@nylorun/runtime 0.23.0-beta → 0.25.0-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (301) hide show
  1. package/CHANGELOG.md +252 -0
  2. package/README.md +87 -28
  3. package/dist/adapters/execution/restate.js +1 -1
  4. package/dist/adapters/replication/pgoutput.d.ts +2 -0
  5. package/dist/adapters/replication/pgoutput.js +6 -3
  6. package/dist/adapters/sandbox/local.d.ts +9 -1
  7. package/dist/adapters/sandbox/local.js +16 -4
  8. package/dist/adapters/sandbox/virtual.js +4 -1
  9. package/dist/api/a2a/card.d.ts +11 -1
  10. package/dist/api/a2a/card.js +26 -2
  11. package/dist/api/a2a/endpoint.js +9 -3
  12. package/dist/api/a2a/protocol.d.ts +25 -2
  13. package/dist/api/a2a/protocol.js +20 -3
  14. package/dist/api/a2a/routes.d.ts +6 -1
  15. package/dist/api/a2a/routes.js +67 -9
  16. package/dist/api/a2a/tasks.js +2 -1
  17. package/dist/api/ag-ui/endpoint.js +8 -3
  18. package/dist/api/ag-ui/history.d.ts +6 -1
  19. package/dist/api/ag-ui/history.js +39 -3
  20. package/dist/api/ag-ui/routes.d.ts +4 -1
  21. package/dist/api/ag-ui/routes.js +63 -20
  22. package/dist/api/ag-ui/translate.js +3 -2
  23. package/dist/api/components.d.ts +5327 -1091
  24. package/dist/api/components.js +40 -16
  25. package/dist/api/gate/keys.d.ts +2 -1
  26. package/dist/api/gate/keys.js +14 -1
  27. package/dist/api/gate/routes.d.ts +6 -0
  28. package/dist/api/gate/routes.js +52 -3
  29. package/dist/api/http/app.js +17 -6
  30. package/dist/api/http/body.d.ts +3 -3
  31. package/dist/api/http/body.js +7 -7
  32. package/dist/api/http/define.d.ts +6 -0
  33. package/dist/api/http/define.js +13 -1
  34. package/dist/api/http/respond.js +1 -1
  35. package/dist/api/http/routes/artifacts.js +35 -8
  36. package/dist/api/http/routes/coverage.d.ts +9 -0
  37. package/dist/api/http/routes/coverage.js +34 -0
  38. package/dist/api/http/routes/environment-manifests.d.ts +9 -0
  39. package/dist/api/http/routes/environment-manifests.js +118 -0
  40. package/dist/api/http/routes/environments.d.ts +11 -0
  41. package/dist/api/http/routes/environments.js +332 -0
  42. package/dist/api/http/routes/mcp.d.ts +1 -1
  43. package/dist/api/http/routes/mcp.js +2 -2
  44. package/dist/api/http/routes/me.js +1 -1
  45. package/dist/api/http/routes/reads.d.ts +94 -9
  46. package/dist/api/http/routes/reads.js +54 -5
  47. package/dist/api/http/routes/sessions.js +24 -9
  48. package/dist/api/http/routes/tenant.js +65 -15
  49. package/dist/api/inbound-files.d.ts +65 -0
  50. package/dist/api/inbound-files.js +115 -0
  51. package/dist/api/openapi.js +48 -28
  52. package/dist/artifacts/disk.d.ts +59 -0
  53. package/dist/artifacts/disk.js +569 -0
  54. package/dist/artifacts/export.d.ts +1 -1
  55. package/dist/artifacts/export.js +2 -3
  56. package/dist/artifacts/folders.d.ts +6 -3
  57. package/dist/artifacts/folders.js +17 -12
  58. package/dist/artifacts/media-types.d.ts +15 -0
  59. package/dist/artifacts/media-types.js +56 -4
  60. package/dist/artifacts/parts.d.ts +12 -3
  61. package/dist/artifacts/parts.js +15 -4
  62. package/dist/artifacts/service.d.ts +2 -1
  63. package/dist/artifacts/service.js +6 -1
  64. package/dist/artifacts/workspace.d.ts +5 -5
  65. package/dist/artifacts/workspace.js +7 -19
  66. package/dist/core/flow-host.d.ts +3 -4
  67. package/dist/core/flow-host.js +5 -2
  68. package/dist/core/provider.d.ts +3 -2
  69. package/dist/core/provider.js +5 -37
  70. package/dist/core/sandbox-routes.d.ts +2 -21
  71. package/dist/core/sandbox-routes.js +11 -44
  72. package/dist/core/turn-manifest.d.ts +3 -2
  73. package/dist/core/turn-manifest.js +29 -5
  74. package/dist/execution/types.d.ts +1 -1
  75. package/dist/gates/contract.d.ts +3 -24
  76. package/dist/gates/contract.js +1 -36
  77. package/dist/gates/egress-credentials.d.ts +9 -0
  78. package/dist/gates/egress-credentials.js +11 -4
  79. package/dist/gates/egress.d.ts +22 -1
  80. package/dist/gates/egress.js +116 -10
  81. package/dist/gates/fixture-model.d.ts +28 -0
  82. package/dist/gates/fixture-model.js +92 -0
  83. package/dist/gates/handler.js +4 -4
  84. package/dist/gates/http-tool.d.ts +9 -6
  85. package/dist/gates/http-tool.js +11 -17
  86. package/dist/gates/in-process.d.ts +5 -0
  87. package/dist/gates/in-process.js +12 -1
  88. package/dist/gates/journal.d.ts +30 -0
  89. package/dist/gates/journal.js +51 -0
  90. package/dist/gates/mcp-handler.d.ts +4 -0
  91. package/dist/gates/mcp-handler.js +7 -4
  92. package/dist/gates/meter.d.ts +10 -2
  93. package/dist/gates/meter.js +20 -5
  94. package/dist/gates/policy.d.ts +49 -0
  95. package/dist/gates/policy.js +132 -0
  96. package/dist/gates/tenant-vaults.d.ts +7 -7
  97. package/dist/gates/tenant-vaults.js +5 -5
  98. package/dist/gates/tool-calls.d.ts +10 -5
  99. package/dist/gates/tool-calls.js +28 -10
  100. package/dist/gates/tool-client.d.ts +8 -0
  101. package/dist/gates/tool-client.js +27 -11
  102. package/dist/gates/tool-contract.d.ts +11 -69
  103. package/dist/gates/tool-contract.js +1 -85
  104. package/dist/gates/tool-gate.d.ts +1 -1
  105. package/dist/harness/calls.d.ts +14 -7
  106. package/dist/harness/calls.js +30 -24
  107. package/dist/harness/executors.js +12 -9
  108. package/dist/harness/main.js +24 -5
  109. package/dist/harness/pod.d.ts +39 -0
  110. package/dist/harness/pod.js +46 -0
  111. package/dist/harness/service.d.ts +0 -1
  112. package/dist/harness/service.js +17 -9
  113. package/dist/harness/setup.d.ts +29 -0
  114. package/dist/harness/setup.js +174 -0
  115. package/dist/harness/ws-client.js +3 -2
  116. package/dist/harness/ws-port.d.ts +1 -5
  117. package/dist/harness/ws-port.js +1 -5
  118. package/dist/harness-api/in-process.js +3 -3
  119. package/dist/harness-api/record.d.ts +15 -1
  120. package/dist/harness-api/record.js +180 -50
  121. package/dist/harness-api/redact.d.ts +3 -0
  122. package/dist/harness-api/redact.js +45 -0
  123. package/dist/harness-api/server.d.ts +35 -4
  124. package/dist/harness-api/server.js +130 -17
  125. package/dist/harness-api/start.d.ts +10 -3
  126. package/dist/harness-api/start.js +40 -10
  127. package/dist/harness-api/tool-journal.d.ts +105 -0
  128. package/dist/harness-api/tool-journal.js +132 -0
  129. package/dist/harness-api/tool-status.d.ts +13 -0
  130. package/dist/harness-api/tool-status.js +26 -0
  131. package/dist/harness-api/workspace.d.ts +12 -7
  132. package/dist/harness-api/workspace.js +47 -25
  133. package/dist/harness-api/ws-server.d.ts +11 -3
  134. package/dist/harness-api/ws-server.js +94 -15
  135. package/dist/host/gates.d.ts +2 -1
  136. package/dist/host/gates.js +10 -2
  137. package/dist/host/main.js +54 -5
  138. package/dist/host/operate.js +67 -5
  139. package/dist/host/stack-config.d.ts +64 -0
  140. package/dist/host/stack-config.js +62 -2
  141. package/dist/keys/client.js +4 -1
  142. package/dist/keys/keys.d.ts +13 -6
  143. package/dist/keys/keys.js +9 -8
  144. package/dist/management-openapi.json +1264 -2171
  145. package/dist/mcp/connect.d.ts +26 -22
  146. package/dist/mcp/connect.js +30 -34
  147. package/dist/mcp/pool.d.ts +3 -6
  148. package/dist/mcp/pool.js +14 -28
  149. package/dist/mcp/preview.d.ts +3 -3
  150. package/dist/mcp/preview.js +10 -21
  151. package/dist/mcp/snapshot.d.ts +16 -24
  152. package/dist/mcp/snapshot.js +33 -45
  153. package/dist/model/capabilities.d.ts +26 -0
  154. package/dist/model/capabilities.js +44 -0
  155. package/dist/model/catalog.d.ts +34 -3
  156. package/dist/model/catalog.js +38 -2
  157. package/dist/model/models.d.ts +2 -0
  158. package/dist/model/models.js +1 -1
  159. package/dist/model/native-blocks.d.ts +35 -0
  160. package/dist/model/native-blocks.js +170 -0
  161. package/dist/model/pi-model.js +114 -94
  162. package/dist/openapi.json +12822 -3943
  163. package/dist/reads/types.d.ts +16 -3
  164. package/dist/record/append.d.ts +3 -1
  165. package/dist/record/append.js +1 -0
  166. package/dist/record/envelope.d.ts +5 -1
  167. package/dist/record/envelope.js +7 -3
  168. package/dist/record/environment.d.ts +25 -0
  169. package/dist/record/environment.js +44 -0
  170. package/dist/record/index.d.ts +1 -1
  171. package/dist/record/index.js +1 -1
  172. package/dist/sandbox/disk-fs.d.ts +95 -0
  173. package/dist/sandbox/disk-fs.js +206 -0
  174. package/dist/sandbox/join.d.ts +17 -18
  175. package/dist/sandbox/join.js +46 -15
  176. package/dist/sandbox/manager.d.ts +47 -21
  177. package/dist/sandbox/manager.js +162 -107
  178. package/dist/sandbox/placement.d.ts +14 -13
  179. package/dist/sandbox/placement.js +31 -14
  180. package/dist/sandbox/pods/client.d.ts +9 -2
  181. package/dist/sandbox/pods/lifecycle.d.ts +36 -27
  182. package/dist/sandbox/pods/lifecycle.js +29 -26
  183. package/dist/sandbox/pods/reconcile.js +18 -12
  184. package/dist/sandbox/pods/spec.d.ts +15 -13
  185. package/dist/sandbox/pods/spec.js +17 -20
  186. package/dist/sandbox/records.d.ts +2 -2
  187. package/dist/sandbox/records.js +3 -3
  188. package/dist/sandbox/resolve.d.ts +37 -27
  189. package/dist/sandbox/resolve.js +73 -41
  190. package/dist/sandbox/runtime-tools.d.ts +9 -0
  191. package/dist/sandbox/runtime-tools.js +16 -0
  192. package/dist/sandbox/session-sandbox.d.ts +4 -6
  193. package/dist/sandbox/session-sandbox.js +47 -94
  194. package/dist/sandbox/setup.d.ts +64 -0
  195. package/dist/sandbox/setup.js +160 -0
  196. package/dist/sandbox/share.d.ts +21 -26
  197. package/dist/sandbox/share.js +36 -63
  198. package/dist/sandbox/skills.d.ts +8 -6
  199. package/dist/sandbox/skills.js +24 -23
  200. package/dist/sandbox/tenant-config.d.ts +12 -14
  201. package/dist/sandbox/tenant-config.js +12 -17
  202. package/dist/sandbox/types.d.ts +6 -0
  203. package/dist/store/postgres/drizzle/0020_environments.sql +63 -0
  204. package/dist/store/postgres/drizzle/0021_disk_versions.sql +7 -0
  205. package/dist/store/postgres/drizzle/0022_model_usage_timing.sql +5 -0
  206. package/dist/store/postgres/drizzle/0023_artifact_pages.sql +1 -0
  207. package/dist/store/postgres/drizzle/0024_flat_manifest.sql +7 -0
  208. package/dist/store/postgres/drizzle/0025_environment_manifests.sql +14 -0
  209. package/dist/store/postgres/drizzle/0026_environment_forks.sql +1 -0
  210. package/dist/store/postgres/drizzle/0027_environment_image_digest.sql +1 -0
  211. package/dist/store/postgres/drizzle/meta/_journal.json +56 -0
  212. package/dist/store/postgres/reads.js +123 -17
  213. package/dist/store/postgres/record-writer.d.ts +4 -4
  214. package/dist/store/postgres/record-writer.js +9 -9
  215. package/dist/store/postgres/record.d.ts +7 -0
  216. package/dist/store/postgres/record.js +23 -2
  217. package/dist/store/postgres/schema.d.ts +1126 -736
  218. package/dist/store/postgres/schema.js +136 -73
  219. package/dist/store/postgres/store.js +195 -67
  220. package/dist/store/types.d.ts +165 -50
  221. package/dist/tenant/advance.d.ts +7 -6
  222. package/dist/tenant/advance.js +118 -42
  223. package/dist/tenant/artifact-tool.d.ts +1 -1
  224. package/dist/tenant/artifact-tool.js +46 -26
  225. package/dist/tenant/commands.d.ts +15 -2
  226. package/dist/tenant/commands.js +115 -14
  227. package/dist/tenant/context.d.ts +56 -24
  228. package/dist/tenant/context.js +4 -15
  229. package/dist/tenant/effects.d.ts +1 -1
  230. package/dist/tenant/effects.js +44 -29
  231. package/dist/tenant/environment-manifests.d.ts +57 -0
  232. package/dist/tenant/environment-manifests.js +200 -0
  233. package/dist/tenant/environments.d.ts +174 -0
  234. package/dist/tenant/environments.js +1044 -0
  235. package/dist/tenant/harness-tokens.d.ts +21 -0
  236. package/dist/tenant/harness-tokens.js +61 -0
  237. package/dist/tenant/host-token.d.ts +1 -1
  238. package/dist/tenant/host-token.js +2 -4
  239. package/dist/tenant/identity-file.d.ts +4 -4
  240. package/dist/tenant/identity-file.js +17 -8
  241. package/dist/tenant/issuers.js +3 -3
  242. package/dist/tenant/model-setting.d.ts +14 -0
  243. package/dist/tenant/model-setting.js +51 -0
  244. package/dist/tenant/principals.js +1 -1
  245. package/dist/tenant/reset.js +3 -3
  246. package/dist/tenant/runtime.d.ts +6 -1
  247. package/dist/tenant/runtime.js +7 -1
  248. package/dist/tenant/session.d.ts +3 -3
  249. package/dist/tenant/session.js +0 -14
  250. package/dist/tenant/sessions.d.ts +18 -14
  251. package/dist/tenant/sessions.js +99 -143
  252. package/dist/tenant/signing-keys.d.ts +5 -1
  253. package/dist/tenant/skill-tool.d.ts +3 -3
  254. package/dist/tenant/skill-tool.js +6 -11
  255. package/dist/tenant/status.js +3 -3
  256. package/dist/tenant/sweep.js +13 -7
  257. package/dist/tenant/tool-results.js +1 -1
  258. package/dist/tenant/tool-search.d.ts +7 -11
  259. package/dist/tenant/tool-search.js +8 -5
  260. package/dist/tenant/transcript.d.ts +245 -36
  261. package/dist/tenant/transcript.js +64 -12
  262. package/dist/tenant/turn-timing.d.ts +43 -0
  263. package/dist/tenant/turn-timing.js +39 -0
  264. package/dist/tenant/types.d.ts +2 -0
  265. package/dist/traces/ids.d.ts +41 -0
  266. package/dist/traces/ids.js +81 -0
  267. package/dist/traces/key.d.ts +6 -0
  268. package/dist/traces/key.js +37 -0
  269. package/dist/traces/map.d.ts +113 -0
  270. package/dist/traces/map.js +289 -0
  271. package/dist/traces/options.d.ts +7 -0
  272. package/dist/traces/options.js +1 -0
  273. package/dist/traces/otlp.d.ts +42 -0
  274. package/dist/traces/otlp.js +84 -0
  275. package/dist/traces/projector.d.ts +58 -0
  276. package/dist/traces/projector.js +200 -0
  277. package/dist/traces/read.d.ts +23 -0
  278. package/dist/traces/read.js +16 -0
  279. package/dist/vault/coverage.d.ts +26 -0
  280. package/dist/vault/coverage.js +62 -0
  281. package/dist/vault/error.d.ts +11 -1
  282. package/dist/vault/error.js +5 -1
  283. package/dist/vault/host-model.d.ts +4 -1
  284. package/dist/vault/host-model.js +10 -2
  285. package/dist/vault/service.d.ts +92 -48
  286. package/dist/vault/service.js +462 -376
  287. package/dist/vault/sources.d.ts +5 -16
  288. package/dist/vault/sources.js +6 -8
