@nylorun/runtime 0.19.1-beta → 0.21.0-beta

package/dist/harness-api/record.js

@@ -1,12 +1,13 @@
 /**
  * The Record seam of the Harness API: core's journal for the effects of a run. `recordIntent`
  * journals an effect before anything runs it, and either answers it from the journal, hands it
- * to core's own executors (flow work, delegation, `save_artifact` and the skill tools), tells
- * the harness to `execute` it (model calls; MCP, HTTP and sandbox tools; a flow's HTTP stages
- * and HTTP verifiers), or fails a tool the Runtime cannot run (one that would run the
- * developer's code, R2 M6). `recordOutcome`
- * records what the harness's call returned. Both run under the advance's lease: every write is
- * epoch-checked (`ownedSession`), and a lost epoch writes nothing.
+ * to core's own executors (flow work, delegation, `save_artifact`, `read_artifact`,
+ * `tool_search` and the skill tools), tells the harness to `execute` it (model calls; MCP, HTTP
+ * and sandbox tools, a deferred MCP tool's `tool_call` among them, whose effect names the tool;
+ * a flow's HTTP stages and HTTP verifiers), or fails a tool the Runtime cannot run (one that
+ * would run the developer's code, R2 M6). `recordOutcome` records what the harness's call returned, an
+ * agent's MCP or HTTP tool result first shaped to fit (R2b C11). Both run under the advance's
+ * lease: every write is epoch-checked (`ownedSession`), and a lost epoch writes nothing.
  *
  * Rows store the request's hash (`requestHash`) and, for a model call, the request without its
  * prompt: drift is a hash compare. Rows written before carry their full request, hashed on read.
@@ -14,9 +15,12 @@
 import { HarnessApiError, effectRequestHash, } from "@nylorun/core/harness-api";
 import { isFlowEffect, isFlowToolEffect, recordVerdict, settleAgentEffect, } from "../core/flow-host.js";
 import { sandboxCapabilityOf } from "../sandbox/capability.js";
-import { isSaveArtifactCall } from "../harness/calls.js";
-import { callSaveArtifact } from "../tenant/artifact-tool.js";
+import { abortOn, isReadArtifactCall, isSaveArtifactCall } from "../harness/calls.js";
+import { callReadArtifact, callSaveArtifact } from "../tenant/artifact-tool.js";
+import { mayNeedShaping, resultBytes, resultLimit, shapeToolOutcome, } from "../tenant/tool-results.js";
 import { callSkillTool, isSkillToolCall } from "../tenant/skill-tool.js";
+import { callToolSearch, isToolSearchCall } from "../tenant/tool-search.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { isOwnershipLost } from "../store/ownership.js";
 import { manifestFor, mcpToolOf } from "../mcp/snapshot.js";
 import { isHttpToolCall } from "../gates/http-tool.js";
@@ -109,17 +113,24 @@ export async function recordIntent(scope, effect, requestHash) {
             throw new Error(`Agent '${request.agent?.id ?? ""}' is not used as a tool`);
         const executed = request.kind === "model" ||
             (request.kind === "tool" &&
-                (mcpToolOf(s.mcpSnapshot, request) !== undefined ||
+                // An MCP tool the turn's manifest disables is not one (R2b C9).
+                (mcpToolOf(s.mcpSnapshot, request, turnManifestOf(s)) !== undefined ||
                     // HTTP tools (R2 M3) cross the Tool Gate.
                     isHttpToolCall(s.manifest, request) ||
                     sandboxCapabilityOf(agentManifest, request.capabilityId, request.toolName) !== undefined ||
-                    // `save_artifact` (F8.1) runs beside the sandbox tools, and the skill tools (R2 M4).
+                    // `save_artifact` (F8.1) runs beside the sandbox tools, as do `read_artifact` (R2b
+                    // C11) and the skill tools (R2 M4).
