@nylorun/runtime 0.20.0-beta → 0.21.1-beta

package/CHANGELOG.md

@@ -1,5 +1,91 @@
 # Changelog
 
+## 0.21.1-beta
+
+### Patch Changes
+
+- 070674d: **One source of truth for the manifest and Harness API schemas.**
+
+  - `@nylorun/core`: `Agent.from` (`agentFrom`) checks a manifest with `AgentManifestSchema`, the Runtime's own check, instead of a validator of its own, and refuses with `agent.build-failed` and the schema's messages (each prefixed with its path, such as `capabilities.0.tools.0.name: …`). It now refuses what the Runtime refuses at registration and it let through, such as unknown fields (it dropped them) or a tool or MCP server name that not every model provider accepts. The schema names a top-level `model` or `schemaVersion` and a capability's `model` as before, and the skill whose `files` are wrong (`Skill 'triage' files must include SKILL.md`). The rebuilt manifest is a frozen copy; the object passed in is no longer frozen. `AgentManifestSchema` and `WorkflowManifestSchema` are no longer force-cast to their types: the build checks that each accepts exactly `AgentManifest` and `WorkflowManifest`. `@nylorun/core/contracts` exports `McpServerManifestSchema`, `HEADER_NAME_PATTERN` and `LOOPBACK_HOSTS`. The Harness API's types (`@nylorun/core/harness-api`) are inferred from the schemas that validate its frames, so they match them: `TurnStart.manifest`, `TurnStart.checkpoint` and `RunRouting.rootManifest` are `object`, `WorkspaceCall.tool` is a sandbox tool name, `ABORT_REASONS` is a tuple, and properties are no longer `readonly` (arrays that were stay so).
+  - `@nylorun/harness`: `runDurable` checks the manifest once, when it rebuilds the agent, instead of twice. The unpublished, stale `schemas/manifest.schema.json` (manifest `schemaVersion` 2) is gone; `z.toJSONSchema(AgentManifestSchema)` is the manifest's JSON Schema.
+  - `@nylorun/agents`: a plugin's MCP servers are checked with core's `McpServerManifestSchema`, header-name pattern and loopback hosts. A server whose key is not a name every model provider accepts is skipped with a `plugin.mcp-server-skipped` warning, since the Runtime would refuse the manifest declaring it.
+  - `@nylorun/runtime`: the stack configuration reads its four listeners (`NYLORUN_LISTEN_*`, `NYLORUN_GATES_LISTEN_*`, `NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_EGRESS_LISTEN_*`) with one parser; the variables and their errors are unchanged.
+
+- 34d1a81: A commit can no longer lose its wake. A transaction that asks for an advance writes the wake to the Session Store's wake outbox (`Tx.wake`, migration `0017_wake_outbox` adds `nylorun.wakes`) and sends it to Durable Session Execution after commit, with an idempotency key (the wake's dedupe key, or one made from its row), deleting the row once Restate accepted it. A send that fails, or that a crash between the commit and the send cut off, is sent again by the Tenant sweep under the same key: on a process's first pass for any row, then for rows older than 2 s. Restate deduplicates the repeat, so a wake whose answer was lost runs one advance. The sweep's orphan scan no longer delivers lost wakes: it runs on a process's first pass and then once a minute, as the backstop for what the execution itself lost (Restate state wiped, an invocation killed, an in-process execution's queue). Restate owns when a session runs (wakes, one advance per session, retries, timers); the Session Store owns what happened (checkpoint, effect journal, events, the lease's epoch and the outbox), as `src/CONTEXT.md` and `adapters/execution/restate.ts` now describe. A Runtime of the previous beta refuses the migrated database (`schema-too-new`); while processes of both run, the old ones send wakes as before.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [417f336]
+- Updated dependencies [6fecd4c]
+- Updated dependencies [7780b2f]
+- Updated dependencies [070674d]
+- Updated dependencies
+  - @nylorun/core@0.18.0-beta
+  - @nylorun/harness@0.25.0-beta
+
+## 0.21.0-beta
+
+### Major Changes
+
+- 50e2f7e: **Protocol 10: MCP credentials come from a session's vaults only.** Nylorun no longer signs the installation in to MCP servers with OAuth and no longer asks a credential resolver. Upgrade every package together; MIGRATION.md has the details.
+
+  - **Breaking (`@nylorun/runtime`): the MCP OAuth connect is gone.** `POST /v1/tenant/vaults/{vaultId}/oauth/start` and `GET /v1/oauth/callback` answer `404`. The vault credential type `oauth` and its refresh are gone: a credential is a `bearer` token or a `headers` map bound to a URL. Migration `0016_mcp_oauth_removed` drops the table of pending connects and deletes every `oauth` credential, writing one audit row each (actor `migration`); the Runtime logs `oauth_credential_removed` once for each, naming its vault, id and URL.
+  - **Breaking (`@nylorun/runtime`): the credential resolver is gone.** The gateway no longer asks the operator's resolver for a person's credential when the session's vaults hold none. A process that still sets a `NYLORUN_RESOLVER_*` variable logs `resolver_removed` and ignores it. Keep a person's own keys in their user vault and attach it to their sessions (`vaultIds`). `TenantConfig.resolver`, `TenantConfig.publicUrl`, `TenantConfig.vaultFetch`, `startEphemeralRuntime({ resolver })`, the `ResolverConfig` export and `VaultService`'s `fetch` option are removed; `NYLORUN_PUBLIC_URL` still sets the protected resource metadata's `resource`.