  289. package/dist/version.d.ts +1 -1
  290. package/dist/version.js +2 -2
  291. package/package.json +13 -13
  292. package/dist/api/http/routes/sandboxes.d.ts +0 -9
  293. package/dist/api/http/routes/sandboxes.js +0 -153
  294. package/dist/api/http/routes/vaults.d.ts +0 -10
  295. package/dist/api/http/routes/vaults.js +0 -139
  296. package/dist/record/sandbox.d.ts +0 -25
  297. package/dist/record/sandbox.js +0 -43
  298. package/dist/sandbox/capability.d.ts +0 -3
  299. package/dist/sandbox/capability.js +0 -10
  300. package/dist/tenant/sandboxes.d.ts +0 -123
  301. package/dist/tenant/sandboxes.js +0 -566
package/dist/management-openapi.json CHANGED
@@ -2,30 +2,38 @@
2
2
  "openapi": "3.2.0",
3
3
  "info": {
4
4
  "title": "Nylorun Management API",
5
- "version": "0.23.0-beta",
5
+ "version": "0.25.0-beta",
6
6
  "x-nylorun-protocol": {
7
- "min": 4,
8
- "max": 10,
7
+ "min": 14,
8
+ "max": 14,
9
9
  "features": [
10
- "runtime-tenants",
11
- "admin-status",
12
10
  "studio-principal",
13
11
  "artifacts",
14
12
  "management-api",
15
13
  "resource-server",
14
+ "environments",
15
+ "model-inputs",
16
+ "flat-manifest",
17
+ "environment-manifests",
16
18
  "tenant-fixture-model",
17
19
  "transcript-events",
18
20
  "subject-headers",
19
21
  "ag-ui-endpoint",
20
22
  "a2a-endpoint",
21
- "sandboxes",
22
23
  "sandbox-pods",
23
24
  "trusted-issuers",
24
25
  "session-reads",
25
- "calls-export"
26
+ "calls-export",
27
+ "credential-coverage",
28
+ "tool-calls",
29
+ "environment-setup",
30
+ "environment-disk-versions",
31
+ "tool-policy",
32
+ "traces",
33
+ "artifact-reads"
26
34
  ]
27
35
  },
28
- "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun key put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
36
+ "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
29
37
  },
30
38
  "servers": [
31
39
  {
@@ -87,17 +95,26 @@
87
95
  "request_rejected",
88
96
  "invalid_request",
89
97
  "subject_required",
90
- "sandbox_not_granted",
91
- "sandbox_busy",
92
- "sandbox_unavailable",
98
+ "environment_not_granted",
99
+ "environment_busy",
100
+ "environment_unavailable",
93
101
  "placement_refused",
94
- "sandbox_lost",
95
- "sandbox_expired",
102
+ "environment_lost",
103
+ "environment_owner_mismatch",
104
+ "harness_mismatch",
105
+ "session_closed",
96
106
  "issuer_unavailable",
97
107
  "definition_files_missing",
98
108
  "credential_rejected",
99
109
  "mcp_preview_failed",
100
110
  "credential_conflict",
111
+ "attachment_unsupported",
112
+ "environment_immutable",
113
+ "secret_not_in_manifest",
114
+ "environment_unsuitable",
115
+ "manifest_not_found",
116
+ "manifest_in_use",
117
+ "manifest_changed",
101
118
  "internal_error"
102
119
  ]
103
120
  },
@@ -164,6 +181,48 @@
164
181
  ],
165
182
  "additionalProperties": false
166
183
  },
184
+ "JsonValue": {
185
+ "anyOf": [
186
+ {
187
+ "type": "string"
188
+ },
189
+ {
190
+ "type": "number"
191
+ },
192
+ {
193
+ "type": "boolean"
194
+ },
195
+ {
196
+ "type": "null"
197
+ },
198
+ {
199
+ "type": "array",
200
+ "items": {
201
+ "oneOf": [
202
+ {
203
+ "$ref": "#/components/schemas/JsonValue"
204
+ },
205
+ {
206
+ "type": "null"
207
+ }
208
+ ]
209
+ }
210
+ },
211
+ {
212
+ "type": "object",
213
+ "additionalProperties": {
214
+ "oneOf": [
215
+ {
216
+ "$ref": "#/components/schemas/JsonValue"
217
+ },
218
+ {
219
+ "type": "null"
220
+ }
221
+ ]
222
+ }
223
+ }
224
+ ]
225
+ },
167
226
  "TenantArtifactsView": {
168
227
  "type": "object",
169
228
  "properties": {
@@ -337,6 +396,20 @@
337
396
  "reasoning": {
338
397
  "type": "boolean"
339
398
  },
399
+ "inputs": {
400
+ "type": "array",
401
+ "items": {
402
+ "type": "string",
403
+ "enum": [
404
+ "text",
405
+ "image",
406
+ "pdf",
407
+ "office",
408
+ "audio",
409
+ "video"
410
+ ]
411
+ }
412
+ },
340
413
  "compat": {
341
414
  "type": "object",
342
415
  "additionalProperties": {}
@@ -621,7 +694,7 @@
621
694
  "type": "string",
622
695
  "enum": [
623
696
  "sessions",
624
- "sandboxes",
697
+ "environments",
625
698
  "all"
626
699
  ]
627
700
  },
@@ -682,58 +755,6 @@
682
755
  "config": {
683
756
  "type": "object",
684
757
  "properties": {
685
- "default": {
686
- "anyOf": [
687
- {
688
- "type": "string",
689
- "enum": [
690
- "none"
691
- ]
692
- },
693
- {
694
- "type": "string",
695
- "enum": [
696
- "virtual"
697
- ]
698
- },
699
- {
700
- "type": "object",
701
- "properties": {
702
- "image": {
703
- "type": "string",
704
- "minLength": 1
705
- },
706
- "network": {
707
- "type": "object",
708
- "properties": {
709
- "allow": {
710
- "type": "array",
711
- "items": {
712
- "type": "string"
713
- }
714
- }
715
- },
716
- "additionalProperties": false
717
- },
718
- "resources": {
719
- "type": "object",
720
- "properties": {
721
- "cpus": {
722
- "type": "integer",
723
- "minimum": 1,
724
- "maximum": 64
725
- },
726
- "memory": {
727
- "type": "string"
728
- }
729
- },
730
- "additionalProperties": false
731
- }
732
- },
733
- "additionalProperties": false
734
- }
735
- ]
736
- },
737
758
  "limits": {
738
759
  "type": "object",
739
760
  "properties": {
@@ -774,13 +795,10 @@
774
795
  "idle": {
775
796
  "type": "string"
776
797
  },
777
- "sandboxes": {
798
+ "environments": {
778
799
  "type": "integer",
779
800
  "minimum": 0,
780
801
  "maximum": 100000
781
- },
782
- "ttl": {
783
- "type": "string"
784
802
  }
785
803
  },
786
804
  "additionalProperties": false
@@ -788,13 +806,6 @@
788
806
  "lifecycle": {
789
807
  "type": "object",
790
808
  "properties": {
791
- "onExpiry": {
792
- "type": "string",
793
- "enum": [
794
- "retain",
795
- "delete"
796
- ]
797
- },
798
809
  "stopGrace": {
799
810
  "type": "string"
800
811
  }
@@ -814,8 +825,7 @@
814
825
  "harness-container",
815
826
  "sandbox"
816
827
  ]
817
- },
818
- "minItems": 1
828
+ }
819
829
  }
820
830
  },
821
831
  "required": [
@@ -859,6 +869,20 @@
859
869
  "reasoning": {
860
870
  "type": "boolean"
861
871
  },
872
+ "inputs": {
873
+ "type": "array",
874
+ "items": {
875
+ "type": "string",
876
+ "enum": [
877
+ "text",
878
+ "image",
879
+ "pdf",
880
+ "office",
881
+ "audio",
882
+ "video"
883
+ ]
884
+ }
885
+ },
862
886
  "compat": {
863
887
  "type": "object",
864
888
  "additionalProperties": {}
@@ -969,11 +993,41 @@
969
993
  },
970
994
  "name": {
971
995
  "type": "string"
996
+ },
997
+ "inputs": {
998
+ "type": "array",
999
+ "items": {
1000
+ "type": "string",
1001
+ "enum": [
1002
+ "text",
1003
+ "image",
1004
+ "pdf",
1005
+ "office",
1006
+ "audio",
1007
+ "video"
1008
+ ]
1009
+ }
1010
+ },
1011
+ "addableInputs": {
1012
+ "type": "array",
1013
+ "items": {
1014
+ "type": "string",
1015
+ "enum": [
1016
+ "text",
1017
+ "image",
1018
+ "pdf",
1019
+ "office",
1020
+ "audio",
1021
+ "video"
1022
+ ]
1023
+ }
972
1024
  }
973
1025
  },
974
1026
  "required": [
975
1027
  "id",
976
- "name"
1028
+ "name",
1029
+ "inputs",
1030
+ "addableInputs"
977
1031
  ],
978
1032
  "additionalProperties": false
979
1033
  }
@@ -993,6 +1047,74 @@
993
1047
  ],
994
1048
  "additionalProperties": false
995
1049
  },
1050
+ "ModelInputsView": {
1051
+ "type": "object",
1052
+ "properties": {
1053
+ "provider": {
1054
+ "type": "string"
1055
+ },
1056
+ "model": {
1057
+ "type": "string"
1058
+ },
1059
+ "inputs": {
1060
+ "type": "array",
1061
+ "items": {
1062
+ "type": "string",
1063
+ "enum": [
1064
+ "text",
1065
+ "image",
1066
+ "pdf",
1067
+ "office",
1068
+ "audio",
1069
+ "video"
1070
+ ]
1071
+ }
1072
+ }
1073
+ },
1074
+ "required": [
1075
+ "provider",
1076
+ "model",
1077
+ "inputs"
1078
+ ],
1079
+ "additionalProperties": false
1080
+ },
1081
+ "PutModelInputsRequest": {
1082
+ "type": "object",
1083
+ "properties": {
1084
+ "requestId": {
1085
+ "type": "string",
1086
+ "minLength": 1
1087
+ },
1088
+ "provider": {
1089
+ "type": "string",
1090
+ "minLength": 1
1091
+ },
1092
+ "model": {
1093
+ "type": "string",
1094
+ "minLength": 1
1095
+ },
1096
+ "inputs": {
1097
+ "type": "array",
1098
+ "items": {
1099
+ "type": "string",
1100
+ "enum": [
1101
+ "text",
1102
+ "image",
1103
+ "pdf",
1104
+ "office",
1105
+ "audio",
1106
+ "video"
1107
+ ]
1108
+ }
1109
+ }
1110
+ },
1111
+ "required": [
1112
+ "provider",
1113
+ "model",
1114
+ "inputs"
1115
+ ],
1116
+ "additionalProperties": false
1117
+ },
996
1118
  "TenantSandboxView": {
997
1119
  "type": "object",
998
1120
  "properties": {
@@ -1081,58 +1203,6 @@
1081
1203
  "config": {
1082
1204
  "type": "object",
1083
1205
  "properties": {
1084
- "default": {
1085
- "anyOf": [
1086
- {
1087
- "type": "string",
1088
- "enum": [
1089
- "none"
1090
- ]
1091
- },
1092
- {
1093
- "type": "string",
1094
- "enum": [
1095
- "virtual"
1096
- ]
1097
- },
1098
- {
1099
- "type": "object",
1100
- "properties": {
1101
- "image": {
1102
- "type": "string",
1103
- "minLength": 1
1104
- },
1105
- "network": {
1106
- "type": "object",
1107
- "properties": {
1108
- "allow": {
1109
- "type": "array",
1110
- "items": {
1111
- "type": "string"
1112
- }
1113
- }
1114
- },
1115
- "additionalProperties": false
1116
- },
1117
- "resources": {
1118
- "type": "object",
1119
- "properties": {
1120
- "cpus": {
1121
- "type": "integer",
1122
- "minimum": 1,
1123
- "maximum": 64
1124
- },
1125
- "memory": {
1126
- "type": "string"
1127
- }
1128
- },
1129
- "additionalProperties": false
1130
- }
1131
- },
1132
- "additionalProperties": false
1133
- }
1134
- ]
1135
- },
1136
1206
  "limits": {
1137
1207
  "type": "object",
1138
1208
  "properties": {
@@ -1177,12 +1247,9 @@
1177
1247
  "idle": {
1178
1248
  "type": "string"
1179
1249
  },
1180
- "sandboxes": {
1250
+ "environments": {
1181
1251
  "type": "integer",
1182
1252
  "minimum": 0
1183
- },
1184
- "ttl": {
1185
- "type": "string"
1186
1253
  }
1187
1254
  },
1188
1255
  "required": [
@@ -1196,19 +1263,11 @@
1196
1263
  "lifecycle": {
1197
1264
  "type": "object",
1198
1265
  "properties": {
1199
- "onExpiry": {
1200
- "type": "string",
1201
- "enum": [
1202
- "retain",
1203
- "delete"
1204
- ]
1205
- },
1206
1266
  "stopGrace": {
1207
1267
  "type": "string"
1208
1268
  }
1209
1269
  },
1210
1270
  "required": [
1211
- "onExpiry",
1212
1271
  "stopGrace"
1213
1272
  ],
1214
1273
  "additionalProperties": false
@@ -1237,7 +1296,6 @@
1237
1296
  }
1238
1297
  },
1239
1298
  "required": [
1240
- "default",
1241
1299
  "limits"
1242
1300
  ],
1243
1301
  "additionalProperties": false
@@ -1293,61 +1351,9 @@
1293
1351
  ],
1294
1352
  "additionalProperties": false
1295
1353
  },
1296
- "PutTenantSandboxRequest": {
1354
+ "PutTenantEnvironmentsRequest": {
1297
1355
  "type": "object",
1298
1356
  "properties": {
1299
- "default": {
1300
- "anyOf": [
1301
- {
1302
- "type": "string",
1303
- "enum": [
1304
- "none"
1305
- ]
1306
- },
1307
- {
1308
- "type": "string",
1309
- "enum": [
1310
- "virtual"
1311
- ]
1312
- },
1313
- {
1314
- "type": "object",
1315
- "properties": {
1316
- "image": {
1317
- "type": "string",
1318
- "minLength": 1
1319
- },
1320
- "network": {
1321
- "type": "object",
1322
- "properties": {
1323
- "allow": {
1324
- "type": "array",
1325
- "items": {
1326
- "type": "string"
1327
- }
1328
- }
1329
- },
1330
- "additionalProperties": false
1331
- },
1332
- "resources": {
1333
- "type": "object",
1334
- "properties": {
1335
- "cpus": {
1336
- "type": "integer",
1337
- "minimum": 1,
1338
- "maximum": 64
1339
- },
1340
- "memory": {
1341
- "type": "string"
1342
- }
1343
- },
1344
- "additionalProperties": false
1345
- }
1346
- },
1347
- "additionalProperties": false
1348
- }
1349
- ]
1350
- },
1351
1357
  "limits": {
1352
1358
  "type": "object",
1353
1359
  "properties": {
@@ -1388,13 +1394,10 @@
1388
1394
  "idle": {
1389
1395
  "type": "string"
1390
1396
  },
1391
- "sandboxes": {
1397
+ "environments": {
1392
1398
  "type": "integer",
1393
1399
  "minimum": 0,
1394
1400
  "maximum": 100000
1395
- },
1396
- "ttl": {
1397
- "type": "string"
1398
1401
  }
1399
1402
  },
1400
1403
  "additionalProperties": false
@@ -1402,13 +1405,6 @@
1402
1405
  "lifecycle": {
1403
1406
  "type": "object",
1404
1407
  "properties": {
1405
- "onExpiry": {
1406
- "type": "string",
1407
- "enum": [
1408
- "retain",
1409
- "delete"
1410
- ]
1411
- },
1412
1408
  "stopGrace": {
1413
1409
  "type": "string"
1414
1410
  }
@@ -1428,8 +1424,7 @@
1428
1424
  "harness-container",
1429
1425
  "sandbox"
1430
1426
  ]
1431
- },
1432
- "minItems": 1
1427
+ }
1433
1428
  }
1434
1429
  },
1435
1430
  "required": [
@@ -1593,47 +1588,257 @@
1593
1588
  ],
1594
1589
  "additionalProperties": false
1595
1590
  },
1596
- "ListProvidersResponse": {
1591
+ "ToolPolicy": {
1597
1592
  "type": "object",
1598
1593
  "properties": {
1599
- "providers": {
1594
+ "rules": {
1600
1595
  "type": "array",
1601
1596
  "items": {
1602
1597
  "type": "object",
1603
1598
  "properties": {
1604
- "id": {
1605
- "type": "string"
1599
+ "effect": {
1600
+ "type": "string",
1601
+ "enum": [
1602
+ "allow",
1603
+ "ask",
1604
+ "deny"
1605
+ ]
1606
1606
  },
1607
- "name": {
1608
- "type": "string"
1607
+ "tool": {
1608
+ "type": "string",
1609
+ "minLength": 1,
1610
+ "maxLength": 200
1609
1611
  },
1610
- "model": {
1611
- "type": "string"
1612
+ "server": {
1613
+ "type": "string",
1614
+ "minLength": 1,
1615
+ "maxLength": 200
1612
1616
  },
1613
- "authType": {
1617
+ "kind": {
1614
1618
  "type": "string",
1615
1619
  "enum": [
1616
- "api_key",
1617
- "oauth"
1620
+ "mcp",
1621
+ "http"
1618
1622
  ]
1619
1623
  },
1620
- "baseUrl": {
1621
- "type": "string"
1624
+ "agent": {
1625
+ "type": "string",
1626
+ "minLength": 1,
1627
+ "maxLength": 200
1622
1628
  },
1623
- "settings": {
1629
+ "when": {
1624
1630
  "type": "object",
1625
- "properties": {
1626
- "contextWindow": {
1627
- "type": "integer",
1628
- "minimum": 1024
1629
- },
1630
- "maxTokens": {
1631
- "type": "integer",
1631
+ "additionalProperties": {
1632
+ "type": "object",
1633
+ "properties": {
1634
+ "equals": {
1635
+ "$ref": "#/components/schemas/JsonValue"
1636
+ },
1637
+ "in": {
1638
+ "type": "array",
1639
+ "items": {
1640
+ "$ref": "#/components/schemas/JsonValue"
1641
+ },
1642
+ "minItems": 1
1643
+ },
1644
+ "gt": {
1645
