@nylorun/runtime 0.20.0-beta → 0.21.0-beta

package/dist/vault/service.js

@@ -7,7 +7,7 @@
  * ## Public surface
  *
  * ```ts
- * new VaultService({ store: SessionStore, kek: () => Buffer, fetch: typeof fetch })
+ * new VaultService({ store: SessionStore, kek: () => Buffer })
  *
  * // Administration: each opens its own transaction and writes its audit rows
  * // in that transaction. Creates and rotations replay by idempotency key.
@@ -25,13 +25,10 @@
  * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: { opaque?: boolean }): Promise<void>
  * recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>
  *
- * // Use: opens its own transactions; never call it inside one. `CredentialSources`
- * // (`vault/sources.ts`) wraps it with the operator's credential resolver.
- * authorize(input: { sessionId; vaultIds; credentialSelections; url; serverName? }): Promise<AuthorizeResult>
- *
- * // MCP OAuth connect (F9 C2, installation vaults only): network calls outside any transaction.
- * startOAuth(input: { vaultId; server; url; clientId?; redirectUri }): Promise<{ authorizeUrl; expiresAt }>
- * finishOAuth(input: { state; code?; error? }): Promise<{ vaultId; credentialId }>
+ * // Use: opens its own transactions; never call it inside one. `sessionCredentials`
+ * // (`vault/sources.ts`) calls it for a session's MCP servers and HTTP tools; a tool preview
+ * // (R2b C12, `mcp/preview.ts`) for no session.
+ * authorize(input: { sessionId?; vaultIds; credentialSelections; url; serverName? }): Promise<AuthorizeResult>
  *
  * // Host model credential: each opens its own transaction.
  * getHostModel(): Promise<HostModelView>
@@ -61,42 +58,37 @@
  *   (ciphertext only) in one transaction and decides there. A refusal decided
  *   from those rows (missing vault, ambiguous, selection mismatch) writes its
  *   audit row in that same transaction. Decryption happens after it commits,
- *   so the plaintext never enters a transaction. An OAuth refresh calls the
- *   token endpoint outside any transaction, then stores the rotated secret and
- *   its `refresh` audit row in one follow-up transaction (re-reading the
- *   current row there). The `use`/`approved` audit row is written in a final
- *   transaction before the header is returned: if that write fails,
- *   `authorize` rejects and no header leaves the vault, so every approved use
- *   has an audit row. Unreadable ciphertext and refresh failures are audited
- *   in their own transaction before the refusal is returned.
+ *   so the plaintext never enters a transaction. The `use`/`approved` audit
+ *   row is written in a final transaction before the header is returned: if
+ *   that write fails, `authorize` rejects and no header leaves the vault, so
+ *   every approved use has an audit row. Unreadable ciphertext is audited in
+ *   its own transaction before the refusal is returned.
+ *
+ * ## Credentials (R2b C2)
+ *
+ * A credential is bound to the URL a manifest names and sends a `bearer` token or a `headers`
+ * map, both sealed. Its `via` (where requests go, such as a gateway) and `identity` (the header
+ * that names the session owner) are not secret: they live unsealed in the binding, beside the
+ * URL and the header names, and a rotation keeps them unless it changes them. The seal's AAD
+ * binds the type and URL only, and matching is by URL only, so `via` never decides which
+ * credential is chosen.
