@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, SandboxPageSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, StartOAuthResponseSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, SandboxPageSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, McpPreviewRequestSchema, McpPreviewSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -76,9 +76,9 @@ export const CreateCredentialRequest = named("CreateCredentialRequest", CreateCr
 export const CredentialInfo = named("CredentialInfo", CredentialInfoSchema);
 export const ListCredentialsResponse = named("ListCredentialsResponse", ListCredentialsResponseSchema);
 export const RotateCredentialRequest = named("RotateCredentialRequest", RotateCredentialRequestSchema);
-export const StartOAuthRequest = named("StartOAuthRequest", StartOAuthRequestSchema);
-export const StartOAuthResponse = named("StartOAuthResponse", StartOAuthResponseSchema);
 export const DeletedResponse = named("DeletedResponse", DeletedResponseSchema);
+export const McpPreviewRequest = named("McpPreviewRequest", McpPreviewRequestSchema);
+export const McpPreview = named("McpPreview", McpPreviewSchema);
 export const Jwks = named("Jwks", JwksSchema);
 export const SigningKeyList = named("SigningKeyList", SigningKeyListSchema);
 export const SigningKeyView = named("SigningKeyView", SigningKeyViewSchema);

package/dist/api/http/app.js

@@ -20,6 +20,7 @@ import { fileRoutes } from "./routes/files.js";
 import { keyRoutes } from "./routes/keys.js";
 import { tenantRoutes } from "./routes/tenant.js";
 import { vaultRoutes } from "./routes/vaults.js";
+import { mcpRoutes } from "./routes/mcp.js";
 let app;
 /** The Tenant API, built on first use. */
 export function tenantApi() {
@@ -48,6 +49,7 @@ function build() {
     tenantRoutes(api);
     keyRoutes(api);
     vaultRoutes(api);
+    mcpRoutes(api);
     accessRoutes(api);
     meRoutes(api);
     agUiRoutes(api);

package/dist/api/http/define.d.ts

@@ -27,7 +27,8 @@ export interface RouteAccess {
     /** The subject scopes that reach the route: any one of them, none (`never`), or all (`any`). */
     readonly scopes: readonly SubjectScope[] | "never" | "any";
     /**
-     * Public data: a request with no credential at all (no `Authorization`) is served too. A credential that is sent is still checked, so a wrong one stays the opaque 404.
+     * Public data: a request with no credential at all (no `Authorization`) is served too. A
+     * credential that is sent is still checked, so a wrong one is `401 credential_invalid`.
      */
     readonly anonymous?: boolean;
     /**
@@ -49,7 +50,7 @@ export declare function authenticateCaller(c: Context<TenantEnv>,
 anonymous?: boolean, 
 /** The keys the route takes; a Runtime API route's by default. */
 keys?: KeyAccess): Promise<AuthScope>;
-/** No route: authenticated first, so an unknown credential stays the opaque 404. */
+/** No route: authenticated first, so only a known credential learns there is no such route. */
 export declare function routeNotFound(c: Context<TenantEnv>): Promise<Response>;
 /** Which keys a route's credentials take. */
 export declare function keyAccess(access: RouteAccess): KeyAccess;