+  - **Breaking (`@nylorun/core`):** `PROTOCOL_VERSION` is 10 and `HOST_PROTOCOL` 4–10. `StartOAuthRequest`, `StartOAuthResponse`, the `oauth` variants of `CreateCredentialRequest` and `RotateCredentialRequest`, `oauth` in `CredentialInfo.type` and `CredentialInfo.expiresAt` are removed, and `ERROR_CODES` drops `oauth_client_required`, `oauth_state_invalid` and `oauth_failed`. `@nylorun/agents` and `@nylorun/cli` send protocol 10.
+  - **Breaking (`@nylorun/admin`):** `admin.vaults` loses its OAuth start method.
+  - **Breaking (`nylorun`):** the `connect` subcommand of `nylorun mcp` is removed (`nylorun mcp inspect` lists a server's tools instead), and the gateway's Compose service no longer passes the `NYLORUN_RESOLVER_*` variables.
+  - `@nylorun/studio`: the Credentials page loses the OAuth type, the Expires column and the OAuth connect hint.
+
+### Minor Changes
+
+- e0e39ff: **Header map, gateway and identity header credentials; `credential_rejected` on a `401`** (R2b C1, C2). For remote MCP servers and HTTP tools alike, in installation and user vaults. MIGRATION.md (protocol 10, "Header and gateway credentials" and "Tool errors the model sees") has the details.
+
+  - `@nylorun/core`: `CreateCredentialRequest` and `RotateCredentialRequest` gain `type: "headers"` with a `headers` map, and optional `via` (where requests go, such as a gateway: `https`, or `http` to a loopback host, with no userinfo, query string or fragment) and `identity: { header }` on both kinds; a rotation may change them, and `null` removes one. `CredentialInfo` gains `headers` in its type, `headerNames`, `via` and `identity`, never a value. `ERROR_CODES` gains `credential_rejected`, and `tool.completed`'s `error` documents `server` and `vault`. The admin client's vault methods take the new bodies through these types.
+  - `@nylorun/runtime`: a `headers` credential is sealed like a token and sends every header in its map; the transport's headers, `Idempotency-Key` and `Nylorun-*` are refused (`400`), and a credential header replaces a manifest header of the same name. A credential with `via` sends the server's requests there, while the manifest's URL still picks the credential and names the tools. An identity header carries the session owner's subject from the session record, and is left out for a session owned by `installation`. A `401` from an MCP server or HTTP tool is a failed tool call with code `credential_rejected` that the model sees, never retried and never `uncertain`. `via`, `identity` and the header names are stored unsealed in the credential's binding: no migration.
+  - `@nylorun/studio`: the Credentials page adds Bearer or Headers credentials (name and value rows), with an optional gateway URL and identity header, and shows them without values.
+
+- 18f9a2f: **Model-safe MCP tool names, coded MCP tool errors and credential scrubbing** (R2b C6, C7, C8). MIGRATION.md (protocol 10, "Tool and MCP server names" and "Tool errors the model sees") has the details.
+
+  - `@nylorun/core`: a declared tool's name and an MCP server's name must match `^[A-Za-z0-9_-]{1,64}$` (`AgentManifestSchema`, so `PUT /v1/agents/{id}` refuses others). `mcp.discovered`'s server outcomes gain `renamed: [{ serverToolName, name }]`; `tool.completed` gains `redacted` and its `error` gains `retryable`. A failed `ToolOutcome` and `ToolResult` may carry `retryable`.
+  - `@nylorun/harness`: a failed tool result keeps the outcome's `retryable`, and the model sees it beside `code` and `message`.
+  - `@nylorun/runtime`: the model knows an MCP tool by `server__tool` with characters outside `[A-Za-z0-9_-]` replaced by `_`, shortened to 64 with an 8-hex SHA-256 suffix (also given to a renamed tool that collides); the server is still called by its own name. A failed MCP tool call is a failed tool result the model sees, with code `mcp.unreachable` (never sent; retryable), `credential_rejected` (`401`), `mcp.forbidden` (`403`), `mcp.error` (a JSON-RPC error) or `mcp.status` (another HTTP status); a call whose answer was lost after it was sent is `mcp.lost` for a `readOnlyHint` or `idempotentHint` tool and stays `uncertain` otherwise, as does a call lost with a gateway restart. A pooled connection whose server ended its session (`404` to its `Mcp-Session-Id`) or whose credential's `via` moved is dropped, opened again, and the call sent once more, since the tool never saw it. The credential values sent on a call (at least 8 characters, and a `Bearer` value's token) are replaced with `[redacted]` in MCP and HTTP tool results and errors before the gate records or returns them; no other field is touched.
+
+- da93711: **Preview an MCP server's tools** (R2b C12). MIGRATION.md (protocol 10, "Previewing a server's tools") has the details.
+
+  - `@nylorun/core`: `McpPreviewRequestSchema` and `McpPreviewSchema` (`McpPreviewTool`), and the error code `mcp_preview_failed`.
+  - `@nylorun/runtime`: `POST /v1/tenant/mcp/preview` (the Management API) connects to a remote MCP server with the installation vault's credential for its URL (headers and `via`, no identity header), under the Host's address policy and within 15 s, and answers its server info, instructions, tools (model names, annotations, schema sizes) and renames; a `401` is `authRequired`, with the server's RFC 9728 protected-resource metadata. It runs in the keys service (`Keys.previewMcp`), which holds the plaintext, and calls no tool. Both OpenAPI documents list it.
+  - `@nylorun/admin`: `admin.mcp.preview({ url, type?, name?, vaultId? })`.
