@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/host/stack-config.js

@@ -15,6 +15,8 @@
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
  * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
  * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
+ * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
+ * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
  *
  * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
  * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
@@ -34,9 +36,9 @@
  * The Postgres, Restate and S2 endpoints are parsed and validated here;
  * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
  * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
- * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`, `NYLORUN_DERIVED_PRINCIPALS`).
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`).
  */
-import { DERIVED_PRINCIPAL_ID_PATTERN, isTenantId } from "@nylorun/core/compatibility";
+import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
@@ -223,30 +225,6 @@ function parseListen(env) {
     const allowedHosts = [...new Set([...explicit, ...loopbackForms(port)])];
     return { host, port, allowedHosts };
 }
-function parseAdminListen(env) {
-    const rawPort = read(env, "NYLORUN_ADMIN_LISTEN_PORT");
-    const rawHost = read(env, "NYLORUN_ADMIN_LISTEN_HOST");
-    const rawAllowed = read(env, "NYLORUN_ADMIN_ALLOWED_HOSTS");
-    if (rawPort === undefined) {
-        if (rawHost !== undefined || rawAllowed !== undefined)
-            throw new StackConfigError("NYLORUN_ADMIN_LISTEN_PORT is required with NYLORUN_ADMIN_LISTEN_HOST or NYLORUN_ADMIN_ALLOWED_HOSTS");
-        return undefined;
-    }
-    const host = rawHost ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_ADMIN_LISTEN_HOST is not an address: ${host}`);
-    const port = parsePort("NYLORUN_ADMIN_LISTEN_PORT", rawPort);
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_ADMIN_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_ADMIN_ALLOWED_HOSTS is required when NYLORUN_ADMIN_LISTEN_HOST is ${host}: list the Host headers operators send, e.g. runtime:${port},localhost:<published port>`);
-    return { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] };
-}
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
 function parseIdentityKeys(env) {
     const raw = read(env, "NYLORUN_RESTATE_IDENTITY_KEY");
@@ -269,15 +247,12 @@ export function parseStackConfig(env, argv) {
     // The image sets NYLORUN_LISTEN_*: only the API's processes read them.
     const servesApi = services.has("core") || services.has("loop");
     const listen = servesApi ? parseListen(env) : undefined;
-    const operator = servesApi ? parseAdminListen(env) : undefined;
     const gates = services.has("gates") || services.has("keys") ? parseGates(env) : undefined;
     const egress = services.has("egress") ? parseEgress(env) : undefined;
-    // The gates service's clients: the loop's model and tool calls, and core's endpoint pings.
+    // The gates service's clients: the loop's model and tool calls.
     const modelGate = servesApi ? parseModelGate(env) : undefined;
     // The keys service is the gateway's unless NYLORUN_KEYS_URL names another listener.
     const keys = servesApi ? (parseKeysEndpoint(env) ?? modelGate) : undefined;
-    if (operator && listen && operator.port === listen.port)
-        throw new StackConfigError("NYLORUN_ADMIN_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT");
     if (services.has("loop") && listen && !modelGate)
         throw new StackConfigError("NYLORUN_GATES_URL is required for the loop service in a container: model calls go through the gates service (the gateway container), so the loop never holds a model credential. Set NYLORUN_GATES_URL and NYLORUN_GATES_TOKEN (`nylorun start` sets both)");
     const rawPacking = read(env, "NYLORUN_PACKING");
@@ -318,18 +293,14 @@ export function parseStackConfig(env, argv) {
     if (restateIdentityKeys)
         endpoints.restateIdentityKeys = restateIdentityKeys;
     const publicUrl = parseUrl(env, "NYLORUN_PUBLIC_URL", http)?.replace(/\/+$/, "");
-    const rawBrowser = read(env, "NYLORUN_BROWSER_ACCESS");
-    if (rawBrowser !== undefined && rawBrowser !== "on" && rawBrowser !== "off")
-        throw new StackConfigError(`NYLORUN_BROWSER_ACCESS must be on or off, not ${rawBrowser}`);
     const harnessMode = servesApi ? parseHarnessMode(env) : undefined;
     const sandboxes = servesApi ? parseSandboxes(env) : undefined;
     // Pods connect to the Harness API listener even when the Tenant runs its own harness.
     const harnessListener = harnessMode === "remote" || sandboxes
         ? parseHarnessListener(env, harnessMode === "remote")
         : undefined;
-    if (harnessListener &&
-        [listen?.port, operator?.port].includes(harnessListener.listen.port))
-        throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT and NYLORUN_ADMIN_LISTEN_PORT");
+    if (harnessListener && listen?.port === harnessListener.listen.port)
+        throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT");
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
@@ -344,11 +315,9 @@ export function parseStackConfig(env, argv) {
         ...(listen ? { listen } : {}),
         endpoints,
         ...(publicUrl ? { publicUrl } : {}),
-        ...(rawBrowser === undefined ? {} : { browserAccess: rawBrowser === "on" }),
         ...(harnessMode ? { harnessMode } : {}),
         ...(harnessListener ? { harnessListener } : {}),
         ...(sandboxes ? { sandboxes } : {}),
-        ...(operator ? { operator } : {}),
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(objectStore ? { objectStore } : {}),
@@ -380,15 +349,13 @@ function parseTenant(env) {
     const id = read(env, "NYLORUN_TENANT_ID");
     if (id !== undefined && !isTenantId(id))
         throw new StackConfigError(`NYLORUN_TENANT_ID must be a Tenant id (tn_ and 26 Crockford characters), not ${id}`);
-    const raw = read(env, "NYLORUN_DERIVED_PRINCIPALS");
-    const derivedPrincipals = raw === undefined ? ["project"] : raw.split(",").map((entry) => entry.trim());
-    for (const principal of derivedPrincipals)
-        if (!DERIVED_PRINCIPAL_ID_PATTERN.test(principal) || principal === "studio")
-            throw new StackConfigError(`NYLORUN_DERIVED_PRINCIPALS has '${principal}': each entry must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be studio`);
+    const identityFile = read(env, "NYLORUN_IDENTITY_FILE");
+    const managementKeyFile = read(env, "NYLORUN_MANAGEMENT_KEY_FILE");
     return {
         ...(id ? { id } : {}),
         name: read(env, "NYLORUN_TENANT_NAME") ?? "default",
-        derivedPrincipals: [...new Set(derivedPrincipals)],
+        ...(identityFile ? { identityFile } : {}),
+        ...(managementKeyFile ? { managementKeyFile } : {}),
     };
 }
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
@@ -542,11 +509,28 @@ function parseGates(env) {
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
+    const resolver = parseResolver(env);
     return {
         listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
         token,
+        ...(resolver ? { resolver } : {}),
     };
 }
+/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
+function parseResolver(env) {
+    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
+    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
+    if (url === undefined) {
+        if (token !== undefined)
+            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
+        return undefined;
+    }
+    if (token === undefined)
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
+    if (/\s/.test(token))
+        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
+    return { url, token };
+}
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
     const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;