package/dist/api/http/define.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { PROTOCOL_VERSION } from "@nylorun/core/compatibility";
-import { authenticate, requireScopes } from "../../tenant/auth.js";
+import { authenticate, challengeMetadata, requireScopes, } from "../../tenant/auth.js";
 import { fail } from "../../tenant/http.js";
 import { ProtocolRejected, Rejected } from "../components.js";
 const SCHEMES = {
@@ -38,7 +38,7 @@ keys) {
         return { kind: "anonymous" };
     return await authenticate(tenant, incoming, keys);
 }
-/** No route: authenticated first, so an unknown credential stays the opaque 404. */
+/** No route: authenticated first, so only a known credential learns there is no such route. */
 export async function routeNotFound(c) {
     // Any known key, of either API, learns only that there is no such route.
     await authenticateCaller(c, false, { application: true, management: true });
@@ -64,8 +64,9 @@ export function declaredRoute(method, segments) {
 }
 function authenticated(access) {
     return async (c, next) => {
-        const scope = await authenticateCaller(c, access.anonymous === true, keyAccess(access));
-        requireScopes(scope, access.scopes);
+        const keys = keyAccess(access);
+        const scope = await authenticateCaller(c, access.anonymous === true, keys);
+        requireScopes(scope, access.scopes, challengeMetadata(c.env.tenant, c.env.incoming, keys));
         c.set("scope", scope);
         await next();
     };
@@ -99,15 +100,13 @@ export function tenantRoute(api, access, route, handler) {
         request: { ...route.request, headers },
         responses: {
             400: rejected("Invalid headers, path, body or cursor"),
-            ...(takes("token")
-                ? {
-                    401: rejected("The token expired (`token_expired`), or its issuer's keys cannot be fetched now (`issuer_unavailable`)"),
-                }
-                : {}),
+            401: rejected(takes("token")
+                ? "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)"
+                : "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge"),
             403: rejected(takes("management")
                 ? "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject"
-                : "Not allowed for this credential or subject scope, a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)"),
-            404: rejected("Not found, or a credential the Tenant does not know (`not_found`)"),
+                : "Not allowed for this credential or subject scope (`scope_required`; a token also gets `WWW-Authenticate: Bearer error=\"insufficient_scope\"` and the scope), a key of the other API (`key_role_mismatch`), or an application key from a browser (`origin_rejected`)"),
+            404: rejected("Not found (`not_found`)"),
             426: { description: "`Nylorun-Protocol` missing or unsupported", content: { "application/json": { schema: ProtocolRejected } } },
             503: rejected("The Tenant's storage or streams are unavailable"),
             ...route.responses,

package/dist/api/http/routes/mcp.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A remote MCP server's tools before an agent names it (`POST /v1/tenant/mcp/preview`, R2b C12,
+ * the Management API): a management key (or Studio's key, acting as itself), as the vault routes
+ * take. The keys service runs it (`Keys.previewMcp`), since it sends an installation vault's
+ * credential; this process never reads the plaintext.
+ */
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+export declare function mcpRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/mcp.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { McpPreviewRequestSchema } from "@nylorun/core/contracts";
+import { McpPreview, McpPreviewRequest, Rejected } from "../../components.js";
+import { readJson } from "../body.js";
+import { tenantRoute } from "../define.js";
+import { jsonResponse } from "../respond.js";
+/** The vault routes' access: a management key. */
+const MANAGEMENT = { credentials: ["management"], scopes: "never" };
+const json = (schema, description) => ({
+    description,
+    content: { "application/json": { schema } },
+});
+export function mcpRoutes(api) {
+    tenantRoute(api, MANAGEMENT, {
+        method: "post",
+        path: "/v1/tenant/mcp/preview",
+        tags: ["MCP servers"],
+        summary: "Preview an MCP server's tools",
+        description: "Connects to the remote MCP server at `url` with the installation vault's credential for that URL (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.",
+        request: {
+            body: { required: true, content: { "application/json": { schema: McpPreviewRequest } } },
+        },
+        responses: {
+            200: json(McpPreview, "The server's tools, or that it needs a credential (`authRequired`)"),
+            409: json(Rejected, "Several installation vaults hold a credential for the URL (name one with `vaultId`), or the one there cannot be used"),
+            502: json(Rejected, "The server could not be listed (`mcp_preview_failed`): `details.failure` is the code a tool call would have failed with, such as `mcp.unreachable` for an address the Host refuses"),
+        },
+    }, async (c) => {
+        const request = McpPreviewRequestSchema.parse(await readJson(c.req.raw));
+        return jsonResponse(200, await c.env.tenant.keys.previewMcp(request));
+    });
+}