                     isSaveArtifactCall(agentManifest, request) ||
-                    isSkillToolCall(agentManifest, request)));
+                    isReadArtifactCall(agentManifest, request) ||
+                    isSkillToolCall(agentManifest, request) ||
+                    // `tool_search` (R2b C10) reads the session's pinned MCP snapshot: core serves it.
+                    isToolSearchCall(agentManifest, request)));
         if (!executed) {
             // A tool that would run the developer's code: refused at save (a turn's manifest only
-            // removes tools), so this is a backstop. The model sees the failure; nothing runs.
-            const outcome = { value: unrunnableTool(request) };
+            // removes tools), so this is a backstop, as is an MCP tool the turn disabled, which the
+            // model was never offered. The model sees the failure; nothing runs.
+            const disabled = request.kind === "tool" && mcpToolOf(s.mcpSnapshot, request) !== undefined;
+            const outcome = { value: disabled ? disabledTool(request) : unrunnableTool(request) };
             await t.put("effects", request.effectId, { request, requestHash, status: "completed", outcome });
             const transcript = toolCompleted(request, outcome.value);
             if (transcript)
@@ -135,13 +146,22 @@ export async function recordIntent(scope, effect, requestHash) {
         // workspace capability, wherever the sandbox is.
         if (request.kind === "tool" && isSaveArtifactCall(agentManifest, request))
             return "save";
+        // `read_artifact` reads the session's artifacts: core serves it, with or without a sandbox.
+        if (isReadArtifactCall(agentManifest, request))
+            return "read";
         // The skill tools read the agent's definition files: core serves them.
         if (isSkillToolCall(agentManifest, request))
             return { skill: agentManifest };
+        if (isToolSearchCall(agentManifest, request))
+            return "search";
         return { status: "execute" };
     });
     if (answer === "save")
         return runInCore(scope, request, () => callSaveArtifact(scope.ctx, request, scope.signal));
+    if (answer === "read")
+        return runInCore(scope, request, () => callReadArtifact(scope.ctx, request, scope.signal));
+    if (answer === "search")
+        return runInCore(scope, request, () => callToolSearch(scope.ctx, request));
     if (typeof answer === "object" && "skill" in answer)
         return runInCore(scope, request, () => callSkillTool(scope.ctx, answer.skill, request, scope.signal));
     if (answer !== "flow")
@@ -151,9 +171,10 @@ export async function recordIntent(scope, effect, requestHash) {
     return resolveNewFlowEffect(ctx, request, signal, lease);
 }
 /**
- * Runs a tool core serves (`save_artifact`, F8.1; the skill tools, R2 M4) for the run and records
- * its outcome, as a harness would record a call it ran: the run gets the outcome as the intent's
- * answer.
+ * Runs a tool core serves (`save_artifact`, F8.1; `read_artifact`, R2b C11; `tool_search`, R2b
+ * C10; the skill tools, R2 M4) for the run and records its outcome, as a harness would record a
+ * call it ran: the run gets
+ * the outcome as the intent's answer.
  */
 async function runInCore(scope, request, call) {
     let value;
@@ -169,6 +190,14 @@ async function runInCore(scope, request, call) {
     }
     return recordOutcome(scope, request.effectId, { value });
 }
+/** The failed outcome of an MCP tool the turn's manifest disables (R2b C9). */
+function disabledTool(request) {
+    return {
+        kind: "failed",
+        code: "tool.disabled",
+        message: `Tool '${request.toolName ?? ""}' is disabled by its MCP server's tools settings.`,
