@nylorun/runtime 0.23.0-beta → 0.24.0-beta

package/dist/mcp/connect.d.ts

@@ -12,10 +12,16 @@ export interface McpRequestOptions {
 /** Options of one tool call. */
 export interface McpCallOptions extends McpRequestOptions {
     /**
-     * The call's effect id. A gate runs a keyed call once and keeps its outcome, so a re-send
-     * after a takeover joins it (F4.1). An in-process connection ignores it.
+     * The call's effect id. A gate keeps a keyed call's outcome, so a re-send after a takeover
+     * joins it (F4.1), and the server gets it in `_meta` (R5.5).
      */
     readonly key?: string;
+    /**
+     * The call's span context (R7.4), sent as the `traceparent` header on the call's requests where
+     * this process holds the connection. A client of the gates service leaves it out: the gate reads
+     * it from the call's journal row.
+     */
+    readonly traceparent?: string;
 }
 /** A page of `tools/list`, as the MCP SDK returns it. */
 export interface McpToolPage {
@@ -73,9 +79,8 @@ export type McpToolFailure = {
     readonly message: string;
     /** True when calling again may work (R2b C7). */
     readonly retryable?: boolean;
-    /** With `credential_rejected`: the server, and the scope of the vault whose credential was sent. */
+    /** With `credential_rejected`: the server. */
     readonly server?: string;
-    readonly vault?: "installation" | "user";
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 };
@@ -93,8 +98,8 @@ export type McpToolOutcome = {
  * - `mcp.forbidden`: the server answered `403`.
  * - `mcp.error`: the server answered a JSON-RPC error; the message has its code.
  * - `mcp.status`: the server answered another HTTP error status, without a JSON-RPC error.
- * - `mcp.lost`: sent, and the answer was lost, so the tool may have run. The model sees it only
- *   for a tool the server marks read-only or idempotent (Q15); any other call is `uncertain`.
+ * - `mcp.lost`: sent, and the answer was lost, so the tool may have run. The model sees it, and
+ *   decides whether to call again (R5; it replaced R2b's read-only and idempotent exception).
  * - `mcp.too-large`: the answer passed `MCP_RESULT_MAX_BYTES` (R2b C11), as an HTTP tool's
  *   answer is `http.too-large`. The tool ran; its answer was not kept.
  */
@@ -110,9 +115,8 @@ export interface McpCallFailure {
     /** The request reached the server, so it may have acted on it. */
     readonly sent: boolean;
     readonly retryable: boolean;
-    /** With `credential_rejected`: the server, and the scope of the vault whose credential was sent. */
+    /** With `credential_rejected`: the server. */
     readonly server?: string;
-    readonly vault?: "installation" | "user";
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 }
@@ -134,16 +138,16 @@ export declare class McpCallFailed extends Error {
  */
 export declare class CredentialRejected extends McpCallFailed {
     readonly server: string;
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    readonly vault?: "installation" | "user" | undefined;
+    /** Whether a credential of the session's Environment was sent. */
+    readonly sent: boolean;
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
     readonly challenge?: string | undefined;
     constructor(server: string, 
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    vault?: "installation" | "user" | undefined, 
+    /** Whether a credential of the session's Environment was sent. */
+    sent: boolean, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
@@ -162,9 +166,16 @@ export declare class McpConnectionStale extends McpCallFailed {
 }
 /** A tool call that never reached its server: its connection could not be opened. */
 export declare function unreachable(server: string, error: unknown): McpCallFailed;
+/**
+ * Where a `tools/call` carries its key (R5.5): MCP has no standard key field, and `_meta` is the
+ * spec's place for extra request data. The key is the call's effect id, the same on every send,
+ * so a server that reads it can run the call once.
+ */
+export declare const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
- * with them (R2b C8), and a failed call is an `McpCallFailed` (C7).
+ * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
+ * `_meta` (R5.5).
  */
 export declare function sdkClient(client: Client, serverName: string): McpClient;
 export declare function openMcpServer(input: {
@@ -212,11 +223,5 @@ export declare function listMcpTools(client: McpClient, input: {
  * be opened again (the caller retries once), and with any error that leaves the call's fate
  * unknown.
  */
-export declare function callMcpTool(client: McpClient, serverToolName: string, args: unknown, options?: McpCallOptions & {
-    /**
-     * The tool is read-only or idempotent (`McpToolRecord.annotations`): a call whose answer was
-     * lost after it was sent is `mcp.lost` to the model. Otherwise it is left uncertain (Q15).
-     */
-    readonly retrySafe?: boolean;
-}): Promise<McpToolOutcome>;
+export declare function callMcpTool(client: McpClient, serverToolName: string, args: unknown, options?: McpCallOptions): Promise<McpToolOutcome>;
 export declare function diagnosticFromError(capabilityId: string, serverName: string, error: unknown): McpDiagnostic;