+  - `nylorun`: `nylorun mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--json]` prints the running Tenant's preview: a table of tools, the renames, or that the server needs a person's sign-in. Its `connect` subcommand still says it was removed, and now points to `inspect`.
+  - `@nylorun/studio`: **Preview tools** on each credential of the Credentials page lists the tools behind its URL.
+
+- 90a817d: **MCP and HTTP tool results that fit** (R2b C11). MIGRATION.md (protocol 10, "Tool results that fit") has the details.
+
+  - `@nylorun/core`: a completed `ToolOutcome` may carry `files` (`ToolResultFile`: a media type and the host's reference) and `truncated`; a completed `ToolResult` carries the `files`. `artifactsCapabilityManifest({ save, read })` adds the built-in `read_artifact` (`READ_ARTIFACT_TOOL`, `READ_ARTIFACT_MAX_BYTES`), and `codeToolsOf` leaves it alone. `SessionView` gains `definitionHash`, the definition the session was opened from. Transcript edits are split at 48 KiB, down from 256 KiB, so each `transcript.updated` event stays under 64 KiB when no entry is larger.
+  - `@nylorun/harness`: a tool result's files go to the model after its output, as media parts; an outcome marked `truncated` is not checked against the tool's output schema.
+  - `@nylorun/runtime`: an agent's remote MCP or HTTP tool result past 32 KiB is stored as a file artifact of the session, and the model gets `{ truncated: true, artifactId, size, preview }` (the first 4 KiB and the last 1 KiB). Image, audio and blob resource parts become artifacts too, an image also shown to a model that reads images (a note for one that does not); each part of a mixed result is shaped alone, and a `resource_link` stays a link. One step's results share a 256 KiB budget, so many parallel results never make an event near S2's 1 MiB record: past it, a result is a stub naming its artifact. When an artifact cannot be stored, the preview stays and `dropped` says why. An MCP answer past 8 MiB is `mcp.too-large`. `read_artifact { artifactId, offset?, length? }` reads 32 KiB of the session's own artifact a call, with or without a sandbox: a session gets it for each agent with an MCP server or an HTTP tool. The session view names its `definitionHash`.
+  - `@nylorun/studio`: a session is shown as running an older manifest only when the definition it was opened from is not the registered one, not because the Runtime pinned its own tools (a sandbox's, `save_artifact`, `read_artifact`) beside it.
+
+- b8d10cb: **Per-tool MCP settings (manifest v6) and deferred tools** (R2b C9, C10). MIGRATION.md (protocol 10, "Per-tool settings and manifest v6" and "Deferred tools") has the details.
+
+  - `@nylorun/core`: an MCP server takes `tools` (`McpToolSettings` by the server's own tool name, `"*"` for the rest: `enabled`, `approval`, `deferred`) and `deferred`, in manifest v6. `mcp()` and `Agent.mcp()` accept them, and the builder writes v6 only for a manifest that uses them, so other manifests keep their hashes; `AgentManifestSchema` accepts v5 unchanged and refuses the fields in v5. `mcpToolSettings` resolves a tool's settings, `manifestVersionFor` says which version a definition needs. `isVariantOf` lets a turn variant disable an MCP tool or require its approval, and nothing else. `TOOLS_CAPABILITY_ID`, `TOOL_SEARCH_TOOL`, `TOOL_CALL_TOOL`, `deferredToolsTools` and `deferredToolsInstructions` describe `tool_search` and `tool_call`. A session tool may carry instructions, read with its capability's. `mcp.discovered` gains `deferred`, `disabled` and `unknownTools` per server.
+  - `@nylorun/harness`: a session tool marked `deferred` stays out of the model's tool list; `tool_call` runs it as its own call, after checking the arguments against its `inputSchema`, and asks for approval when it needs it.
+  - `@nylorun/runtime`: discovery leaves out the tools a server's settings disable and names keys that match no tool. A session of an agent with a remote MCP server pins an empty `nylorun.tools` capability; when the agent's MCP tools pass a tenth of the model's context window (or settings say so), they are deferred for the session's life, and the model gets `tool_search` (BM25 over the deferred tools' names and descriptions, served by core) and `tool_call`, with a note naming each server and its instructions. Approval resolves per tool, and a turn variant's tightening applies to its turn. The gate's `mcp/connect` answers the server's instructions.
+
+### Patch Changes
+
+- fed5e58: **Docs: reaching a person's accounts** (R2b C5). The READMEs describe MCP credentials as protocol 10 has them (a `bearer` token or a `headers` map per URL, with `via` and an identity header for an MCP gateway), and point to "MCP servers and HTTP tools" in DEPLOYMENT.md: the operator's flow from credential to preview, tool settings, deferral, stored results and the error codes a model sees, with gateway recipes for Arcade, ToolHive, Obot and Nylorun Cloud and the proxy pattern for gateways that mint per person. `HttpToolTarget.credential`'s doc (`@nylorun/core`) no longer names the removed credential resolver.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [50e2f7e]
+- Updated dependencies [e0e39ff]
+- Updated dependencies [fed5e58]
+- Updated dependencies [18f9a2f]
+- Updated dependencies [da93711]
+- Updated dependencies [90a817d]
+- Updated dependencies [b8d10cb]
+- Updated dependencies
+  - @nylorun/core@0.17.0-beta
+  - @nylorun/harness@0.24.0-beta
+
 ## 0.20.0-beta
 