+ "type": "number"
1646
+ },
1647
+ "gte": {
1648
+ "type": "number"
1649
+ },
1650
+ "lt": {
1651
+ "type": "number"
1652
+ },
1653
+ "lte": {
1654
+ "type": "number"
1655
+ },
1656
+ "matches": {
1657
+ "type": "string",
1658
+ "minLength": 1,
1659
+ "maxLength": 500
1660
+ }
1661
+ },
1662
+ "additionalProperties": false
1663
+ }
1664
+ },
1665
+ "reason": {
1666
+ "type": "string",
1667
+ "minLength": 1,
1668
+ "maxLength": 500
1669
+ }
1670
+ },
1671
+ "required": [
1672
+ "effect"
1673
+ ],
1674
+ "additionalProperties": false
1675
+ }
1676
+ },
1677
+ "updatedAt": {
1678
+ "type": [
1679
+ "string",
1680
+ "null"
1681
+ ]
1682
+ }
1683
+ },
1684
+ "required": [
1685
+ "rules",
1686
+ "updatedAt"
1687
+ ],
1688
+ "additionalProperties": false
1689
+ },
1690
+ "PutToolPolicyRequest": {
1691
+ "type": "object",
1692
+ "properties": {
1693
+ "requestId": {
1694
+ "type": "string",
1695
+ "minLength": 1
1696
+ },
1697
+ "rules": {
1698
+ "type": "array",
1699
+ "items": {
1700
+ "type": "object",
1701
+ "properties": {
1702
+ "effect": {
1703
+ "type": "string",
1704
+ "enum": [
1705
+ "allow",
1706
+ "ask",
1707
+ "deny"
1708
+ ]
1709
+ },
1710
+ "tool": {
1711
+ "type": "string",
1712
+ "minLength": 1,
1713
+ "maxLength": 200
1714
+ },
1715
+ "server": {
1716
+ "type": "string",
1717
+ "minLength": 1,
1718
+ "maxLength": 200
1719
+ },
1720
+ "kind": {
1721
+ "type": "string",
1722
+ "enum": [
1723
+ "mcp",
1724
+ "http"
1725
+ ]
1726
+ },
1727
+ "agent": {
1728
+ "type": "string",
1729
+ "minLength": 1,
1730
+ "maxLength": 200
1731
+ },
1732
+ "when": {
1733
+ "type": "object",
1734
+ "additionalProperties": {
1735
+ "type": "object",
1736
+ "properties": {
1737
+ "equals": {
1738
+ "$ref": "#/components/schemas/JsonValue"
1739
+ },
1740
+ "in": {
1741
+ "type": "array",
1742
+ "items": {
1743
+ "$ref": "#/components/schemas/JsonValue"
1744
+ },
1745
+ "minItems": 1
1746
+ },
1747
+ "gt": {
1748
+ "type": "number"
1749
+ },
1750
+ "gte": {
1751
+ "type": "number"
1752
+ },
1753
+ "lt": {
1754
+ "type": "number"
1755
+ },
1756
+ "lte": {
1757
+ "type": "number"
1758
+ },
1759
+ "matches": {
1760
+ "type": "string",
1761
+ "minLength": 1,
1762
+ "maxLength": 500
1763
+ }
1764
+ },
1765
+ "additionalProperties": false
1766
+ }
1767
+ },
1768
+ "reason": {
1769
+ "type": "string",
1770
+ "minLength": 1,
1771
+ "maxLength": 500
1772
+ }
1773
+ },
1774
+ "required": [
1775
+ "effect"
1776
+ ],
1777
+ "additionalProperties": false
1778
+ },
1779
+ "maxItems": 200
1780
+ }
1781
+ },
1782
+ "required": [
1783
+ "rules"
1784
+ ],
1785
+ "additionalProperties": false
1786
+ },
1787
+ "ListProvidersResponse": {
1788
+ "type": "object",
1789
+ "properties": {
1790
+ "providers": {
1791
+ "type": "array",
1792
+ "items": {
1793
+ "type": "object",
1794
+ "properties": {
1795
+ "id": {
1796
+ "type": "string"
1797
+ },
1798
+ "name": {
1799
+ "type": "string"
1800
+ },
1801
+ "model": {
1802
+ "type": "string"
1803
+ },
1804
+ "authType": {
1805
+ "type": "string",
1806
+ "enum": [
1807
+ "api_key",
1808
+ "oauth"
1809
+ ]
1810
+ },
1811
+ "baseUrl": {
1812
+ "type": "string"
1813
+ },
1814
+ "settings": {
1815
+ "type": "object",
1816
+ "properties": {
1817
+ "contextWindow": {
1818
+ "type": "integer",
1819
+ "minimum": 1024
1820
+ },
1821
+ "maxTokens": {
1822
+ "type": "integer",
1632
1823
  "minimum": 1
1633
1824
  },
1634
1825
  "reasoning": {
1635
1826
  "type": "boolean"
1636
1827
  },
1828
+ "inputs": {
1829
+ "type": "array",
1830
+ "items": {
1831
+ "type": "string",
1832
+ "enum": [
1833
+ "text",
1834
+ "image",
1835
+ "pdf",
1836
+ "office",
1837
+ "audio",
1838
+ "video"
1839
+ ]
1840
+ }
1841
+ },
1637
1842
  "compat": {
1638
1843
  "type": "object",
1639
1844
  "additionalProperties": {}
@@ -1641,6 +1846,20 @@
1641
1846
  },
1642
1847
  "additionalProperties": false
1643
1848
  },
1849
+ "inputs": {
1850
+ "type": "array",
1851
+ "items": {
1852
+ "type": "string",
1853
+ "enum": [
1854
+ "text",
1855
+ "image",
1856
+ "pdf",
1857
+ "office",
1858
+ "audio",
1859
+ "video"
1860
+ ]
1861
+ }
1862
+ },
1644
1863
  "lastUpdated": {
1645
1864
  "type": "string"
1646
1865
  },
@@ -1721,6 +1940,20 @@
1721
1940
  "reasoning": {
1722
1941
  "type": "boolean"
1723
1942
  },
1943
+ "inputs": {
1944
+ "type": "array",
1945
+ "items": {
1946
+ "type": "string",
1947
+ "enum": [
1948
+ "text",
1949
+ "image",
1950
+ "pdf",
1951
+ "office",
1952
+ "audio",
1953
+ "video"
1954
+ ]
1955
+ }
1956
+ },
1724
1957
  "compat": {
1725
1958
  "type": "object",
1726
1959
  "additionalProperties": {}
@@ -1777,6 +2010,20 @@
1777
2010
  "reasoning": {
1778
2011
  "type": "boolean"
1779
2012
  },
2013
+ "inputs": {
2014
+ "type": "array",
2015
+ "items": {
2016
+ "type": "string",
2017
+ "enum": [
2018
+ "text",
2019
+ "image",
2020
+ "pdf",
2021
+ "office",
2022
+ "audio",
2023
+ "video"
2024
+ ]
2025
+ }
2026
+ },
1780
2027
  "compat": {
1781
2028
  "type": "object",
1782
2029
  "additionalProperties": {}
@@ -1973,1079 +2220,509 @@
1973
2220
  ],
1974
2221
  "additionalProperties": false
1975
2222
  },
1976
- "VaultInfo": {
2223
+ "CredentialCoverage": {
1977
2224
  "type": "object",
1978
2225
  "properties": {
1979
- "id": {
2226
+ "agentId": {
1980
2227
  "type": "string"
1981
2228
  },
1982
- "name": {
1983
- "type": "string"
2229
+ "environmentId": {
2230
+ "type": [
2231
+ "string",
2232
+ "null"
2233
+ ]
1984
2234
  },
1985
- "ownerUserId": {
1986
- "type": "string"
2235
+ "complete": {
2236
+ "type": "boolean"
1987
2237
  },
1988
- "metadata": {
1989
- "type": "object",
1990
- "additionalProperties": {
1991
- "type": "string"
2238
+ "entries": {
2239
+ "type": "array",
2240
+ "items": {
2241
+ "type": "object",
2242
+ "properties": {
2243
+ "kind": {
2244
+ "type": "string",
2245
+ "enum": [
2246
+ "mcp",
2247
+ "http"
2248
+ ]
2249
+ },
2250
+ "agentId": {
2251
+ "type": "string"
2252
+ },
2253
+ "stage": {
2254
+ "type": "string"
2255
+ },
2256
+ "name": {
2257
+ "type": "string"
2258
+ },
2259
+ "serverName": {
2260
+ "type": "string"
2261
+ },
2262
+ "url": {
2263
+ "type": "string"
2264
+ },
2265
+ "required": {
2266
+ "type": "boolean"
2267
+ },
2268
+ "status": {
2269
+ "type": "string",
2270
+ "enum": [
2271
+ "covered",
2272
+ "missing"
2273
+ ]
2274
+ },
2275
+ "credential": {
2276
+ "type": "object",
2277
+ "properties": {
2278
+ "environmentId": {
2279
+ "type": "string"
2280
+ },
2281
+ "name": {
2282
+ "type": "string"
2283
+ },
2284
+ "via": {
2285
+ "type": "string"
2286
+ }
2287
+ },
2288
+ "required": [
2289
+ "environmentId",
2290
+ "name"
2291
+ ],
2292
+ "additionalProperties": false
2293
+ },
2294
+ "message": {
2295
+ "type": "string"
2296
+ }
2297
+ },
2298
+ "required": [
2299
+ "kind",
2300
+ "name",
2301
+ "serverName",
2302
+ "url",
2303
+ "required",
2304
+ "status",
2305
+ "message"
2306
+ ],
2307
+ "additionalProperties": false
1992
2308
  }
1993
- },
1994
- "createdAt": {
1995
- "type": "string"
1996
2309
  }
1997
2310
  },
1998
2311
  "required": [
1999
- "id",
2000
- "name",
2001
- "ownerUserId",
2002
- "createdAt"
2312
+ "agentId",
2313
+ "environmentId",
2314
+ "complete",
2315
+ "entries"
2003
2316
  ],
2004
2317
  "additionalProperties": false
2005
2318
  },
2006
- "CreateVaultRequest": {
2319
+ "CredentialCoverageRequest": {
2007
2320
  "type": "object",
2008
2321
  "properties": {
2009
2322
  "requestId": {
2010
2323
  "type": "string",
2011
2324
  "minLength": 1
2012
2325
  },
2013
- "idempotencyKey": {
2014
- "type": "string",
2015
- "minLength": 1,
2016
- "maxLength": 256
2017
- },
2018
- "name": {
2326
+ "agentId": {
2019
2327
  "type": "string",
2020
2328
  "minLength": 1
2021
2329
  },
2022
- "scope": {
2023
- "type": "string",
2024
- "enum": [
2025
- "user",
2026
- "installation"
2027
- ]
2028
- },
2029
- "ownerUserId": {
2330
+ "environmentId": {
2030
2331
  "type": "string",
2031
- "minLength": 1
2032
- },
2033
- "metadata": {
2034
- "type": "object",
2035
- "additionalProperties": {
2036
- "type": "string"
2037
- }
2332
+ "description": "An Environment id, such as `user-42` or `users/alice/web`"
2038
2333
  }
2039
2334
  },
2040
2335
  "required": [
2041
- "requestId",
2042
- "idempotencyKey",
2043
- "name"
2336
+ "agentId"
2044
2337
  ],
2045
2338
  "additionalProperties": false
2046
2339
  },
2047
- "ListVaultsResponse": {
2340
+ "McpPreview": {
2048
2341
  "type": "object",
2049
2342
  "properties": {
2050
- "vaults": {
2051
- "type": "array",
2052
- "items": {
2053
- "type": "object",
2054
- "properties": {
2055
- "id": {
2343
+ "name": {
2344
+ "type": "string"
2345
+ },
2346
+ "url": {
2347
+ "type": "string"
2348
+ },
2349
+ "type": {
2350
+ "type": "string",
2351
+ "enum": [
2352
+ "streamable-http",
2353
+ "sse"
2354
+ ]
2355
+ },
2356
+ "credentialSent": {
2357
+ "type": "boolean"
2358
+ },
2359
+ "serverInfo": {
2360
+ "type": "object",
2361
+ "additionalProperties": {}
2362
+ },
2363
+ "instructions": {
2364
+ "type": "string"
2365
+ },
2366
+ "tools": {
2367
+ "type": "array",
2368
+ "items": {
2369
+ "type": "object",
2370
+ "properties": {
2371
+ "serverToolName": {
2056
2372
  "type": "string"
2057
2373
  },
2058
- "name": {
2374
+ "modelName": {
2059
2375
  "type": "string"
2060
2376
  },
2061
- "ownerUserId": {
2377
+ "description": {
2062
2378
  "type": "string"
2063
2379
  },
2064
- "metadata": {
2380
+ "annotations": {
2065
2381
  "type": "object",
2066
- "additionalProperties": {
2067
- "type": "string"
2068
- }
2382
+ "additionalProperties": {}
2069
2383
  },
2070
- "createdAt": {
2071
- "type": "string"
2384
+ "schemaBytes": {
2385
+ "type": "integer",
2386
+ "minimum": 0
2072
2387
  }
2073
2388
  },
2074
2389
  "required": [
2075
- "id",
2076
- "name",
2077
- "ownerUserId",
2078
- "createdAt"
2390
+ "serverToolName",
2391
+ "schemaBytes"
2079
2392
  ],
2080
2393
  "additionalProperties": false
2081
2394
  }
2082
- }
2083
- },
2084
- "required": [
2085
- "vaults"
2086
- ],
2087
- "additionalProperties": false
2088
- },
2089
- "DeletedResponse": {
2090
- "type": "object",
2091
- "properties": {
2092
- "id": {
2093
- "type": "string"
2094
- }
2095
- },
2096
- "required": [
2097
- "id"
2098
- ],
2099
- "additionalProperties": false
2100
- },
2101
- "CredentialInfo": {
2102
- "type": "object",
2103
- "properties": {
2104
- "id": {
2105
- "type": "string"
2106
- },
2107
- "vaultId": {
2108
- "type": "string"
2109
- },
2110
- "name": {
2111
- "type": "string"
2112
- },
2113
- "type": {
2114
- "type": "string",
2115
- "enum": [
2116
- "bearer",
2117
- "headers",
2118
- "environment_secret",
2119
- "environment_variable"
2120
- ]
2121
2395
  },
2122
- "binding": {
2123
- "type": "object",
2124
- "properties": {
2125
- "url": {
2126
- "type": "string"
2127
- },
2128
- "secretName": {
2129
- "type": "string"
2130
- },
2131
- "allowedHosts": {
2132
- "type": "array",
2133
- "items": {
2396
+ "renamed": {
2397
+ "type": "array",
2398
+ "items": {
2399
+ "type": "object",
2400
+ "properties": {
2401
+ "serverToolName": {
2134
2402
  "type": "string"
2135
- }
2136
- },
2137
- "inject": {
2138
- "type": "object",
2139
- "properties": {
2140
- "header": {
2141
- "type": "string",
2142
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2143
- },
2144
- "format": {
2145
- "type": "string",
2146
- "minLength": 1
2147
- }
2148
2403
  },
2149
- "required": [
2150
- "header",
2151
- "format"
2152
- ],
2153
- "additionalProperties": false
2154
- },
2155
- "variableName": {
2156
- "type": "string"
2404
+ "name": {
2405
+ "type": "string"
2406
+ }
2157
2407
  },
2158
- "variableValue": {
2159
- "type": "string"
2160
- }
2161
- },
2162
- "additionalProperties": false
2163
- },
2164
- "headerNames": {
2165
- "type": "array",
2166
- "items": {
2167
- "type": "string"
2408
+ "required": [
2409
+ "serverToolName",
2410
+ "name"
2411
+ ],
2412
+ "additionalProperties": false
2168
2413
  }
2169
2414
  },
2170
- "via": {
2171
- "type": "string"
2172
- },
2173
- "identity": {
2415
+ "authRequired": {
2174
2416
  "type": "object",
2175
2417
  "properties": {
2176
- "header": {
2177
- "type": "string",
2178
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2418
+ "resourceMetadataUrl": {
2419
+ "type": "string"
2420
+ },
2421
+ "resourceMetadata": {
2422
+ "type": "object",
2423
+ "additionalProperties": {}
2179
2424
  }
2180
2425
  },
2181
- "required": [
2182
- "header"
2183
- ],
2184
2426
  "additionalProperties": false
2185
- },
2186
- "createdAt": {
2187
- "type": "string"
2188
- },
2189
- "rotatedAt": {
2190
- "type": "string"
2191
2427
  }
2192
2428
  },
2193
2429
  "required": [
2194
- "id",
2195
- "vaultId",
2196
2430
  "name",
2431
+ "url",
2197
2432
  "type",
2198
- "binding",
2199
- "createdAt"
2433
+ "credentialSent",
2434
+ "tools",
2435
+ "renamed"
2200
2436
  ],
2201
2437
  "additionalProperties": false
2202
2438
  },
2203
- "CreateCredentialRequest": {
2439
+ "McpPreviewRequest": {
2204
2440
  "type": "object",
2205
2441
  "properties": {
2206
2442
  "requestId": {
2207
2443
  "type": "string",
2208
2444
  "minLength": 1
2209
2445
  },
2210
- "idempotencyKey": {
2446
+ "url": {
2211
2447
  "type": "string",
2212
- "minLength": 1,
2213
- "maxLength": 256
2448
+ "minLength": 1
2449
+ },
2450
+ "type": {
2451
+ "type": "string",
2452
+ "enum": [
2453
+ "streamable-http",
2454
+ "sse"
2455
+ ]
2214
2456
  },
2215
2457
  "name": {
2216
2458
  "type": "string",
2217
- "minLength": 1
2459
+ "pattern": "^[A-Za-z0-9_-]{1,64}$"
2218
2460
  },
2219
- "auth": {
2220
- "oneOf": [
2221
- {
2222
- "type": "object",
2223
- "properties": {
2224
- "type": {
2225
- "type": "string",
2226
- "enum": [
2227
- "bearer"
2228
- ]
2229
- },
2230
- "url": {
2231
- "type": "string",
2232
- "minLength": 1
2233
- },
2234
- "token": {
2235
- "type": "string",
2236
- "minLength": 1
2237
- },
2238
- "via": {
2239
- "type": "string"
2240
- },
2241
- "identity": {
2242
- "type": "object",
2243
- "properties": {
2244
- "header": {
2245
- "type": "string",
2246
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2247
- }
2248
- },
2249
- "required": [
2250
- "header"
2251
- ],
2252
- "additionalProperties": false
2253
- }
2461
+ "environmentId": {
2462
+ "type": "string",
2463