package/dist/mcp/connect.js

@@ -29,7 +29,7 @@ export class McpCallFailed extends Error {
     /** The failure the gate answered, as the class the loop's own call would have thrown. */
     static from(failure) {
         return failure.code === "credential_rejected" && failure.server !== undefined
-            ? new CredentialRejected(failure.server, failure.vault)
+            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"))
             : new McpCallFailed(failure);
     }
     /** The failed tool outcome the model sees. */
@@ -41,7 +41,6 @@ export class McpCallFailed extends Error {
             message: failure.message,
             retryable: failure.retryable,
             ...(failure.server === undefined ? {} : { server: failure.server }),
-            ...(failure.vault === undefined ? {} : { vault: failure.vault }),
             ...(failure.redacted ? { redacted: failure.redacted } : {}),
         };
     }
@@ -54,11 +53,11 @@ export class McpCallFailed extends Error {
  */
 export class CredentialRejected extends McpCallFailed {
     server;
-    vault;
+    sent;
     challenge;
     constructor(server, 
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    vault, 
+    /** Whether a credential of the session's Environment was sent. */
+    sent, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
@@ -66,16 +65,15 @@ export class CredentialRejected extends McpCallFailed {
     challenge) {
         super({
             code: "credential_rejected",
-            message: vault === undefined
-                ? `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's vaults hold none for it`
-                : `The MCP server '${server}' answered HTTP 401: it rejected the credential from the ${vault} vault`,
+            message: sent
+                ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Environment`
+                : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Environment holds none for it`,
             sent: true,
             retryable: false,
             server,
-            ...(vault === undefined ? {} : { vault }),
         });
         this.server = server;
-        this.vault = vault;
+        this.sent = sent;
         this.challenge = challenge;
         this.name = "CredentialRejected";
     }
@@ -106,18 +104,26 @@ export function unreachable(server, error) {
 }
 /** The operation a request of the transport's fetch belongs to. */
 const tracking = new AsyncLocalStorage();
-function tracked(call, run) {
+function tracked(call, run, traceparent) {
     const tracker = {
         secrets: new Set(),
         sent: false,
         settled: false,
         ...(call ? { calling: new AbortController() } : {}),
+        ...(traceparent ? { traceparent } : {}),
     };
     return tracking.run(tracker, () => run(tracker));
 }
+/**
+ * Where a `tools/call` carries its key (R5.5): MCP has no standard key field, and `_meta` is the
+ * spec's place for extra request data. The key is the call's effect id, the same on every send,
+ * so a server that reads it can run the call once.
+ */
+export const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
- * with them (R2b C8), and a failed call is an `McpCallFailed` (C7).
+ * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
+ * `_meta` (R5.5).
  */
 export function sdkClient(client, serverName) {
     return {
@@ -133,7 +139,10 @@ export function sdkClient(client, serverName) {
         callTool: (params, options) => tracked(true, async (tracker) => {
             const lost = tracker.calling.signal;
             try {
-                const result = (await client.callTool(params, undefined, {
+                const keyed = options?.key === undefined
+                    ? params
+                    : { ...params, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
+                const result = (await client.callTool(keyed, undefined, {
                     signal: options?.signal ? AbortSignal.any([options.signal, lost]) : lost,
                 }));
                 // An answer the stream did not count (an `sse` server answers on its event stream).