 ### Major Changes

package/README.md

@@ -42,8 +42,10 @@ whose key the admin key derives (the only derived key). Management keys come fro
 rotates and deletes the Tenant's application keys (`PUT /v1/tenant/keys/{keyId}`); a rotated
 or deleted key stops authenticating at once. A database written by a Runtime that kept several Tenants in one
 database (`tenant_<id>` schemas), or by a pre-release build of one Tenant per database
-(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time and holds the Tenant's sweep
-timer (Durable Session Execution); every session's events are relayed from the record to
+(`schema_version` tables), is refused: this release starts fresh on a new database. Restate runs one advance of a session at a time, delivers its wakes and holds
+its timers and the Tenant's sweep (Durable Session Execution), and journals no effect:
+checkpoints, effects, events and the wake outbox are the Session Store's, and a wake is
+written to the outbox in the transaction that causes it, so a commit never loses it; every session's events are relayed from the record to
 its own S2 stream, which history and SSE read (Durable Streams). One image runs every **service**,
 and `--service` picks what a process runs: `core` serves the Runtime API, the
 Management API and SSE and runs the stream relay, `loop` runs advances (the Worker), and
@@ -86,11 +88,13 @@ is refused with `409 run_stale`. A `gates` process needs only
 `NYLORUN_DATABASE_URL`, `NYLORUN_GATES_TOKEN`, its listener
 (`NYLORUN_GATES_LISTEN_HOST`, `NYLORUN_GATES_LISTEN_PORT`, default 4100, and
 `NYLORUN_GATES_ALLOWED_HOSTS`) and the Host's `tenant/` directory, which it
-never writes; it serves the database's one Tenant. `NYLORUN_RESOLVER_URL` and
-`NYLORUN_RESOLVER_TOKEN` (both or neither, gates only) name the operator's
-credential resolver, which the gate asks for a person's MCP credential when the
-session's vaults hold none ([DEPLOYMENT.md](../DEPLOYMENT.md#credentials)); an
-embedding or `startEphemeralRuntime` takes `resolver: { url, token }` instead. With `egress`
+never writes; it serves the database's one Tenant. A session's MCP servers and
+HTTP tools get their credentials from its attached vaults only: a `bearer` token
+or a `headers` map per URL, sent to an MCP gateway instead when it has `via`,
+with the session owner in its identity header
+([DEPLOYMENT.md](../DEPLOYMENT.md#mcp-servers-and-http-tools)); the credential resolver is gone
+(protocol 10), and a process that still sets a `NYLORUN_RESOLVER_*` variable logs
+`resolver_removed` and ignores it. With `egress`
 (`--service gates,keys,egress`, for pod sandboxes) the same process runs
 egress-gate on `NYLORUN_EGRESS_LISTEN_HOST`:`NYLORUN_EGRESS_LISTEN_PORT`
 (default `0.0.0.0:4200`): a CONNECT proxy that admits a pod's egress token and
@@ -142,8 +146,6 @@ The Host root is `NYLORUN_HOME` or `~/.nylorun` (for a local Tenant,
 | `/v1/*` Runtime API routes (all but `/v1/tenant/*`) | application key or trusted issuer's token | Require `Nylorun-Protocol`; nothing names the Tenant. A management key is `403 key_role_mismatch`, except on `/v1/me` and the public `GET /v1/access/jwks` |
 | `/v1/tenant/*` Management API routes | management key | Require `Nylorun-Protocol`. An application key, alone or acting for a subject, is `403 key_role_mismatch`; a management key with `Nylorun-Subject` or `Nylorun-Scopes` is `403 subject_invalid` |
 | `PUT /v1/tenant/keys/{keyId}` | management key | Creates application key `keyId` or rotates it, and returns it once; `GET /v1/tenant/keys` lists every key (id, role, when issued, never the keys) and `DELETE` deletes one. `studio`, `bootstrap` and management keys are refused |
-| `POST /v1/tenant/vaults/{vaultId}/oauth/start` | management key | MCP OAuth connect into an installation vault (F9 C2): `{url, server, clientId?}` → `{authorizeUrl, expiresAt}`; the gateway's keys module does discovery, registration and the exchange. `oauth_client_required` without DCR or a `clientId` |
-| `GET /v1/oauth/callback` | the `state` itself | Where the authorization server sends the browser back: no credential, no `Nylorun-Protocol`; finishes the connect once (`oauth_state_invalid` after) and answers a small HTML page. Its base is `NYLORUN_PUBLIC_URL`, else the start request's origin |
 | `GET /v1/artifact-links/{token}` | the link itself | A capability link to one artifact version (protocol 6): no credential, no `Nylorun-Protocol`, Range supported; a folder's link opens its zip, or one of its files |
 