+ "description": "An Environment id, such as `user-42` or `users/alice/web`"
2464
+ }
2465
+ },
2466
+ "required": [
2467
+ "url"
2468
+ ],
2469
+ "additionalProperties": false
2470
+ },
2471
+ "SigningKeyList": {
2472
+ "type": "object",
2473
+ "properties": {
2474
+ "keys": {
2475
+ "type": "array",
2476
+ "items": {
2477
+ "type": "object",
2478
+ "properties": {
2479
+ "id": {
2480
+ "type": "string"
2254
2481
  },
2255
- "required": [
2256
- "type",
2257
- "url",
2258
- "token"
2259
- ],
2260
- "additionalProperties": false
2261
- },
2262
- {
2263
- "type": "object",
2264
- "properties": {
2265
- "type": {
2266
- "type": "string",
2267
- "enum": [
2268
- "headers"
2269
- ]
2270
- },
2271
- "url": {
2272
- "type": "string",
2273
- "minLength": 1
2274
- },
2275
- "headers": {
2276
- "type": "object",
2277
- "additionalProperties": {
2482
+ "state": {
2483
+ "type": "string",
2484
+ "enum": [
2485
+ "standby",
2486
+ "current",
2487
+ "previous",
2488
+ "revoked"
2489
+ ]
2490
+ },
2491
+ "alg": {
2492
+ "type": "string",
2493
+ "enum": [
2494
+ "ES256"
2495
+ ]
2496
+ },
2497
+ "publicKey": {
2498
+ "type": "object",
2499
+ "properties": {
2500
+ "kty": {
2278
2501
  "type": "string",
2279
- "minLength": 1
2280
- }
2281
- },
2282
- "via": {
2283
- "type": "string"
2284
- },
2285
- "identity": {
2286
- "type": "object",
2287
- "properties": {
2288
- "header": {
2289
- "type": "string",
2290
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2291
- }
2502
+ "enum": [
2503
+ "EC"
2504
+ ]
2292
2505
  },
2293
- "required": [
2294
- "header"
2295
- ],
2296
- "additionalProperties": false
2297
- }
2298
- },
2299
- "required": [
2300
- "type",
2301
- "url",
2302
- "headers"
2303
- ],
2304
- "additionalProperties": false
2305
- },
2306
- {
2307
- "type": "object",
2308
- "properties": {
2309
- "type": {
2310
- "type": "string",
2311
- "enum": [
2312
- "environment_secret"
2313
- ]
2314
- },
2315
- "secretName": {
2316
- "type": "string",
2317
- "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
2318
- },
2319
- "secretValue": {
2320
- "type": "string",
2321
- "minLength": 1,
2322
- "maxLength": 8192
2323
- },
2324
- "allowedHosts": {
2325
- "type": "array",
2326
- "items": {
2327
- "type": "string"
2328
- },
2329
- "minItems": 1,
2330
- "maxItems": 32
2331
- },
2332
- "inject": {
2333
- "type": "object",
2334
- "properties": {
2335
- "header": {
2336
- "type": "string",
2337
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2338
- },
2339
- "format": {
2340
- "type": "string",
2341
- "minLength": 1
2342
- }
2506
+ "crv": {
2507
+ "type": "string",
2508
+ "enum": [
2509
+ "P-256"
2510
+ ]
2343
2511
  },
2344
- "required": [
2345
- "header",
2346
- "format"
2347
- ],
2348
- "additionalProperties": false
2349
- }
2350
- },
2351
- "required": [
2352
- "type",
2353
- "secretName",
2354
- "secretValue",
2355
- "allowedHosts"
2356
- ],
2357
- "additionalProperties": false
2358
- },
2359
- {
2360
- "type": "object",
2361
- "properties": {
2362
- "type": {
2363
- "type": "string",
2364
- "enum": [
2365
- "environment_variable"
2366
- ]
2367
- },
2368
- "variableName": {
2369
- "type": "string",
2370
- "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$"
2371
- },
2372
- "variableValue": {
2373
- "type": "string",
2374
- "minLength": 1,
2375
- "maxLength": 8192
2376
- }
2377
- },
2378
- "required": [
2379
- "type",
2380
- "variableName",
2381
- "variableValue"
2382
- ],
2383
- "additionalProperties": false
2384
- }
2385
- ]
2386
- }
2387
- },
2388
- "required": [
2389
- "requestId",
2390
- "idempotencyKey",
2391
- "name",
2392
- "auth"
2393
- ],
2394
- "additionalProperties": false
2395
- },
2396
- "ListCredentialsResponse": {
2397
- "type": "object",
2398
- "properties": {
2399
- "credentials": {
2400
- "type": "array",
2401
- "items": {
2402
- "type": "object",
2403
- "properties": {
2404
- "id": {
2405
- "type": "string"
2406
- },
2407
- "vaultId": {
2408
- "type": "string"
2409
- },
2410
- "name": {
2411
- "type": "string"
2412
- },
2413
- "type": {
2414
- "type": "string",
2415
- "enum": [
2416
- "bearer",
2417
- "headers",
2418
- "environment_secret",
2419
- "environment_variable"
2420
- ]
2421
- },
2422
- "binding": {
2423
- "type": "object",
2424
- "properties": {
2425
- "url": {
2512
+ "x": {
2426
2513
  "type": "string"
2427
2514
  },
2428
- "secretName": {
2515
+ "y": {
2429
2516
  "type": "string"
2430
2517
  },
2431
- "allowedHosts": {
2432
- "type": "array",
2433
- "items": {
2434
- "type": "string"
2435
- }
2436
- },
2437
- "inject": {
2438
- "type": "object",
2439
- "properties": {
2440
- "header": {
2441
- "type": "string",
2442
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2443
- },
2444
- "format": {
2445
- "type": "string",
2446
- "minLength": 1
2447
- }
2448
- },
2449
- "required": [
2450
- "header",
2451
- "format"
2452
- ],
2453
- "additionalProperties": false
2454
- },
2455
- "variableName": {
2518
+ "kid": {
2456
2519
  "type": "string"
2457
2520
  },
2458
- "variableValue": {
2459
- "type": "string"
2460
- }
2461
- },
2462
- "additionalProperties": false
2463
- },
2464
- "headerNames": {
2465
- "type": "array",
2466
- "items": {
2467
- "type": "string"
2468
- }
2469
- },
2470
- "via": {
2471
- "type": "string"
2472
- },
2473
- "identity": {
2474
- "type": "object",
2475
- "properties": {
2476
- "header": {
2521
+ "alg": {
2522
+ "type": "string",
2523
+ "enum": [
2524
+ "ES256"
2525
+ ]
2526
+ },
2527
+ "use": {
2477
2528
  "type": "string",
2478
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2529
+ "enum": [
2530
+ "sig"
2531
+ ]
2479
2532
  }
2480
2533
  },
2481
2534
  "required": [
2482
- "header"
2535
+ "kty",
2536
+ "crv",
2537
+ "x",
2538
+ "y",
2539
+ "kid",
2540
+ "alg",
2541
+ "use"
2483
2542
  ],
2484
2543
  "additionalProperties": false
2485
2544
  },
2486
2545
  "createdAt": {
2487
2546
  "type": "string"
2488
2547
  },
2489
- "rotatedAt": {
2490
- "type": "string"
2548
+ "activatedAt": {
2549
+ "type": [
2550
+ "string",
2551
+ "null"
2552
+ ]
2553
+ },
2554
+ "retiredAt": {
2555
+ "type": [
2556
+ "string",
2557
+ "null"
2558
+ ]
2559
+ },
2560
+ "revokedAt": {
2561
+ "type": [
2562
+ "string",
2563
+ "null"
2564
+ ]
2491
2565
  }
2492
2566
  },
2493
2567
  "required": [
2494
2568
  "id",
2495
- "vaultId",
2496
- "name",
2497
- "type",
2498
- "binding",
2499
- "createdAt"
2569
+ "state",
2570
+ "alg",
2571
+ "publicKey",
2572
+ "createdAt",
2573
+ "activatedAt",
2574
+ "retiredAt",
2575
+ "revokedAt"
2500
2576
  ],
2501
2577
  "additionalProperties": false
2502
2578
  }
2503
2579
  }
2504
2580
  },
2505
2581
  "required": [
2506
- "credentials"
2582
+ "keys"
2507
2583
  ],
2508
2584
  "additionalProperties": false
2509
2585
  },
2510
- "RotateCredentialRequest": {
2586
+ "RotateSigningKeysRequest": {
2511
2587
  "type": "object",
2512
2588
  "properties": {
2513
2589
  "requestId": {
2514
2590
  "type": "string",
2515
2591
  "minLength": 1
2516
2592
  },
2517
- "idempotencyKey": {
2593
+ "force": {
2594
+ "type": "boolean"
2595
+ }
2596
+ },
2597
+ "required": [
2598
+ "requestId"
2599
+ ],
2600
+ "additionalProperties": false
2601
+ },
2602
+ "SigningKeyView": {
2603
+ "type": "object",
2604
+ "properties": {
2605
+ "id": {
2606
+ "type": "string"
2607
+ },
2608
+ "state": {
2518
2609
  "type": "string",
2519
- "minLength": 1,
2520
- "maxLength": 256
2610
+ "enum": [
2611
+ "standby",
2612
+ "current",
2613
+ "previous",
2614
+ "revoked"
2615
+ ]
2521
2616
  },
2522
- "auth": {
2523
- "oneOf": [
2524
- {
2525
- "type": "object",
2526
- "properties": {
2527
- "type": {
2528
- "type": "string",
2529
- "enum": [
2530
- "bearer"
2531
- ]
2532
- },
2533
- "token": {
2534
- "type": "string",
2535
- "minLength": 1
2536
- },
2537
- "via": {
2538
- "type": [
2539
- "string",
2540
- "null"
2541
- ]
2542
- },
2543
- "identity": {
2544
- "type": [
2545
- "object",
2546
- "null"
2547
- ],
2548
- "properties": {
2549
- "header": {
2550
- "type": "string",
2551
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2552
- }
2553
- },
2554
- "required": [
2555
- "header"
2556
- ],
2557
- "additionalProperties": false
2558
- }
2559
- },
2560
- "required": [
2561
- "type",
2562
- "token"
2563
- ],
2564
- "additionalProperties": false
2617
+ "alg": {
2618
+ "type": "string",
2619
+ "enum": [
2620
+ "ES256"
2621
+ ]
2622
+ },
2623
+ "publicKey": {
2624
+ "type": "object",
2625
+ "properties": {
2626
+ "kty": {
2627
+ "type": "string",
2628
+ "enum": [
2629
+ "EC"
2630
+ ]
2565
2631
  },
2566
- {
2567
- "type": "object",
2568
- "properties": {
2569
- "type": {
2570
- "type": "string",
2571
- "enum": [
2572
- "headers"
2573
- ]
2574
- },
2575
- "headers": {
2576
- "type": "object",
2577
- "additionalProperties": {
2578
- "type": "string",
2579
- "minLength": 1
2580
- }
2581
- },
2582
- "via": {
2583
- "type": [
2584
- "string",
2585
- "null"
2586
- ]
2587
- },
2588
- "identity": {
2589
- "type": [
2590
- "object",
2591
- "null"
2592
- ],
2593
- "properties": {
2594
- "header": {
2595
- "type": "string",
2596
- "pattern": "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
2597
- }
2598
- },
2599
- "required": [
2600
- "header"
2601
- ],
2602
- "additionalProperties": false
2603
- }
2604
- },
2605
- "required": [
2606
- "type",
2607
- "headers"
2608
- ],
2609
- "additionalProperties": false
2632
+ "crv": {
2633
+ "type": "string",
2634
+ "enum": [
2635
+ "P-256"
2636
+ ]
2610
2637
  },
2611
- {
2612
- "type": "object",
2613
- "properties": {
2614
- "type": {
2615
- "type": "string",
2616
- "enum": [
2617
- "environment_secret"
2618
- ]
2619
- },
2620
- "secretValue": {
2621
- "type": "string",
2622
- "minLength": 1,
2623
- "maxLength": 8192
2624
- }
2625
- },
2626
- "required": [
2627
- "type",
2628
- "secretValue"
2629
- ],
2630
- "additionalProperties": false
2638
+ "x": {
2639
+ "type": "string"
2631
2640
  },
2632
- {
2633
- "type": "object",
2634
- "properties": {
2635
- "type": {
2636
- "type": "string",
2637
- "enum": [
2638
- "environment_variable"
2639
- ]
2640
- },
2641
- "variableValue": {
2642
- "type": "string",
2643
- "minLength": 1,
2644
- "maxLength": 8192
2645
- }
2646
- },
2647
- "required": [
2648
- "type",
2649
- "variableValue"
2650
- ],
2651
- "additionalProperties": false
2641
+ "y": {
2642
+ "type": "string"
2643
+ },
2644
+ "kid": {
2645
+ "type": "string"
2646
+ },
2647
+ "alg": {
2648
+ "type": "string",
2649
+ "enum": [
2650
+ "ES256"
2651
+ ]
2652
+ },
2653
+ "use": {
2654
+ "type": "string",
2655
+ "enum": [
2656
+ "sig"
2657
+ ]
2652
2658
  }
2653
- ]
2654
- }
2655
- },
2656
- "required": [
2657
- "requestId",
2658
- "idempotencyKey",
2659
- "auth"
2660
- ],
2661
- "additionalProperties": false
2662
- },
2663
- "McpPreview": {
2664
- "type": "object",
2665
- "properties": {
2666
- "name": {
2667
- "type": "string"
2659
+ },
2660
+ "required": [
2661
+ "kty",
2662
+ "crv",
2663
+ "x",
2664
+ "y",
2665
+ "kid",
2666
+ "alg",
2667
+ "use"
2668
+ ],
2669
+ "additionalProperties": false
2668
2670
  },
2669
- "url": {
2671
+ "createdAt": {
2670
2672
  "type": "string"
2671
2673
  },
2672
- "type": {
2673
- "type": "string",
2674
- "enum": [
2675
- "streamable-http",
2676
- "sse"
2674
+ "activatedAt": {
2675
+ "type": [
2676
+ "string",
2677
+ "null"
2677
2678
  ]
2678
2679
  },
2679
- "credentialSent": {
2680
- "type": "boolean"
2681
- },
2682
- "serverInfo": {
2683
- "type": "object",
2684
- "additionalProperties": {}
2685
- },
2686
- "instructions": {
2687
- "type": "string"
2688
- },
2689
- "tools": {
2690
- "type": "array",
2691
- "items": {
2692
- "type": "object",
2693
- "properties": {
2694
- "serverToolName": {
2695
- "type": "string"
2696
- },
2697
- "modelName": {
2698
- "type": "string"
2699
- },
2700
- "description": {
2701
- "type": "string"
2702
- },
2703
- "annotations": {
2704
- "type": "object",
2705
- "additionalProperties": {}
2706
- },
2707
- "schemaBytes": {
2708
- "type": "integer",
2709
- "minimum": 0
2710
- }
2711
- },
2712
- "required": [
2713
- "serverToolName",
2714
- "schemaBytes"
2715
- ],
2716
- "additionalProperties": false
2717
- }
2718
- },
2719
- "renamed": {
2720
- "type": "array",
2721
- "items": {
2722
- "type": "object",
2723
- "properties": {
2724
- "serverToolName": {
2725
- "type": "string"
2726
- },
2727
- "name": {
2728
- "type": "string"
2729
- }
2730
- },
2731
- "required": [
2732
- "serverToolName",
2733
- "name"
2734
- ],
2735
- "additionalProperties": false
2736
- }
2680
+ "retiredAt": {
2681
+ "type": [
2682
+ "string",
2683
+ "null"
2684
+ ]
2737
2685
  },
2738
- "authRequired": {
2739
- "type": "object",
2740
- "properties": {
2741
- "resourceMetadataUrl": {
2742
- "type": "string"
2743
- },
2744
- "resourceMetadata": {
2745
- "type": "object",
2746
- "additionalProperties": {}
2747
- }
2748
- },
2749
- "additionalProperties": false
2686
+ "revokedAt": {
2687
+ "type": [
2688
+ "string",
2689
+ "null"
2690
+ ]
2750
2691
  }
2751
2692
  },
2752
2693
  "required": [
2753
- "name",
2754
- "url",
2755
- "type",
2756
- "credentialSent",
2757
- "tools",
2758
- "renamed"
2694
+ "id",
2695
+ "state",
2696
+ "alg",
2697
+ "publicKey",
2698
+ "createdAt",
2699
+ "activatedAt",
2700
+ "retiredAt",
2701
+ "revokedAt"
2759
2702
  ],
2760
2703
  "additionalProperties": false
2761
2704
  },
2762
- "McpPreviewRequest": {
2705
+ "RevokeSigningKeyRequest": {
2763
2706
  "type": "object",
2764
2707
  "properties": {
2765
2708
  "requestId": {
2766
2709
  "type": "string",
2767
2710
  "minLength": 1
2768
- },
2769
- "url": {
2770
- "type": "string",
2771
- "minLength": 1
2772
- },
2773
- "type": {
2774
- "type": "string",
2775
- "enum": [
2776
- "streamable-http",
2777
- "sse"
2778
- ]
2779
- },
2780
- "name": {
2781
- "type": "string",
2782
- "pattern": "^[A-Za-z0-9_-]{1,64}$"
2783
- },
2784
- "vaultId": {
2785
- "type": "string",
2786
- "minLength": 1
2787
2711
  }
2788
2712
  },
2789
2713
  "required": [
2790
- "url"
2714
+ "requestId"
2791
2715
  ],
2792
2716
  "additionalProperties": false
2793
2717
  },
2794
- "SigningKeyList": {
2718
+ "MeResponse": {
2795
2719
  "type": "object",
2796
2720
  "properties": {
2797
- "keys": {
2798
- "type": "array",
2799
- "items": {
2800
- "type": "object",