@@ -151,7 +160,7 @@ export function sdkClient(client, serverName) {
             finally {
                 tracker.settled = true;
             }
-        }),
+        }, options?.traceparent),
     };
 }
 export async function openMcpServer(input) {
@@ -275,7 +284,6 @@ export async function listMcpTools(client, input) {
             continue;
         const { tool, inputSchema } = candidate;
         const outputSchema = tool.outputSchema ? usableSchema(tool.outputSchema) : undefined;
-        const annotations = retryHints(tool.annotations);
         tools.push({
             capabilityId: input.capabilityId,
             serverName: input.serverName,
@@ -286,7 +294,6 @@ export async function listMcpTools(client, input) {
                 : {}),
             inputSchema,
             ...(outputSchema === undefined ? {} : { outputSchema }),
-            ...(annotations === undefined ? {} : { annotations }),
         });
     }
     return { tools, omitted, renamed, disabled, unknownTools };
@@ -307,6 +314,7 @@ export async function callMcpTool(client, serverToolName, args, options = {}) {
         }, {
             ...(options.key === undefined ? {} : { key: options.key }),
             ...(options.signal ? { signal: options.signal } : {}),
+            ...(options.traceparent === undefined ? {} : { traceparent: options.traceparent }),
         });
     }
     catch (error) {
@@ -315,11 +323,7 @@ export async function callMcpTool(client, serverToolName, args, options = {}) {
         // The connection's to handle: its holder opens it again and sends the call once more.
         if (error instanceof McpConnectionStale)
             throw error;
-        // Sent, then lost: the tool may have run. Calling it again is the model's choice only for a
-        // tool the server says is safe to repeat; any other waits for an operator.
-        if (error.code === "mcp.lost" && !options.retrySafe)
-            throw new Error(error.message);
-        // Otherwise the outcome is known: the model sees it.
+        // The model sees it, `mcp.lost` included: sent, then lost, so the tool may have run (R5).
         return error.outcome();
     }
     const { result } = answer;
@@ -418,6 +422,9 @@ function authorizedFetch(server, endpoint, authorize, policy) {
             for (const [key, value] of Object.entries(result.headers))
                 headers.set(key, value);
         const tracker = tracking.getStore();
+        // The tool call's span (R7.4): per request, so a pooled connection carries each call's own.
+        if (tracker?.traceparent)
+            headers.set("traceparent", tracker.traceparent);
         if (tracker && result.status === "authorized")
             for (const secret of credentialSecrets(result.headers, result.identity))
                 tracker.secrets.add(secret);
@@ -436,7 +443,7 @@ function authorizedFetch(server, endpoint, authorize, policy) {
             tracker.sent = true;
         if (response.status === 401) {
             await response.body?.cancel().catch(() => undefined);
-            throw new CredentialRejected(server.name, result.status === "authorized" ? result.vault : undefined, response.headers.get("www-authenticate") ?? undefined);
+            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined);
         }
         // The server ended the connection's session: the tool never saw the request.
         if (post && response.status === 404 && headers.has("mcp-session-id")) {
@@ -622,14 +629,6 @@ function rpcErrorOf(body) {
     }
     return undefined;
 }
-/** The hints that calling a tool again is safe, when the server gives any. */
-function retryHints(annotations) {
-    const readOnly = annotations?.readOnlyHint === true;
-    const idempotent = annotations?.idempotentHint === true;
-    if (!readOnly && !idempotent)
-        return undefined;
-    return { ...(readOnly ? { readOnlyHint: true } : {}), ...(idempotent ? { idempotentHint: true } : {}) };
-}
 function sameOrigin(requestUrl, serverUrl) {
     try {
         return new URL(requestUrl).origin === new URL(serverUrl).origin;