  */
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { INSTALLATION_OWNER } from "@nylorun/core/contracts";
 import { canonical } from "../store/canonical.js";
-import { decryptSecret, encryptSecret, kekId as kekIdOf, openBytes, sealBytes, VaultCryptoError, } from "./crypto.js";
-import { HttpError } from "../tenant/http.js";
-import { authorizationUrl, discoverOAuthServer, exchangeCode, oauthClient, } from "./oauth.js";
+import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
+import { checkCredentialHeaders } from "./headers.js";
 import { hostModelCatalog } from "../model/catalog.js";
 import { normalizeVaultUrl } from "./url.js";
-const REFRESH_SKEW_MS = 60_000;
-const REFRESH_TIMEOUT_MS = 30_000;
-/** How long an MCP OAuth connect may take between its start and its callback (F9 C2). */
-export const OAUTH_PENDING_MS = 10 * 60_000;
 export const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
 export class VaultService {
     store;
     kek;
-    fetchImpl;
-    refreshTimeoutMs;
-    /** Refreshes in progress by credential id: concurrent uses share one. */
-    refreshing = new Map();
     constructor(options) {
         this.store = options.store;
         this.kek = options.kek;
-        this.fetchImpl = options.fetch;
-        this.refreshTimeoutMs = options.refreshTimeoutMs ?? REFRESH_TIMEOUT_MS;
     }
     // --- administration --------------------------------------------------------
     async createVault(body) {
@@ -166,14 +158,16 @@ export class VaultService {
             const id = randomUUID();
             const url = normalizeVaultUrl(body.auth.url);
             const type = body.auth.type;
-            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, url), Buffer.from(JSON.stringify(payloadFromCreate(body)), "utf8"));
+            const payload = payloadOf(body.auth);
+            const binding = bindingOf(url, payload, body.auth);
+            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, url), Buffer.from(JSON.stringify(payload), "utf8"));
             const row = {
                 id,
                 vaultId,
                 name: body.name,
                 type,
-                bindingJson: JSON.stringify({ url }),
-                expiresAt: expiresFromCreate(body),
+                bindingJson: JSON.stringify(binding),
+                expiresAt: null,
                 createdAt: new Date().toISOString(),
                 rotatedAt: null,
                 ...sealed,
@@ -206,18 +200,13 @@ export class VaultService {
             const row = await this.credentialRow(t, vaultId, id);
             if (row.type !== body.auth.type)
                 throw new VaultError(409, "Credential type cannot change");
-            const next = { ...readPayload(kek, row) };
-            let expiresAt = row.expiresAt;
-            if (body.auth.type === "bearer")
-                next.token = body.auth.token;
-            else {
-                next.accessToken = body.auth.accessToken;
-                expiresAt =
-                    body.auth.expiresAt === undefined || body.auth.expiresAt === null
-                        ? null
-                        : requireTimestamp(body.auth.expiresAt);
-            }
-            const updated = await this.writePayload(t, kek, row, next, expiresAt, new Date().toISOString());
+            const current = credentialBinding(row);
+            const next = payloadOf(body.auth);
+            const binding = bindingOf(current.url, next, {
+                via: body.auth.via === undefined ? current.via : body.auth.via,
+                identity: body.auth.identity === undefined ? current.identity : body.auth.identity,
+            });
+            const updated = await this.writePayload(t, kek, row, next, binding, new Date().toISOString());
             await this.audit(t, {
                 actor: "application",
                 action: "rotate",
@@ -286,9 +275,13 @@ export class VaultService {
     async authorize(input) {
         const url = normalizeVaultUrl(input.url);
         const decided = await this.store.tx(async (t) => {
+            const scopes = new Map();
             for (const id of input.vaultIds) {
-                if (await t.getVault(id))
+                const found = await t.getVault(id);
+                if (found) {
+                    scopes.set(id, found.scope);
                     continue;
+                }
                 await this.audit(t, {
                     actor: "host",
                     action: "use",
@@ -334,7 +327,10 @@ export class VaultService {
                     },
                 };
             }
-            return { row: chosen.row };
+            return {
+                row: chosen.row,
+                vault: scopes.get(chosen.row.vaultId) === "installation" ? "installation" : "user",
+            };
         });
         if ("result" in decided)
             return decided.result;
@@ -364,14 +360,8 @@ export class VaultService {
                 reason: "unreadable",
             };
         }
-        if (row.type === "oauth" && dueForRefresh(row.expiresAt)) {
-            const refreshed = await this.refreshShared(kek, row, payload, input.sessionId, url);
-            if (refreshed.status === "refused")
-                return refreshed;
-            payload = refreshed.payload;
-        }
-        const token = row.type === "bearer" ? payload.token : payload.accessToken;
-        if (!token) {
+        const headers = sendHeaders(row, payload);
+        if (!headers) {
             return {
                 status: "refused",
                 url,
@@ -388,198 +378,15 @@ export class VaultService {
             target: url,
             outcome: "approved",
         }));
+        const binding = credentialBinding(row);
         return {
             status: "authorized",
             url,
-            headers: { authorization: `Bearer ${token}` },
-        };
-    }
-    // --- MCP OAuth connect (F9 C2) ---------------------------------------------
-    /**
-     * Starts signing the installation in to the MCP server at `url`: discovery, a client (the
-     * given id, or one registered now), an S256 PKCE verifier and a `state`, kept for ten minutes
-     * in a pending row (verifier and secret sealed, state hashed). Returns where to send the
-     * browser. Installation vaults only.