 Every route checks `Host` first (`421 host_rejected`) and rejects non-JSON bodies
@@ -155,8 +157,10 @@ are refused from browsers before they are looked up. The Runtime sends no CORS h
 `OPTIONS` with `204` and `Allow` only: the operator's reverse proxy answers preflights
 ([DEPLOYMENT.md](../DEPLOYMENT.md#calling-the-runtime-from-browsers-and-apps)). Missing or
 unsupported protocol → `426` before authentication, unless the request sends neither
-`Nylorun-Protocol` nor `Authorization` (the Host serves protocols 4 to 9; protocol 9 makes the
-Runtime API an OAuth 2.1 resource server: a missing or rejected credential is `401
+`Nylorun-Protocol` nor `Authorization` (the Host serves protocols 4 to 10; protocol 10 removes
+the MCP OAuth connect, the vault's `oauth` credentials and the credential resolver, and adds
+`headers` credentials, `via` and the identity header, manifest v6 and
+`POST /v1/tenant/mcp/preview`; protocol 9 makes the Runtime API an OAuth 2.1 resource server: a missing or rejected credential is `401
 credential_required` or `credential_invalid` with a `WWW-Authenticate: Bearer` challenge, a
 token without a route's scope gets `error="insufficient_scope"`, and
 `/.well-known/oauth-protected-resource` lists the trusted issuers (RFC 9728); protocol 8 gives keys roles, moves vaults and signing keys under `/v1/tenant` and removes
@@ -239,7 +243,10 @@ Save agents with `PUT /v1/agents/{agentId}` using the application principal (`sa
 in `@nylorun/agents`). The Runtime runs the agent from its manifest and never calls your
 code during a session: a definition with a tool that would (`tool({ run })`, a flow's tool
 stage) is refused. Your services are reached as tools: HTTP tools, POSTed from the Runtime,
-so their URLs must be reachable from it, and remote MCP servers. Model gateway
+so their URLs must be reachable from it, and remote MCP servers. The operator gives
+each URL a vault credential, previews an MCP server's tools (`nylorun mcp inspect`),
+and the manifest says which tools are enabled, need approval or are deferred
+([DEPLOYMENT.md](../DEPLOYMENT.md#mcp-servers-and-http-tools)). Model gateway
 and sandbox backend are Tenant configuration (vault / seed), not Host process
 env.
 

package/dist/adapters/execution/restate.js

@@ -25,7 +25,32 @@
  *   What a run answers arms its timers and its retry.
  *
  * Wakes, sandbox reconciles, timers and sweep arming go through the ingress as one-way
- * sends, so an API node can call them without ever calling `start`.
+ * sends, so an API node can call them without ever calling `start`. A wake a commit asked for
+ * comes from the Session Store's wake outbox (`Tx.wake`) with an idempotency key, so a send
+ * repeated after its answer was lost causes no second advance.
+ *
+ * ## What Restate owns, and what the Session Store owns
+ *
+ * Restate owns when a session runs: it delivers each wake at least once, deduped by its
+ * key for `dedupeRetentionMs`; runs at most one invocation per key at a time; retries an
+ * invocation whose attempt failed, so an advance whose Worker died runs again and takes the
+ * session over (§11.4); and keeps every timer: the busy re-wake, `NylorunTimer`,
+ * `NylorunSandbox` and the `NylorunTenant` sweep chain. The Session Store (Postgres) owns
+ * what happened: the checkpoint, the effect journal (`harness-api/record.ts`), the events
+ * (the Record), and the wake outbox that hands each committed wake to Restate. Restate
+ * journals no effect: an effect's intent and outcome commit with the session's events in
+ * one transaction, under the advance's lease, and remote harnesses and pod engines write
+ * them too, over the Harness API.
+ *
+ * Two Session Store mechanisms overlap Restate on purpose:
+ *
+ * - **The lease and its epoch** (§10.6). Restate's one invocation per key holds for an
+ *   attempt, not for the code it started: an attempt that ends (abort timeout, a dropped
+ *   connection) is retried while the previous attempt's handler may still run on its Worker,
+ *   and a remote harness or pod engine may still hold the run. The epoch fences their writes,
+ *   and `busy` answers the overlap.
+ * - **The advance deadline** (`tenant/worker.ts`). Restate's abort timeout does not stop a
+ *   running handler, so the Worker bounds each advance itself, below `timeouts`.
  */
 import { createServer } from "node:http2";
 import * as restate from "@restatedev/restate-sdk";

