool(tenant, call, options) {
+    const started = Date.now();
+    const { tool } = call;
+    let outcome;
+    try {
+        outcome = await run();
+    }
+    catch (error) {
+        if (options.signal.aborted)
+            throw error;
+        outcome = failed("http.failed", error instanceof Error ? error.message : String(error));
+    }
+    options.logger?.info("http_tool_call", {
+        session: tool.sessionId,
+        ...("stage" in tool
+            ? { stage: tool.stage }
+            : {
+                capability: tool.capabilityId,
+                tool: tool.toolName,
+                ...(tool.agentId === undefined ? {} : { agent: tool.agentId }),
+            }),
+        effect: call.effectId,
+        ms: Date.now() - started,
+        outcome: outcome.kind === "completed" ? "ok" : outcome.code,
+    });
+    return outcome;
+    async function run() {
+        const session = await tenant.session(tool.sessionId);
+        if (!session)
+            return failed("http.undeclared", `Session ${tool.sessionId} not found`);
+        const agentId = "stage" in tool ? undefined : tool.agentId;
+        const declared = "stage" in tool
+            ? declaredFlowHttp(session.manifest, tool.stage)
+            : declaredHttpTool(session.manifest, agentId, tool.capabilityId, tool.toolName);
+        if (!declared)
+            return failed("http.undeclared", "stage" in tool
+                ? `'${tool.stage}' is not an HTTP stage of the flow`
+                : `'${tool.toolName}' is not an HTTP tool of the session`);
+        const { http } = declared;
+        let credential = {};
+        if (http.credential !== undefined) {
+            const authorized = await tenant.authorize(tool.sessionId, {
+                kind: "http",
+                url: http.url,
+                serverName: http.credential,
+                ...(agentId === undefined ? {} : { agentId }),
+            });
+            if (authorized.status === "refused")
+                return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
+            if (authorized.status === "unauthenticated")
+                return failed("http.credential", `The session's vaults hold no credential '${http.credential}' for ${authorized.url}`);
+            credential = authorized.headers;
+        }
+        return callHttpTarget(http, call.input, {
+            headers: {
+                ...credential,
+                [SESSION_ID_HEADER]: tool.sessionId,
+                [TURN_ID_HEADER]: call.turnId,
+                [AGENT_ID_HEADER]: agentId ?? session.manifest.id,
+                "idempotency-key": call.effectId,
+            },
+            policy: options.policy,
+            signal: options.signal,
+            ...(declared.outputSchema === undefined ? {} : { outputSchema: declared.outputSchema }),
+        });
+    }
+}
+/** The gates service's HTTP tool calls, with the Tenant's vault (`host/gates.ts`). */
+export function gateHttpTools(vaults, policy, logger) {
+    return {
+        call: (tenantId, call, signal) => runHttpTool({
+            session: async (sessionId) => (await vaults.open(tenantId)).session(sessionId),
+            authorize: async (sessionId, request) => (await vaults.open(tenantId)).authorizeMcp(sessionId, request),
+        }, call, { policy, signal, logger }),
+    };
+}
+function failed(code, message) {
+    return { kind: "failed", code, message };
+}

package/dist/gates/mcp-handler.d.ts

@@ -1,5 +1,6 @@
 import { openMcpServer, type McpToolPage } from "../mcp/connect.js";
 import { type McpServerRef } from "../mcp/pool.js";
+import type { OutboundPolicy } from "../tenant/outbound.js";
 import type { Logger } from "../tenant/types.js";
 import type { McpAnswer } from "./tool-contract.js";
 import { type TenantVaults } from "./tenant-vaults.js";
@@ -13,6 +14,8 @@ export interface McpHandlerOptions {
     readonly now?: () => number;
     /** Tests replace how a server is opened. */
     readonly open?: typeof openMcpServer;
+    /** How the gate reaches remote servers (`NYLORUN_ENDPOINT_*`). Default: no limits. */
+    readonly delivery?: OutboundPolicy;
 }
 export interface McpHandler {
     connect(tenantId: string | undefined, server: McpServerRef): Promise<McpAnswer<null>>;