+    };
+}
 /** The failed outcome of a tool the Runtime cannot run: it would run the developer's code. */
 function unrunnableTool(request) {
     return {
@@ -199,7 +228,7 @@ export async function recordOutcome(scope, effectId, result) {
         });
         return { status: "uncertain" };
     }
-    const { value } = result;
+    const value = await shaped(scope, effectId, result.value);
     return ctx.store.tx(async (t) => {
         const s = await t.assertEpoch(lease.sessionId, lease.epoch);
         const effect = await t.get("effects", effectId);
@@ -234,6 +263,59 @@ export async function recordOutcome(scope, effectId, result) {
         return { status: "completed", outcome: effect.outcome };
     });
 }
+/**
+ * The outcome of an agent's remote MCP or HTTP tool call, shaped to fit before anything records
+ * it (R2b C11, `tenant/tool-results.ts`): what does not fit becomes the session's artifacts. Any
+ * other outcome, and one a cancel will discard, as it is. Only a cancel stops the upload: after a
+ * shutdown or a deadline the outcome is still recorded, so the next advance replays it.
+ *
+ * Its cap is what its step's budget has left (`resultLimit`): a step's results are one transcript
+ * entry. Parallel results are counted under the session lock, each reserving its share on its
+ * row (`resultBytes`) before it is shaped, so two never spend the same room.
+ */
+async function shaped(scope, effectId, value) {
+    const { ctx, lease, signal } = scope;
+    if (abortKind(signal) === "cancel" || !mayNeedShaping(value))
+        return value;
+    const call = await ctx.store.tx(async (t) => {
+        const s = await t.lockSession(lease.sessionId);
+        const effect = await t.get("effects", effectId);
+        if (!s || !effect || effect.status === "completed")
+            return undefined;
+        const request = effect.request;
+        // An agent's tool; a flow's HTTP stage or verifier names no capability, and its output is data.
+        if (request.kind !== "tool" || request.capabilityId === undefined)
+            return undefined;
+        const mcp = mcpToolOf(s.mcpSnapshot, request) !== undefined;
+        if (!mcp && !isHttpToolCall(s.manifest, request))
+            return undefined;
+        const step = stepOf(request);
+        let used = 0;
+        if (step !== undefined)
+            for (const other of await t.effectsForTurn(s.id, request.turnId, [
+                "invoking",
+                "completed",
+            ])) {
+                if (other.request.effectId === effectId || stepOf(other.request) !== step)
+                    continue;
+                used +=
+                    other.resultBytes ??
+                        (other.status === "completed" ? resultBytes(other.outcome?.value) : 0);
+            }
+        const limit = resultLimit(used);
+        effect.resultBytes = Math.min(resultBytes(value), limit);
+        await t.put("effects", effectId, effect);
+        return { request, session: { id: s.id, ownerUserId: s.ownerUserId }, mcp, limit };
+    });
+    return call ? shapeToolOutcome(ctx, call, value, abortOn(signal, ["cancel"])) : value;
+}
+/** The model step a tool call answers, and whose agent: its results share one transcript entry. */
+function stepOf(request) {
+    if (request.kind !== "tool")
+        return undefined;
+    const stepId = request.context?.stepId;
+    return typeof stepId === "string" ? JSON.stringify([request.agent?.id ?? null, stepId]) : undefined;
+}
 /** What a journal row keeps of a request: a model call without its prompt. */
 function storedRequest(request) {
     if (request.kind !== "model" || request.input === undefined)

