@nylorun/runtime 0.20.0-beta → 0.21.0-beta

package/dist/tenant/transcript.js

@@ -102,14 +102,27 @@ export function toolCompleted(request, value) {
             error: {
                 code: String(outcome.code ?? "tool.failed"),
                 message: String(outcome.message ?? ""),
+                // `credential_rejected` (R2b C1): which server, and which vault's credential.
+                ...(typeof outcome.server === "string" ? { server: outcome.server } : {}),
+                ...(outcome.vault === "installation" || outcome.vault === "user"
+                    ? { vault: outcome.vault }
+                    : {}),
+                ...(typeof outcome.retryable === "boolean" ? { retryable: outcome.retryable } : {}),
             },
         }
         : { output: outcome?.kind === "completed" ? outcome.output : value };
+    // Credential values the server echoed, replaced before the outcome was recorded (R2b C8).
+    const redacted = (outcome?.kind === "completed" || outcome?.kind === "failed") &&
+        typeof outcome.redacted === "number" &&
+        outcome.redacted > 0
+        ? { redacted: outcome.redacted }
+        : {};
     return {
         ...ids,
         capabilityId: request.capabilityId,
         toolName: request.toolName,
         ...result,
+        ...redacted,
         ...agentOf(request),
     };
 }

package/dist/tenant/types.d.ts

@@ -8,7 +8,6 @@ import type { SessionStore } from "../store/types.js";
 import type { SandboxBackend } from "../sandbox/types.js";
 import type { TenantCause } from "./cause.js";
 import type { OutboundPolicy } from "./outbound.js";
-import type { ResolverConfig } from "../vault/sources.js";
 import type { TenantWorker } from "./worker.js";
 export type TenantMode = "shared" | "ephemeral" | "test";
 /**
@@ -75,24 +74,11 @@ export interface TenantConfig {
      * never reads ambient process environment for flow limits.
      */
     flowEnv?: Readonly<Record<string, string | undefined>>;
-    vaultFetch?: typeof fetch;
     /**
      * The trusted issuers whose JWTs the Tenant API accepts (Host feature `trusted-issuers`), from
      * the identity file (`NYLORUN_IDENTITY_FILE`). Absent: none.
      */
     issuers?: import("./issuers.js").TrustedIssuers;
-    /**
-     * The operator's credential resolver (F9 C1), asked for a person's MCP credential when the
-     * session's vaults hold none. Used where this process authorizes MCP calls itself (embedding,
-     * the ephemeral Runtime, tests); the gateway takes `NYLORUN_RESOLVER_*` instead.
-     */
-    resolver?: ResolverConfig;
-    /**
-     * The URL browsers reach this Tenant API at (`NYLORUN_PUBLIC_URL`, no trailing slash): the
-     * base of the MCP OAuth callback, `<publicUrl>/v1/oauth/callback` (F9 C2). Absent (embedding,
-     * tests): the origin the start request was sent to.
-     */
-    publicUrl?: string;
     logger: Logger;
 }
 export interface Logger {

package/dist/vault/crypto.d.ts

@@ -10,10 +10,3 @@ export declare function encryptSecret(kek: Buffer, aad: Buffer, plaintext: Buffe
     kekId: string;
 };
 export declare function decryptSecret(kek: Buffer, aad: Buffer, nonce: Buffer, ciphertext: Buffer, wrappedDek: Buffer, expectedKekId: string): Buffer;
-/**
- * `encryptSecret` in one column: nonce, wrapped DEK, then ciphertext and tag. For rows that
- * seal several short secrets under one `kekId` (`oauth_pending`, F9 C2).
- */
-export declare function sealBytes(kek: Buffer, aad: Buffer, plaintext: Buffer): Buffer;
-/** Opens what `sealBytes` sealed; `VaultCryptoError` when it cannot. */
-export declare function openBytes(kek: Buffer, aad: Buffer, sealed: Buffer, expectedKekId: string): Buffer;