-     */
-    async startOAuth(input) {
-        const url = normalizeVaultUrl(input.url);
-        const redirectUri = callbackUrl(input.redirectUri);
-        await this.store.tx(async (t) => {
-            await this.installationVault(t, input.vaultId);
-            await t.deleteExpiredOAuthPending(new Date().toISOString());
-        });
-        const kek = this.kek();
-        const server = await discoverOAuthServer(url, this.fetchImpl);
-        const client = await oauthClient(server, {
-            ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
-            redirectUri,
-            fetchFn: this.fetchImpl,
-        });
-        const state = randomBytes(32).toString("base64url");
-        const { authorizeUrl, codeVerifier } = await authorizationUrl(server, client, { redirectUri, state });
-        const stateHash = hashState(state);
-        const now = Date.now();
-        const expiresAt = new Date(now + OAUTH_PENDING_MS).toISOString();
-        const row = {
-            stateHash,
-            vaultId: input.vaultId,
-            server: input.server,
-            url,
-            tokenEndpoint: server.metadata.token_endpoint,
-            clientId: client.clientId,
-            tokenEndpointAuth: client.tokenEndpointAuth,
-            resource: server.resource ?? null,
-            kekId: "",
-            clientSecret: null,
-            codeVerifier: new Uint8Array(),
-            redirectUri,
-            expiresAt,
-            createdAt: new Date(now).toISOString(),
-        };
-        const verifier = sealBytes(kek, pendingAad(row, "codeVerifier"), Buffer.from(codeVerifier, "utf8"));
-        const secret = client.clientSecret
-            ? sealBytes(kek, pendingAad(row, "clientSecret"), Buffer.from(client.clientSecret, "utf8"))
-            : null;
-        await this.store.tx(async (t) => {
-            await this.installationVault(t, input.vaultId);
-            await t.insertOAuthPending({
-                ...row,
-                kekId: kekIdOf(kek),
-                codeVerifier: verifier,
-                clientSecret: secret,
-            });
-            await this.audit(t, {
-                actor: "application",
-                action: "oauth_start",
-                vaultId: input.vaultId,
-                target: url,
-                outcome: "started",
-            });
-        });
-        return { authorizeUrl, expiresAt };
-    }
-    /**
-     * Finishes a connect from its callback: takes the pending row of `state` (deleted whatever
-     * happens next), exchanges the code, and seals an `oauth` credential bound to the server's
-     * URL in the installation vault, rotating the vault's OAuth credential for that URL when it
-     * has one.
-     */
-    async finishOAuth(input) {
-        const row = await this.store.tx((t) => t.takeOAuthPending(hashState(input.state)));
-        if (!row || Date.parse(row.expiresAt) <= Date.now())
-            throw new HttpError(400, "This sign-in is unknown, already used or expired: start the connect again", { code: "oauth_state_invalid" });
-        const failed = async (error) => {
-            await this.store.tx((t) => this.audit(t, {
-                actor: "application",
-                action: "oauth_connect",
-                vaultId: row.vaultId,
-                target: row.url,
-                outcome: "failed",
-            }));
-            throw error;
+            headers,
+            ...(binding.via === undefined ? {} : { via: binding.via }),
+            ...(binding.identity === undefined ? {} : { identity: binding.identity }),
+            vault: decided.vault,
         };
-        if (input.error !== undefined || !input.code)
-            return failed(new HttpError(400, `The authorization server did not grant access (${oauthErrorName(input.error)})`, { code: "oauth_failed" }));
-        const kek = this.kek();
-        let client;
-        let codeVerifier;
-        try {
-            codeVerifier = openSealed(kek, row, "codeVerifier", row.codeVerifier);
-            client = {
-                clientId: row.clientId,
-                tokenEndpointAuth: row.tokenEndpointAuth,
-                ...(row.clientSecret ? { clientSecret: openSealed(kek, row, "clientSecret", row.clientSecret) } : {}),
-            };
-        }
-        catch (error) {
-            if (!(error instanceof VaultCryptoError))
-                throw error;
-            return failed(new HttpError(500, "The sign-in could not be read with this vault key", { code: "oauth_failed" }));
-        }
-        let tokens;
-        try {
-            tokens = await exchangeCode({
-                tokenEndpoint: row.tokenEndpoint,
-                client,
-                code: input.code,
-                codeVerifier,
-                redirectUri: row.redirectUri,
-                ...(row.resource === null ? {} : { resource: row.resource }),
-                fetchFn: this.fetchImpl,