package/dist/harness-api/server.js

@@ -29,7 +29,9 @@ import { HARNESS_API_VERSION, HARNESS_CLAIMS, HarnessApiError, } from "@nylorun/
 import { definitionFilesOf } from "@nylorun/core/contracts";
 import { isOwnershipLost } from "../store/ownership.js";
 import { ownedSession } from "../tenant/context.js";
-import { mcpDiscovered, sessionToolsOf } from "../mcp/snapshot.js";
+import { mcpDiscovered, pinDeferral, sessionToolsOf, } from "../mcp/snapshot.js";
+import { contextWindowOf } from "../model/catalog.js";
+import { turnManifestOf } from "../tenant/session.js";
 import { sandboxWorkspaceKey, workspacePrefix } from "../sandbox/records.js";
 import { abortKind } from "../tenant/worker.js";
 import { readDefinitionFile } from "../tenant/definition-files.js";
@@ -194,36 +196,42 @@ export function createHarnessApiServer(ctx, options = {}) {
      * session wins, with `mcp.discovered` in its log; diagnostics replace those of the same server.
      * Answers the session's snapshot and the tools the engine advertises.
      */
-    const recordMcp = (run, params) => ctx.store.tx(async (t) => {
-        const { lease } = run.offer;
-        const current = await ownedSession(t, lease, lease.sessionId);
-        const diagnostics = params.diagnostics;
+    const recordMcp = async (run, params) => {
         const snapshot = params.snapshot;
         if (snapshot !== undefined && !isSnapshot(snapshot))
             throw new HarnessApiError("invalid", "The MCP snapshot is malformed");
-        if (snapshot && !current.mcpSnapshot) {
-            current.mcpSnapshot = snapshot;
-            current.mcpDiagnostics = diagnostics;
-            await t.put("sessions", current.id, current);
-            await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(snapshot, diagnostics));
-        }
-        else if (diagnostics.length > 0) {
-            const prior = [...(current.mcpDiagnostics ?? [])];
-            for (const item of diagnostics) {
-                const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
-                if (index >= 0)
-                    prior[index] = item;
-                else
-                    prior.push(item);
+        // Which MCP tools the model reaches through tool_search, decided once for the session from
+        // the Tenant's model's context window (R2b C10, Q21).
+        const contextWindow = snapshot ? contextWindowOf(await ctx.vault.getHostModel()) : 0;
+        return ctx.store.tx(async (t) => {
+            const { lease } = run.offer;
+            const current = await ownedSession(t, lease, lease.sessionId);
+            const diagnostics = params.diagnostics;
+            if (snapshot && !current.mcpSnapshot) {
+                current.mcpSnapshot = pinDeferral(snapshot, current.manifest, contextWindow);
+                current.mcpDiagnostics = diagnostics;
+                await t.put("sessions", current.id, current);
+                await t.event(current.id, run.grant.turnId, "mcp.discovered", mcpDiscovered(current.mcpSnapshot, diagnostics));
             }
-            current.mcpDiagnostics = prior;
-            await t.put("sessions", current.id, current);
-        }
-        return {
-            ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
-            sessionTools: [...(sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [])],
-        };
-    });
+            else if (diagnostics.length > 0) {
+                const prior = [...(current.mcpDiagnostics ?? [])];
+                for (const item of diagnostics) {
+                    const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId && existing.serverName === item.serverName);
+                    if (index >= 0)
+                        prior[index] = item;
+                    else
+                        prior.push(item);
+                }
+                current.mcpDiagnostics = prior;
+                await t.put("sessions", current.id, current);
+            }
+            return {
+                ...(current.mcpSnapshot ? { snapshot: current.mcpSnapshot } : {}),
+                // The turn's manifest: a variant may have disabled tools or required their approval.
+                sessionTools: [...(sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [])],
+            };
+        });
+    };
     /** A definition file the run's definition names (its skills', for its sandbox), base64. */
     const definitionFile = async (run, sha256, signal) => {
         if (!definitionFilesOf(run.offer.start.routing.rootManifest).has(sha256))

package/dist/harness-api/start.js

@@ -57,7 +57,8 @@ export function buildTurnStart(ctx, segment) {
         checkpoint: !flow && cp.state
             ? { ...cp, state: withTranscript(cp.state, []) }
             : cp,
-        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, current.manifest) ?? [] }),
+        // The turn's manifest: a variant may have disabled MCP tools or required their approval.
+        ...(flow ? {} : { sessionTools: sessionToolsOf(current.mcpSnapshot, turnManifestOf(current)) ?? [] }),
         outcomes: segment.outcomes,
         transcript: { cursor: segment.cursor },
         options: {