2801
- "properties": {
2802
- "id": {
2803
- "type": "string"
2804
- },
2805
- "state": {
2806
- "type": "string",
2807
- "enum": [
2808
- "standby",
2809
- "current",
2810
- "previous",
2811
- "revoked"
2812
- ]
2813
- },
2814
- "alg": {
2815
- "type": "string",
2816
- "enum": [
2817
- "ES256"
2818
- ]
2819
- },
2820
- "publicKey": {
2821
- "type": "object",
2822
- "properties": {
2823
- "kty": {
2824
- "type": "string",
2825
- "enum": [
2826
- "EC"
2827
- ]
2828
- },
2829
- "crv": {
2830
- "type": "string",
2831
- "enum": [
2832
- "P-256"
2833
- ]
2834
- },
2835
- "x": {
2836
- "type": "string"
2837
- },
2838
- "y": {
2839
- "type": "string"
2840
- },
2841
- "kid": {
2842
- "type": "string"
2843
- },
2844
- "alg": {
2845
- "type": "string",
2846
- "enum": [
2847
- "ES256"
2848
- ]
2849
- },
2850
- "use": {
2851
- "type": "string",
2852
- "enum": [
2853
- "sig"
2854
- ]
2855
- }
2856
- },
2857
- "required": [
2858
- "kty",
2859
- "crv",
2860
- "x",
2861
- "y",
2862
- "kid",
2863
- "alg",
2864
- "use"
2865
- ],
2866
- "additionalProperties": false
2867
- },
2868
- "createdAt": {
2869
- "type": "string"
2870
- },
2871
- "activatedAt": {
2872
- "type": [
2873
- "string",
2874
- "null"
2875
- ]
2876
- },
2877
- "retiredAt": {
2878
- "type": [
2879
- "string",
2880
- "null"
2881
- ]
2882
- },
2883
- "revokedAt": {
2884
- "type": [
2885
- "string",
2886
- "null"
2887
- ]
2888
- }
2889
- },
2890
- "required": [
2891
- "id",
2892
- "state",
2893
- "alg",
2894
- "publicKey",
2895
- "createdAt",
2896
- "activatedAt",
2897
- "retiredAt",
2898
- "revokedAt"
2899
- ],
2900
- "additionalProperties": false
2901
- }
2902
- }
2903
- },
2904
- "required": [
2905
- "keys"
2906
- ],
2907
- "additionalProperties": false
2908
- },
2909
- "RotateSigningKeysRequest": {
2910
- "type": "object",
2911
- "properties": {
2912
- "requestId": {
2913
- "type": "string",
2914
- "minLength": 1
2915
- },
2916
- "force": {
2917
- "type": "boolean"
2918
- }
2919
- },
2920
- "required": [
2921
- "requestId"
2922
- ],
2923
- "additionalProperties": false
2924
- },
2925
- "SigningKeyView": {
2926
- "type": "object",
2927
- "properties": {
2928
- "id": {
2929
- "type": "string"
2930
- },
2931
- "state": {
2932
- "type": "string",
2933
- "enum": [
2934
- "standby",
2935
- "current",
2936
- "previous",
2937
- "revoked"
2938
- ]
2939
- },
2940
- "alg": {
2941
- "type": "string",
2942
- "enum": [
2943
- "ES256"
2944
- ]
2945
- },
2946
- "publicKey": {
2947
- "type": "object",
2948
- "properties": {
2949
- "kty": {
2950
- "type": "string",
2951
- "enum": [
2952
- "EC"
2953
- ]
2954
- },
2955
- "crv": {
2956
- "type": "string",
2957
- "enum": [
2958
- "P-256"
2959
- ]
2960
- },
2961
- "x": {
2962
- "type": "string"
2963
- },
2964
- "y": {
2965
- "type": "string"
2966
- },
2967
- "kid": {
2968
- "type": "string"
2969
- },
2970
- "alg": {
2971
- "type": "string",
2972
- "enum": [
2973
- "ES256"
2974
- ]
2975
- },
2976
- "use": {
2977
- "type": "string",
2978
- "enum": [
2979
- "sig"
2980
- ]
2981
- }
2982
- },
2983
- "required": [
2984
- "kty",
2985
- "crv",
2986
- "x",
2987
- "y",
2988
- "kid",
2989
- "alg",
2990
- "use"
2991
- ],
2992
- "additionalProperties": false
2993
- },
2994
- "createdAt": {
2995
- "type": "string"
2996
- },
2997
- "activatedAt": {
2998
- "type": [
2999
- "string",
3000
- "null"
3001
- ]
3002
- },
3003
- "retiredAt": {
3004
- "type": [
3005
- "string",
3006
- "null"
3007
- ]
3008
- },
3009
- "revokedAt": {
3010
- "type": [
3011
- "string",
3012
- "null"
3013
- ]
3014
- }
3015
- },
3016
- "required": [
3017
- "id",
3018
- "state",
3019
- "alg",
3020
- "publicKey",
3021
- "createdAt",
3022
- "activatedAt",
3023
- "retiredAt",
3024
- "revokedAt"
3025
- ],
3026
- "additionalProperties": false
3027
- },
3028
- "RevokeSigningKeyRequest": {
3029
- "type": "object",
3030
- "properties": {
3031
- "requestId": {
3032
- "type": "string",
3033
- "minLength": 1
3034
- }
3035
- },
3036
- "required": [
3037
- "requestId"
3038
- ],
3039
- "additionalProperties": false
3040
- },
3041
- "MeResponse": {
3042
- "type": "object",
3043
- "properties": {
3044
- "subject": {
3045
- "type": "string",
3046
- "description": "The person the request acts for; absent for an application key alone"
3047
- },
3048
- "scopes": {
2721
+ "subject": {
2722
+ "type": "string",
2723
+ "description": "The person the request acts for; absent for an application key alone"
2724
+ },
2725
+ "scopes": {
3049
2726
  "type": "array",
3050
2727
  "items": {
3051
2728
  "type": "string",
@@ -3053,7 +2730,7 @@
3053
2730
  "agents:read",
3054
2731
  "agents:write",
3055
2732
  "sessions:own",
3056
- "sandboxes:write",
2733
+ "environments:write",
3057
2734
  "studio"
3058
2735
  ]
3059
2736
  }
@@ -3075,12 +2752,12 @@
3075
2752
  }
3076
2753
  ]
3077
2754
  },
3078
- "sandboxes": {
2755
+ "environments": {
3079
2756
  "type": "array",
3080
2757
  "items": {
3081
2758
  "type": "string"
3082
2759
  },
3083
- "description": "A token caller's sandbox grants (empty reaches none); absent when no grant limits the caller"
2760
+ "description": "A token caller's Environment grants (empty reaches none); absent when no grant limits the caller"
3084
2761
  },
3085
2762
  "via": {
3086
2763
  "type": "string",
@@ -3100,6 +2777,9 @@
3100
2777
  "id": {
3101
2778
  "type": "string"
3102
2779
  },
2780
+ "effectId": {
2781
+ "type": "string"
2782
+ },
3103
2783
  "sessionId": {
3104
2784
  "type": "string"
3105
2785
  },
@@ -3191,534 +2871,65 @@
3191
2871
  "costUsd",
3192
2872
  "duplicate",
3193
2873
  "tokensReported",
3194
- "costKnown"
3195
- ],
3196
- "additionalProperties": false
3197
- }
3198
- },
3199
- "required": [
3200
- "id",
3201
- "sessionId",
3202
- "turnId",
3203
- "agentId",
3204
- "provider",
3205
- "model",
3206
- "at",
3207
- "outcome",
3208
- "usage"
3209
- ],
3210
- "additionalProperties": false
3211
- },
3212
- "ModelCallExportPage": {
3213
- "type": "object",
3214
- "properties": {
3215
- "calls": {
3216
- "type": "array",
3217
- "items": {
3218
- "$ref": "#/components/schemas/ModelCall"
3219
- }
3220
- },
3221
- "next": {
3222
- "type": [
3223
- "string",
3224
- "null"
3225
- ]
3226
- },
3227
- "caughtUp": {
3228
- "type": "boolean"
3229
- },
3230
- "asOf": {
3231
- "type": "string"
3232
- }
3233
- },
3234
- "required": [
3235
- "calls",
3236
- "next",
3237
- "caughtUp",
3238
- "asOf"
3239
- ],
3240
- "additionalProperties": false
3241
- }
3242
- },
3243
- "parameters": {}
3244
- },
3245
- "paths": {
3246
- "/v1/tenant": {
3247
- "get": {
3248
- "tags": [
3249
- "Tenant"
3250
- ],
3251
- "summary": "Get the Tenant's status",
3252
- "security": [
3253
- {
3254
- "managementKey": []
3255
- }
3256
- ],
3257
- "x-nylorun-credentials": [
3258
- "management"
3259
- ],
3260
- "x-nylorun-scopes": "never",
3261
- "parameters": [
3262
- {
3263
- "schema": {
3264
- "type": "string",
3265
- "description": "The protocol version, `10`"
3266
- },
3267
- "required": true,
3268
- "description": "The protocol version, `10`",
3269
- "name": "Nylorun-Protocol",
3270
- "in": "header"
3271
- }
3272
- ],
3273
- "responses": {
3274
- "200": {
3275
- "description": "Readiness, model, sandboxes, streams and counts",
3276
- "content": {
3277
- "application/json": {
3278
- "schema": {
3279
- "$ref": "#/components/schemas/TenantStatus"
3280
- }
3281
- }
3282
- }
3283
- },
3284
- "400": {
3285
- "description": "Invalid headers, path, body or cursor",
3286
- "content": {
3287
- "application/json": {
3288
- "schema": {
3289
- "$ref": "#/components/schemas/Rejected"
3290
- }
3291
- }
3292
- }
3293
- },
3294
- "401": {
3295
- "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3296
- "content": {
3297
- "application/json": {
3298
- "schema": {
3299
- "$ref": "#/components/schemas/Rejected"
3300
- }
3301
- }
3302
- }
3303
- },
3304
- "403": {
3305
- "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
3306
- "content": {
3307
- "application/json": {
3308
- "schema": {
3309
- "$ref": "#/components/schemas/Rejected"
3310
- }
3311
- }
3312
- }
3313
- },
3314
- "404": {
3315
- "description": "Not found (`not_found`)",
3316
- "content": {
3317
- "application/json": {
3318
- "schema": {
3319
- "$ref": "#/components/schemas/Rejected"
3320
- }
3321
- }
3322
- }
3323
- },
3324
- "426": {
3325
- "description": "`Nylorun-Protocol` missing or unsupported",
3326
- "content": {
3327
- "application/json": {
3328
- "schema": {
3329
- "$ref": "#/components/schemas/ProtocolRejected"
3330
- }
3331
- }
3332
- }
3333
- },
3334
- "503": {
3335
- "description": "The Tenant's storage or streams are unavailable",
3336
- "content": {
3337
- "application/json": {
3338
- "schema": {
3339
- "$ref": "#/components/schemas/Rejected"
3340
- }
3341
- }
3342
- }
3343
- }
3344
- }
3345
- }
3346
- },
3347
- "/v1/tenant/config/seed": {
3348
- "put": {
3349
- "tags": [
3350
- "Tenant"
3351
- ],
3352
- "summary": "Seed the Tenant's configuration",
3353
- "description": "Sets each setting the Tenant does not have yet; keeps the ones it has.",
3354
- "security": [
3355
- {
3356
- "managementKey": []
3357
- }
3358
- ],
3359
- "x-nylorun-credentials": [
3360
- "management"
3361
- ],
3362
- "x-nylorun-scopes": "never",
3363
- "parameters": [
3364
- {
3365
- "schema": {
3366
- "type": "string",
3367
- "description": "The protocol version, `10`"
3368
- },
3369
- "required": true,
3370
- "description": "The protocol version, `10`",
3371
- "name": "Nylorun-Protocol",
3372
- "in": "header"
3373
- }
3374
- ],
3375
- "requestBody": {
3376
- "required": true,
3377
- "content": {
3378
- "application/json": {
3379
- "schema": {
3380
- "$ref": "#/components/schemas/SeedTenantConfigRequest"
3381
- }
3382
- }
3383
- }
3384
- },
3385
- "responses": {
3386
- "200": {
3387
- "description": "What was set, and what was kept",
3388
- "content": {
3389
- "application/json": {
3390
- "schema": {
3391
- "$ref": "#/components/schemas/SeedTenantConfigResponse"
3392
- }
3393
- }
3394
- }
3395
- },
3396
- "400": {
3397
- "description": "Invalid headers, path, body or cursor",
3398
- "content": {
3399
- "application/json": {
3400
- "schema": {
3401
- "$ref": "#/components/schemas/Rejected"
3402
- }
3403
- }
3404
- }
3405
- },
3406
- "401": {
3407
- "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3408
- "content": {
3409
- "application/json": {
3410
- "schema": {
3411
- "$ref": "#/components/schemas/Rejected"
3412
- }
3413
- }
3414
- }
3415
- },
3416
- "403": {
3417
- "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
3418
- "content": {
3419
- "application/json": {
3420
- "schema": {
3421
- "$ref": "#/components/schemas/Rejected"
3422
- }
3423
- }
3424
- }
3425
- },
3426
- "404": {
3427
- "description": "Not found (`not_found`)",
3428
- "content": {
3429
- "application/json": {
3430
- "schema": {
3431
- "$ref": "#/components/schemas/Rejected"
3432
- }
3433
- }
3434
- }
3435
- },
3436
- "426": {
3437
- "description": "`Nylorun-Protocol` missing or unsupported",
3438
- "content": {
3439
- "application/json": {
3440
- "schema": {
3441
- "$ref": "#/components/schemas/ProtocolRejected"
3442
- }
3443
- }
3444
- }
3445
- },
3446
- "503": {
3447
- "description": "The Tenant's storage or streams are unavailable",
3448
- "content": {
3449
- "application/json": {
3450
- "schema": {
3451
- "$ref": "#/components/schemas/Rejected"
3452
- }
3453
- }
3454
- }
3455
- }
3456
- }
3457
- }
3458
- },
3459
- "/v1/tenant/reset": {
3460
- "post": {
3461
- "tags": [
3462
- "Tenant"
3463
- ],
3464
- "summary": "Reset the Tenant",
3465
- "description": "Deletes its sessions, its sandboxes, or both, after draining or cancelling the turns in progress. The Tenant stays open.",
3466
- "security": [
3467
- {
3468
- "managementKey": []
3469
- }
3470
- ],
3471
- "x-nylorun-credentials": [
3472
- "management"
3473
- ],
3474
- "x-nylorun-scopes": "never",
3475
- "parameters": [
3476
- {
3477
- "schema": {
3478
- "type": "string",
3479
- "description": "The protocol version, `10`"
3480
- },
3481
- "required": true,
3482
- "description": "The protocol version, `10`",
3483
- "name": "Nylorun-Protocol",
3484
- "in": "header"
3485
- }
3486
- ],
3487
- "requestBody": {
3488
- "required": true,
3489
- "content": {
3490
- "application/json": {
3491
- "schema": {
3492
- "$ref": "#/components/schemas/ResetTenantRequest"
3493
- }
3494
- }
3495
- }
3496
- },
3497
- "responses": {
3498
- "200": {
3499
- "description": "Reset",
3500
- "content": {
3501
- "application/json": {
3502
- "schema": {
3503
- "$ref": "#/components/schemas/ResetTenantResponse"
3504
- }
3505
- }
3506
- }
3507
- },
3508
- "400": {
3509
- "description": "Invalid headers, path, body or cursor",
3510
- "content": {
3511
- "application/json": {
3512
- "schema": {
3513
- "$ref": "#/components/schemas/Rejected"
3514
- }
3515
- }
3516
- }
3517
- },
3518
- "401": {
3519
- "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3520
- "content": {
3521
- "application/json": {
3522
- "schema": {
3523
- "$ref": "#/components/schemas/Rejected"
3524
- }
3525
- }
3526
- }
3527
- },
3528
- "403": {
3529
- "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
3530
- "content": {
3531
- "application/json": {
3532
- "schema": {
3533
- "$ref": "#/components/schemas/Rejected"
3534
- }
3535
- }
3536
- }
3537
- },
3538
- "404": {
3539
- "description": "Not found (`not_found`)",
3540
- "content": {
3541
- "application/json": {
3542
- "schema": {
3543
- "$ref": "#/components/schemas/Rejected"
3544
- }
3545
- }
3546
- }
3547
- },
3548
- "426": {
3549
- "description": "`Nylorun-Protocol` missing or unsupported",
3550
- "content": {
3551
- "application/json": {
3552
- "schema": {
3553
- "$ref": "#/components/schemas/ProtocolRejected"
3554
- }
3555
- }
3556
- }
3557
- },
3558
- "503": {
3559
- "description": "The Tenant's storage or streams are unavailable",
3560
- "content": {
3561
- "application/json": {
3562
- "schema": {
3563
- "$ref": "#/components/schemas/Rejected"
3564
- }
3565
- }
3566
- }
3567
- }
3568
- }
3569
- }
3570
- },
3571
- "/v1/me": {
3572
- "get": {
3573
- "tags": [
3574
- "Tenant"
3575
- ],
3576
- "summary": "Get who the caller is",
3577
