@nylorun/runtime 0.21.1-beta → 0.23.0-beta

package/dist/tenant/sweep.js

@@ -4,26 +4,34 @@
  * and startup scan the Tenant runtime used to keep. It reconciles the Session Store with what
  * Durable Session Execution was asked to do; it never decides when a session advances:
  *
- * 1. **Wakes.** Wake outbox rows (`Tx.wake`) are delivered again and deleted: a delivery
- *    after commit that failed, or that a crash between the commit and the send cut off. The
- *    first pass on this process takes every row, so a previous process's are not left
- *    waiting; later passes take the rows older than `WAKE_GRACE_MS`. Each row carries the
- *    idempotency key it was first sent with, so a wake the execution did accept before the
- *    crash, or one still being sent after its commit, causes no second advance.
+ * 1. **Outbox.** Outbox rows (`Tx.wake`, `Tx.signalSandbox`) are delivered again and deleted:
+ *    a delivery after commit that failed, or that a crash between the commit and the send cut
+ *    off. The first pass on this process takes every row, so a previous process's are not
+ *    left waiting; later passes take those whose delivery after commit failed and those older
+ *    than `OUTBOX_GRACE_MS` (the database's clock), batch after batch within
+ *    `DRAIN_BUDGET_MS`. Each row carries the idempotency key it was first sent with, so a
+ *    request the execution did accept before the crash, or one still being sent after its
+ *    commit, runs once. Rows are delivered one by one: a row that fails is retried with
+ *    backoff and parked after `MAX_OUTBOX_ATTEMPTS` (`deliverOutbox`), and no delivery fails
+ *    the step.
  * 2. **Linked agents.** Pending workflow `agent` effects whose linked turn already settled
- *    are completed and the workflow is woken (a crash between the two, or data written by an
- *    older Runtime).
+ *    are completed and the workflow is woken. A linked turn's settle does both in its own
+ *    transaction; this is the backstop for one that settle left pending, such as an effect
+ *    an older Runtime wrote.
  * 3. **Orphaned sessions.** On this process's first pass for the Tenant, then at most every
  *    `ORPHAN_SCAN_MS`: `running` or `runnable` sessions with no owner, or an owner whose lease
- *    expired, are woken with reason `recover`. Neither a lost wake (step 1) nor a Worker that
- *    died mid-advance (the execution retries that advance, which takes over, §11.4) needs it:
- *    it is the backstop for what the execution itself lost or ended without an advance, such
- *    as an in-process execution's queue when its process stopped, an advance for a Tenant not
- *    open on its Worker, an invocation an operator killed, or Restate's state wiped (§17.11).
+ *    expired, are woken with reason `recover`, page by page within `DRAIN_BUDGET_MS`; a scan
+ *    the budget cut short goes on at the next pass. Neither a lost wake (step 1) nor a Worker
+ *    that died mid-advance (the execution retries that advance, which takes over, §11.4)
+ *    needs it: it is the backstop for what the execution itself lost or ended without an
+ *    advance, such as an in-process execution's queue when its process stopped, an advance
+ *    for a Tenant not open on its Worker, an invocation an operator killed, Restate's state
+ *    wiped (§17.11), or a parked outbox row.
  * 4. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
  *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
  *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
- *    workspaces). Idle MCP connections of the in-process harness are closed.
+ *    workspaces). Idle MCP connections of the in-process harness are closed. As often as the
+ *    orphan scan, pod sandboxes whose change stalled get a reconcile (`reconcileStalePods`).
  * 5. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
  *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
  * 6. **Hooks.** Callbacks registered with `ctx.onSweep`.
@@ -38,14 +46,28 @@ const BATCH = 100;
 /** How long a control signal is kept after it was written. */
 const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
 /**
- * How old a wake outbox row is before the sweep delivers it: longer than a delivery after
- * commit takes, so the sweep seldom sends a wake its commit is still sending. Sending one
- * twice is harmless either way (the idempotency key).