package/dist/api/components.d.ts

@@ -11,6 +11,7 @@ export declare const Rejected: z.ZodObject<{
     code: z.ZodEnum<{
         connection_missing: "connection_missing";
         credential_invalid: "credential_invalid";
+        credential_rejected: "credential_rejected";
         credential_required: "credential_required";
         definition_files_missing: "definition_files_missing";
         host_rejected: "host_rejected";
@@ -20,10 +21,8 @@ export declare const Rejected: z.ZodObject<{
         issuer_unavailable: "issuer_unavailable";
         key_role_mismatch: "key_role_mismatch";
         limit_exceeded: "limit_exceeded";
+        mcp_preview_failed: "mcp_preview_failed";
         not_found: "not_found";
-        oauth_client_required: "oauth_client_required";
-        oauth_failed: "oauth_failed";
-        oauth_state_invalid: "oauth_state_invalid";
         origin_rejected: "origin_rejected";
         placement_refused: "placement_refused";
         protocol_unsupported: "protocol_unsupported";
@@ -522,6 +521,7 @@ export declare const SessionView: z.ZodObject<{
     agentId: z.ZodString;
     ownerUserId: z.ZodString;
     manifestHash: z.ZodString;
+    definitionHash: z.ZodOptional<z.ZodString>;
     implementationVersion: z.ZodString;
     status: z.ZodEnum<{
         cancelled: "cancelled";
@@ -1594,7 +1594,14 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }>;
             message: z.ZodString;
             tools: z.ZodNumber;
+            deferred: z.ZodOptional<z.ZodNumber>;
+            disabled: z.ZodOptional<z.ZodNumber>;
+            unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                serverToolName: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$loose>>>;
         }, z.core.$loose>>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
@@ -2119,7 +2126,14 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodString;
             message: z.ZodString;
+            server: z.ZodOptional<z.ZodString>;
+            vault: z.ZodOptional<z.ZodEnum<{
+                installation: "installation";
+                user: "user";
+            }>>;
+            retryable: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$loose>>;
+        redacted: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -3400,7 +3414,14 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             }>;
             message: z.ZodString;
             tools: z.ZodNumber;
+            deferred: z.ZodOptional<z.ZodNumber>;
+            disabled: z.ZodOptional<z.ZodNumber>;
+            unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
             credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                serverToolName: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$loose>>>;
         }, z.core.$loose>>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
@@ -3925,7 +3946,14 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         error: z.ZodOptional<z.ZodObject<{
             code: z.ZodString;
             message: z.ZodString;
+            server: z.ZodOptional<z.ZodString>;
+            vault: z.ZodOptional<z.ZodEnum<{
+                installation: "installation";
+                user: "user";
+            }>>;
+            retryable: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$loose>>;
+        redacted: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;
 }, z.core.$strip> | z.ZodObject<{
     schema: z.ZodLiteral<"nylorun.event/2">;
@@ -5209,7 +5237,14 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 }>;
                 message: z.ZodString;
                 tools: z.ZodNumber;
+                deferred: z.ZodOptional<z.ZodNumber>;
+                disabled: z.ZodOptional<z.ZodNumber>;
+                unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    serverToolName: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$loose>>>;
             }, z.core.$loose>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
@@ -5734,7 +5769,14 @@ export declare const SessionItemsResponse: z.ZodObject<{
             error: z.ZodOptional<z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
+                server: z.ZodOptional<z.ZodString>;
+                vault: z.ZodOptional<z.ZodEnum<{
+                    installation: "installation";
+                    user: "user";
+                }>>;
+                retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
+            redacted: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -7015,7 +7057,14 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 }>;
                 message: z.ZodString;
                 tools: z.ZodNumber;
+                deferred: z.ZodOptional<z.ZodNumber>;
+                disabled: z.ZodOptional<z.ZodNumber>;
+                unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    serverToolName: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$loose>>>;
             }, z.core.$loose>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
@@ -7540,7 +7589,14 @@ export declare const SessionItemsResponse: z.ZodObject<{
             error: z.ZodOptional<z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
+                server: z.ZodOptional<z.ZodString>;
+                vault: z.ZodOptional<z.ZodEnum<{
+                    installation: "installation";
+                    user: "user";
+                }>>;
+                retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
+            redacted: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -8305,28 +8361,21 @@ export declare const CreateCredentialRequest: z.ZodObject<{
     idempotencyKey: z.ZodString;
     name: z.ZodString;
     auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        via: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+        }, z.core.$strict>>;
         type: z.ZodLiteral<"bearer">;
         url: z.ZodString;
         token: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
-        type: z.ZodLiteral<"oauth">;
-        url: z.ZodString;
-        accessToken: z.ZodString;
-        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-        refresh: z.ZodOptional<z.ZodObject<{
-            tokenEndpoint: z.ZodString;
-            clientId: z.ZodString;
-            refreshToken: z.ZodString;
-            tokenEndpointAuth: z.ZodDiscriminatedUnion<[z.ZodObject<{
-                type: z.ZodLiteral<"none">;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"client_secret_basic">;
-                clientSecret: z.ZodString;
-            }, z.core.$strict>, z.ZodObject<{
-                type: z.ZodLiteral<"client_secret_post">;
-                clientSecret: z.ZodString;
