@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/host/operate.js

@@ -9,12 +9,16 @@
  *   nylorun-operate keys list [--json]
  *   nylorun-operate keys put <id> [--role application|management] [--json]
  *   nylorun-operate keys rm <id> [--json]
+ *   nylorun-operate harness token put <id> [--json]
+ *   nylorun-operate harness token list [--json]
+ *   nylorun-operate harness token rm <id> [--json]
  *
  * `status` says whether the Tenant is open and, when it is not, why: from the database (no
  * Tenant yet, an old layout, a schema newer or older than this Runtime) and from the running
  * Host's `/ready` on this container's listen port. It needs no key, so it works when the Tenant
  * cannot open. `keys put` prints the new key once on stdout (with `--json`, the whole
- * response). Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
+ * response). `harness token put` makes a custom harness's own token (R4.1), bound to its harness
+ * id, and prints it once; putting it again rotates it. Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
  * 2 the Tenant cannot be opened (`status` still prints it), 64 usage.
  */
 import { pathToFileURL } from "node:url";
@@ -26,6 +30,7 @@ import { createPostgresSessionStore } from "../store/postgres/store.js";
 import { readTenantEnvelope } from "../store/postgres/tenant.js";
 import { openError, TenantOpenError } from "../tenant/cause.js";
 import { operatorKeys } from "../tenant/operator-keys.js";
+import { deleteHarnessToken, listHarnessTokens, putHarnessToken } from "../tenant/harness-tokens.js";
 import { RUNTIME_VERSION } from "../version.js";
 import { DEFAULT_CONTAINER_LISTEN_PORT } from "./stack-config.js";
 export const EXIT_REFUSED = 1;
@@ -35,7 +40,10 @@ const USAGE = `Usage:
   nylorun-operate status [--json]
   nylorun-operate keys list [--json]
   nylorun-operate keys put <id> [--role application|management] [--json]
-  nylorun-operate keys rm <id> [--json]`;
+  nylorun-operate keys rm <id> [--json]
+  nylorun-operate harness token put <id> [--json]
+  nylorun-operate harness token list [--json]
+  nylorun-operate harness token rm <id> [--json]`;
 class Exit extends Error {
     code;
     constructor(code, message) {
@@ -52,14 +60,14 @@ export async function runOperate(argv, io) {
                 throw new Exit(EXIT_USAGE, USAGE);
             return await status(io, json);
         }
-        const command = parse(argv);
+        const command = argv[0] === "harness" ? harnessCommand(argv) : parse(argv);
         const url = io.env.NYLORUN_DATABASE_URL;
         if (!url)
             throw new Exit(EXIT_TENANT, "NYLORUN_DATABASE_URL is not set: run this inside the runtime container");
         const sql = createPostgresClient(url, { max: 1 });
         try {
-            const keys = operatorKeys(await openStore(sql));
-            return await command(keys, io);
+            const store = await openStore(sql);
+            return await command(operatorKeys(store), io, store);
         }
         finally {
             await sql.end({ timeout: 5 });
@@ -74,6 +82,60 @@ export async function runOperate(argv, io) {
         return EXIT_TENANT;
     }
 }
+/** `harness token put|list|rm` (R4.1). */
+function harnessCommand(argv) {
+    const [, noun, verb, ...rest] = argv;
+    const json = rest.includes("--json");
+    const args = rest.filter((arg) => arg !== "--json");
+    if (noun !== "token")
+        throw new Exit(EXIT_USAGE, USAGE);
+    switch (verb) {
+        case "list":
+            if (args.length > 0)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const tokens = await listHarnessTokens(store);
+                if (json)
+                    io.out(JSON.stringify({ tokens }));
+                else
+                    for (const token of tokens)
+                        io.out(`${token.id}\t${token.createdAt}`);
+                return 0;
+            };
+        case "put": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const put = await putHarnessToken(store, id);
+                if ("reason" in put)
+                    throw new Exit(EXIT_REFUSED, put.message);
+                if (json)
+                    io.out(JSON.stringify(put));
+                else {
+                    io.out(put.token);
+                    io.err(`${put.rotated ? "Rotated" : "Created"} the token of harness ${put.id}. It is shown this once: the harness connects with it as NYLORUN_HARNESS_TOKEN and must say ${put.id} in hello.`);
+                }
+                return 0;
+            };
+        }
+        case "rm": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (_keys, io, store) => {
+                const deleted = await deleteHarnessToken(store, id);
+                if (json)
+                    io.out(JSON.stringify({ id, deleted }));
+                else
+                    io.err(deleted ? `Deleted the token of harness ${id}.` : `Harness ${id} has no token.`);
+                return 0;
+            };
+        }
+        default:
+            throw new Exit(EXIT_USAGE, USAGE);
+    }
+}
 function parse(argv) {
     const [group, verb, ...rest] = argv;
     if (group !== "keys")