package/dist/api/http/routes/vaults.d.ts

@@ -3,16 +3,8 @@
  * a session's tools use. Only a management key (or Studio's key, acting as itself) reaches these
  * routes; an application key is `403 key_role_mismatch`, and nothing acts for a subject here. The
  * installation's own vaults (`scope: "installation"`) attach to any session (`vaultIds`); a vault
- * of one person (`ownerUserId`) attaches only to that person's sessions. A person's own
- * credentials come from the operator's credential resolver (`vault/sources.ts`), not from these
- * routes.
- *
- * MCP OAuth connect: a management key starts one into an installation vault (`/oauth/start`);
- * the authorization server sends the browser back to the anonymous, unversioned
- * `GET /v1/oauth/callback`. Both only route: the gateway's keys module does the OAuth.
+ * of one person (`ownerUserId`) attaches only to that person's sessions.
  */
 import type { OpenAPIHono } from "@hono/zod-openapi";
 import type { TenantEnv } from "../app.js";
-/** Where the authorization server sends the browser back. */
-export declare const OAUTH_CALLBACK_PATH = "/v1/oauth/callback";
 export declare function vaultRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/vaults.js

@@ -1,25 +1,11 @@
 import { z } from "zod";
-import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, } from "@nylorun/core/contracts";
-import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, StartOAuthRequest, StartOAuthResponse, VaultInfo, } from "../../components.js";
-import { HttpError } from "../../../tenant/http.js";
-import { VaultError } from "../../../vault/error.js";
+import { CreateCredentialRequestSchema, CreateVaultRequestSchema, RotateCredentialRequestSchema, } from "@nylorun/core/contracts";
+import { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, DeletedResponse, ListCredentialsResponse, ListVaultsResponse, RotateCredentialRequest, VaultInfo, } from "../../components.js";
 import { readJson } from "../body.js";
 import { tenantRoute } from "../define.js";
 import { jsonResponse } from "../respond.js";
 /** The Management API's vault routes (`/v1/tenant/vaults`): a management key. */
 const MANAGEMENT = { credentials: ["management"], scopes: "never" };
-/**
- * The OAuth callback: a browser sent back by the authorization server, with no credential and no
- * protocol header. The `state` it carries is the grant.
- */
-const CALLBACK = {
-    credentials: ["application", "subject", "token"],
-    scopes: "any",
-    anonymous: true,
-    unversioned: true,
-};
-/** Where the authorization server sends the browser back. */
-export const OAUTH_CALLBACK_PATH = "/v1/oauth/callback";
 const json = (schema, description) => ({
     description,
     content: { "application/json": { schema } },
@@ -94,7 +80,7 @@ function vaultRoutesAt(api, base, access) {
         path: `${base}/{vaultId}/credentials`,
         tags: ["Vaults"],
         summary: "Add a credential",
-        description: "A bearer token or OAuth tokens, bound to the URLs a tool may send them to.",
+        description: "A bearer token, bound to the URL a tool may send it to.",
         request: { params: vaultId, body: body(CreateCredentialRequest) },
         responses: { 200: json(CredentialInfo, "The credential, without its secret") },
     }, async (c) => {
@@ -147,93 +133,7 @@ function vaultRoutesAt(api, base, access) {
     }, async (c) => {
         return jsonResponse(200, await c.env.tenant.vault.deleteCredential(c.req.param("vaultId"), c.req.param("credentialId")));
     });
-    tenantRoute(api, access, {
-        method: "post",
-        path: `${base}/{vaultId}/oauth/start`,
-        tags: ["Vaults"],
-        summary: "Start an MCP OAuth connect",
-        description: "Signs the installation in to the remote MCP server at `url` (declared as `server`) and stores its OAuth credential, bound to `url`, in this installation vault. The Runtime discovers the server's authorization server (RFC 9728, RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and answers the URL to open in a browser; the sign-in returns to `GET /v1/oauth/callback` within `expiresAt`. The callback URL is `NYLORUN_PUBLIC_URL` + `/v1/oauth/callback`, or this request's own origin when the Host has no public URL. Application keys acting for no one only. `oauth_client_required` when the server offers no registration and no `clientId` was given.",