-            });
-        }
-        catch (error) {
-            return failed(error instanceof HttpError ? error : new HttpError(502, "The OAuth code exchange failed", { code: "oauth_failed" }));
-        }
-        if (tokens.token_type.toLowerCase() !== "bearer")
-            return failed(new HttpError(502, `The authorization server issued a ${tokens.token_type} token; MCP needs a bearer token`, {
-                code: "oauth_failed",
-            }));
-        const payload = {
-            accessToken: tokens.access_token,
-            ...(tokens.refresh_token
-                ? {
-                    refreshToken: tokens.refresh_token,
-                    tokenEndpoint: row.tokenEndpoint,
-                    clientId: client.clientId,
-                    tokenEndpointAuth: client.tokenEndpointAuth,
-                    ...(client.clientSecret ? { clientSecret: client.clientSecret } : {}),
-                }
-                : {}),
-        };
-        const now = new Date();
-        const expiresAt = typeof tokens.expires_in === "number" && Number.isFinite(tokens.expires_in)
-            ? new Date(now.getTime() + tokens.expires_in * 1000).toISOString()
-            : null;
-        return this.store.tx(async (t) => {
-            await this.installationVault(t, row.vaultId);
-            const existing = (await t.credentialsForVault(row.vaultId, { type: "oauth" })).find((item) => bindingUrl(item) === row.url);
-            if (existing) {
-                await this.writePayload(t, kek, existing, payload, expiresAt, now.toISOString());
-                await this.audit(t, {
-                    actor: "application",
-                    action: "oauth_connect",
-                    vaultId: row.vaultId,
-                    credentialId: existing.id,
-                    target: row.url,
-                    outcome: "rotated",
-                });
-                return { vaultId: row.vaultId, credentialId: existing.id };
-            }
-            const id = randomUUID();
-            const sealed = encryptSecret(kek, credentialAad(row.vaultId, id, "oauth", row.url), Buffer.from(JSON.stringify(payload), "utf8"));
-            await t.insertCredential({
-                id,
-                vaultId: row.vaultId,
-                name: row.server,
-                type: "oauth",
-                bindingJson: JSON.stringify({ url: row.url }),
-                expiresAt,
-                createdAt: now.toISOString(),
-                rotatedAt: null,
-                ...sealed,
-            });
-            await this.audit(t, {
-                actor: "application",
-                action: "oauth_connect",
-                vaultId: row.vaultId,
-                credentialId: id,
-                target: row.url,
-                outcome: "created",
-            });
-            return { vaultId: row.vaultId, credentialId: id };
-        });
-    }
-    /** An installation vault, else the 404 of a missing one (a user vault is a 400). */
-    async installationVault(t, id) {
-        const row = await t.getVault(id);
-        if (!row || row.scope === "host")
-            throw new VaultError(404, "Vault not found");
-        if (row.scope !== "installation")
-            throw new HttpError(400, "MCP OAuth connect stores its credential in an installation vault only", {
-                code: "request_rejected",
-            });
-        return row;
     }
     // --- host model ----------------------------------------------------------------
     async getHostModel() {
@@ -675,128 +482,6 @@ export class VaultService {
         }));
     }
     // --- internals -----------------------------------------------------------------
-    /** Calls the token endpoint outside any transaction, then stores the result. */
-    /**
-     * Refreshes an OAuth grant once for every concurrent use in this process. A rotating refresh
-     * token is valid once, so two refreshes with it would fail the second, or make the provider
-     * revoke the grant.
-     */
-    refreshShared(kek, row, payload, sessionId, url) {
-        let pending = this.refreshing.get(row.id);
-        if (!pending) {
-            pending = this.refreshLatest(kek, row, payload, sessionId, url).finally(() => this.refreshing.delete(row.id));
-            this.refreshing.set(row.id, pending);
-        }
-        return pending;
-    }
-    /** Uses a token another process refreshed instead of refreshing again, before and after. */
-    async refreshLatest(kek, row, payload, sessionId, url) {
-        const before = await this.rotatedSince(kek, row);
-        if (before)
-            return { status: "ok", payload: before };
-        const refreshed = await this.refresh(kek, row, payload, sessionId, url);
-        if (refreshed.status === "ok")
-            return refreshed;
-        // The loser of a race with another process fails with the spent refresh token.