package/dist/index.d.ts

@@ -1,10 +1,13 @@
 export { openTenantRuntime, type TenantOpenHooks, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, type StartEphemeralRuntimeOptions, type EphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
+export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";
-export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, } from "./host/environment.js";
+export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";
 export type { HostProcessPathInputs } from "./host/environment.js";
 export type { HostConfigFile, HostCredentialsFile, } from "./host/config.js";

package/dist/index.js

@@ -1,5 +1,7 @@
 export { openTenantRuntime, } from "./tenant/runtime.js";
 export { startEphemeralRuntime, } from "./tenant/ephemeral.js";
+export { parseIdentityFile, IdentityFileError, } from "./tenant/identity-file.js";
+export { createTrustedIssuers, } from "./tenant/issuers.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
-export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, } from "./host/environment.js";
+export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";

package/dist/infra/workers.d.ts

@@ -3,7 +3,7 @@
  *
  * | Services | Serves | `execution.start` |
  * | --- | --- | --- |
- * | `core` | Tenant API, Admin API, SSE | **never**: wakes, timers and sweep arming go through Restate's ingress, which needs no Worker endpoint |
+ * | `core` | Runtime and Management APIs, SSE | **never**: wakes, timers and sweep arming go through Restate's ingress, which needs no Worker endpoint |
  * | `loop` | the Restate endpoint (`NylorunSession.advance`, `NylorunTenant.sweep`, timers) | yes |
  * | `core,loop` | both (the local stack's `runtime` container) | yes |
  *

package/dist/keys/client.js

@@ -12,10 +12,18 @@ import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
 /** Signing and vault writes are short; anything slower is a gateway in trouble. */
 const KEYS_TIMEOUT_MS = 30_000;
+/**
+ * MCP OAuth connect calls the authorization server several times (discovery, registration, the
+ * code exchange), each bounded by `guardedFetch`'s 30 s: these wait longer.
+ */
+const SLOW_OPERATIONS = {
+    startOAuth: 120_000,
+    finishOAuth: 60_000,
+};
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
-    const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
     function call(operation, args) {
+        const timeoutMs = Math.max(options.timeoutMs ?? KEYS_TIMEOUT_MS, SLOW_OPERATIONS[operation] ?? 0);
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");

package/dist/keys/keys.d.ts

@@ -1,7 +1,7 @@
 import type { CreateCredentialRequest, CredentialInfo, HostModelView, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { VaultService } from "../vault/service.js";
+import type { FinishOAuthInput, StartOAuthInput, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -26,9 +26,19 @@ export interface Keys {
     }): Promise<SigningKeyView[]>;
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
+    /** Starts an MCP OAuth connect into an installation vault (`VaultService.startOAuth`). */
+    startOAuth(input: StartOAuthInput): Promise<{
+        authorizeUrl: string;
+        expiresAt: string;
+    }>;
+    /** Finishes one from its callback (`VaultService.finishOAuth`). */
+    finishOAuth(input: FinishOAuthInput): Promise<{
+        vaultId: string;
+        credentialId: string;
+    }>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "startOAuth", "finishOAuth"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -1,10 +1,14 @@
 /**
  * The keys seam (blueprint §14, F4.2): everything that needs the vault key. Vault writes that
  * touch a secret (creating and rotating a credential, setting and selecting the host model;
- * rotation and selection decrypt the old secret first) and all token signing (subject and
- * delivery tokens, signing-key rotation) run here, whole, so the process that calls them never
+ * rotation and selection decrypt the old secret first) and all token signing (capability
+ * links, run and host tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
+ * MCP OAuth connect (F9-D14) runs here too: discovery, registration, the code exchange and the
+ * credential it seals, so the plaintext tokens, the PKCE verifier and any client secret never
+ * reach the runtime container; core only routes the start and the callback.
+ *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
@@ -20,6 +24,8 @@ export const KEYS_OPERATIONS = [
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
+    "startOAuth",
+    "finishOAuth",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
@@ -28,6 +34,8 @@ export function inProcessKeys(options) {
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
+        startOAuth: (input) => vault.startOAuth(input),
+        finishOAuth: (input) => vault.finishOAuth(input),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));