+ * How old an outbox row is before the sweep delivers it, unless its delivery after commit
+ * already failed (then it is due at once): longer than that delivery can take with its
+ * retries, so the sweep does not send again, and double the load on, an execution that is
+ * only slow. Sending one twice is harmless either way (the idempotency key).
+ */
+export const OUTBOX_GRACE_MS = 30_000;
+/**
+ * How often the orphan scan, and the stale pod sandbox check, run after the first pass of a
+ * Tenant opened on this process.
  */
-export const WAKE_GRACE_MS = 2000;
-/** How often the orphan scan runs after the first pass of a Tenant opened on this process. */
 export const ORPHAN_SCAN_MS = 60_000;
-/** Each open Tenant's sweep state on this process: when its orphan scan last ran. */
+/**
+ * How long one pass may spend draining the outbox, and paging through orphaned sessions.
+ * A backlog is worked off over several passes rather than holding one (and with it the
+ * Tenant's sweep object in the execution) for long.
+ */
+export const DRAIN_BUDGET_MS = 2000;
+/**
+ * Each open Tenant's sweep state on this process: when its last orphan scan finished, the
+ * last session id of one that ran out of budget, which the next pass goes on from, and when
+ * the stale pod sandbox check last ran.
+ */
 const passes = new WeakMap();
 export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
@@ -54,20 +76,22 @@ export async function sweep(ctx) {
     const first = !passes.has(ctx);
     const pass = passes.get(ctx) ?? {};
     passes.set(ctx, pass);
-    const scanOrphans = pass.orphansAt === undefined || now.getTime() - pass.orphansAt >= ORPHAN_SCAN_MS;
+    const scanOrphans = pass.orphansAt === undefined ||
+        pass.orphansAfter !== undefined ||
+        now.getTime() - pass.orphansAt >= ORPHAN_SCAN_MS;
+    const checkPods = pass.podsAt === undefined || now.getTime() - pass.podsAt >= ORPHAN_SCAN_MS;
     const steps = [
-        [
-            "wakes",
-            () => deliverPendingWakes(ctx, first ? now : new Date(now.getTime() - WAKE_GRACE_MS)),
-        ],
+        ["outbox", () => deliverOutbox(ctx, first ? 0 : OUTBOX_GRACE_MS)],
         ["linked", () => reconcileLinkedAgents(ctx)],
         ...(scanOrphans
             ? [
                 [
                     "orphans",
                     async () => {
-                        await wakeOrphanedSessions(ctx, now);
-                        pass.orphansAt = now.getTime();
+                        const scan = await wakeOrphanedSessions(ctx, now, pass.orphansAfter);
+                        pass.orphansAfter = scan.next;
+                        if (scan.next === undefined)
+                            pass.orphansAt = now.getTime();
                     },
                 ],
             ]
@@ -80,7 +104,17 @@ export async function sweep(ctx) {
                 sandboxExists: async (id) => (await ctx.store.tx((t) => t.sandboxResource(id))) !== undefined,
             }),
         ],
-        ["pods", () => reconcileStalePods(ctx, now)],
+        ...(checkPods
+            ? [
+                [
+                    "pods",
+                    async () => {
+                        await reconcileStalePods(ctx, now);
+                        pass.podsAt = now.getTime();
+                    },
+                ],
+            ]
+            : []),
         // A harness elsewhere closes its own idle MCP connections.
         ["mcp", async () => ctx.mcp?.sweep()],
         [
@@ -107,53 +141,118 @@ export async function sweep(ctx) {
     if (failure)
         throw failure.error;
 }
+/** Failed deliveries after which the sweep parks an outbox row (`Tx.failOutbox`). */
+export const MAX_OUTBOX_ATTEMPTS = 10;
+/** How long after its first failed delivery the sweep tries a row again; doubled each time. */
+const RETRY_MS = 5000;
+const RETRY_MAX_MS = 10 * 60_000;
 /**
- * Deliver the wake outbox rows written before `before` (oldest first, one batch) and delete
- * the delivered ones. A row the Tenant declines (it is closing) stays. Returns the ids of the
- * rows delivered.