package/dist/mcp/pool.d.ts

@@ -58,8 +58,8 @@ export declare class McpPool {
         manifest: AgentManifest;
         /** The effect id: a gate runs the call once under it (F4.1). */
         effectId?: string;
-        /** The tool is read-only or idempotent: a lost answer is the model's to retry (R2b C7). */
-        retrySafe?: boolean;
+        /** The call's span context (R7.4), sent as `traceparent` on a connection this process holds. */
+        traceparent?: string;
         signal?: AbortSignal;
     }): Promise<McpToolOutcome>;
     /** The session's connection to the server, opened when there is none, or why it cannot be. */

package/dist/mcp/pool.js

@@ -126,8 +126,8 @@ export class McpPool {
             try {
                 return await callMcpTool(live.connection.client, input.serverToolName, input.args, {
                     ...(input.effectId === undefined ? {} : { key: input.effectId }),
-                    ...(input.retrySafe ? { retrySafe: true } : {}),
                     ...(input.signal ? { signal: input.signal } : {}),
+                    ...(input.traceparent === undefined ? {} : { traceparent: input.traceparent }),
                 });
             }
             catch (error) {

package/dist/mcp/preview.d.ts

@@ -1,9 +1,9 @@
 /**
  * A remote MCP server's tools before an agent names it (R2b C12, `POST /v1/tenant/mcp/preview`,
- * `nylorun mcp inspect`, Studio's Credentials page). It runs where plaintext credentials live:
+ * `nylorun mcp inspect`, an Environment's Secrets tab in Studio). It runs where plaintext credentials live:
  * the keys service (`keys/keys.ts`, `previewMcp`), in the gateway or in process.
  *
- * One connection: `initialize` and `tools/list` with the installation vault's credential for the
+ * One connection: `initialize` and `tools/list` with the Environment's credential for the
  * URL (its headers, and its `via`), under the Host's address policy, within 15 s; then it closes.
  * It never calls a tool, and sends no identity header: no person asked. A server that answers
  * `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any,
@@ -16,7 +16,7 @@ import { openMcpServer } from "./connect.js";
 /** How long a preview may take, `initialize` and every `tools/list` page together. */
 export declare const MCP_PREVIEW_TIMEOUT_MS = 15000;
 export interface McpPreviewOptions {
-    readonly vault: Pick<VaultService, "authorize" | "getVault" | "listVaults">;
+    readonly vault: Pick<VaultService, "authorize" | "listEnvironmentSecrets">;
     /** The Host's address policy for developer URLs (`TenantConfig.delivery`). */
     readonly policy: OutboundPolicy;
     /** Default `MCP_PREVIEW_TIMEOUT_MS`. */

package/dist/mcp/preview.js

@@ -1,15 +1,15 @@
 /**
  * A remote MCP server's tools before an agent names it (R2b C12, `POST /v1/tenant/mcp/preview`,
- * `nylorun mcp inspect`, Studio's Credentials page). It runs where plaintext credentials live:
+ * `nylorun mcp inspect`, an Environment's Secrets tab in Studio). It runs where plaintext credentials live:
  * the keys service (`keys/keys.ts`, `previewMcp`), in the gateway or in process.
  *
- * One connection: `initialize` and `tools/list` with the installation vault's credential for the
+ * One connection: `initialize` and `tools/list` with the Environment's credential for the
  * URL (its headers, and its `via`), under the Host's address policy, within 15 s; then it closes.
  * It never calls a tool, and sends no identity header: no person asked. A server that answers
  * `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any,
  * read under the same policy. No credential value sent is in the answer (`scrubValues`, C8).
  */
-import { INSTALLATION_OWNER, McpPreviewRequestSchema, } from "@nylorun/core/contracts";
+import { McpPreviewRequestSchema, } from "@nylorun/core/contracts";
 import { scrubValues } from "../redact.js";
 import { HttpError } from "../tenant/http.js";
 import { guardedFetch, OutboundRefused } from "../tenant/outbound.js";
@@ -119,28 +119,18 @@ export async function previewMcpServer(body, options) {
     }
 }
 /**
- * The installation vault credential for the URL: from `vaultId`, else from every installation
- * vault. None is a preview without one; two or more without `vaultId` is a refusal that names
- * them.
+ * The credential of Environment `environmentId`'s vault for the URL; none without an
+ * Environment (a preview without a credential). An Environment that does not exist is a 404.
  */
 async function credentialFor(vault, request) {
-    let vaultIds;
-    if (request.vaultId !== undefined) {
-        const found = await vault.getVault(request.vaultId);
-        if (found.ownerUserId !== INSTALLATION_OWNER)
-            throw new VaultError(400, "A preview uses an installation vault's credential: no person asked for it");
-        vaultIds = [found.id];
-    }
-    else
-        vaultIds = (await vault.listVaults(undefined, { installation: true })).map((found) => found.id);
-    if (vaultIds.length === 0)
+    if (request.environmentId === undefined)
         return { status: "unauthenticated", url: request.url, headers: {} };
-    const result = await vault.authorize({ vaultIds, credentialSelections: [], url: request.url });
+    // The 404 of a missing Environment, before any request leaves.
+    await vault.listEnvironmentSecrets(request.environmentId);
+    const result = await vault.authorize({ environmentId: request.environmentId, url: request.url });
     if (result.status !== "refused")
         return result;
-    throw new HttpError(409, result.reason === "ambiguous"
-        ? "Several installation vaults hold a credential for this URL: name one with vaultId"
-        : `The installation vault's credential for this URL cannot be used (${result.reason})`, { code: "request_rejected", details: { reason: result.reason, credentialIds: result.credentialIds } });
+    throw new HttpError(409, `Environment ${request.environmentId}'s credential for this URL cannot be used (${result.reason})`, { code: "request_rejected", details: { reason: result.reason, credentialIds: result.credentialIds } });
 }
 /** A preview that listed nothing: `mcp_preview_failed`, with the code a tool call would have had. */
 function failed(server, error, signal, secrets, timeoutMs) {