-        const after = await this.rotatedSince(kek, row);
-        return after ? { status: "ok", payload: after } : refreshed;
-    }
-    /** The credential's payload when it was rotated after `row` was read and is not due. */
-    async rotatedSince(kek, row) {
-        const current = await this.store.tx((t) => t.getCredential(row.id));
-        if (!current || current.vaultId !== row.vaultId || !isUserCredential(current))
-            return undefined;
-        if (current.rotatedAt === row.rotatedAt || dueForRefresh(current.expiresAt))
-            return undefined;
-        try {
-            return readPayload(kek, current);
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async refresh(kek, row, payload, sessionId, url) {
-        const failRefresh = async () => {
-            await this.store.tx((t) => this.audit(t, {
-                actor: "host",
-                action: "refresh",
-                vaultId: row.vaultId,
-                credentialId: row.id,
-                sessionId,
-                target: payload.tokenEndpoint,
-                outcome: "refresh_failed",
-            }));
-            return {
-                status: "refused",
-                url,
-                credentialIds: [row.id],
-                reason: "refresh_failed",
-            };
-        };
-        if (!payload.refreshToken || !payload.tokenEndpoint || !payload.clientId)
-            return failRefresh();
-        let next;
-        try {
-            const body = new URLSearchParams({
-                grant_type: "refresh_token",
-                refresh_token: payload.refreshToken,
-                client_id: payload.clientId,
-            });
-            const headers = {
-                "content-type": "application/x-www-form-urlencoded",
-            };
-            if (payload.tokenEndpointAuth === "client_secret_post") {
-                if (!payload.clientSecret)
-                    return failRefresh();
-                body.set("client_secret", payload.clientSecret);
-            }
-            if (payload.tokenEndpointAuth === "client_secret_basic") {
-                if (!payload.clientSecret)
-                    return failRefresh();
-                const encoded = Buffer.from(`${encodeURIComponent(payload.clientId)}:${encodeURIComponent(payload.clientSecret)}`).toString("base64");
-                headers.authorization = `Basic ${encoded}`;
-            }
-            const response = await this.fetchImpl(payload.tokenEndpoint, {
-                method: "POST",
-                headers,
-                body: body.toString(),
-                redirect: "error",
-                signal: AbortSignal.timeout(this.refreshTimeoutMs),
-            });
-            if (!response.ok)
-                return failRefresh();
-            const json = (await response.json());
-            if (typeof json.access_token !== "string" || json.access_token.length === 0)
-                return failRefresh();
-            next = {
-                ...payload,
-                accessToken: json.access_token,
-                refreshToken: typeof json.refresh_token === "string"
-                    ? json.refresh_token
-                    : payload.refreshToken,
-            };
-            const expiresAt = typeof json.expires_in === "number" && Number.isFinite(json.expires_in)
-                ? new Date(Date.now() + json.expires_in * 1000).toISOString()
-                : null;
-            await this.store.tx(async (t) => {
-                const current = await this.credentialRow(t, row.vaultId, row.id);
-                await this.writePayload(t, kek, current, next, expiresAt, new Date().toISOString());
-                await this.audit(t, {
-                    actor: "host",
-                    action: "refresh",
-                    vaultId: row.vaultId,
-                    credentialId: row.id,
-                    sessionId,
-                    target: payload.tokenEndpoint,
-                    outcome: "approved",
-                });
-            });
-        }
-        catch {
-            return failRefresh();
-        }
-        return { status: "ok", payload: next };
-    }
     async replay(t, key, body, create) {
         const hash = createHash("sha256")
             .update(requestHash(body))
@@ -815,10 +500,10 @@ export class VaultService {
         });
         return created;
     }
-    /** Re-seals a user credential's payload and returns the updated row. */
-    async writePayload(t, kek, row, payload, expiresAt, rotatedAt) {
+    /** Re-seals a user credential's payload with its new binding and returns the updated row. */
+    async writePayload(t, kek, row, payload, binding, rotatedAt) {
         const sealed = encryptSecret(kek, credentialAad(row.vaultId, row.id, row.type, bindingUrl(row)), Buffer.from(JSON.stringify(payload), "utf8"));
-        const patch = { expiresAt, rotatedAt, ...sealed };
+        const patch = { rotatedAt, bindingJson: JSON.stringify(binding), ...sealed };