-        request: { params: vaultId, body: body(StartOAuthRequest) },
-        responses: {
-            200: json(StartOAuthResponse, "Where to send the browser"),
-            502: {
-                description: "The authorization server, or its discovery, failed or refused (`oauth_failed`)",
-            },
-        },
-    }, async (c) => {
-        const request = StartOAuthRequestSchema.parse(await readJson(c.req.raw));
-        const tenant = c.env.tenant;
-        const base = tenant.config.publicUrl ?? new URL(c.req.url).origin;
-        return jsonResponse(200, await tenant.keys.startOAuth({
-            vaultId: c.req.param("vaultId"),
-            server: request.server,
-            url: request.url,
-            ...(request.clientId === undefined ? {} : { clientId: request.clientId }),
-            redirectUri: `${base}${OAUTH_CALLBACK_PATH}`,
-        }));
-    });
 }
 export function vaultRoutes(api) {
     vaultRoutesAt(api, "/v1/tenant/vaults", MANAGEMENT);
-    tenantRoute(api, CALLBACK, {
-        method: "get",
-        path: OAUTH_CALLBACK_PATH,
-        tags: ["Vaults"],
-        summary: "Finish an MCP OAuth connect",
-        description: "Where the authorization server sends the browser back with `code` and `state` (or `error`). Exchanges the code once and stores the credential; answers a small HTML page. Needs no credential and no `Nylorun-Protocol`. A `state` is used once, for ten minutes (`oauth_state_invalid`).",
-        request: {
-            query: z.object({
-                code: z.string().optional(),
-                state: z.string().optional(),
-                error: z.string().optional(),
-            }),
-        },
-        responses: {
-            200: { description: "Connected", content: { "text/html": { schema: z.string() } } },
-            502: { description: "The authorization server refused the code (`oauth_failed`)" },
-        },
-    }, async (c) => {
-        const state = c.req.query("state");
-        const code = c.req.query("code");
-        const error = c.req.query("error");
-        if (!state)
-            return page(400, "Sign-in failed", "The authorization server sent no state. Start the connect again.");
-        try {
-            await c.env.tenant.keys.finishOAuth({
-                state,
-                ...(code === undefined ? {} : { code }),
-                ...(error === undefined ? {} : { error }),
-            });
-        }
-        catch (failure) {
-            if (failure instanceof HttpError || failure instanceof VaultError)
-                return page(failure.status, "Sign-in failed", failure.message);
-            c.env.tenant.config.logger.error("oauth_callback_failed", {
-                error: failure instanceof Error ? failure.name : "unknown",
-            });
-            return page(500, "Sign-in failed", "The connect failed. Start it again.");
-        }
-        return page(200, "Connected", "Connected. You can close this tab.");
-    });
-}
-const ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
-const escape = (text) => text.replace(/[&<>"']/g, (char) => ESCAPES[char]);
-/** The callback's answer: a small page that loads nothing, is never cached and leaks no referrer. */
-function page(status, title, message) {
-    const html = `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${escape(title)} · Nylorun</title>
-<style>body{font:16px/1.5 system-ui,sans-serif;max-width:32rem;margin:15vh auto;padding:0 1rem;color:#1a1a1a;background:#fff}@media (prefers-color-scheme:dark){body{color:#eee;background:#111}}h1{font-size:1.25rem}</style>
-</head><body><h1>${escape(title)}</h1><p>${escape(message)}</p></body></html>
-`;
-    return new Response(html, {
-        status,
-        headers: {
-            "content-type": "text/html; charset=utf-8",
-            "cache-control": "no-store",
-            "referrer-policy": "no-referrer",
-            "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'",
-            "x-content-type-options": "nosniff",
-        },
-    });
 }