package/dist/host/stack-config.d.ts

@@ -1,3 +1,49 @@
+/**
+ * Stack configuration for the Runtime process, parsed from an environment
+ * snapshot and argv. Pure: `host/main.ts` passes the process environment and
+ * arguments; nothing here reads ambient state.
+ *
+ * `--service core,loop` names the Runtime services the process runs (blueprint
+ * §19, D12): one image runs every service, and a container may pack several.
+ * Without the flag a process runs core and loop. `--role api|worker|all` is
+ * the deprecated name of the same choice (core, loop, or both). `gates` (the
+ * Model Gate) never shares a process with core or loop: it holds the
+ * credentials they must not. Only a process that runs core or loop parses the
+ * API listener (`NYLORUN_LISTEN_*`); only one that runs gates parses its
+ * listener (`NYLORUN_GATES_LISTEN_*`), and only one that runs loop parses
+ * where to reach the gate (`NYLORUN_GATES_URL`). Both read
+ * `NYLORUN_GATES_TOKEN`. In a container, loop requires the gate: the loop
+ * process must never hold a model credential. `egress` (egress-gate, F7.2) joins gates and keys
+ * in the gateway and parses its listener (`NYLORUN_EGRESS_LISTEN_*`, default `0.0.0.0:4200`).
+ * The credential resolver is gone (protocol 10): its `NYLORUN_RESOLVER_*` variables are ignored,
+ * and the Host logs `resolver_removed` when one is set.
+ *
+ * `harness` (F6.2) runs alone: it holds the harness credential and nothing else. It connects to
+ * core's Harness API listener (`NYLORUN_HARNESS_URL`, `NYLORUN_HARNESS_TOKEN`), calls models and
+ * remote MCP servers through the gates service (`NYLORUN_GATES_URL`, with run tokens only), and
+ * keeps its workspaces under `NYLORUN_HARNESS_ROOT`. It refuses to start with a database, the
+ * gates' or keys' credential, or Restate settings. A process running core starts the Harness API
+ * listener when `NYLORUN_HARNESS=remote` (`NYLORUN_HARNESS_LISTEN_*`, `NYLORUN_HARNESS_TOKEN`).
+ *
+ * Two listen modes:
+ * - **local** (no `NYLORUN_LISTEN_*` / `NYLORUN_ALLOWED_HOSTS`): the Host binds
+ *   what `host.json` names, loopback only unless `allowNonLoopback`.
+ * - **container**: the Host binds `NYLORUN_LISTEN_HOST:NYLORUN_LISTEN_PORT`
+ *   (default `0.0.0.0:4000`) and accepts only the `Host` headers in
+ *   `NYLORUN_ALLOWED_HOSTS`, plus the loopback forms of the listen port for
+ *   probes from inside the container.
+ *
+ * The Postgres, Restate and S2 endpoints are parsed and validated here;
+ * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
+ * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`). So are traces (R7.2), for a
+ * process running core: where they go (`OTEL_EXPORTER_OTLP_ENDPOINT`, or
+ * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
+ * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
+ * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
+ */
+import { type TraceResource } from "../traces/otlp.js";
+import { type TraceContentKind } from "../traces/map.js";
 import { type BlockedAddress } from "../sandbox/pods/network-gate.js";
 /** A Runtime service this release has. */
 export type RuntimeService = "core" | "loop" | "gates" | "keys" | "egress" | "harness";
@@ -197,6 +243,24 @@ export interface StackConfig {
      * (the `fs` adapter, `TenantPaths.blobs`).
      */
     objectStore?: ObjectStoreConfig;
+    /**
+     * Present when the process runs core and an `OTEL_*` or `NYLORUN_TRACE_CONTENT` variable is set:
+     * how spans are made, for the trace projector and the trace route (R7.2, R7.5). `export` is
+     * present only with an endpoint (Q5): without one there is no replication slot and no cost.
+     */
+    traces?: TraceConfig;
+}
+/** Traces (R7.2), from the standard `OTEL_*` variables and `NYLORUN_TRACE_CONTENT`. */
+export interface TraceConfig {
+    /** `OTEL_SERVICE_NAME` (default `nylorun`) and `OTEL_RESOURCE_ATTRIBUTES`. */
+    resource: TraceResource;
+    /** The content kinds spans carry: none by default. */
+    content: TraceContentKind[];
+    /** Where the projector posts: the traces URL and `OTEL_EXPORTER_OTLP_HEADERS`. */
+    export?: {
+        url: string;
+        headers: Record<string, string>;
+    };
 }
 /** Where the Object store is and the credential for it (`NYLORUN_OBJECT_STORE_*`). */
 export interface ObjectStoreConfig {