package/dist/host/app.d.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import type { Logger, NodeBindings, TenantModule } from "../tenant/types.js";
+import { type ResourceServerConfig } from "../tenant/resource-server.js";
 export type HostEnv = {
     Bindings: NodeBindings;
     Variables: {
@@ -19,6 +20,8 @@ export interface HostAppOptions {
         ok: boolean;
         checks: Record<string, boolean>;
     }>;
+    /** The public URL and trusted issuers the OAuth metadata and challenges name. */
+    resourceServer?: ResourceServerConfig;
     /** The listener is listening. */
     listening(): boolean;
     closing(): boolean;

package/dist/host/app.js

@@ -3,10 +3,13 @@ import { RESPONSE_ALREADY_SENT } from "@hono/node-server/utils/response";
 import { checkCompatibility, HOST_PROTOCOL, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
 import { RUNTIME_VERSION } from "../version.js";
 import { findTenantRoute } from "../api/http/app.js";
+import { keyAccess } from "../api/http/define.js";
+import { bearerChallenge, PROTECTED_RESOURCE_PATH, protectedResourceMetadata, protectedResourceMetadataUrl, } from "../tenant/resource-server.js";
 import { managementDocument, runtimeDocument } from "../api/openapi.js";
 import { headerValue, isJsonContentType, jsonResponse, opaqueNotFoundResponse, protocolRejectedResponse, pathnameIsLogged, redactRoutePath, rejectedResponse, requestHasBody, } from "./http.js";
 export function createHostApp(options) {
     const { module, logger } = options;
+    const resourceServer = options.resourceServer ?? {};
     const app = new Hono();
     app.use(async (c, next) => {
         const started = Date.now();
@@ -28,9 +31,10 @@ export function createHostApp(options) {
     app.use(async (c, next) => {
         const { incoming } = c.env;
         if (headerValue(incoming, "origin") !== undefined) {
-            // Only Tenant routes; the Tenant then accepts only a trusted issuer's token from a
-            // browser.
-            if (pathnameOf(incoming).split("/").filter(Boolean)[0] !== "v1")
+            // Only Tenant routes, where the Tenant then accepts only a trusted issuer's token from a
+            // browser, and the public OAuth metadata a browser client reads before it signs in.
+            if (pathnameOf(incoming).split("/").filter(Boolean)[0] !== "v1" &&
+                !isProtectedResourcePath(pathnameOf(incoming)))
                 return rejectedResponse(403, "origin_rejected", "Browser Origin headers are not accepted");
         }
         // CORS is the operator's proxy's: an OPTIONS request gets no CORS header.
@@ -83,13 +87,35 @@ export function createHostApp(options) {
             return jsonResponse(200, runtimeDocument(), { "cache-control": "no-cache" });
         if (pathname === "/openapi/management.json" && incoming.method === "GET")
             return jsonResponse(200, managementDocument(), { "cache-control": "no-cache" });
+        // RFC 9728: where the Runtime API's tokens come from. None without trusted issuers.
+        if (isProtectedResourcePath(pathname) && incoming.method === "GET") {
+            const metadata = protectedResourceMetadata(resourceServer, incoming);
+            return metadata
+                ? jsonResponse(200, metadata, { "cache-control": "no-cache" })
+                : rejectedResponse(404, "not_found", "This Runtime trusts no identity provider");
+        }
         // Tenant routes: protocol → the Tenant → selection → the Tenant's routes.
         const tenantHeader = headerValue(incoming, TENANT_HEADER);
         const named = tenantHeader === undefined || tenantHeader.trim() === "" ? undefined : tenantHeader.trim();
         const protocol = headerValue(incoming, PROTOCOL_HEADER);
+        // A generic OAuth client sends neither header: answer it the challenge, not the 426.
+        const route = tenantRouteOf(incoming);
+        if (protocol === undefined &&
+            headerValue(incoming, "authorization") === undefined &&
+            route !== undefined &&
+            route.anonymous !== true) {
+            const metadata = keyAccess(route).application
+                ? protectedResourceMetadataUrl(resourceServer, incoming)
+                : undefined;
+            return jsonResponse(401, {
+                status: "rejected",
+                code: "credential_required",
+                message: "A bearer credential is required",
+            }, { "www-authenticate": bearerChallenge({ resourceMetadata: metadata }) });
+        }
         // A capability link is opened without the header; when one is sent, it is checked.
         if (!protocolAccepted(protocol) &&
-            !(protocol === undefined && tenantRouteOf(incoming)?.unversioned === true))
+            !(protocol === undefined && route?.unversioned === true))
             return protocolRejectedResponse();
         const resolution = await module.resolve();
         if (resolution.kind !== "open") {
@@ -138,6 +164,9 @@ export function createHostApp(options) {
 }
 /** The methods the Runtime serves, for an `OPTIONS` answer's `Allow`. */
 const ALLOWED_METHODS = "GET, POST, PUT, DELETE, OPTIONS";
+function isProtectedResourcePath(pathname) {
+    return pathname === PROTECTED_RESOURCE_PATH || pathname.startsWith(`${PROTECTED_RESOURCE_PATH}/`);
+}
 /** The Tenant route a request names, if any; a malformed path names none. */
 function tenantRouteOf(incoming) {
     const segments = [];