-            }, z.core.$strict>], "type">;
+        via: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
         }, z.core.$strict>>;
+        type: z.ZodLiteral<"headers">;
+        url: z.ZodString;
+        headers: z.ZodRecord<z.ZodString, z.ZodString>;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const CredentialInfo: z.ZodObject<{
@@ -8335,12 +8384,16 @@ export declare const CredentialInfo: z.ZodObject<{
     name: z.ZodString;
     type: z.ZodEnum<{
         bearer: "bearer";
-        oauth: "oauth";
+        headers: "headers";
     }>;
     binding: z.ZodObject<{
         url: z.ZodString;
     }, z.core.$strict>;
-    expiresAt: z.ZodOptional<z.ZodString>;
+    headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    via: z.ZodOptional<z.ZodString>;
+    identity: z.ZodOptional<z.ZodObject<{
+        header: z.ZodString;
+    }, z.core.$strict>>;
     createdAt: z.ZodString;
     rotatedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -8351,12 +8404,16 @@ export declare const ListCredentialsResponse: z.ZodObject<{
         name: z.ZodString;
         type: z.ZodEnum<{
             bearer: "bearer";
-            oauth: "oauth";
+            headers: "headers";
         }>;
         binding: z.ZodObject<{
             url: z.ZodString;
         }, z.core.$strict>;
-        expiresAt: z.ZodOptional<z.ZodString>;
+        headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        via: z.ZodOptional<z.ZodString>;
+        identity: z.ZodOptional<z.ZodObject<{
+            header: z.ZodString;
+        }, z.core.$strict>>;
         createdAt: z.ZodString;
         rotatedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
@@ -8365,26 +8422,60 @@ export declare const RotateCredentialRequest: z.ZodObject<{
     requestId: z.ZodString;
     idempotencyKey: z.ZodString;
     auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        via: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        identity: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            header: z.ZodString;
+        }, z.core.$strict>>>;
         type: z.ZodLiteral<"bearer">;
         token: z.ZodString;
     }, z.core.$strict>, z.ZodObject<{
-        type: z.ZodLiteral<"oauth">;
-        accessToken: z.ZodString;
-        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        via: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        identity: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            header: z.ZodString;
+        }, z.core.$strict>>>;
+        type: z.ZodLiteral<"headers">;
+        headers: z.ZodRecord<z.ZodString, z.ZodString>;
     }, z.core.$strict>], "type">;
 }, z.core.$strict>;
-export declare const StartOAuthRequest: z.ZodObject<{
-    url: z.ZodString;
-    server: z.ZodString;
-    clientId: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export declare const StartOAuthResponse: z.ZodObject<{
-    authorizeUrl: z.ZodString;
-    expiresAt: z.ZodString;
-}, z.core.$strict>;
 export declare const DeletedResponse: z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strict>;
+export declare const McpPreviewRequest: z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+    type: z.ZodOptional<z.ZodEnum<{
+        sse: "sse";
+        "streamable-http": "streamable-http";
+    }>>;
+    name: z.ZodOptional<z.ZodString>;
+    vaultId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const McpPreview: z.ZodObject<{
+    name: z.ZodString;
+    url: z.ZodString;
+    type: z.ZodEnum<{
+        sse: "sse";
+        "streamable-http": "streamable-http";
+    }>;
+    credentialSent: z.ZodBoolean;
+    serverInfo: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    instructions: z.ZodOptional<z.ZodString>;
+    tools: z.ZodArray<z.ZodObject<{
+        serverToolName: z.ZodString;
+        modelName: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        schemaBytes: z.ZodNumber;
+    }, z.core.$strict>>;
+    renamed: z.ZodArray<z.ZodObject<{
+        serverToolName: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    authRequired: z.ZodOptional<z.ZodObject<{
+        resourceMetadataUrl: z.ZodOptional<z.ZodString>;
+        resourceMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export declare const Jwks: z.ZodObject<{
     keys: z.ZodArray<z.ZodObject<{
         kty: z.ZodLiteral<"EC">;
@@ -9506,7 +9597,14 @@ export declare const HistoryPage: z.ZodObject<{
                 }>;
                 message: z.ZodString;
                 tools: z.ZodNumber;
+                deferred: z.ZodOptional<z.ZodNumber>;
+                disabled: z.ZodOptional<z.ZodNumber>;
+                unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    serverToolName: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$loose>>>;
             }, z.core.$loose>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
@@ -10031,7 +10129,14 @@ export declare const HistoryPage: z.ZodObject<{
             error: z.ZodOptional<z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
+                server: z.ZodOptional<z.ZodString>;
+                vault: z.ZodOptional<z.ZodEnum<{
+                    installation: "installation";
+                    user: "user";
+                }>>;
+                retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
+            redacted: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;
@@ -11312,7 +11417,14 @@ export declare const HistoryPage: z.ZodObject<{
                 }>;
                 message: z.ZodString;
                 tools: z.ZodNumber;
+                deferred: z.ZodOptional<z.ZodNumber>;
+                disabled: z.ZodOptional<z.ZodNumber>;
+                unknownTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 credentialIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                renamed: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    serverToolName: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$loose>>>;
             }, z.core.$loose>>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
@@ -11837,7 +11949,14 @@ export declare const HistoryPage: z.ZodObject<{
             error: z.ZodOptional<z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
+                server: z.ZodOptional<z.ZodString>;
+                vault: z.ZodOptional<z.ZodEnum<{
+                    installation: "installation";
+                    user: "user";
+                }>>;
+                retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
+            redacted: z.ZodOptional<z.ZodNumber>;
         }, z.core.$loose>;
     }, z.core.$strip> | z.ZodObject<{
         schema: z.ZodLiteral<"nylorun.event/2">;