package/dist/api/openapi.js

@@ -12,6 +12,7 @@
 import { OpenAPIRegistry, OpenApiGeneratorV32, } from "@asteasolutions/zod-to-openapi";
 import { HOST_PROTOCOL } from "@nylorun/core/compatibility";
 import { HealthResponseSchema, ReadyResponseSchema } from "@nylorun/core/contracts";
+import { z } from "zod";
 import { RUNTIME_VERSION } from "../version.js";
 import { tenantApi } from "./http/app.js";
 const PROTOCOL = {
@@ -25,9 +26,21 @@ const bearer = (description, bearerFormat) => ({
     ...(bearerFormat ? { bearerFormat } : {}),
     description,
 });
+/** RFC 9728 protected resource metadata, as `tenant/resource-server.ts` builds it. */
+const ProtectedResourceMetadataSchema = z
+    .object({
+    resource: z.string().meta({ description: "The Runtime API: `NYLORUN_PUBLIC_URL`, else the origin the request reached" }),
+    authorization_servers: z
+        .array(z.string())
+        .meta({ description: "The identity file's issuers, in its order: a client usually signs in at the first" }),
+    scopes_supported: z.array(z.string()).meta({ description: "The scopes the issuers' tokens may carry, `studio` aside" }),
+    bearer_methods_supported: z.array(z.literal("header")),
+    resource_name: z.string(),
+})
+    .meta({ id: "ProtectedResourceMetadata" });
 /**
- * `/health`, `/ready` and the documents: what every listener answers without a key. The
- * `/openapi.json` alias is served but left out of the documents.
+ * `/health`, `/ready`, the documents and the OAuth metadata: what every listener answers
+ * without a key. The `/openapi.json` alias is served but left out of the documents.
  */
 function hostRoutes() {
     const registry = new OpenAPIRegistry();
@@ -59,6 +72,20 @@ function hostRoutes() {
             503: { description: "Not ready: `checks` says what is not" },
         },
     });
+    route({
+        method: "get",
+        path: "/.well-known/oauth-protected-resource",
+        tags: ["Host"],
+        summary: "Get the protected resource metadata",
+        description: "OAuth 2.0 Protected Resource Metadata (RFC 9728): the identity providers whose access tokens the Runtime API accepts (the identity file's trusted issuers) and their scopes. Nylorun is never the authorization server: a client signs in at one of `authorization_servers` and presents its token as `Authorization: Bearer`. A `401` from the Runtime API names this document in `WWW-Authenticate` (`resource_metadata`). Needs no key or `Nylorun-Protocol`, and accepts an `Origin`.",
+        responses: {
+            200: {
+                description: "The metadata",
+                content: { "application/json": { schema: ProtectedResourceMetadataSchema } },
+            },
+            404: { description: "The Runtime trusts no identity provider (no identity file)" },
+        },
+    });
     route({
         method: "get",
         path: "/openapi/runtime.json",
@@ -164,11 +191,12 @@ const RUNTIME_TAGS = [
     {
         name: "Service",
         group: "Service",
-        description: "Check a Runtime is up and speaks your protocol, ask who your credential is, and read the public keys of the tokens it signs. `/health`, `/ready`, the JWKS and the documents need no key.",
+        description: "Check a Runtime is up and speaks your protocol, ask who your credential is, find the identity providers it takes tokens from, and read the public keys of the tokens it signs. `/health`, `/ready`, the protected resource metadata, the JWKS and the documents need no key.",
         operations: [
             "GET /health",
             "GET /ready",
             "GET /v1/me",
+            "GET /.well-known/oauth-protected-resource",
             "GET /v1/access/jwks",
             "GET /openapi/runtime.json",
         ],
@@ -208,7 +236,7 @@ const MANAGEMENT_TAGS = [
     },
     {
         name: "Vaults",
-        description: "The installation's credentials for agents' tools: API keys and MCP OAuth connections. Sessions attach a vault by id. `admin.vaults`.",
+        description: "The installation's and each person's credentials for agents' tools: API keys, bound to the URL they are sent to. Sessions attach a vault by id. `admin.vaults`.",
         operations: [
             "POST /v1/tenant/vaults",
             "GET /v1/tenant/vaults",
@@ -219,10 +247,13 @@ const MANAGEMENT_TAGS = [
             "GET /v1/tenant/vaults/{vaultId}/credentials/{credentialId}",
             "POST /v1/tenant/vaults/{vaultId}/credentials/{credentialId}",
             "DELETE /v1/tenant/vaults/{vaultId}/credentials/{credentialId}",
-            "POST /v1/tenant/vaults/{vaultId}/oauth/start",
-            "GET /v1/oauth/callback",
         ],
     },
+    {
+        name: "MCP servers",
+        description: "See a remote MCP server's tools before an agent names it, with the installation vault's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`.",
+        operations: ["POST /v1/tenant/mcp/preview"],
+    },
     {
         name: "Signing keys",
         description: "The keys the Runtime signs capability links and run tokens with; their public halves are the Runtime API's JWKS. `admin.signingKeys`.",