package/dist/mcp/snapshot.d.ts

@@ -1,6 +1,6 @@
 import type { EventPayload } from "@nylorun/core/contracts";
 import type { JsonObject } from "@nylorun/core/define";
-import { type AgentManifest } from "@nylorun/core/define";
+import { type AgentManifest, type ResolvedMcpToolSettings } from "@nylorun/core/define";
 import type { DurableSessionTool, HostEffect } from "@nylorun/harness/run";
 export interface McpToolRecord {
     /** The agent used as a tool that declares the server; absent for the session's root agent. */
@@ -14,14 +14,6 @@ export interface McpToolRecord {
     readonly description?: string;
     readonly inputSchema: JsonObject;
     readonly outputSchema?: JsonObject;
-    /**
-     * The server's hints that calling the tool again is safe (R2b C7, Q15): a call whose answer
-     * was lost after it was sent is then `mcp.lost` to the model, not `uncertain`.
-     */
-    readonly annotations?: {
-        readonly readOnlyHint?: boolean;
-        readonly idempotentHint?: boolean;
-    };
     /**
      * Out of the model's tool list for the session's life (R2b C10): core decides it once, when it
      * records the snapshot (`pinDeferral`), so every model call of the session lists the same tools.
@@ -78,12 +70,14 @@ export declare function normalizeToolName(serverName: string, serverToolName: st
     readonly suffixed?: boolean;
 }): string;
 export declare function declaredToolNames(manifest: AgentManifest): Set<string>;
+/** The tool's settings in `manifest` (R2b C9); the defaults when its server is not there. */
+export declare function mcpToolSettingsIn(manifest: AgentManifest, tool: McpToolRecord): ResolvedMcpToolSettings;
 /**
  * The tools of a snapshot, as the engine gets them for a turn whose manifest is `manifest` (the
  * session's pin, or a turn variant that tightened its MCP servers' tools):
  *
- * - a tool its settings disable is left out (R2b C9); one whose approval resolves to `always`
- *   waits for approval on each call;
+ * - a tool its settings disable is left out (R2b C9); the Tool Gate holds a call its approval
+ *   or the Tenant's tool policy asks a person about (R5 step 2);
  * - a deferred tool (R2b C10) is marked so, out of the model's list, and its agent gets
  *   `tool_search`, with the note on the servers it holds deferred tools of, and `tool_call` in
  *   its `nylorun.tools` capability. An agent whose turn has no such capability keeps its tools in