package/dist/vault/crypto.js

@@ -78,19 +78,3 @@ function unwrapKey(kek, wrapped) {
         throw new VaultCryptoError();
     }
 }
-/** The wrapped DEK's length: its nonce, the 32-byte key and the tag. */
-const WRAPPED_DEK_BYTES = IV_BYTES + 32 + TAG_BYTES;
-/**
- * `encryptSecret` in one column: nonce, wrapped DEK, then ciphertext and tag. For rows that
- * seal several short secrets under one `kekId` (`oauth_pending`, F9 C2).
- */
-export function sealBytes(kek, aad, plaintext) {
-    const sealed = encryptSecret(kek, aad, plaintext);
-    return Buffer.concat([sealed.nonce, sealed.wrappedDek, sealed.ciphertext]);
-}
-/** Opens what `sealBytes` sealed; `VaultCryptoError` when it cannot. */
-export function openBytes(kek, aad, sealed, expectedKekId) {
-    if (sealed.length < IV_BYTES + WRAPPED_DEK_BYTES + TAG_BYTES)
-        throw new VaultCryptoError();
-    return decryptSecret(kek, aad, sealed.subarray(0, IV_BYTES), sealed.subarray(IV_BYTES + WRAPPED_DEK_BYTES), sealed.subarray(IV_BYTES, IV_BYTES + WRAPPED_DEK_BYTES), expectedKekId);
-}

package/dist/vault/headers.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
+ * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names
+ * the session owner and is no secret, so it is left out.
+ */
+export declare function credentialSecrets(headers: Readonly<Record<string, string>>, identity?: {
+    readonly header: string;
+}): string[];
+/** True when a credential may not send `name`: a transport header or `Nylorun-*`. */
+export declare function isReservedHeader(name: string): boolean;
+/**
+ * The header names a credential sends, lower-cased: a `headers` map's, `authorization` for a
+ * `bearer`. Refuses a reserved name, and an identity header that repeats one of them.
+ */
+export declare function checkCredentialHeaders(names: readonly string[], identity: {
+    readonly header: string;
+} | undefined): string[];

package/dist/vault/headers.js

@@ -0,0 +1,61 @@
+/**
+ * The headers a vault credential may send (R2b C2): a `headers` credential's names and an
+ * identity header. The core schema checks their syntax; this module refuses the names the
+ * Runtime sets itself, so a credential can never replace them.
+ */
+import { VaultError } from "./error.js";
+/** Headers the MCP transport and the HTTP tool call own. */
+const RESERVED_HEADERS = new Set([
+    "host",
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+    "connection",
+    "accept",
+    "mcp-session-id",
+    "mcp-protocol-version",
+    "last-event-id",
+    "idempotency-key",
+]);
+/**
+ * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
+ * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names
+ * the session owner and is no secret, so it is left out.
+ */
+export function credentialSecrets(headers, identity) {
+    const skip = identity?.header.toLowerCase();
+    const secrets = new Set();
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() === skip)
+            continue;
+        if (value.length >= 8)
+            secrets.add(value);
+        const bearer = /^bearer\s+(\S+)\s*$/iu.exec(value)?.[1];
+        if (bearer !== undefined && bearer.length >= 8)
+            secrets.add(bearer);
+    }
+    return [...secrets];
+}
+/** True when a credential may not send `name`: a transport header or `Nylorun-*`. */
+export function isReservedHeader(name) {
+    const lower = name.toLowerCase();
+    return RESERVED_HEADERS.has(lower) || lower.startsWith("nylorun-");
+}
+/**
+ * The header names a credential sends, lower-cased: a `headers` map's, `authorization` for a
+ * `bearer`. Refuses a reserved name, and an identity header that repeats one of them.
+ */
+export function checkCredentialHeaders(names, identity) {
+    const lower = names.map((name) => name.toLowerCase());
+    for (const name of lower)
+        if (isReservedHeader(name))
+            throw new VaultError(400, `A credential may not set the header ${name}`);
+    if (identity) {
+        const header = identity.header.toLowerCase();
+        if (isReservedHeader(header))
+            throw new VaultError(400, `The identity header may not be ${header}`);
+        if (lower.includes(header))
+            throw new VaultError(400, `The identity header ${header} is already one of the credential's headers`);
+    }
+    return lower;
+}