package/dist/host/config-for.d.ts

@@ -14,6 +14,4 @@ export declare function configForFactory(options: {
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];
-    /** `NYLORUN_PUBLIC_URL`: the base of the MCP OAuth callback (F9 C2). */
-    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -16,7 +16,6 @@ export function configForFactory(options) {
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
             ...(options.issuers ? { issuers: options.issuers } : {}),
-            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
                 warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),

package/dist/host/create-host.d.ts

@@ -1,3 +1,4 @@
+import type { ResourceServerConfig } from "../tenant/resource-server.js";
 import type { Logger, TenantModule } from "../tenant/types.js";
 import type { HostConfigFile } from "./config.js";
 import type { ContainerListen } from "./stack-config.js";
@@ -25,6 +26,11 @@ export interface CreateHostOptions {
         ok: boolean;
         checks: Record<string, boolean>;
     }>;
+    /**
+     * The public URL and trusted issuers behind `/.well-known/oauth-protected-resource` and the
+     * challenge a request without credential or protocol gets (protocol 9). Absent: no metadata.
+     */
+    resourceServer?: ResourceServerConfig;
     /**
      * Shutdown steps around closing the Tenant. `close()` runs them whatever asked for it
      * (SIGTERM in `host/main.ts`): the listener stops, then

package/dist/host/create-host.js

@@ -20,6 +20,7 @@ export function createHost(options) {
         coreVersion,
         pid,
         ...(options.readiness ? { readiness: options.readiness } : {}),
+        ...(options.resourceServer ? { resourceServer: options.resourceServer } : {}),
         listening: () => Boolean(server?.listening),
         closing: () => closing,
     });

package/dist/host/gates.js

@@ -38,7 +38,6 @@ export async function startGates(options) {
         vaults = createTenantVaults({
             sql: database,
             hostRoot: options.hostRoot,
-            ...(gates.resolver ? { resolver: gates.resolver } : {}),
             ...(options.delivery ? { delivery: options.delivery } : {}),
         });
     }