- "description": "The subject, scopes, agents and sandbox grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:<principalId>`, no scopes, no agents), or a trusted issuer's token (`via: issuer:<name>`).",
3578
- "security": [
3579
- {
3580
- "applicationKey": []
3581
- },
3582
- {
3583
- "managementKey": []
3584
- },
3585
- {
3586
- "issuerToken": []
3587
- }
3588
- ],
3589
- "x-nylorun-credentials": [
3590
- "application",
3591
- "subject",
3592
- "management",
3593
- "token"
3594
- ],
3595
- "x-nylorun-scopes": "any",
3596
- "parameters": [
3597
- {
3598
- "schema": {
3599
- "type": "string",
3600
- "description": "The protocol version, `10`"
3601
- },
3602
- "required": true,
3603
- "description": "The protocol version, `10`",
3604
- "name": "Nylorun-Protocol",
3605
- "in": "header"
3606
- },
3607
- {
3608
- "schema": {
3609
- "type": "string",
3610
- "description": "The person an application key acts for"
3611
- },
3612
- "required": false,
3613
- "description": "The person an application key acts for",
3614
- "name": "Nylorun-Subject",
3615
- "in": "header"
3616
- },
3617
- {
3618
- "schema": {
3619
- "type": "string",
3620
- "description": "The subject's space-separated scopes; required with a subject"
3621
- },
3622
- "required": false,
3623
- "description": "The subject's space-separated scopes; required with a subject",
3624
- "name": "Nylorun-Scopes",
3625
- "in": "header"
2874
+ "costKnown"
2875
+ ],
2876
+ "additionalProperties": false
3626
2877
  }
2878
+ },
2879
+ "required": [
2880
+ "id",
2881
+ "effectId",
2882
+ "sessionId",
2883
+ "turnId",
2884
+ "agentId",
2885
+ "provider",
2886
+ "model",
2887
+ "at",
2888
+ "outcome",
2889
+ "usage"
3627
2890
  ],
3628
- "responses": {
3629
- "200": {
3630
- "description": "The caller",
3631
- "content": {
3632
- "application/json": {
3633
- "schema": {
3634
- "$ref": "#/components/schemas/MeResponse"
3635
- }
3636
- }
3637
- }
3638
- },
3639
- "400": {
3640
- "description": "Invalid headers, path, body or cursor",
3641
- "content": {
3642
- "application/json": {
3643
- "schema": {
3644
- "$ref": "#/components/schemas/Rejected"
3645
- }
3646
- }
3647
- }
3648
- },
3649
- "401": {
3650
- "description": "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)",
3651
- "content": {
3652
- "application/json": {
3653
- "schema": {
3654
- "$ref": "#/components/schemas/Rejected"
3655
- }
3656
- }
3657
- }
3658
- },
3659
- "403": {
3660
- "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
3661
- "content": {
3662
- "application/json": {
3663
- "schema": {
3664
- "$ref": "#/components/schemas/Rejected"
3665
- }
3666
- }
2891
+ "additionalProperties": false
2892
+ },
2893
+ "ModelCallExportPage": {
2894
+ "type": "object",
2895
+ "properties": {
2896
+ "calls": {
2897
+ "type": "array",
2898
+ "items": {
2899
+ "$ref": "#/components/schemas/ModelCall"
3667
2900
  }
3668
2901
  },
3669
- "404": {
3670
- "description": "Not found (`not_found`)",
3671
- "content": {
3672
- "application/json": {
3673
- "schema": {
3674
- "$ref": "#/components/schemas/Rejected"
3675
- }
3676
- }
3677
- }
2902
+ "next": {
2903
+ "type": [
2904
+ "string",
2905
+ "null"
2906
+ ]
3678
2907
  },
3679
- "426": {
3680
- "description": "`Nylorun-Protocol` missing or unsupported",
3681
- "content": {
3682
- "application/json": {
3683
- "schema": {
3684
- "$ref": "#/components/schemas/ProtocolRejected"
3685
- }
3686
- }
3687
- }
2908
+ "caughtUp": {
2909
+ "type": "boolean"
3688
2910
  },
3689
- "503": {
3690
- "description": "The Tenant's storage or streams are unavailable",
3691
- "content": {
3692
- "application/json": {
3693
- "schema": {
3694
- "$ref": "#/components/schemas/Rejected"
3695
- }
3696
- }
3697
- }
2911
+ "asOf": {
2912
+ "type": "string"
3698
2913
  }
3699
- }
3700
- }
3701
- },
3702
- "/openapi/management.json": {
3703
- "get": {
3704
- "tags": [
3705
- "Tenant"
2914
+ },
2915
+ "required": [
2916
+ "calls",
2917
+ "next",
2918
+ "caughtUp",
2919
+ "asOf"
3706
2920
  ],
3707
- "summary": "Get the Management API's document",
3708
- "responses": {
3709
- "200": {
3710
- "description": "The Management API's OpenAPI document"
3711
- }
3712
- }
2921
+ "additionalProperties": false
3713
2922
  }
3714
2923
  },
3715
- "/v1/tenant/keys": {
2924
+ "parameters": {}
2925
+ },
2926
+ "paths": {
2927
+ "/v1/tenant": {
3716
2928
  "get": {
3717
2929
  "tags": [
3718
- "Application keys"
2930
+ "Tenant"
3719
2931
  ],
3720
- "summary": "List the Tenant's keys",
3721
- "description": "Every key of the Tenant by name, with its role (`application`, `management` or `studio`) and when it was issued. Keys themselves are never shown again.",
2932
+ "summary": "Get the Tenant's status",
3722
2933
  "security": [
3723
2934
  {
3724
2935
  "managementKey": []
@@ -3732,21 +2943,21 @@
3732
2943
  {
3733
2944
  "schema": {
3734
2945
  "type": "string",
3735
- "description": "The protocol version, `10`"
2946
+ "description": "The protocol version, `14`"
3736
2947
  },
3737
2948
  "required": true,
3738
- "description": "The protocol version, `10`",
2949
+ "description": "The protocol version, `14`",
3739
2950
  "name": "Nylorun-Protocol",
3740
2951
  "in": "header"
3741
2952
  }
3742
2953
  ],
3743
2954
  "responses": {
3744
2955
  "200": {
3745
- "description": "The keys, by id",
2956
+ "description": "Readiness, model, sandboxes, streams and counts",
3746
2957
  "content": {
3747
2958
  "application/json": {
3748
2959
  "schema": {
3749
- "$ref": "#/components/schemas/ListOperatorKeysResponse"
2960
+ "$ref": "#/components/schemas/TenantStatus"
3750
2961
  }
3751
2962
  }
3752
2963
  }
@@ -3814,13 +3025,13 @@
3814
3025
  }
3815
3026
  }
3816
3027
  },
3817
- "/v1/tenant/keys/{keyId}": {
3028
+ "/v1/tenant/config/seed": {
3818
3029
  "put": {
3819
3030
  "tags": [
3820
- "Application keys"
3031
+ "Tenant"
3821
3032
  ],
3822
- "summary": "Create or rotate an application key",
3823
- "description": "Issues a new application key named `keyId` and returns it this once. An application key of that name is replaced: the old one stops authenticating at once. A management key, `studio` and `bootstrap` are refused.",
3033
+ "summary": "Seed the Tenant's configuration",
3034
+ "description": "Sets each setting the Tenant does not have yet; keeps the ones it has.",
3824
3035
  "security": [
3825
3036
  {
3826
3037
  "managementKey": []
@@ -3834,141 +3045,45 @@
3834
3045
  {
3835
3046
  "schema": {
3836
3047
  "type": "string",
3837
- "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`"
3838
- },
3839
- "required": true,
3840
- "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`",
3841
- "name": "keyId",
3842
- "in": "path"
3843
- },
3844
- {
3845
- "schema": {
3846
- "type": "string",
3847
- "description": "The protocol version, `10`"
3048
+ "description": "The protocol version, `14`"
3848
3049
  },
3849
3050
  "required": true,
3850
- "description": "The protocol version, `10`",
3051
+ "description": "The protocol version, `14`",
3851
3052
  "name": "Nylorun-Protocol",
3852
3053
  "in": "header"
3853
3054
  }
3854
3055
  ],
3056
+ "requestBody": {
3057
+ "required": true,
3058
+ "content": {
3059
+ "application/json": {
3060
+ "schema": {
3061
+ "$ref": "#/components/schemas/SeedTenantConfigRequest"
3062
+ }
3063
+ }
3064
+ }
3065
+ },
3855
3066
  "responses": {
3856
3067
  "200": {
3857
- "description": "The new key, shown once",
3068
+ "description": "What was set, and what was kept",
3858
3069
  "content": {
3859
3070
  "application/json": {
3860
3071
  "schema": {
3861
- "$ref": "#/components/schemas/PutOperatorKeyResponse"
3072
+ "$ref": "#/components/schemas/SeedTenantConfigResponse"
3862
3073
  }
3863
3074
  }
3864
3075
  }
3865
3076
  },
3866
3077
  "400": {
3867
- "description": "Not a key name, a reserved name, or a management key's name"
3868
- },
3869
- "401": {
3870
- "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3871
- "content": {
3872
- "application/json": {
3873
- "schema": {
3874
- "$ref": "#/components/schemas/Rejected"
3875
- }
3876
- }
3877
- }
3878
- },
3879
- "403": {
3880
- "description": "Not allowed for this credential, a key of the other API (`key_role_mismatch`), a key from a browser (`origin_rejected`) or a management key acting for a subject",
3881
- "content": {
3882
- "application/json": {
3883
- "schema": {
3884
- "$ref": "#/components/schemas/Rejected"
3885
- }
3886
- }
3887
- }
3888
- },
3889
- "404": {
3890
- "description": "Not found (`not_found`)",
3891
- "content": {
3892
- "application/json": {
3893
- "schema": {
3894
- "$ref": "#/components/schemas/Rejected"
3895
- }
3896
- }
3897
- }
3898
- },
3899
- "426": {
3900
- "description": "`Nylorun-Protocol` missing or unsupported",
3901
- "content": {
3902
- "application/json": {
3903
- "schema": {
3904
- "$ref": "#/components/schemas/ProtocolRejected"
3905
- }
3906
- }
3907
- }
3908
- },
3909
- "503": {
3910
- "description": "The Tenant's storage or streams are unavailable",
3911
- "content": {
3912
- "application/json": {
3913
- "schema": {
3914
- "$ref": "#/components/schemas/Rejected"
3915
- }
3916
- }
3917
- }
3918
- }
3919
- }
3920
- },
3921
- "delete": {
3922
- "tags": [
3923
- "Application keys"
3924
- ],
3925
- "summary": "Delete an application key",
3926
- "description": "The key stops authenticating at once. A management key, `studio` and `bootstrap` are refused.",
3927
- "security": [
3928
- {
3929
- "managementKey": []
3930
- }
3931
- ],
3932
- "x-nylorun-credentials": [
3933
- "management"
3934
- ],
3935
- "x-nylorun-scopes": "never",
3936
- "parameters": [
3937
- {
3938
- "schema": {
3939
- "type": "string",
3940
- "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`"
3941
- },
3942
- "required": true,
3943
- "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`",
3944
- "name": "keyId",
3945
- "in": "path"
3946
- },
3947
- {
3948
- "schema": {
3949
- "type": "string",
3950
- "description": "The protocol version, `10`"
3951
- },
3952
- "required": true,
3953
- "description": "The protocol version, `10`",
3954
- "name": "Nylorun-Protocol",
3955
- "in": "header"
3956
- }
3957
- ],
3958
- "responses": {
3959
- "200": {
3960
- "description": "The key is deleted",
3078
+ "description": "Invalid headers, path, body or cursor",
3961
3079
  "content": {
3962
3080
  "application/json": {
3963
3081
  "schema": {
3964
- "$ref": "#/components/schemas/DeleteOperatorKeyResponse"
3082
+ "$ref": "#/components/schemas/Rejected"
3965
3083
  }
3966
3084
  }
3967
3085
  }
3968
3086
  },
3969
- "400": {
3970
- "description": "Not a key name, a reserved name, or a management key's name"
3971
- },
3972
3087
  "401": {
3973
3088
  "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3974
3089
  "content": {
@@ -4022,12 +3137,13 @@
4022
3137
  }
4023
3138
  }
4024
3139
  },
4025
- "/v1/tenant/models": {
4026
- "get": {
3140
+ "/v1/tenant/reset": {
3141
+ "post": {
4027
3142
  "tags": [
4028
- "Models"
3143
+ "Tenant"
4029
3144
  ],
4030
- "summary": "List model providers and models",
3145
+ "summary": "Reset the Tenant",
3146
+ "description": "Deletes its sessions, its Environments (with their vaults), or both, after draining or cancelling the turns in progress. The Tenant stays open.",
4031
3147
  "security": [
4032
3148
  {
4033
3149
  "managementKey": []
@@ -4041,21 +3157,31 @@
4041
3157
  {
4042
3158
  "schema": {
4043
3159
  "type": "string",
4044
- "description": "The protocol version, `10`"
3160
+ "description": "The protocol version, `14`"
4045
3161
  },
4046
3162
  "required": true,
4047
- "description": "The protocol version, `10`",
3163
+ "description": "The protocol version, `14`",
4048
3164
  "name": "Nylorun-Protocol",
4049
3165
  "in": "header"
4050
3166
  }
4051
3167
  ],
3168
+ "requestBody": {
3169
+ "required": true,
3170
+ "content": {
3171
+ "application/json": {
3172
+ "schema": {
3173
+ "$ref": "#/components/schemas/ResetTenantRequest"
3174
+ }
3175
+ }
3176
+ }
3177
+ },
4052
3178
  "responses": {
4053
3179
  "200": {
4054
- "description": "Provider and model names",
3180
+ "description": "Reset",
4055
3181
  "content": {
4056
3182
  "application/json": {
4057
3183
  "schema": {
4058
- "$ref": "#/components/schemas/HostModelCatalog"
3184
+ "$ref": "#/components/schemas/ResetTenantResponse"
4059
3185
  }
4060
3186
  }
4061
3187
  }
@@ -4123,40 +3249,70 @@
4123
3249
  }
4124
3250
  }
4125
3251
  },
4126
- "/v1/tenant/providers": {
3252
+ "/v1/me": {
4127
3253
  "get": {
4128
3254
  "tags": [
4129
- "Models"
3255
+ "Tenant"
4130
3256
  ],
4131
- "summary": "List the model providers the Tenant has credentials for",
3257
+ "summary": "Get who the caller is",
3258
+ "description": "The subject, scopes, agents and sandbox grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:<principalId>`, no scopes, no agents), or a trusted issuer's token (`via: issuer:<name>`).",
4132
3259
  "security": [
3260
+ {
3261
+ "applicationKey": []
3262
+ },
4133
3263
  {
4134
3264
  "managementKey": []
3265
+ },
3266
+ {
3267
+ "issuerToken": []
4135
3268
  }
4136
3269
  ],
4137
3270
  "x-nylorun-credentials": [
4138
- "management"
3271
+ "application",
3272
+ "subject",
3273
+ "management",
3274
+ "token"
4139
3275
  ],
4140
- "x-nylorun-scopes": "never",
3276
+ "x-nylorun-scopes": "any",
4141
3277
  "parameters": [
4142
3278
  {
4143
3279
  "schema": {
4144
3280
  "type": "string",
4145
- "description": "The protocol version, `10`"
3281
+ "description": "The protocol version, `14`"
4146
3282
  },
4147
3283
  "required": true,
4148
- "description": "The protocol version, `10`",
3284
+ "description": "The protocol version, `14`",
4149
3285
  "name": "Nylorun-Protocol",
4150
3286
  "in": "header"
3287
+ },
3288
+ {
3289
+ "schema": {
3290
+ "type": "string",
3291
+ "description": "The person an application key acts for"
3292
+ },
3293
+ "required": false,
3294
+ "description": "The person an application key acts for",
3295
+ "name": "Nylorun-Subject",
3296
+ "in": "header"
3297
+ },
3298
+ {
3299
+ "schema": {
3300
+ "type": "string",
3301
+ "description": "The subject's space-separated scopes; required with a subject"
3302
+ },
3303
+ "required": false,
3304
+ "description": "The subject's space-separated scopes; required with a subject",
3305
+ "name": "Nylorun-Scopes",