package/dist/artifacts/media-types.d.ts

@@ -11,3 +11,5 @@ export declare function contentTypeFor(name: string): string;
 export declare function isModelImage(contentType: string): boolean;
 /** Files the model reads as text: `text/*`, JSON, XML, YAML and their `+json`/`+xml` kin. */
 export declare function isText(contentType: string): boolean;
+/** The usual extension of a media type, for a name the Runtime gives a file; undefined if none. */
+export declare function extensionFor(contentType: string): string | undefined;

package/dist/artifacts/media-types.js

@@ -78,3 +78,8 @@ export function isText(contentType) {
         type.endsWith("+json") ||
         type.endsWith("+xml"));
 }
+/** The usual extension of a media type, for a name the Runtime gives a file; undefined if none. */
+export function extensionFor(contentType) {
+    const type = essence(contentType);
+    return Object.keys(BY_EXTENSION).find((extension) => BY_EXTENSION[extension] === type);
+}

package/dist/execution/types.d.ts

@@ -91,7 +91,7 @@ export interface SandboxResult {
 export interface WorkerHandlers {
     /**
      * Advances one session (§10.5). `signal` aborts when the Worker stops or the
-     * session is cancelled through the control stream. Throw only on
+     * session is cancelled through the control bus. Throw only on
      * infrastructure errors.
      */
     advance(tenantId: string, sessionId: string, signal: AbortSignal): Promise<AdvanceResult>;

package/dist/gates/http-tool.d.ts

@@ -11,10 +11,17 @@ export declare const HTTP_ERROR_BODY_CHARS = 2000;
 export type HttpOutcome = {
     readonly kind: "completed";
     readonly output: unknown;
+    /** How many credential values the answer echoed, replaced with `[redacted]` (R2b C8). */
+    readonly redacted?: number;
 } | {
     readonly kind: "failed";
     readonly code: string;
     readonly message: string;
+    /** With `credential_rejected`: the tool's `credential`, and the scope of its vault. */
+    readonly server?: string;
+    readonly vault?: "installation" | "user";
+    /** How many credential values the message had in it, replaced (R2b C8). */
+    readonly redacted?: number;
 };
 /**
  * One declared HTTP tool of a session: what the gate finds it by in the pinned manifest. An