+ * Deliver the outbox rows that are due (`Tx.pendingOutbox`: older than `graceMs`, or whose
+ * delivery failed), oldest first, batch after batch until none is left or `budgetMs` is
+ * spent, and delete the delivered ones. Each row is delivered on its own: one that fails
+ * (Restate refuses it, or a Runtime that does not know a wake's reason) is tried again later,
+ * with backoff, so it never holds back the rows behind it, and after `MAX_OUTBOX_ATTEMPTS`
+ * failures it is parked: logged once, at error, and kept in the outbox for an operator. A
+ * parked wake's session is still re-woken by the orphan scan while it is runnable, and a
+ * parked sandbox signal's pod by the stale pod check. A row the Tenant declines (it is
+ * closing) stays as it is, and ends the drain. Never throws for a delivery; returns the rows
+ * delivered.
  */
-export async function deliverPendingWakes(ctx, before = new Date()) {
-    const pending = await ctx.store.tx((t) => t.pendingWakes(before, BATCH));
+export async function deliverOutbox(ctx, graceMs = 0, budgetMs = DRAIN_BUDGET_MS) {
+    const deadline = Date.now() + budgetMs;
     const delivered = [];
-    try {
-        for (const row of pending)
-            if ((await ctx.wake(row.sessionId, row.wake)) !== false)
-                delivered.push(row.id);
-    }
-    finally {
-        // Delivered ones go even when a later one fails, so they are not sent again.
-        if (delivered.length > 0)
-            await ctx.store.tx((t) => t.deleteWakes(delivered));
+    for (;;) {
+        const pending = await ctx.store.tx((t) => t.pendingOutbox(graceMs, BATCH));
+        const batch = [];
+        let done = pending.length < BATCH;
+        try {
+            for (const row of pending) {
+                if (Date.now() >= deadline) {
+                    done = true;
+                    break;
+                }
+                let accepted;
+                try {
+                    accepted = await ctx.send(row.request);
+                }
+                catch (error) {
+                    await failed(ctx, row, error);
+                    continue;
+                }
+                if (accepted)
+                    batch.push(row);
+                else
+                    done = true;
+            }
+        }
+        finally {
+            // Delivered ones go even when a later step fails, so they are not sent again.
+            if (batch.length > 0)
+                await ctx.store.tx((t) => t.deleteOutbox(batch));
+        }
+        delivered.push(...batch);
+        if (done)
+            return delivered;
     }
-    return delivered;
+}
+/** Records a failed delivery of `row`: retried with backoff, parked after the last attempt. */
+async function failed(ctx, row, error) {
+    const attempts = row.attempts + 1;
+    const park = attempts >= MAX_OUTBOX_ATTEMPTS;
+    const retryInMs = Math.min(RETRY_MS * 2 ** (attempts - 1), RETRY_MAX_MS);
+    await ctx.store.tx((t) => t.failOutbox(row, { retryInMs, park }));
+    const { request } = row;
+    const fields = {
+        rowId: row.id,
+        ...(request.kind === "wake"
+            ? { sessionId: request.sessionId, reason: request.wake.reason }
+            : { sandboxId: request.sandboxId, signal: request.signal.kind }),
+        attempts,
+        message: error instanceof Error ? error.message : String(error),
+    };
+    if (park)
+        ctx.config.logger.error("outbox row parked: its delivery keeps failing", fields);
+    else
+        ctx.config.logger.warn("outbox delivery failed; the sweep tries it again", fields);
 }
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export async function reconcileLinkedAgents(ctx) {
     const { store } = ctx;
     const effects = await store.tx((t) => pendingAgentEffects(t));
     for (const effect of effects)
-        await store.tx((t) => reconcilePendingAgentEffect({
-            t,
-            effectId: effect.request.effectId,
-            schedule: ctx.wake,
-        }));
+        await store.tx((t) => reconcilePendingAgentEffect({ t, effectId: effect.request.effectId }));
 }
-/** Wake `running`/`runnable` sessions without a live owner. Returns the ids woken. */
-export async function wakeOrphanedSessions(ctx, now = new Date()) {
-    const orphans = await ctx.store.tx((t) => t.orphanedSessions(now, BATCH));
-    const ids = orphans.map((session) => session.id);
-    for (const id of ids)
-        await ctx.wake(id, { reason: "recover" });
-    return ids;
+/**
+ * Wake `running`/`runnable` sessions without a live owner, page after page from the first id
+ * after `after`, until none is left or `budgetMs` is spent. Returns the ids woken, and the last
+ * id when the budget ran out first (`next`, where the next scan goes on).