3306
+ "in": "header"
4151
3307
  }
4152
3308
  ],
4153
3309
  "responses": {
4154
3310
  "200": {
4155
- "description": "The providers",
3311
+ "description": "The caller",
4156
3312
  "content": {
4157
3313
  "application/json": {
4158
3314
  "schema": {
4159
- "$ref": "#/components/schemas/ListProvidersResponse"
3315
+ "$ref": "#/components/schemas/MeResponse"
4160
3316
  }
4161
3317
  }
4162
3318
  }
@@ -4172,7 +3328,7 @@
4172
3328
  }
4173
3329
  },
4174
3330
  "401": {
4175
- "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
3331
+ "description": "No credential (`credential_required`), one the Tenant does not accept (`credential_invalid`), a token that expired (`token_expired`), or a token whose issuer's keys cannot be fetched now (`issuer_unavailable`). `WWW-Authenticate: Bearer` names the protected resource metadata (`resource_metadata`)",
4176
3332
  "content": {
4177
3333
  "application/json": {
4178
3334
  "schema": {
@@ -4224,12 +3380,26 @@
4224
3380
  }
4225
3381
  }
4226
3382
  },
4227
- "/v1/tenant/model": {
3383
+ "/openapi/management.json": {
4228
3384
  "get": {
4229
3385
  "tags": [
4230
- "Models"
3386
+ "Tenant"
4231
3387
  ],
4232
- "summary": "Get the Tenant's model",
3388
+ "summary": "Get the Management API's document",
3389
+ "responses": {
3390
+ "200": {
3391
+ "description": "The Management API's OpenAPI document"
3392
+ }
3393
+ }
3394
+ }
3395
+ },
3396
+ "/v1/tenant/keys": {
3397
+ "get": {
3398
+ "tags": [
3399
+ "Application keys"
3400
+ ],
3401
+ "summary": "List the Tenant's keys",
3402
+ "description": "Every key of the Tenant by name, with its role (`application`, `management` or `studio`) and when it was issued. Keys themselves are never shown again.",
4233
3403
  "security": [
4234
3404
  {
4235
3405
  "managementKey": []
@@ -4243,21 +3413,21 @@
4243
3413
  {
4244
3414
  "schema": {
4245
3415
  "type": "string",
4246
- "description": "The protocol version, `10`"
3416
+ "description": "The protocol version, `14`"
4247
3417
  },
4248
3418
  "required": true,
4249
- "description": "The protocol version, `10`",
3419
+ "description": "The protocol version, `14`",
4250
3420
  "name": "Nylorun-Protocol",
4251
3421
  "in": "header"
4252
3422
  }
4253
3423
  ],
4254
3424
  "responses": {
4255
3425
  "200": {
4256
- "description": "The model its sessions call",
3426
+ "description": "The keys, by id",
4257
3427
  "content": {
4258
3428
  "application/json": {
4259
3429
  "schema": {
4260
- "$ref": "#/components/schemas/HostModelView"
3430
+ "$ref": "#/components/schemas/ListOperatorKeysResponse"
4261
3431
  }
4262
3432
  }
4263
3433
  }
@@ -4323,12 +3493,15 @@
4323
3493
  }
4324
3494
  }
4325
3495
  }
4326
- },
3496
+ }
3497
+ },
3498
+ "/v1/tenant/keys/{keyId}": {
4327
3499
  "put": {
4328
3500
  "tags": [
4329
- "Models"
3501
+ "Application keys"
4330
3502
  ],
4331
- "summary": "Set a model provider's credentials",
3503
+ "summary": "Create or rotate an application key",
3504
+ "description": "Issues a new application key named `keyId` and returns it this once. An application key of that name is replaced: the old one stops authenticating at once. A management key, `studio` and `bootstrap` are refused.",
4332
3505
  "security": [
4333
3506
  {
4334
3507
  "managementKey": []
@@ -4342,44 +3515,37 @@
4342
3515
  {
4343
3516
  "schema": {
4344
3517
  "type": "string",
4345
- "description": "The protocol version, `10`"
3518
+ "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`"
3519
+ },
3520
+ "required": true,
3521
+ "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`",
3522
+ "name": "keyId",
3523
+ "in": "path"
3524
+ },
3525
+ {
3526
+ "schema": {
3527
+ "type": "string",
3528
+ "description": "The protocol version, `14`"
4346
3529
  },
4347
3530
  "required": true,
4348
- "description": "The protocol version, `10`",
3531
+ "description": "The protocol version, `14`",
4349
3532
  "name": "Nylorun-Protocol",
4350
3533
  "in": "header"
4351
3534
  }
4352
3535
  ],
4353
- "requestBody": {
4354
- "required": true,
4355
- "content": {
4356
- "application/json": {
4357
- "schema": {
4358
- "$ref": "#/components/schemas/PutHostModelRequest"
4359
- }
4360
- }
4361
- }
4362
- },
4363
3536
  "responses": {
4364
3537
  "200": {
4365
- "description": "The model now in force",
3538
+ "description": "The new key, shown once",
4366
3539
  "content": {
4367
3540
  "application/json": {
4368
3541
  "schema": {
4369
- "$ref": "#/components/schemas/HostModelView"
3542
+ "$ref": "#/components/schemas/PutOperatorKeyResponse"
4370
3543
  }
4371
3544
  }
4372
3545
  }
4373
3546
  },
4374
3547
  "400": {
4375
- "description": "Invalid headers, path, body or cursor",
4376
- "content": {
4377
- "application/json": {
4378
- "schema": {
4379
- "$ref": "#/components/schemas/Rejected"
4380
- }
4381
- }
4382
- }
3548
+ "description": "Not a key name, a reserved name, or a management key's name"
4383
3549
  },
4384
3550
  "401": {
4385
3551
  "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
@@ -4432,14 +3598,13 @@
4432
3598
  }
4433
3599
  }
4434
3600
  }
4435
- }
4436
- },
4437
- "/v1/tenant/model/selection": {
4438
- "put": {
3601
+ },
3602
+ "delete": {
4439
3603
  "tags": [
4440
- "Models"
3604
+ "Application keys"
4441
3605
  ],
4442
- "summary": "Choose the provider and model",
3606
+ "summary": "Delete an application key",
3607
+ "description": "The key stops authenticating at once. A management key, `studio` and `bootstrap` are refused.",
4443
3608
  "security": [
4444
3609
  {
4445
3610
  "managementKey": []
@@ -4453,44 +3618,37 @@
4453
3618
  {
4454
3619
  "schema": {
4455
3620
  "type": "string",
4456
- "description": "The protocol version, `10`"
3621
+ "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`"
3622
+ },
3623
+ "required": true,
3624
+ "description": "The key's name: `^[a-z][a-z0-9-]{0,31}$`, never `studio` or `bootstrap`",
3625
+ "name": "keyId",
3626
+ "in": "path"
3627
+ },
3628
+ {
3629
+ "schema": {
3630
+ "type": "string",
3631
+ "description": "The protocol version, `14`"
4457
3632
  },
4458
3633
  "required": true,
4459
- "description": "The protocol version, `10`",
3634
+ "description": "The protocol version, `14`",
4460
3635
  "name": "Nylorun-Protocol",
4461
3636
  "in": "header"
4462
3637
  }
4463
3638
  ],
4464
- "requestBody": {
4465
- "required": true,
4466
- "content": {
4467
- "application/json": {
4468
- "schema": {
4469
- "$ref": "#/components/schemas/SelectHostModelRequest"
4470
- }
4471
- }
4472
- }
4473
- },
4474
3639
  "responses": {
4475
3640
  "200": {
4476
- "description": "The model now in force",
3641
+ "description": "The key is deleted",
4477
3642
  "content": {
4478
3643
  "application/json": {
4479
3644
  "schema": {
4480
- "$ref": "#/components/schemas/HostModelView"
3645
+ "$ref": "#/components/schemas/DeleteOperatorKeyResponse"
4481
3646
  }
4482
3647
  }
4483
3648
  }
4484
3649
  },
4485
3650
  "400": {
4486
- "description": "Invalid headers, path, body or cursor",
4487
- "content": {
4488
- "application/json": {
4489
- "schema": {
4490
- "$ref": "#/components/schemas/Rejected"
4491
- }
4492
- }
4493
- }
3651
+ "description": "Not a key name, a reserved name, or a management key's name"
4494
3652
  },
4495
3653
  "401": {
4496
3654
  "description": "No credential (`credential_required`), or one the Tenant does not accept (`credential_invalid`), with a `WWW-Authenticate: Bearer` challenge",
@@ -4545,13 +3703,13 @@
4545
3703
  }
4546
3704
  }
4547
3705
  },
4548
- "/v1/tenant/usage": {
3706
+ "/v1/tenant/models": {
4549
3707
  "get": {
4550
3708
  "tags": [
4551
3709
  "Models"
4552
3710
  ],
4553
- "summary": "Get what the Tenant's model calls used",
4554
- "description": "Totals from the model usage ledger, which the model gate writes once per call: for the Tenant, one agent or one turn, over the current UTC day or month, or all time.",
3711
+ "summary": "List model providers and models",
3712
+ "description": "Each model says what it reads (`inputs`: its catalog's inputs and those the operator added) and what may be added (`addableInputs`).",
4555
3713
  "security": [
4556
3714
  {
4557
3715
  "managementKey": []
@@ -4565,58 +3723,21 @@
4565
3723
  {
4566
3724
  "schema": {
4567
3725
  "type": "string",
4568
- "enum": [
4569
- "tenant",
4570
- "agent",
4571
- "turn"
4572
- ],
4573
- "default": "tenant"
4574
- },
4575
- "required": false,
4576
- "name": "scope",
4577
- "in": "query"
4578
- },
4579
- {
4580
- "schema": {
4581
- "type": "string",
4582
- "minLength": 1
4583
- },
4584
- "required": false,
4585
- "name": "id",
4586
- "in": "query"
4587
- },
4588
- {
4589
- "schema": {
4590
- "type": "string",
4591
- "enum": [
4592
- "day",
4593
- "month",
4594
- "total"
4595
- ],
4596
- "default": "total"
4597
- },
4598
- "required": false,
4599
- "name": "period",
4600
- "in": "query"
4601
- },
4602
- {
4603
- "schema": {
4604
- "type": "string",
4605
- "description": "The protocol version, `10`"
3726
+ "description": "The protocol version, `14`"
4606
3727
  },
4607
3728
  "required": true,
4608
- "description": "The protocol version, `10`",
3729
+ "description": "The protocol version, `14`",
4609
3730
  "name": "Nylorun-Protocol",
4610
3731
  "in": "header"
4611
3732
  }
4612
3733
  ],
4613
3734
  "responses": {
4614
3735
  "200": {
4615
- "description": "The calls, tokens and cost",
3736
+ "description": "Provider and model names, and their inputs",
4616
3737
  "content": {
4617
3738
  "application/json": {
4618
3739
  "schema": {
4619
- "$ref": "#/components/schemas/ModelUsageTotals"
3740
+ "$ref": "#/components/schemas/HostModelCatalog"
4620
3741
  }
4621
3742
  }
4622
3743
  }
@@ -4684,12 +3805,13 @@
4684
3805
  }
4685
3806
  }
4686
3807
  },
4687
- "/v1/tenant/calls/model": {
4688
- "get": {
3808
+ "/v1/tenant/models/inputs": {
3809
+ "put": {
4689
3810
  "tags": [
4690
3811
  "Models"
4691
3812
  ],
4692
- "summary": "Export committed model calls in safe transaction order",
3813
+ "summary": "Set what a catalog model reads",
3814
+ "description": "Replaces the inputs the operator added to one catalog model (Tenant setting `model.inputs`): only those in its `addableInputs`, which its provider API carries. Its catalog's own inputs always stay; an empty list removes the additions. A message naming a file the Tenant's model does not read is refused with `422 attachment_unsupported`. A custom endpoint sets `settings.inputs` on `PUT /v1/tenant/model` instead.",
4693
3815
  "security": [
4694
3816
  {
4695
3817
  "managementKey": []
@@ -4700,43 +3822,34 @@
4700
3822
  ],
4701
3823
  "x-nylorun-scopes": "never",
4702
3824
  "parameters": [
4703
- {
4704
- "schema": {
4705
- "type": "string"
4706
- },
4707
- "required": false,
4708
- "name": "after",
4709
- "in": "query"
4710
- },
4711
- {
4712
- "schema": {
4713
- "type": "integer",
4714
- "minimum": 1,
4715
- "maximum": 1000,
4716
- "default": 200
4717
- },
4718
- "required": false,
4719
- "name": "limit",
4720
- "in": "query"
4721
- },
4722
3825
  {
4723
3826
  "schema": {
4724
3827
  "type": "string",
4725
- "description": "The protocol version, `10`"
3828
+ "description": "The protocol version, `14`"
4726
3829
  },
4727
3830
  "required": true,
4728
- "description": "The protocol version, `10`",
3831
+ "description": "The protocol version, `14`",
4729
3832
  "name": "Nylorun-Protocol",
4730
3833
  "in": "header"
4731
3834
  }
4732
- ],
3835
+ ],
3836
+ "requestBody": {
3837
+ "required": true,
3838
+ "content": {
3839
+ "application/json": {
3840
+ "schema": {
3841
+ "$ref": "#/components/schemas/PutModelInputsRequest"
3842
+ }
3843
+ }
3844
+ }
3845
+ },
4733
3846
  "responses": {
4734
3847
  "200": {
4735
- "description": "An unfiltered resumable ledger page",
3848
+ "description": "What the model reads now",
4736
3849
  "content": {
4737
3850
  "application/json": {
4738
3851
  "schema": {
4739
- "$ref": "#/components/schemas/ModelCallExportPage"
3852
+ "$ref": "#/components/schemas/ModelInputsView"
4740
3853
  }
4741
3854
  }
4742
3855
  }
@@ -4804,12 +3917,12 @@
4804
3917
  }
4805
3918
  }
4806
3919
  },
4807
- "/v1/tenant/budgets": {
3920
+ "/v1/tenant/providers": {
4808
3921
  "get": {
4809
3922
  "tags": [
4810
3923
  "Models"
4811
3924
  ],
4812
- "summary": "Get the Tenant's model budgets",
3925
+ "summary": "List the model providers the Tenant has credentials for",
4813
3926
  "security": [
4814
3927
  {
4815
3928
  "managementKey": []
@@ -4823,21 +3936,21 @@
4823
3936
  {
4824
3937
  "schema": {
4825
3938
  "type": "string",
4826
- "description": "The protocol version, `10`"
3939
+ "description": "The protocol version, `14`"
4827
3940
  },
4828
3941
  "required": true,
4829
- "description": "The protocol version, `10`",
3942
+ "description": "The protocol version, `14`",
4830
3943
  "name": "Nylorun-Protocol",
4831
3944
  "in": "header"
4832
3945
  }
4833
3946
  ],
4834
3947
  "responses": {
4835
3948
  "200": {
4836
- "description": "The hard caps on model spend",
3949
+ "description": "The providers",
4837
3950
  "content": {
4838
3951
  "application/json": {
4839
3952
  "schema": {
4840
- "$ref": "#/components/schemas/ModelBudgets"
3953
+ "$ref": "#/components/schemas/ListProvidersResponse"
4841
3954
  }
4842
3955
  }
4843
3956
  }
@@ -4903,13 +4016,14 @@
4903
4016
  }
4904
4017
  }
4905
4018
  }
4906
- },
4907
- "put": {
4019
+ }
4020
+ },
4021
+ "/v1/tenant/model": {
4022
+ "get": {
4908
4023
  "tags": [
4909
4024
  "Models"
4910
4025
  ],
4911
- "summary": "Set the Tenant's model budgets",
4912
- "description": "Replaces every budget. Before each model call the gate checks the scope's spend against its cap; once a cap is reached the call fails with `budget_exhausted` and the turn with `model.budget_exhausted`. An empty list removes every cap.",
4026
+ "summary": "Get the Tenant's model",
4913
4027
  "security": [
4914
4028
  {
4915
4029
  "managementKey": []
@@ -4923,31 +4037,21 @@
4923
4037
  {
4924
4038
  "schema": {
4925
4039
  "type": "string",
4926
- "description": "The protocol version, `10`"
4040
+ "description": "The protocol version, `14`"
4927
4041
  },
4928
4042
  "required": true,
4929
- "description": "The protocol version, `10`",