package/dist/vault/service.d.ts

@@ -1,7 +1,5 @@
-import type { CreateCredentialRequest, CreateVaultRequest, CredentialInfo, CredentialSelection, HostModelProviderInfo, HostModelView, PutHostModelRequest, CustomModelSettings, RotateCredentialRequest, SelectHostModelRequest, VaultInfo } from "@nylorun/core/contracts";
+import type { CreateCredentialRequest, CreateVaultRequest, CredentialIdentity, CredentialInfo, CredentialSelection, HostModelProviderInfo, HostModelView, PutHostModelRequest, CustomModelSettings, RotateCredentialRequest, SelectHostModelRequest, VaultInfo } from "@nylorun/core/contracts";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
-/** How long an MCP OAuth connect may take between its start and its callback (F9 C2). */
-export declare const OAUTH_PENDING_MS: number;
 export declare const HOST_VAULT_ID = "host";
 export type HostModelSecret = {
     provider: string;
@@ -27,50 +25,28 @@ export type AuthorizeResult = {
 } | {
     status: "authorized";
     url: string;
-    /** A vault credential's `authorization`, or the headers the credential resolver gave. */
+    /** The vault credential's headers: `authorization` for a `bearer`, a `headers` map's. */
     headers: Record<string, string>;
+    /** Where the request goes instead of `url` (a gateway), when the credential has one. */
+    via?: string;
+    /** The header that names the session owner; `sessionCredentials` adds it. */
+    identity?: CredentialIdentity;
+    /** The scope of the vault the credential is in. */
+    vault: "installation" | "user";
 } | {
     status: "refused";
     url: string;
     credentialIds: string[];
     reason: string;
 };
-/** `startOAuth`'s input: the route's body, the installation vault and the callback URL. */
-export interface StartOAuthInput {
-    vaultId: string;
-    /** The MCP server's name, the credential's name. */
-    server: string;
-    url: string;
-    clientId?: string;
-    /** `<public URL>/v1/oauth/callback`. */
-    redirectUri: string;
-}
-/** The callback's query: `code`, or the authorization server's `error`. */
-export interface FinishOAuthInput {
-    state: string;
-    code?: string;
-    error?: string;
-}
 export interface VaultServiceOptions {
     store: SessionStore;
     /** The Tenant key-encryption key. May read or create the key file. */
     kek: () => Buffer;
-    /**
-     * OAuth refresh and MCP OAuth connect (discovery, registration, the code exchange), always
-     * outside a transaction: the Host's `guardedFetch` (`tenant/outbound.ts`) unless a test or
-     * an embedder injects one.
-     */
-    fetch: typeof fetch;
-    /** How long a token endpoint may take to answer a refresh. Default 30 s. */
-    refreshTimeoutMs?: number;
 }
 export declare class VaultService {
     private readonly store;
     private readonly kek;
-    private readonly fetchImpl;
-    private readonly refreshTimeoutMs;
-    /** Refreshes in progress by credential id: concurrent uses share one. */
-    private readonly refreshing;
     constructor(options: VaultServiceOptions);
     createVault(body: CreateVaultRequest): Promise<VaultInfo>;
     /**
@@ -101,54 +77,21 @@ export declare class VaultService {
     /** Writes the `attach` audit row. Run in the session PUT transaction. */
     recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
     authorize(input: {
-        sessionId: string;
+        /** The session the request is made for; absent for a tool preview (R2b C12). */
+        sessionId?: string;
         vaultIds: readonly string[];
         credentialSelections: readonly CredentialSelection[];
         url: string;
         serverName?: string;
     }): Promise<AuthorizeResult>;
-    /**
-     * Starts signing the installation in to the MCP server at `url`: discovery, a client (the
-     * given id, or one registered now), an S256 PKCE verifier and a `state`, kept for ten minutes
-     * in a pending row (verifier and secret sealed, state hashed). Returns where to send the
-     * browser. Installation vaults only.
-     */
-    startOAuth(input: StartOAuthInput): Promise<{
-        authorizeUrl: string;
-        expiresAt: string;
-    }>;
-    /**
-     * Finishes a connect from its callback: takes the pending row of `state` (deleted whatever
-     * happens next), exchanges the code, and seals an `oauth` credential bound to the server's
-     * URL in the installation vault, rotating the vault's OAuth credential for that URL when it
-     * has one.
-     */
-    finishOAuth(input: FinishOAuthInput): Promise<{
-        vaultId: string;
-        credentialId: string;
-    }>;
-    /** An installation vault, else the 404 of a missing one (a user vault is a 400). */
-    private installationVault;
     getHostModel(): Promise<HostModelView>;
     listHostProviders(): Promise<{
         providers: HostModelProviderInfo[];
     }>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
-    /** Calls the token endpoint outside any transaction, then stores the result. */
-    /**
-     * Refreshes an OAuth grant once for every concurrent use in this process. A rotating refresh
-     * token is valid once, so two refreshes with it would fail the second, or make the provider
-     * revoke the grant.
-     */
-    private refreshShared;
-    /** Uses a token another process refreshed instead of refreshing again, before and after. */
-    private refreshLatest;
-    /** The credential's payload when it was rotated after `row` was read and is not due. */
-    private rotatedSince;
-    private refresh;
     private replay;
-    /** Re-seals a user credential's payload and returns the updated row. */
+    /** Re-seals a user credential's payload with its new binding and returns the updated row. */
     private writePayload;
     private vaultInfo;
     private ensureHostVault;