package/dist/gates/mcp-handler.js

@@ -22,8 +22,6 @@ export function createMcpHandler(options) {
         const found = findServer(session.manifest, server.agentId, server.capabilityId, server.serverName);
         if (!found)
             throw new NotDeclared(`MCP server '${server.serverName}' is not declared`);
-        if (found.server.type === "stdio")
-            throw new NotDeclared(`MCP server '${server.serverName}' is a stdio server, which runs beside the loop`);
         return found.server;
     }
     async function connection(tenantId, server) {
@@ -38,8 +36,12 @@ export function createMcpHandler(options) {
                 const manifest = await declared(vault, server);
                 const connection = await open({
                     server: manifest,
-                    authorize: (url) => vault.authorizeMcp(server.sessionId, { url, serverName: server.serverName }),
-                    pluginData: "",
+                    authorize: (url) => vault.authorizeMcp(server.sessionId, {
+                        url,
+                        serverName: server.serverName,
+                        ...(server.agentId === undefined ? {} : { agentId: server.agentId }),
+                    }),
+                    policy: options.delivery ?? {},
                 });
                 const entry = { connection, lastUsedAt: now(), active: 0 };
                 live.set(key, entry);

package/dist/gates/meter.d.ts

@@ -1,4 +1,4 @@
-import type { ModelBudgetRow, ModelUsageRow, ModelUsageTotals, SessionStore } from "../store/types.js";
+import type { ModelBudgetRow, ModelUsageWrite, ModelUsageTotals, SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
 import type { ModelGateOutcome, ModelGateRequest } from "./model-gate.js";
 export interface Meter {
@@ -14,7 +14,7 @@ export interface MeterOptions {
 }
 export declare function createMeter(options: MeterOptions): Meter;
 /** The ledger row of an outcome that carries usage; undefined for a failure. */
-export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): Omit<ModelUsageRow, "duplicate"> | undefined;
+export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): ModelUsageWrite | undefined;
 /**
  * Why the budget refuses another call, or undefined. Calls in flight count at the scope's
  * average cost per recorded call.

package/dist/gates/meter.js

@@ -107,6 +107,12 @@ export function usageRow(request, outcome, at) {
     return {
         id: randomUUID(),
         effectKey: request.effectId,
+        tokensReported: typeof outcome.evidence?.extras?.tokensReported === "boolean"
+            ? outcome.evidence.extras.tokensReported
+            : null,
+        costKnown: typeof outcome.evidence?.extras?.costKnown === "boolean"
+            ? outcome.evidence.extras.costKnown
+            : null,
         sessionId: request.sessionId,
         turnId: request.turnId,
         agentId: request.agentId,