+ */
+export async function wakeOrphanedSessions(ctx, now = new Date(), after, budgetMs = DRAIN_BUDGET_MS) {
+    const deadline = Date.now() + budgetMs;
+    const woken = [];
+    let cursor = after;
+    for (;;) {
+        const page = await ctx.store.tx((t) => t.orphanedSessions(now, BATCH, cursor));
+        for (const session of page) {
+            await ctx.wake(session.id, { reason: "recover" });
+            woken.push(session.id);
+            cursor = session.id;
+        }
+        if (page.length < BATCH)
+            return { woken };
+        if (Date.now() >= deadline)
+            return { woken, next: cursor };
+    }
 }
 /** A pod sandbox in a change this long without a reconcile gets one from the sweep. */
 const STALE_POD_MS = 60_000;
 /**
  * Pod sandboxes (F7.2) whose change has not finished (creating, deleting, an old volume still
  * to delete, an expiry not yet recorded), or that should run but whose engine is not connected,
- * and whose row has not moved for a minute: a reconcile the `Sandbox` object lost (a send
- * dropped while the Tenant closed) is sent again, and a pod or volume deleted outside the
- * Runtime is found.
+ * and whose row has not moved for a minute, get a reconcile: a pod or volume deleted outside
+ * the Runtime is found, and a change goes on whose reconcile the execution itself lost (its
+ * retry timer, an invocation an operator killed, Restate's state wiped) or whose outbox row
+ * was parked. A reconcile a commit asked for is never lost: it is in the outbox.
  */
 async function reconcileStalePods(ctx, now) {
     if (!ctx.pods)

package/dist/tenant/transcript.d.ts

@@ -103,6 +103,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error: {
         code: string;
@@ -112,10 +113,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent?: undefined;
     error: {
         code: string;
@@ -125,7 +126,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -143,17 +143,17 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     agent?: undefined;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -187,6 +187,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
@@ -198,10 +199,10 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
@@ -213,7 +214,6 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
         retryable?: boolean | undefined;
     };
     output?: undefined;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
@@ -235,21 +235,21 @@ export declare function toolCompleted(request: HostEffect, value: unknown): {
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent: import("@nylorun/core/define").AgentRef;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | {
+    redacted?: undefined;
     callId: string;
     invocationId: string;
     agent?: undefined;
     error?: undefined;
     output: unknown;
-    redacted?: undefined;
     capabilityId: string;
     toolName: string;
 } | undefined;

package/dist/vault/service.d.ts

@@ -76,6 +76,40 @@ export declare class VaultService {
     }): Promise<void>;
     /** Writes the `attach` audit row. Run in the session PUT transaction. */
     recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
+    /**
+     * The variables a session's sandbox commands get (R2c, D50): each `environment_secret`'s name
+     * set to the sentinel, each `environment_variable`'s value, and each host a secret is bound to
+     * with that secret's credential id. `conflict` says why they are ambiguous: two credentials with one variable name, or two
+     * secrets bound to one host. Reads rows only; no plaintext. Run in the caller's transaction.