package/dist/mcp/snapshot.js

@@ -58,7 +58,7 @@ function serverOf(manifest, tool) {
     return agent?.capabilities.find((item) => item.id === tool.capabilityId)?.mcpServers?.[tool.serverName];
 }
 /** The tool's settings in `manifest` (R2b C9); the defaults when its server is not there. */
-function settingsOf(manifest, tool) {
+export function mcpToolSettingsIn(manifest, tool) {
     const server = serverOf(manifest, tool);
     return server ? mcpToolSettings(server, tool.serverToolName) : { enabled: true, approval: "never" };
 }
@@ -71,8 +71,8 @@ function reachesDeferred(manifest, agentId) {
  * The tools of a snapshot, as the engine gets them for a turn whose manifest is `manifest` (the
  * session's pin, or a turn variant that tightened its MCP servers' tools):
  *
- * - a tool its settings disable is left out (R2b C9); one whose approval resolves to `always`
- *   waits for approval on each call;
+ * - a tool its settings disable is left out (R2b C9); the Tool Gate holds a call its approval
+ *   or the Tenant's tool policy asks a person about (R5 step 2);
  * - a deferred tool (R2b C10) is marked so, out of the model's list, and its agent gets
  *   `tool_search`, with the note on the servers it holds deferred tools of, and `tool_call` in
  *   its `nylorun.tools` capability. An agent whose turn has no such capability keeps its tools in
@@ -87,7 +87,7 @@ export function sessionToolsOf(snapshot, manifest) {
     const deferred = new Map();
     const notes = new Map();
     for (const tool of snapshot.mcpTools) {
-        const settings = settingsOf(manifest, tool);
+        const settings = mcpToolSettingsIn(manifest, tool);
         if (!settings.enabled)
             continue;
         const defer = tool.deferred === true && reachesDeferred(manifest, tool.agentId);
@@ -98,7 +98,6 @@ export function sessionToolsOf(snapshot, manifest) {
             ...(tool.description === undefined ? {} : { description: tool.description }),
             inputSchema: tool.inputSchema,
             ...(tool.outputSchema === undefined ? {} : { outputSchema: tool.outputSchema }),
-            ...(settings.approval === "always" ? { approval: "always" } : {}),
             ...(defer ? { deferred: true } : {}),
         };
         if (!defer) {
@@ -145,7 +144,7 @@ export const CHARS_PER_TOKEN = 4;
 export function pinDeferral(snapshot, manifest, contextWindow) {
     const limit = contextWindow * CHARS_PER_TOKEN * DEFER_CONTEXT_SHARE;
     const listed = new Map();
-    const set = snapshot.mcpTools.map((tool) => settingsOf(manifest, tool).deferred);
+    const set = snapshot.mcpTools.map((tool) => mcpToolSettingsIn(manifest, tool).deferred);
     snapshot.mcpTools.forEach((tool, i) => {
         if (set[i] === true)
             return;
@@ -175,7 +174,7 @@ export function mcpToolOf(snapshot, request, manifest) {
 }
 /** True when the tool's settings in `manifest` leave it enabled (R2b C9). */
 export function isEnabledIn(manifest, tool) {
-    return settingsOf(manifest, tool).enabled;
+    return mcpToolSettingsIn(manifest, tool).enabled;
 }
 /** The manifest of the agent an effect belongs to: the root, or an agent it uses as a tool. */
 export function manifestFor(manifest, agent) {

package/dist/model/pi-model.js

@@ -38,6 +38,9 @@ export function piModel(options = {}) {
     };
     return async (call, context) => {
         context.signal.throwIfAborted();
+        // The first stream event's time, from here (R7.1): the meter keeps it on the usage row.
+        const calledAt = Date.now();
+        let firstEventAt;
         const root = options.root ?? "";
         const stored = await options.readHostModel?.();
         if (!stored)
@@ -100,6 +103,8 @@ export function piModel(options = {}) {
                 timer = setTimeout(() => idle.abort(), settings.idleTimeoutMs);
             };
             arm();
+            // Only the answer's own attempt counts: a retried attempt's first event is not its.
+            firstEventAt = undefined;
             try {
                 const stream = registry.streamSimple(selected, request, {
                     ...invocationOptions,
@@ -107,6 +112,7 @@ export function piModel(options = {}) {
                 });
                 for await (const event of stream) {
                     arm();
+                    firstEventAt ??= Date.now();
                     if (event.type === "text_delta" && options.onPreview) {
                         try {
                             void Promise.resolve(options.onPreview({
@@ -218,6 +224,8 @@ export function piModel(options = {}) {
                     // The engine keeps the next prompt inside this window (Model Calls §7).
                     contextWindow: selected.contextWindow,
                     maxOutputTokens: selected.maxTokens,
+                    // From the call to the provider's first stream event (R7.1); absent when none came.
+                    ...(firstEventAt !== undefined ? { firstTokenMs: firstEventAt - calledAt } : {}),
                 },
             },
         };