package/dist/host/stack-config.js

@@ -36,8 +36,14 @@
  * The Postgres, Restate and S2 endpoints are parsed and validated here;
  * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
  * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
- * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`).
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`). So are traces (R7.2), for a
+ * process running core: where they go (`OTEL_EXPORTER_OTLP_ENDPOINT`, or
+ * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
+ * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
+ * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  */
+import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
+import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
@@ -316,6 +322,7 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
+    const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
         .filter((name) => name.startsWith(REMOVED_RESOLVER_PREFIX) && read(env, name) !== undefined)
         .sort();
@@ -337,8 +344,61 @@ export function parseStackConfig(env, argv) {
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(objectStore ? { objectStore } : {}),
+        ...(traces ? { traces } : {}),
     };
 }
+/**
+ * `StackConfig.traces` (R7.2). The OTLP endpoint is the collector's base URL, to which
+ * `/v1/traces` is added; `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` is the full URL and wins. Headers
+ * and resource attributes are `key=value` lists separated by commas, values percent-encoded (the
+ * OTel SDK environment specification).
+ */
+function parseTraces(env) {
+    const traces = parseUrl(env, "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", ["http:", "https:"]);
+    const base = parseUrl(env, "OTEL_EXPORTER_OTLP_ENDPOINT", ["http:", "https:"]);
+    const url = traces ?? (base === undefined ? undefined : `${base.replace(/\/+$/, "")}/v1/traces`);
+    const resource = keyValues(env, "OTEL_RESOURCE_ATTRIBUTES");
+    const all = read(env, "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT")?.toLowerCase() === "true";
+    const content = new Set(all ? TRACE_CONTENT_KINDS : []);
+    for (const kind of (read(env, "NYLORUN_TRACE_CONTENT") ?? "").split(",").map((part) => part.trim())) {
+        if (kind === "")
+            continue;
+        if (!TRACE_CONTENT_KINDS.includes(kind))
+            throw new StackConfigError(`NYLORUN_TRACE_CONTENT lists ${TRACE_CONTENT_KINDS.join(", ")}, not ${kind}`);
+        content.add(kind);
+    }
+    const serviceName = read(env, "OTEL_SERVICE_NAME") ?? resource["service.name"];
+    // Nothing set: the defaults (`service.name` nylorun, no content, no export).
+    if (url === undefined && serviceName === undefined && Object.keys(resource).length === 0 && content.size === 0)
+        return undefined;
+    return {
+        resource: {
+            serviceName: serviceName ?? DEFAULT_SERVICE_NAME,
+            attributes: resource,
+        },
+        content: TRACE_CONTENT_KINDS.filter((kind) => content.has(kind)),
+        ...(url ? { export: { url, headers: keyValues(env, "OTEL_EXPORTER_OTLP_HEADERS") } } : {}),
+    };
+}
+/** A `key=value,key=value` variable, values percent-decoded; a malformed one is refused. */
+function keyValues(env, name) {
+    const out = {};
+    for (const pair of (read(env, name) ?? "").split(",")) {
+        if (pair.trim() === "")
+            continue;
+        const at = pair.indexOf("=");
+        const key = at < 0 ? "" : pair.slice(0, at).trim();
+        if (key === "")
+            throw new StackConfigError(`${name} must be key=value pairs separated by commas`);
+        try {
+            out[key] = decodeURIComponent(pair.slice(at + 1).trim());
+        }
+        catch {
+            throw new StackConfigError(`${name} has a value that is not percent-encoded: ${key}`);
+        }
+    }
+    return out;
+}
 /** S3 bucket names: 3 to 63 lowercase letters, digits, dots and hyphens. */
 const BUCKET = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
 /** `StackConfig.objectStore` from `NYLORUN_OBJECT_STORE_*`, or `undefined` without an endpoint. */
@@ -399,7 +459,7 @@ function parseSandboxes(env) {
         return undefined;
     const token = read(env, "NYLORUN_SANDBOXES_TOKEN");
     if (token === undefined || token.length < 32)
-        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun sandbox enable` sets both)");
+        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun local sandbox enable` sets both)");
     const harnessImage = read(env, "NYLORUN_SANDBOX_HARNESS_IMAGE");
     if (harnessImage === undefined || /\s/.test(harnessImage))
         throw new StackConfigError("NYLORUN_SANDBOX_HARNESS_IMAGE is required with NYLORUN_SANDBOXES_URL: the Runtime image sandbox pods copy the engine from (`nylorun start` sets it)");