+     */
+    sessionEnvironment(t: Tx, vaultIds: readonly string[]): Promise<{
+        environment: Record<string, string>;
+        secretHosts: Record<string, string>;
+        conflict?: string;
+    }>;
+    /**
+     * The header egress-gate sets on a request from `sandboxId` to `host` (R2c, D50): the
+     * `environment_secret` bound to `host` among the vaults of the sessions using the sandbox, its
+     * value unsealed and rendered into its format. `none` when no secret is bound to the host;
+     * `refused` when two are, or the sealed value cannot be read. One query and one unseal per
+     * call; nothing is cached (E3). Plaintext exists only in the returned header.
+     */
+    releaseEnvironmentSecret(input: {
+        sandboxId: string;
+        host: string;
+    }): Promise<{
+        status: "none";
+    } | {
+        status: "released";
+        header: string;
+        value: string;
+        credentialId: string;
+    } | {
+        status: "refused";
+        reason: "ambiguous" | "unreadable";
+    }>;
+    /** Whether any `environment_secret` of the sessions using `sandboxId` is bound to `host`. */
+    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
     authorize(input: {
         /** The session the request is made for; absent for a tool preview (R2b C12). */
         sessionId?: string;

package/dist/vault/service.js

@@ -74,7 +74,7 @@
  * credential is chosen.
  */
 import { createHash, randomUUID } from "node:crypto";
-import { INSTALLATION_OWNER } from "@nylorun/core/contracts";
+import { ENVIRONMENT_SECRET_DEFAULT_INJECT, ENVIRONMENT_SECRET_SENTINEL, INSTALLATION_OWNER, renderInjectFormat, } from "@nylorun/core/contracts";
 import { canonical } from "../store/canonical.js";
 import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
@@ -156,11 +156,18 @@ export class VaultService {
         return this.store.tx((t) => this.replay(t, `create-credential:${vaultId}:${body.idempotencyKey}`, body, async () => {
             await this.vaultInfo(t, vaultId);
             const id = randomUUID();
-            const url = normalizeVaultUrl(body.auth.url);
             const type = body.auth.type;
-            const payload = payloadOf(body.auth);
-            const binding = bindingOf(url, payload, body.auth);
-            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, url), Buffer.from(JSON.stringify(payload), "utf8"));
+            let payload;
+            let binding;
+            if (body.auth.type === "environment_secret" || body.auth.type === "environment_variable") {
+                ({ payload, binding } = environmentCredential(body.auth));
+            }
+            else {
+                const url = normalizeVaultUrl(body.auth.url);
+                payload = payloadOf(body.auth);
+                binding = bindingOf(url, payload, body.auth);
+            }
+            const sealed = encryptSecret(kek, credentialAad(vaultId, id, type, binding), Buffer.from(JSON.stringify(payload), "utf8"));
             const row = {
                 id,
                 vaultId,
@@ -201,11 +208,23 @@ export class VaultService {
             if (row.type !== body.auth.type)
                 throw new VaultError(409, "Credential type cannot change");
             const current = credentialBinding(row);
-            const next = payloadOf(body.auth);
-            const binding = bindingOf(current.url, next, {
-                via: body.auth.via === undefined ? current.via : body.auth.via,
-                identity: body.auth.identity === undefined ? current.identity : body.auth.identity,
-            });
+            let next;
+            let binding;
+            if (body.auth.type === "environment_secret") {
+                next = { value: body.auth.secretValue };
+                binding = current;
+            }
+            else if (body.auth.type === "environment_variable") {
+                next = {};
+                binding = { ...current, variableValue: body.auth.variableValue };
+            }
+            else {
+                next = payloadOf(body.auth);
+                binding = bindingOf(current.url, next, {
+                    via: body.auth.via === undefined ? current.via : body.auth.via,
+                    identity: body.auth.identity === undefined ? current.identity : body.auth.identity,
+                });
+            }
             const updated = await this.writePayload(t, kek, row, next, binding, new Date().toISOString());
             await this.audit(t, {
                 actor: "application",
@@ -271,6 +290,65 @@ export class VaultService {
             outcome: "attached",
         });
     }
+    /**
+     * The variables a session's sandbox commands get (R2c, D50): each `environment_secret`'s name
+     * set to the sentinel, each `environment_variable`'s value, and each host a secret is bound to
+     * with that secret's credential id. `conflict` says why they are ambiguous: two credentials with one variable name, or two
+     * secrets bound to one host. Reads rows only; no plaintext. Run in the caller's transaction.