package/dist/host/main.js

@@ -71,9 +71,10 @@ function loadJson(path) {
 /**
  * The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`, Host feature
  * `trusted-issuers`). A missing or malformed file stops the boot, naming the issuer and field;
- * an issuer's JWKS is fetched only when a token needs it, so one that is down does not.
+ * a key the file does not define is logged and ignored. An issuer's JWKS is fetched only when a
+ * token needs it, so one that is down does not stop the boot.
  */
-function loadIssuers(path) {
+function loadIssuers(path, logger) {
     let text;
     try {
         text = readFileSync(path, "utf8");
@@ -81,7 +82,9 @@ function loadIssuers(path) {
     catch (error) {
         throw new Error(`NYLORUN_IDENTITY_FILE names ${path}, which cannot be read: ${error instanceof Error ? error.message : String(error)}`);
     }
-    return createTrustedIssuers(parseIdentityFile(text, path));
+    return createTrustedIssuers(parseIdentityFile(text, path, {
+        warn: (message) => logger.warn("identity_file_key_ignored", { message }),
+    }));
 }
 /** The bootstrap management key: 64 hex characters, surrounding whitespace ignored. */
 function loadManagementKey(path) {
@@ -136,6 +139,17 @@ async function ensureBucket(store, bucket, logger) {
         }
     }
 }
+/**
+ * Settings of a removed feature that are still set: logged, never fatal. The credential
+ * resolver (`NYLORUN_RESOLVER_*`) is gone in protocol 10. Never logs the values.
+ */
+function warnRemovedSettings(stack, logger) {
+    if (stack.removedResolverVariables)
+        logger.warn("resolver_removed", {
+            variables: stack.removedResolverVariables,
+            message: "The credential resolver is gone (protocol 10) and these variables are ignored: keep a person's keys in their user vault, or reach their accounts through a gateway",
+        });
+}
 /**
  * The gateway's services: the Model Gate's listener (gates, keys) and egress-gate's (egress), over
  * the Postgres pool and the Host's tenant directory. Writes nothing to the Host root (the local
@@ -150,9 +164,8 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
-        // Never the resolver's URL or token: only whether one is set (F9 C1).
-        resolver: stack.gates?.resolver ? "configured" : "none",
     });
+    warnRemovedSettings(stack, logger);
     const database = createDatabase(stack);
     const servers = [];
     try {
@@ -224,13 +237,14 @@ export async function main() {
     const config = loadJson(paths.config);
     const credentials = loadJson(paths.credentials);
     const identityFile = stack.tenant?.identityFile;
-    const issuers = identityFile ? loadIssuers(identityFile) : undefined;
     const logger = createHostLogger();
+    const issuers = identityFile ? loadIssuers(identityFile, logger) : undefined;
     if (issuers)
         logger.info("trusted_issuers", {
             file: identityFile,
             issuers: issuers.issuers.map((issuer) => issuer.config.name),
         });
+    warnRemovedSettings(stack, logger);
     if (stack.deprecatedRole)
         logger.warn("deprecated_flag", {
             flag: "--role",
@@ -258,7 +272,6 @@ export async function main() {
         logger,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
         ...(issuers ? { issuers } : {}),
-        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.
@@ -362,6 +375,10 @@ export async function main() {
         coreVersion: coreVersion(),
         ...(stack.listen ? { listen: stack.listen } : {}),
         ...(infra.readiness ? { readiness: infra.readiness } : {}),
+        resourceServer: {
+            ...(issuers ? { issuers } : {}),
+            ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
+        },
         // SIGTERM closes the Host this way: stop the Worker and the relay, close the Tenant, then end the infrastructure clients.
         shutdown: {
             beforeTenants: async () => {

package/dist/host/stack-config.d.ts

@@ -54,14 +54,6 @@ export interface GatesConfig {
     listen: ContainerListen;
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
-    /**
-     * The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`), asked
-     * for a person's MCP credential when the session's vaults hold none (F9 C1). Absent: vaults only.
-     */
-    resolver?: {
-        url: string;
-        token: string;
-    };
 }
 /** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
 export interface EgressConfig {
@@ -168,6 +160,11 @@ export interface StackConfig {
     packing?: "combined" | "split";
     /** Set when the process was started with the deprecated `--role` (logged at startup). */
     deprecatedRole?: RuntimeRole;
+    /**
+     * The removed credential resolver's variables (`NYLORUN_RESOLVER_*`, protocol 10) the
+     * environment still sets: ignored, and logged at startup as `resolver_removed`.
+     */
+    removedResolverVariables?: string[];
     /** Present in container mode; absent means bind what host.json names. */
     listen?: ContainerListen;
     endpoints: StackEndpoints;