package/dist/gates/http-tool.js

@@ -15,7 +15,9 @@
  */
 import { AGENT_ID_HEADER, SESSION_ID_HEADER, TURN_ID_HEADER, } from "@nylorun/core/compatibility";
 import { HTTP_TOOL_DEFAULT_TIMEOUT_MS, delegateManifest, flowHttpTarget, isWorkflowManifest, schemaFromJSON, } from "@nylorun/core/define";
+import { scrubValues } from "../redact.js";
 import { MAX_RESPONSE_BYTES, post } from "../tenant/outbound.js";
+import { credentialSecrets } from "../vault/headers.js";
 /** How much of a failed answer's body the model sees. */
 export const HTTP_ERROR_BODY_CHARS = 2_000;
 /** The HTTP tool `capabilityId`/`toolName` of the agent `agentId` (the root when absent). */
@@ -83,6 +85,9 @@ export async function callHttpTarget(target, input, options) {
         case "too_large":
             return failed("http.too-large", `The answer (HTTP ${result.status}) is larger than ${MAX_RESPONSE_BYTES} bytes`);
     }
+    // The service answered, so the outcome is known; never retried, and its body is not shown (R2b C1).
+    if (result.status === 401)
+        return failed("credential_rejected", "The service answered HTTP 401: it rejected the credential, or needs one");
     const text = result.body.toString("utf8");
     if (result.status < 200 || result.status > 299) {
         const body = text.length > HTTP_ERROR_BODY_CHARS ? `${text.slice(0, HTTP_ERROR_BODY_CHARS)}…` : text;
@@ -156,20 +161,26 @@ export async function runHttpTool(tenant, call, options) {
                 : `'${tool.toolName}' is not an HTTP tool of the session`);
         const { http } = declared;
         let credential = {};
+        let identity;
+        let target = http;
+        let vault;
         if (http.credential !== undefined) {
             const authorized = await tenant.authorize(tool.sessionId, {
-                kind: "http",
                 url: http.url,
                 serverName: http.credential,
-                ...(agentId === undefined ? {} : { agentId }),
             });
             if (authorized.status === "refused")
                 return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
             if (authorized.status === "unauthenticated")
                 return failed("http.credential", `The session's vaults hold no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
+            identity = authorized.identity;
+            vault = authorized.vault;
+            // A credential with `via` sends the call there, a gateway (R2b C2, Q9).
+            if (authorized.via !== undefined)
+                target = { ...http, url: authorized.via };
         }
-        return callHttpTarget(http, call.input, {
+        const answered = await callHttpTarget(target, call.input, {
             headers: {
                 ...credential,
                 [SESSION_ID_HEADER]: tool.sessionId,
@@ -181,6 +192,17 @@ export async function runHttpTool(tenant, call, options) {
             signal: options.signal,
             ...(declared.outputSchema === undefined ? {} : { outputSchema: declared.outputSchema }),
         });
+        // Nothing the service echoes of the credential reaches the model, an event or the gate's
+        // record of the call: its answer and the start of an error body alike (R2b C8).
+        const outcome = scrubbedOutcome(answered, credentialSecrets(credential, identity));
+        if (outcome.kind !== "failed" || outcome.code !== "credential_rejected" || http.credential === undefined)
+            return outcome;
+        return {
+            ...outcome,
+            message: `The service answered HTTP 401: it rejected the credential '${http.credential}' from the ${vault} vault`,
+            server: http.credential,
+            ...(vault === undefined ? {} : { vault }),
+        };
     }
 }
 /** The gates service's HTTP tool calls, with the Tenant's vault (`host/gates.ts`). */
@@ -195,3 +217,12 @@ export function gateHttpTools(vaults, policy, logger) {
 function failed(code, message) {
     return { kind: "failed", code, message };
 }
+/** `outcome` with each of `secrets` replaced by `[redacted]`, and how many were. */
+function scrubbedOutcome(outcome, secrets) {
+    if (outcome.kind === "completed") {
+        const output = scrubValues(outcome.output, secrets);
+        return output.redacted === 0 ? outcome : { ...outcome, output: output.value, redacted: output.redacted };
+    }
+    const message = scrubValues(outcome.message, secrets);
+    return message.redacted === 0 ? outcome : { ...outcome, message: message.value, redacted: message.redacted };
+}

package/dist/gates/mcp-handler.d.ts

@@ -18,7 +18,10 @@ export interface McpHandlerOptions {
     readonly delivery?: OutboundPolicy;
 }
 export interface McpHandler {
-    connect(tenantId: string | undefined, server: McpServerRef): Promise<McpAnswer<null>>;
+    /** Opens the connection; answers the server's instructions when it gave any (R2b C10). */
+    connect(tenantId: string | undefined, server: McpServerRef): Promise<McpAnswer<{
+        instructions: string;
+    } | null>>;
     list(tenantId: string | undefined, server: McpServerRef, cursor: string | undefined, signal: AbortSignal): Promise<McpAnswer<McpToolPage>>;
     /** One `tools/call`; the raw `CallToolResult` on success. */
     call(tenantId: string | undefined, request: {