+     */
+    async sessionEnvironment(t, vaultIds) {
+        const environment = {};
+        const hosts = new Map();
+        let conflict;
+        for (const vaultId of vaultIds)
+            for (const row of await t.credentialsForVault(vaultId)) {
+                if (row.type !== "environment_secret" && row.type !== "environment_variable")
+                    continue;
+                const binding = JSON.parse(row.bindingJson);
+                const name = row.type === "environment_secret" ? binding.secretName : binding.variableName;
+                if (name in environment)
+                    conflict ??= `Two attached credentials set the variable ${name}`;
+                environment[name] = row.type === "environment_secret" ? ENVIRONMENT_SECRET_SENTINEL : binding.variableValue;
+                for (const host of row.type === "environment_secret" ? binding.allowedHosts ?? [] : []) {
+                    if (hosts.has(host) && hosts.get(host) !== row.id)
+                        conflict ??= `Two attached environment_secret credentials are bound to ${host}`;
+                    hosts.set(host, row.id);
+                }
+            }
+        return { environment, secretHosts: Object.fromEntries([...hosts].sort()), ...(conflict ? { conflict } : {}) };
+    }
+    /**
+     * The header egress-gate sets on a request from `sandboxId` to `host` (R2c, D50): the
+     * `environment_secret` bound to `host` among the vaults of the sessions using the sandbox, its
+     * value unsealed and rendered into its format. `none` when no secret is bound to the host;
+     * `refused` when two are, or the sealed value cannot be read. One query and one unseal per
+     * call; nothing is cached (E3). Plaintext exists only in the returned header.
+     */
+    async releaseEnvironmentSecret(input) {
+        const found = await this.store.tx((t) => sandboxSecretsFor(t, input.sandboxId, input.host));
+        if (found.length === 0)
+            return { status: "none" };
+        if (found.length > 1)
+            return { status: "refused", reason: "ambiguous" };
+        const row = found[0];
+        let payload;
+        try {
+            payload = readPayload(this.kek(), row);
+        }
+        catch (error) {
+            if (!(error instanceof VaultCryptoError))
+                throw error;
+            return { status: "refused", reason: "unreadable" };
+        }
+        if (!payload.value)
+            return { status: "refused", reason: "unreadable" };
+        const inject = credentialBinding(row).inject ?? ENVIRONMENT_SECRET_DEFAULT_INJECT;
+        return { status: "released", header: inject.header, value: renderInjectFormat(inject.format, payload.value), credentialId: row.id };
+    }
+    /** Whether any `environment_secret` of the sessions using `sandboxId` is bound to `host`. */
+    async environmentSecretBound(sandboxId, host) {
+        return (await this.store.tx((t) => sandboxSecretsFor(t, sandboxId, host))).length > 0;
+    }
     // --- use ---------------------------------------------------------------------
     async authorize(input) {
         const url = normalizeVaultUrl(input.url);
@@ -502,7 +580,7 @@ export class VaultService {
     }
     /** Re-seals a user credential's payload with its new binding and returns the updated row. */
     async writePayload(t, kek, row, payload, binding, rotatedAt) {
-        const sealed = encryptSecret(kek, credentialAad(row.vaultId, row.id, row.type, bindingUrl(row)), Buffer.from(JSON.stringify(payload), "utf8"));
+        const sealed = encryptSecret(kek, credentialAad(row.vaultId, row.id, row.type, binding), Buffer.from(JSON.stringify(payload), "utf8"));
         const patch = { rotatedAt, bindingJson: JSON.stringify(binding), ...sealed };
         if (!(await t.updateCredential(row.vaultId, row.id, patch)))
             throw new VaultError(404, "Credential not found");
@@ -649,7 +727,15 @@ function credentialInfoOf(row) {
         vaultId: row.vaultId,