package/dist/keys/client.js

@@ -51,7 +51,10 @@ export function httpKeys(options) {
                         return resolve(answer.result);
                     const error = answer.error;
                     reject(error.kind === "vault"
-                        ? new VaultError(error.status, error.message)
+                        ? new VaultError(error.status, error.message, {
+                            ...(error.code === undefined ? {} : { code: error.code }),
+                            ...(error.details === undefined ? {} : { details: error.details }),
+                        })
                         : new HttpError(error.status, error.message, {
                             ...(error.code === undefined ? {} : { code: error.code }),
                             ...(error.details === undefined ? {} : { details: error.details }),

package/dist/keys/keys.d.ts

@@ -1,8 +1,8 @@
-import type { CreateCredentialRequest, CredentialInfo, HostModelView, McpPreview, McpPreviewRequest, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
+import type { EnvironmentSecretView, HostModelView, McpPreview, McpPreviewRequest, PutEnvironmentSecretRequest, PutHostModelRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { VaultService } from "../vault/service.js";
+import type { SealedSecretCopies, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -14,10 +14,17 @@ export interface Signed {
     readonly keyId: string;
 }
 export interface Keys {
-    createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>;
-    rotateCredential(vaultId: string, id: string, body: RotateCredentialRequest): Promise<CredentialInfo>;
+    /** `PUT /v1/environments/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
+    /**
+     * Environment `from`'s secrets sealed again for a fork's new vault `vaultId`, limited to
+     * `slots` when given (`VaultService.sealEnvironmentSecretCopies`, Q15). Writes nothing: the
+     * fork's transaction inserts the copies; call it before that transaction opens. `null`, not
+     * `undefined`, crosses the wire.
+     */
+    sealEnvironmentSecretCopies(from: string, vaultId: string, slots: Readonly<Record<string, Record<string, unknown>>> | null): Promise<SealedSecretCopies>;
     /** Signs with the current key, creating the Tenant's keys if it has none. */
     sign(request: SignRequest): Promise<Signed>;
     /** Rotates the signing keys (`SigningKeys.rotate`); 409 while the previous key may verify live tokens. */
@@ -28,7 +35,7 @@ export interface Keys {
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
     /**
-     * Lists a remote MCP server's tools with the installation vault's credential for its URL
+     * Lists a remote MCP server's tools with the Environment's credential for its URL
      * (R2b C12, `mcp/preview.ts`); never calls a tool.
      */
     previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
@@ -41,7 +48,7 @@ export interface Keys {
     signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
+export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sealEnvironmentSecretCopies", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -1,12 +1,13 @@
 /**
  * The keys seam (blueprint §14, F4.2): everything that needs the vault key. Vault writes that
- * touch a secret (creating and rotating a credential, setting and selecting the host model;
- * rotation and selection decrypt the old secret first) and all token signing (capability
+ * touch a secret (writing an Environment's secret, setting and selecting the host model;
+ * rotation and selection decrypt the old secret first; sealing a fork's copies of its source's
+ * secrets, which the fork's transaction then inserts) and all token signing (capability
  * links, run and host tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
- * A tool preview (R2b C12, `previewMcp`) runs here too: it sends an installation vault's
- * credential to the server it lists, so the process that reads the plaintext makes the request.
+ * A tool preview (R2b C12, `previewMcp`) runs here too: it sends an Environment's credential to
+ * the server it lists, so the process that reads the plaintext makes the request.
  *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
@@ -18,10 +19,10 @@ import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
 /** The operations, by the name the HTTP route carries. */
 export const KEYS_OPERATIONS = [
-    "createCredential",
-    "rotateCredential",
+    "putEnvironmentSecret",
     "putHostModel",
     "selectHostModel",
+    "sealEnvironmentSecretCopies",
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
@@ -33,10 +34,10 @@ export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
     const egress = new EgressAuthority(store, kek);
     return {
-        createCredential: (vaultId, body) => vault.createCredential(vaultId, body),
-        rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
+        putEnvironmentSecret: (environmentId, name, body, actor) => vault.putEnvironmentSecret(environmentId, name, body, actor),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
+        sealEnvironmentSecretCopies: (from, vaultId, slots) => vault.sealEnvironmentSecretCopies(from, vaultId, slots),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));