package/dist/api/components.js

@@ -5,7 +5,7 @@
  * global registry.
  */
 import { z } from "zod";
-import { SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, SandboxPageSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, StartOAuthRequestSchema, StartOAuthResponseSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
+import { SessionListItemSchema, ModelCallSchema, SessionPageSchema, SessionManifestViewSchema, HistoryPageSchema, SessionUsageTotalsSchema, ModelCallsPageSchema, ModelCallExportPageSchema, SandboxPageSchema, JwksSchema, SigningKeyListSchema, SigningKeyViewSchema, RotateSigningKeysRequestSchema, RevokeSigningKeyRequestSchema, MeResponseSchema, TenantStatusSchema, ResetTenantRequestSchema, ResetTenantResponseSchema, SeedTenantConfigRequestSchema, SeedTenantConfigResponseSchema, HostModelCatalogSchema, TenantSandboxViewSchema, ModelUsageTotalsSchema, ModelBudgetsSchema, PutModelBudgetsRequestSchema, PutTenantSandboxRequestSchema, ListProvidersResponseSchema, HostModelViewSchema, PutHostModelRequestSchema, SelectHostModelRequestSchema, CreateVaultRequestSchema, VaultInfoSchema, ListVaultsResponseSchema, CreateCredentialRequestSchema, CredentialInfoSchema, ListCredentialsResponseSchema, RotateCredentialRequestSchema, McpPreviewRequestSchema, McpPreviewSchema, DeletedResponseSchema, ListAgentsResponseSchema, ListPublicAgentsResponseSchema, ListSessionsResponseSchema, LiveEventSchema, PutAgentRequestSchema, PutAgentResponseSchema, PutSessionRequestSchema, SessionItemsResponseSchema, SessionViewSchema, StreamClosedFrameSchema, AcceptedResponseSchema, SandboxToolOutcomeSchema, PutSandboxRequestSchema, SandboxViewSchema, ListSandboxesResponseSchema, DeleteSandboxResponseSchema, ListSandboxEventsResponseSchema, ArtifactViewSchema, ArtifactVersionViewSchema, ListArtifactsResponseSchema, UploadArtifactResponseSchema, DefinitionFileViewSchema, DeleteArtifactResponseSchema, CreateArtifactLinkRequestSchema, ArtifactLinkSchema, PutTenantArtifactsRequestSchema, TenantArtifactsViewSchema, ArtifactTreeSchema, ArtifactDiffSchema, SessionCommandSchema, ListOperatorKeysResponseSchema, PutOperatorKeyResponseSchema, DeleteOperatorKeyResponseSchema, OperatorKeySchema, ProtocolRejectedResponseSchema, RejectedResponseSchema, EVENT_SCHEMAS, EVENT_TYPES, } from "@nylorun/core/contracts";
 function named(id, schema) {
     return schema.meta({ id });
 }
@@ -76,9 +76,9 @@ export const CreateCredentialRequest = named("CreateCredentialRequest", CreateCr
 export const CredentialInfo = named("CredentialInfo", CredentialInfoSchema);
 export const ListCredentialsResponse = named("ListCredentialsResponse", ListCredentialsResponseSchema);
 export const RotateCredentialRequest = named("RotateCredentialRequest", RotateCredentialRequestSchema);
-export const StartOAuthRequest = named("StartOAuthRequest", StartOAuthRequestSchema);
-export const StartOAuthResponse = named("StartOAuthResponse", StartOAuthResponseSchema);
 export const DeletedResponse = named("DeletedResponse", DeletedResponseSchema);
+export const McpPreviewRequest = named("McpPreviewRequest", McpPreviewRequestSchema);
+export const McpPreview = named("McpPreview", McpPreviewSchema);
 export const Jwks = named("Jwks", JwksSchema);
 export const SigningKeyList = named("SigningKeyList", SigningKeyListSchema);
 export const SigningKeyView = named("SigningKeyView", SigningKeyViewSchema);

package/dist/api/http/app.js

@@ -20,6 +20,7 @@ import { fileRoutes } from "./routes/files.js";
 import { keyRoutes } from "./routes/keys.js";
 import { tenantRoutes } from "./routes/tenant.js";
 import { vaultRoutes } from "./routes/vaults.js";
+import { mcpRoutes } from "./routes/mcp.js";
 let app;
 /** The Tenant API, built on first use. */
 export function tenantApi() {
@@ -48,6 +49,7 @@ function build() {
     tenantRoutes(api);
     keyRoutes(api);
     vaultRoutes(api);
+    mcpRoutes(api);
     accessRoutes(api);
     meRoutes(api);
     agUiRoutes(api);

package/dist/api/http/routes/mcp.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A remote MCP server's tools before an agent names it (`POST /v1/tenant/mcp/preview`, R2b C12,
+ * the Management API): a management key (or Studio's key, acting as itself), as the vault routes
+ * take. The keys service runs it (`Keys.previewMcp`), since it sends an installation vault's
+ * credential; this process never reads the plaintext.
+ */
+import type { OpenAPIHono } from "@hono/zod-openapi";
+import type { TenantEnv } from "../app.js";
+export declare function mcpRoutes(api: OpenAPIHono<TenantEnv>): void;