         name: row.name,
         type: row.type,
-        binding: { url: binding.url },
+        binding: row.type === "environment_secret"
+            ? {
+                secretName: binding.secretName,
+                allowedHosts: binding.allowedHosts,
+                inject: binding.inject ?? { ...ENVIRONMENT_SECRET_DEFAULT_INJECT },
+            }
+            : row.type === "environment_variable"
+                ? { variableName: binding.variableName, variableValue: binding.variableValue }
+                : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
         ...(binding.via === undefined ? {} : { via: binding.via }),
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
@@ -658,7 +744,7 @@ function credentialInfoOf(row) {
     };
 }
 function readPayload(kek, row) {
-    const aad = credentialAad(row.vaultId, row.id, row.type, bindingUrl(row));
+    const aad = credentialAad(row.vaultId, row.id, row.type, credentialBinding(row));
     const plaintext = decryptSecret(kek, aad, Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrappedDek), row.kekId);
     try {
         return JSON.parse(plaintext.toString("utf8"));
@@ -804,10 +890,57 @@ export function hostModelAad(provider, model) {
         model,
     }), "utf8");
 }
-function credentialAad(vaultId, credentialId, type, url) {
-    return Buffer.from(canonical({ vaultId, credentialId, type, url }), "utf8");
+/**
+ * What a user credential's ciphertext is bound to: its vault, id, type and URL; for an
+ * `environment_secret` (R2c) also its variable, hosts and header, so the value can never be sent
+ * anywhere else without a new seal.
+ */
+function credentialAad(vaultId, credentialId, type, binding) {
+    return Buffer.from(canonical(type === "environment_secret"
+        ? {
+            vaultId,
+            credentialId,
+            type,
+            secretName: binding.secretName,
+            allowedHosts: binding.allowedHosts,
+            inject: binding.inject ?? null,
+        }
+        : { vaultId, credentialId, type, url: binding.url }), "utf8");
+}
+/** The sealed payload and unsealed binding of an environment credential (R2c). */
+function environmentCredential(auth) {
+    if (auth.type === "environment_variable")
+        return { payload: {}, binding: { variableName: auth.variableName, variableValue: auth.variableValue } };
+    if (auth.inject)
+        checkCredentialHeaders([auth.inject.header.toLowerCase()], undefined);
+    return {
+        payload: { value: auth.secretValue },
+        binding: {
+            secretName: auth.secretName,
+            allowedHosts: auth.allowedHosts.map((host) => host.toLowerCase()),
+            ...(auth.inject ? { inject: { header: auth.inject.header, format: auth.inject.format } } : {}),
+        },
+    };
 }
 function requestHash(body) {
     const { requestId: _requestId, ...rest } = body;
     return canonical(rest);
 }
+/**
+ * The `environment_secret` credentials bound to `host` in the vaults of every session on the
+ * sandbox (R2c). A session between turns counts: it can run again, and what it started may
+ * still run. Session open keeps them to one owner and one credential per host.
+ */
+async function sandboxSecretsFor(t, sandboxId, host) {
+    const lower = host.toLowerCase();
+    const vaultIds = new Set();
+    for (const session of await t.sessionsOnSandbox(sandboxId))
+        for (const vaultId of session.vaultIds ?? [])
+            vaultIds.add(vaultId);
+    const matches = [];
+    for (const vaultId of vaultIds)
+        for (const row of await t.credentialsForVault(vaultId))
+            if (row.type === "environment_secret" && (credentialBinding(row).allowedHosts ?? []).includes(lower))
+                matches.push(row);
+    return matches;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.21.1-beta";
+export declare const RUNTIME_VERSION = "0.23.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.21.1-beta";
+export const RUNTIME_VERSION = "0.23.0-beta";