         if (!(await t.updateCredential(row.vaultId, row.id, patch)))
             throw new VaultError(404, "Credential not found");
         return { ...row, ...patch };
@@ -937,40 +622,6 @@ export class VaultService {
         });
     }
 }
-function hashState(state) {
-    return createHash("sha256").update(state, "utf8").digest("hex");
-}
-function pendingAad(row, field) {
-    return Buffer.from(canonical({ table: "oauth_pending", stateHash: row.stateHash, vaultId: row.vaultId, field }), "utf8");
-}
-function openSealed(kek, row, field, sealed) {
-    const plaintext = openBytes(kek, pendingAad(row, field), Buffer.from(sealed), row.kekId);
-    try {
-        return plaintext.toString("utf8");
-    }
-    finally {
-        plaintext.fill(0);
-    }
-}
-/** The callback URL the authorization server sends the browser back to. */
-function callbackUrl(value) {
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new VaultError(400, "The OAuth redirect URI is invalid");
-    }
-    if (url.protocol !== "https:" && url.protocol !== "http:")
-        throw new VaultError(400, "The OAuth redirect URI must be http or https");
-    return url.href;
-}
-/** An authorization server's `error`, safe to show: an OAuth error code, or a stand-in. */
-function oauthErrorName(error) {
-    if (error === undefined)
-        return "no code";
-    return /^[A-Za-z0-9_.-]{1,64}$/.test(error) ? error : "error";
-}
 function isUserCredential(row) {
     return row.type !== "model";
 }
@@ -988,14 +639,20 @@ function vaultInfoOf(row) {
         createdAt: row.createdAt,
     };
 }
+function credentialBinding(row) {
+    return JSON.parse(row.bindingJson);
+}
 function credentialInfoOf(row) {
+    const binding = credentialBinding(row);
     return {
         id: row.id,
         vaultId: row.vaultId,
         name: row.name,
         type: row.type,
-        binding: JSON.parse(row.bindingJson),
-        ...(row.expiresAt ? { expiresAt: row.expiresAt } : {}),
+        binding: { url: binding.url },
+        ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
+        ...(binding.via === undefined ? {} : { via: binding.via }),
+        ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
     };
@@ -1099,44 +756,32 @@ function choose(matches, selection) {
         };
     return { kind: "use", row: chosen };
 }
-function dueForRefresh(expiresAt) {
-    if (!expiresAt)
-        return false;
-    return Date.parse(expiresAt) - Date.now() <= REFRESH_SKEW_MS;
-}
-function payloadFromCreate(body) {
-    if (body.auth.type === "bearer")
-        return { token: body.auth.token };
-    const refresh = body.auth.refresh;
-    const tokenEndpoint = refresh
-        ? normalizeVaultUrl(refresh.tokenEndpoint, { httpsOnly: true })
-        : undefined;
-    if (body.auth.expiresAt)
-        requireTimestamp(body.auth.expiresAt);
+/** The sealed part of a create or rotate: a token, or a header map with lower-cased names. */
+function payloadOf(auth) {
+    if (auth.type === "bearer")
+        return { token: auth.token };
     return {
-        accessToken: body.auth.accessToken,
-        ...(refresh
-            ? {
-                refreshToken: refresh.refreshToken,
-                tokenEndpoint,
-                clientId: refresh.clientId,
-                tokenEndpointAuth: refresh.tokenEndpointAuth.type,
-                ...(refresh.tokenEndpointAuth.type === "none"
-                    ? {}
-                    : { clientSecret: refresh.tokenEndpointAuth.clientSecret }),
-            }
-            : {}),
+        headers: Object.fromEntries(Object.entries(auth.headers).map(([name, value]) => [name.toLowerCase(), value])),
     };
 }
-function expiresFromCreate(body) {
-    if (body.auth.type !== "oauth" || !body.auth.expiresAt)
-        return null;
-    return requireTimestamp(body.auth.expiresAt);
+/** The unsealed binding of a credential that sends `payload`; refuses a reserved header name. */
+function bindingOf(url, payload, routing) {
+    const sent = payload.headers ? Object.keys(payload.headers) : ["authorization"];
+    checkCredentialHeaders(sent, routing.identity ?? undefined);
+    return {
+        url,
+        ...(routing.via ? { via: routing.via } : {}),
+        ...(routing.identity ? { identity: { header: routing.identity.header.toLowerCase() } } : {}),
+        ...(payload.headers ? { headerNames: sent } : {}),
+    };
 }
-function requireTimestamp(value) {
-    if (Number.isNaN(Date.parse(value)))
-        throw new VaultError(400, "Credential expiry is invalid");
-    return new Date(Date.parse(value)).toISOString();
+/** The headers a credential sends, or undefined when its payload holds none. */
+function sendHeaders(row, payload) {
+    if (row.type === "headers")
+        return payload.headers && Object.keys(payload.headers).length > 0
+            ? { ...payload.headers }
+            : undefined;
+    return payload.token ? { authorization: `Bearer ${payload.token}` } : undefined;
 }
 export function modelBinding(row) {
     const binding = JSON.parse(row.bindingJson);