package/dist/host/stack-config.js

@@ -15,8 +15,8 @@
  * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
  * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
  * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
- * Only gates reads the operator's credential resolver (`NYLORUN_RESOLVER_URL`,
- * `NYLORUN_RESOLVER_TOKEN`, F9 C1): remote MCP calls are authorized in the gateway.
+ * The credential resolver is gone (protocol 10): its `NYLORUN_RESOLVER_*` variables are ignored,
+ * and the Host logs `resolver_removed` when one is set.
  *
  * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
  * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
@@ -66,7 +66,7 @@ export const DEFAULT_SERVICES = new Set([
 ]);
 /** Services of the blueprint this release doesn't have yet. */
 const LATER_SERVICES = [
-    "sandboxd",
+    "sandboxes",
 ];
 const ROLE_SERVICES = {
     api: ["core"],
@@ -304,9 +304,13 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
+    const removedResolverVariables = Object.keys(env)
+        .filter((name) => name.startsWith(REMOVED_RESOLVER_PREFIX) && read(env, name) !== undefined)
+        .sort();
     return {
         services,
         ...(deprecatedRole ? { deprecatedRole } : {}),
+        ...(removedResolverVariables.length ? { removedResolverVariables } : {}),
         ...(gates ? { gates } : {}),
         ...(egress ? { egress } : {}),
         ...(modelGate ? { modelGate } : {}),
@@ -509,28 +513,13 @@ function parseGates(env) {
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
-    const resolver = parseResolver(env);
     return {
         listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
         token,
-        ...(resolver ? { resolver } : {}),
     };
 }
-/** `GatesConfig.resolver` from `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN`: both or neither. */
-function parseResolver(env) {
-    const url = parseUrl(env, "NYLORUN_RESOLVER_URL", ["http:", "https:"]);
-    const token = read(env, "NYLORUN_RESOLVER_TOKEN");
-    if (url === undefined) {
-        if (token !== undefined)
-            throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is set without NYLORUN_RESOLVER_URL: set the URL of your credential resolver");
-        return undefined;
-    }
-    if (token === undefined)
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN is required with NYLORUN_RESOLVER_URL: the bearer the gateway presents to your credential resolver");
-    if (/\s/.test(token))
-        throw new StackConfigError("NYLORUN_RESOLVER_TOKEN cannot contain whitespace");
-    return { url, token };
-}
+/** The prefix of the credential resolver's variables (removed in protocol 10). */
+const REMOVED_RESOLVER_PREFIX = "NYLORUN_RESOLVER_";
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
     const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;

package/dist/index.d.ts

@@ -4,7 +4,6 @@ export { parseIdentityFile, IdentityFileError, type TrustedIssuerConfig, } from
 export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions, } from "./tenant/issuers.js";
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
-export type { ResolverConfig } from "./vault/sources.js";
 export type { RuntimeAgent } from "./contracts.js";
 export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";

package/dist/infra/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * The Host's infrastructure clients, built from the stack configuration: the
  * Postgres pool, Durable Session Execution and Durable Streams, each only when
- * its endpoints are configured, plus the readiness that covers them.
+ * its endpoints are configured, plus the readiness that covers Postgres and
+ * Restate (not S2: `readiness.ts`).
  *
  * Building a client connects to nothing: the pool connects on first query,
  * Restate and S2 on first call. Nothing here starts a Worker (see

package/dist/infra/index.js

@@ -20,7 +20,6 @@ export function createInfra(config, options = {}) {
     const probes = infraProbes({
         ...(database ? { database } : {}),
         ...(execution ? { execution } : {}),
-        ...(streams ? { streams } : {}),
     });
     const readiness = Object.keys(probes).length > 0
         ? logTransitions(createReadiness(probes), options.logger)