package/dist/gates/tenant-vaults.d.ts

@@ -9,10 +9,12 @@
 import type { Credential } from "@earendil-works/pi-ai";
 import type { ModelFailureOutcome } from "@nylorun/core/define";
 import type { PostgresClient } from "../store/postgres/connect.js";
-import { VaultService, type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
+import { type AuthorizeResult, type HostModelSecret } from "../vault/service.js";
+import { CredentialSources, type McpCredentialRequest, type ResolverConfig } from "../vault/sources.js";
 import type { SessionStore } from "../store/types.js";
 import type { Session } from "../tenant/context.js";
 import { type Keys } from "../keys/keys.js";
+import { type OutboundPolicy } from "../tenant/outbound.js";
 /** The Tenant, as a model call needs it. */
 export interface TenantVault {
     readonly tenantId: string;
@@ -23,16 +25,14 @@ export interface TenantVault {
     readHostModel(): Promise<HostModelSecret | undefined>;
     /** Writes back a credential pi-ai refreshed (OAuth). */
     writeHostCredential(credential: Credential): Promise<void>;
-    /** A session, for the remote MCP servers its pinned manifest declares (F4.1). */
+    /** A session, for the remote MCP servers and HTTP tools its pinned manifest declares. */
     session(sessionId: string): Promise<Session | undefined>;
     /**
-     * The vault authorization of one request to a session's remote MCP server: its credential
-     * from the session's attached vaults, refreshed when due (F4.1).
+     * The authorization of one request to a session's remote MCP server or HTTP tool: its
+     * credential from the session's attached vaults, refreshed when due (F4.1), else from the
+     * operator's credential resolver (F9 C1).
      */
-    authorizeMcp(sessionId: string, request: {
-        url: string;
-        serverName: string;
-    }): Promise<AuthorizeResult>;
+    authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
 }
@@ -52,13 +52,18 @@ export interface TenantVaultsOptions {
     readonly sql: PostgresClient;
     /** The Host root; the gate reads `keys/vault-kek` and `tenant/home` under it. */
     readonly hostRoot: string;
+    /** The operator's credential resolver (`NYLORUN_RESOLVER_*`, F9 C1). */
+    readonly resolver?: ResolverConfig;
+    /**
+     * The Host's address policy (`NYLORUN_ENDPOINT_*`): OAuth refresh and MCP OAuth connect call
+     * authorization servers through `guardedFetch` under it (F9 C2).
+     */
+    readonly delivery?: OutboundPolicy;
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop did in its own process before F4.1 (`tenant/effects.ts` `authorize`).
+ * A request to a session's remote MCP server, authorized from the session's attached vaults,
+ * else the operator's credential resolver: what the loop does in its own process
+ * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
  */
-export declare function authorizeSessionMcp(credentials: VaultService, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: {
-    url: string;
-    serverName: string;
-}): Promise<AuthorizeResult>;
+export declare function authorizeSessionMcp(sources: CredentialSources, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -8,8 +8,10 @@ import { tenantPaths } from "../tenant/paths.js";
 import { readVaultKek } from "../vault/kek.js";
 import { HostModelVault } from "../vault/host-model.js";
 import { VaultService } from "../vault/service.js";
+import { CredentialSources } from "../vault/sources.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { SigningKeys } from "../tenant/signing-keys.js";
+import { guardedFetch } from "../tenant/outbound.js";
 /** A call the gate refuses before the provider is called; it answers with `outcome`. */
 export class GateRefusal extends Error {
     outcome;
@@ -33,7 +35,15 @@ export function createTenantVaults(options) {
             return kek;
         };
         const vault = new HostModelVault({ store, kek: readKek });
-        const credentials = new VaultService({ store, kek: readKek, fetch: globalThis.fetch });
+        const credentials = new VaultService({
+            store,
+            kek: readKek,
+            fetch: guardedFetch(options.delivery ?? {}),
+        });
+        const sources = new CredentialSources({
+            vault: credentials,
+            ...(options.resolver ? { resolver: options.resolver } : {}),
+        });
         const keys = inProcessKeys({
             store,
             vault: credentials,
@@ -48,7 +58,7 @@ export function createTenantVaults(options) {
             readHostModel: () => vault.readHostModel(),
             writeHostCredential: (credential) => vault.updateHostCredential(credential),
             session,
-            authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
+            authorizeMcp: (sessionId, request) => authorizeSessionMcp(sources, session, sessionId, request),
             keys: () => keys,
         };
     }
@@ -77,18 +87,13 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop did in its own process before F4.1 (`tenant/effects.ts` `authorize`).
+ * A request to a session's remote MCP server, authorized from the session's attached vaults,
+ * else the operator's credential resolver: what the loop does in its own process
+ * (`tenant/effects.ts` `authorize`). The owner and turn come from the session row.
  */
-export async function authorizeSessionMcp(credentials, session, sessionId, request) {
+export async function authorizeSessionMcp(sources, session, sessionId, request) {
     const found = await session(sessionId);
     if (!found)
         throw new Error(`Session ${sessionId} not found`);
-    return credentials.authorize({
-        sessionId,
-        vaultIds: found.vaultIds ?? [],
-        credentialSelections: found.credentialSelections ?? [],
-        url: request.url,
-        serverName: request.serverName,
-    });
+    return sources.authorize({ ...found, id: sessionId }, request);
 }

package/dist/gates/tool-calls.d.ts

@@ -1,6 +1,6 @@
 /**
- * Keyed remote MCP calls in the gates service (F4.1 G3). A call sent with an `Idempotency-Key`
- * (the loop's effect id) runs once:
+ * Keyed tool calls in the gates service (F4.1 G3): remote MCP calls and HTTP tool calls (R2 M3).
+ * A call sent with an `Idempotency-Key` (the loop's effect id) runs once:
  *
  * - While it runs, and for 30 minutes after, a re-send joins it or gets its answer from memory
  *   (`inflight.ts`), as model calls do (P1.2). So a runtime that dies or shuts down mid-call
@@ -13,28 +13,21 @@
  * A cancel aborts the call and leaves its row without an answer. Settled rows are deleted a day
  * later (`prune`).
  */
-import type { McpServerRef } from "../mcp/pool.js";
 import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
-import type { McpHandler } from "./mcp-handler.js";
 import type { TenantVaults } from "./tenant-vaults.js";
 import type { McpAnswer } from "./tool-contract.js";
 /** How long a settled crossing is kept. */
 export declare const TOOL_CROSSING_TTL_MS: number;
+/** A tool call's answer: an MCP `CallToolResult`, or an HTTP tool's outcome. */
 export type ToolCallAnswer = McpAnswer<Record<string, unknown>>;
-export interface ToolCallRequest {
-    readonly server: McpServerRef;
-    readonly effectId: string;
-    readonly name: string;
-    readonly arguments: Record<string, unknown>;
-}
 export interface ToolCalls {
     /**
-     * Runs, joins or answers the call under `key`. Rejects with `InflightConflict` when a
-     * different request already ran under it, and as `InflightCalls.run` does for `owner`, the
-     * run that sends it (F5).
+     * Runs `call` under `key`, joins the call running under it, or answers it from its crossing.
+     * Rejects with `InflightConflict` when a different request (`hash`) already ran under it, and
+     * as `InflightCalls.run` does for `owner`, the run that sends it (F5).
      */
-    run(tenantId: string | undefined, key: string, hash: string, request: ToolCallRequest, owner?: InflightOwner): Promise<ToolCallAnswer>;
+    run(tenantId: string | undefined, key: string, hash: string, call: (signal: AbortSignal) => Promise<ToolCallAnswer>, owner?: InflightOwner): Promise<ToolCallAnswer>;
     /**
      * Aborts the call under `key`; it is never run again under that key. With `sessionId`, false
      * when the running call is another session's (nothing is aborted).
@@ -47,7 +40,6 @@ export interface ToolCalls {
 }
 export interface ToolCallsOptions {
     readonly vaults: TenantVaults;
-    readonly mcp: McpHandler;
     readonly logger: Logger;
     readonly inflight?: InflightCallsOptions;
     readonly now?: () => number;

package/dist/gates/tool-calls.js

@@ -5,16 +5,16 @@ const LOST = {
     ok: false,
     error: {
         uncertain: true,
-        message: "The gateway stopped while this MCP call ran; the call may have reached the server, so it is not run again",
+        message: "The gateway stopped while this tool call ran; the call may have reached its server, so it is not run again",
     },
 };
 export function createToolCalls(options) {
-    const { vaults, mcp, logger } = options;
+    const { vaults, logger } = options;
     const now = options.now ?? Date.now;
     const inflight = createInflightCalls(options.inflight);
     const iso = () => new Date(now()).toISOString();
     return {
-        async run(tenantId, key, hash, request, owner) {
+        async run(tenantId, key, hash, call, owner) {
             if (inflight.has(key))
                 return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
             const vault = await vaults.open(tenantId);
@@ -35,7 +35,7 @@ export function createToolCalls(options) {
                 // Another gateway process wrote it between the read and now: never run it twice.
                 if (!started)
                     return LOST;
-                const answer = await mcp.call(tenantId, request, signal);
+                const answer = await call(signal);
                 // A cancel or a shutdown: the call may have reached the server; the row stays open.
                 if (signal.aborted)
                     throw signal.reason ?? new Error("aborted");

package/dist/gates/tool-client.d.ts

@@ -4,7 +4,7 @@ export interface HttpToolGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;
     /**
-     * `NYLORUN_GATES_TOKEN`: core's credential, for deliveries and MCP requests outside a run. A
+     * `NYLORUN_GATES_TOKEN`: core's credential, for MCP requests outside a run. A
      * harness has none (F6.2): its requests outside a run carry the session's last run token, or
      * nothing, and the gate refuses them.
      */