4043
+ "description": "The protocol version, `14`",
4930
4044
  "name": "Nylorun-Protocol",
4931
4045
  "in": "header"
4932
4046
  }
4933
4047
  ],
4934
- "requestBody": {
4935
- "required": true,
4936
- "content": {
4937
- "application/json": {
4938
- "schema": {
4939
- "$ref": "#/components/schemas/PutModelBudgetsRequest"
4940
- }
4941
- }
4942
- }
4943
- },
4944
4048
  "responses": {
4945
4049
  "200": {
4946
- "description": "The budgets now in force",
4050
+ "description": "The model its sessions call",
4947
4051
  "content": {
4948
4052
  "application/json": {
4949
4053
  "schema": {
4950
- "$ref": "#/components/schemas/ModelBudgets"
4054
+ "$ref": "#/components/schemas/HostModelView"
4951
4055
  }
4952
4056
  }
4953
4057
  }
@@ -5013,15 +4117,12 @@
5013
4117
  }
5014
4118
  }
5015
4119
  }
5016
- }
5017
- },
5018
- "/v1/tenant/vaults": {
5019
- "post": {
4120
+ },
4121
+ "put": {
5020
4122
  "tags": [
5021
- "Vaults"
4123
+ "Models"
5022
4124
  ],
5023
- "summary": "Create a vault",
5024
- "description": "With `scope: \"installation\"` the installation's own vault, owned by `installation`, which any session may attach; or a vault of one person (`ownerUserId`), which only that person's sessions attach.",
4125
+ "summary": "Set a model provider's credentials",
5025
4126
  "security": [
5026
4127
  {
5027
4128
  "managementKey": []
@@ -5035,10 +4136,10 @@
5035
4136
  {
5036
4137
  "schema": {
5037
4138
  "type": "string",
5038
- "description": "The protocol version, `10`"
4139
+ "description": "The protocol version, `14`"
5039
4140
  },
5040
4141
  "required": true,
5041
- "description": "The protocol version, `10`",
4142
+ "description": "The protocol version, `14`",
5042
4143
  "name": "Nylorun-Protocol",
5043
4144
  "in": "header"
5044
4145
  }
@@ -5048,18 +4149,18 @@
5048
4149
  "content": {
5049
4150
  "application/json": {
5050
4151
  "schema": {
5051
- "$ref": "#/components/schemas/CreateVaultRequest"
4152
+ "$ref": "#/components/schemas/PutHostModelRequest"
5052
4153
  }
5053
4154
  }
5054
4155
  }
5055
4156
  },
5056
4157
  "responses": {
5057
4158
  "200": {
5058
- "description": "The vault",
4159
+ "description": "The model now in force",
5059
4160
  "content": {
5060
4161
  "application/json": {
5061
4162
  "schema": {
5062
- "$ref": "#/components/schemas/VaultInfo"
4163
+ "$ref": "#/components/schemas/HostModelView"
5063
4164
  }
5064
4165
  }
5065
4166
  }
@@ -5104,9 +4205,6 @@
5104
4205
  }
5105
4206
  }
5106
4207
  },
5107
- "409": {
5108
- "description": "The idempotency key was used for another vault"
5109
- },
5110
4208
  "426": {
5111
4209
  "description": "`Nylorun-Protocol` missing or unsupported",
5112
4210
  "content": {
@@ -5128,13 +4226,14 @@
5128
4226
  }
5129
4227
  }
5130
4228
  }
5131
- },
5132
- "get": {
4229
+ }
4230
+ },
4231
+ "/v1/tenant/model/selection": {
4232
+ "put": {
5133
4233
  "tags": [
5134
- "Vaults"
4234
+ "Models"
5135
4235
  ],
5136
- "summary": "List vaults",
5137
- "description": "The installation vaults, after the vaults of `ownerUserId` when it names a person.",
4236
+ "summary": "Choose the provider and model",
5138
4237
  "security": [
5139
4238
  {
5140
4239
  "managementKey": []
@@ -5148,31 +4247,31 @@
5148
4247
  {
5149
4248
  "schema": {
5150
4249
  "type": "string",
5151
- "description": "Also list this person's vaults"
5152
- },
5153
- "required": false,
5154
- "description": "Also list this person's vaults",
5155
- "name": "ownerUserId",
5156
- "in": "query"
5157
- },
5158
- {
5159
- "schema": {
5160
- "type": "string",
5161
- "description": "The protocol version, `10`"
4250
+ "description": "The protocol version, `14`"
5162
4251
  },
5163
4252
  "required": true,
5164
- "description": "The protocol version, `10`",
4253
+ "description": "The protocol version, `14`",
5165
4254
  "name": "Nylorun-Protocol",
5166
4255
  "in": "header"
5167
4256
  }
5168
4257
  ],
4258
+ "requestBody": {
4259
+ "required": true,
4260
+ "content": {
4261
+ "application/json": {
4262
+ "schema": {
4263
+ "$ref": "#/components/schemas/SelectHostModelRequest"
4264
+ }
4265
+ }
4266
+ }
4267
+ },
5169
4268
  "responses": {
5170
4269
  "200": {
5171
- "description": "The vaults",
4270
+ "description": "The model now in force",
5172
4271
  "content": {
5173
4272
  "application/json": {
5174
4273
  "schema": {
5175
- "$ref": "#/components/schemas/ListVaultsResponse"
4274
+ "$ref": "#/components/schemas/HostModelView"
5176
4275
  }
5177
4276
  }
5178
4277
  }
@@ -5240,12 +4339,13 @@
5240
4339
  }
5241
4340
  }
5242
4341
  },
5243
- "/v1/tenant/vaults/{vaultId}": {
4342
+ "/v1/tenant/usage": {
5244
4343
  "get": {
5245
4344
  "tags": [
5246
- "Vaults"
4345
+ "Models"
5247
4346
  ],
5248
- "summary": "Get a vault",
4347
+ "summary": "Get what the Tenant's model calls used",
4348
+ "description": "Totals from the model usage ledger, which the model gate writes once per call: for the Tenant, one agent or one turn, over the current UTC day or month, or all time.",
5249
4349
  "security": [
5250
4350
  {
5251
4351
  "managementKey": []
@@ -5258,30 +4358,59 @@
5258
4358
  "parameters": [
5259
4359
  {
5260
4360
  "schema": {
5261
- "type": "string"
4361
+ "type": "string",
4362
+ "enum": [
4363
+ "tenant",
4364
+ "agent",
4365
+ "turn"
4366
+ ],
4367
+ "default": "tenant"
5262
4368
  },
5263
- "required": true,
5264
- "name": "vaultId",
5265
- "in": "path"
4369
+ "required": false,
4370
+ "name": "scope",
4371
+ "in": "query"
4372
+ },
4373
+ {
4374
+ "schema": {
4375
+ "type": "string",
4376
+ "minLength": 1
4377
+ },
4378
+ "required": false,
4379
+ "name": "id",
4380
+ "in": "query"
4381
+ },
4382
+ {
4383
+ "schema": {
4384
+ "type": "string",
4385
+ "enum": [
4386
+ "day",
4387
+ "month",
4388
+ "total"
4389
+ ],
4390
+ "default": "total"
4391
+ },
4392
+ "required": false,
4393
+ "name": "period",
4394
+ "in": "query"
5266
4395
  },
5267
4396
  {
5268
4397
  "schema": {
5269
4398
  "type": "string",
5270
- "description": "The protocol version, `10`"
4399
+ "description": "The protocol version, `14`"
5271
4400
  },
5272
4401
  "required": true,
5273
- "description": "The protocol version, `10`",
4402
+ "description": "The protocol version, `14`",
5274
4403
  "name": "Nylorun-Protocol",
5275
4404
  "in": "header"
5276
4405
  }
5277
4406
  ],
5278
4407
  "responses": {
5279
4408
  "200": {
5280
- "description": "The vault",
4409
+ "description": "The calls, tokens and cost",
5281
4410
  "content": {
5282
4411
  "application/json": {
5283
4412
  "schema": {
5284
- "$ref": "#/components/schemas/VaultInfo"
4413
+ "$ref": "#/components/schemas/ModelUsageTotals"
5285
4414
  }
5286
4415
  }
5287
4416
  }
@@ -5347,12 +4476,14 @@
5347
4476
  }
5348
4477
  }
5349
4478
  }
5350
- },
5351
- "delete": {
4479
+ }
4480
+ },
4481
+ "/v1/tenant/calls/model": {
4482
+ "get": {
5352
4483
  "tags": [
5353
- "Vaults"
4484
+ "Models"
5354
4485
  ],
5355
- "summary": "Delete a vault and its credentials",
4486
+ "summary": "Export committed model calls in safe transaction order",
5356
4487
  "security": [
5357
4488
  {
5358
4489
  "managementKey": []
@@ -5367,28 +4498,39 @@
5367
4498
  "schema": {
5368
4499
  "type": "string"
5369
4500
  },
5370
- "required": true,
5371
- "name": "vaultId",
5372
- "in": "path"
4501
+ "required": false,
4502
+ "name": "after",
4503
+ "in": "query"
4504
+ },
4505
+ {
4506
+ "schema": {
4507
+ "type": "integer",
4508
+ "minimum": 1,
4509
+ "maximum": 1000,
4510
+ "default": 200
4511
+ },
4512
+ "required": false,
4513
+ "name": "limit",
4514
+ "in": "query"
5373
4515
  },
5374
4516
  {
5375
4517
  "schema": {
5376
4518
  "type": "string",
5377
- "description": "The protocol version, `10`"
4519
+ "description": "The protocol version, `14`"
5378
4520
  },
5379
4521
  "required": true,
5380
- "description": "The protocol version, `10`",
4522
+ "description": "The protocol version, `14`",
5381
4523
  "name": "Nylorun-Protocol",
5382
4524
  "in": "header"
5383
4525
  }
5384
4526
  ],
5385
4527
  "responses": {
5386
4528
  "200": {
5387
- "description": "Deleted",
4529
+ "description": "An unfiltered resumable ledger page",
5388
4530
  "content": {
5389
4531
  "application/json": {
5390
4532
  "schema": {
5391
- "$ref": "#/components/schemas/DeletedResponse"
4533
+ "$ref": "#/components/schemas/ModelCallExportPage"
5392
4534
  }
5393
4535
  }
5394
4536
  }
@@ -5456,13 +4598,12 @@
5456
4598
  }
5457
4599
  }
5458
4600
  },
5459
- "/v1/tenant/vaults/{vaultId}/credentials": {
5460
- "post": {
4601
+ "/v1/tenant/budgets": {
4602
+ "get": {
5461
4603
  "tags": [
5462
- "Vaults"
4604
+ "Models"
5463
4605
  ],
5464
- "summary": "Add a credential",
5465
- "description": "A bearer token, bound to the URL a tool may send it to.",
4606
+ "summary": "Get the Tenant's model budgets",
5466
4607
  "security": [
5467
4608
  {
5468
4609
  "managementKey": []
@@ -5473,42 +4614,24 @@
5473
4614
  ],
5474
4615
  "x-nylorun-scopes": "never",
5475
4616
  "parameters": [
5476
- {
5477
- "schema": {
5478
- "type": "string"
5479
- },
5480
- "required": true,
5481
- "name": "vaultId",
5482
- "in": "path"
5483
- },
5484
4617
  {
5485
4618
  "schema": {
5486
4619
  "type": "string",
5487
- "description": "The protocol version, `10`"
4620
+ "description": "The protocol version, `14`"
5488
4621
  },
5489
4622
  "required": true,
5490
- "description": "The protocol version, `10`",
4623
+ "description": "The protocol version, `14`",
5491
4624
  "name": "Nylorun-Protocol",
5492
4625
  "in": "header"
5493
4626
  }
5494
4627
  ],
5495
- "requestBody": {
5496
- "required": true,
5497
- "content": {
5498
- "application/json": {
5499
- "schema": {
5500
- "$ref": "#/components/schemas/CreateCredentialRequest"
5501
- }
5502
- }
5503
- }
5504
- },
5505
4628
  "responses": {
5506
4629
  "200": {
5507
- "description": "The credential, without its secret",
4630
+ "description": "The hard caps on model spend",
5508
4631
  "content": {
5509
4632
  "application/json": {
5510
4633
  "schema": {
5511
- "$ref": "#/components/schemas/CredentialInfo"
4634
+ "$ref": "#/components/schemas/ModelBudgets"
5512
4635
  }
5513
4636
  }
5514
4637
  }
@@ -5575,11 +4698,12 @@
5575
4698
  }
5576
4699
  }
5577
4700
  },
5578
- "get": {
4701
+ "put": {
5579
4702
  "tags": [
5580
- "Vaults"
4703
+ "Models"
5581
4704
  ],
5582
- "summary": "List a vault's credentials",
4705
+ "summary": "Set the Tenant's model budgets",
4706
+ "description": "Replaces every budget. Before each model call the gate checks the scope's spend against its cap; once a cap is reached the call fails with `budget_exhausted` and the turn with `model.budget_exhausted`. An empty list removes every cap.",
5583
4707
  "security": [
5584
4708
  {
5585
4709
  "managementKey": []
@@ -5590,32 +4714,34 @@
5590
4714
  ],
5591
4715
  "x-nylorun-scopes": "never",
5592
4716
  "parameters": [
5593
- {
5594
- "schema": {
5595
- "type": "string"
5596
- },
5597
- "required": true,
5598
- "name": "vaultId",
5599
- "in": "path"
5600
- },
5601
4717
  {
5602
4718
  "schema": {
5603
4719
  "type": "string",
5604
- "description": "The protocol version, `10`"
4720
+ "description": "The protocol version, `14`"
5605
4721
  },
5606
4722
  "required": true,
5607
- "description": "The protocol version, `10`",
4723
+ "description": "The protocol version, `14`",
5608
4724
  "name": "Nylorun-Protocol",
5609
4725
  "in": "header"
5610
4726
  }
5611
4727
  ],
4728
+ "requestBody": {
4729
+ "required": true,
4730
+ "content": {
4731
+ "application/json": {
4732
+ "schema": {
4733
+ "$ref": "#/components/schemas/PutModelBudgetsRequest"
4734
+ }
4735
+ }
4736
+ }
4737
+ },
5612
4738
  "responses": {
5613
4739
  "200": {
5614
- "description": "The credentials, without their secrets",
4740
+ "description": "The budgets now in force",
5615
4741
  "content": {
5616
4742
  "application/json": {
5617
4743
  "schema": {
5618
- "$ref": "#/components/schemas/ListCredentialsResponse"
4744
+ "$ref": "#/components/schemas/ModelBudgets"
5619
4745
  }
5620
4746
  }
5621
4747
  }
@@ -5683,12 +4809,12 @@
5683
4809
  }
5684
4810
  }
5685
4811
  },
5686
- "/v1/tenant/vaults/{vaultId}/credentials/{credentialId}": {
4812
+ "/v1/tenant/tool-policy": {
5687
4813
  "get": {
5688
4814
  "tags": [
5689
- "Vaults"
4815
+ "Tool policy"
5690
4816
  ],
5691
- "summary": "Get a credential",
4817
+ "summary": "Get the Tenant's tool policy",
5692
4818
  "security": [
5693
4819
  {
5694
4820
  "managementKey": []
@@ -5699,40 +4825,24 @@
5699
4825
  ],
5700
4826
  "x-nylorun-scopes": "never",
5701
4827
  "parameters": [
5702
- {
5703
- "schema": {
5704
- "type": "string"
5705
- },
5706
- "required": true,
5707
- "name": "vaultId",
5708
- "in": "path"
5709
- },
5710
- {
5711
- "schema": {
5712
- "type": "string"
5713
- },
5714
- "required": true,
5715
- "name": "credentialId",
5716
- "in": "path"
5717
- },
5718
4828
  {
5719
4829
  "schema": {
5720
4830
  "type": "string",
5721
- "description": "The protocol version, `10`"
4831
+ "description": "The protocol version, `14`"
5722
4832
  },
5723
4833
  "required": true,
5724
- "description": "The protocol version, `10`",
4834
+ "description": "The protocol version, `14`",
5725
4835
  "name": "Nylorun-Protocol",
5726
4836
  "in": "header"
5727
4837
  }
5728
4838
  ],
5729
4839
  "responses": {
5730
4840
  "200": {
5731
- "description": "The credential, without its secret",
4841
+ "description": "The rules the Tool Gate applies to every MCP and HTTP tool call",
5732
4842
  "content": {
5733
4843
  "application/json": {
5734
4844
  "schema": {
5735
- "$ref": "#/components/schemas/CredentialInfo"
4845
+ "$ref": "#/components/schemas/ToolPolicy"
5736
4846
  }
5737
4847
  }
5738
4848
  }
@@ -5799,11 +4909,12 @@
5799
4909
  }
5800
4910
  }
5801
4911
  },
5802
- "post": {
4912
+ "put": {
5803
4913
  "tags": [
5804
- "Vaults"
4914
+ "Tool policy"
5805
4915
  ],
5806
- "summary": "Rotate a credential's secret",
4916
+ "summary": "Set the Tenant's tool policy",
4917
+ "description": "Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). Sandbox tools never cross the gate. An empty list allows every call.",
5807
4918
  "security": [
5808
4919
  {
5809
4920
  "managementKey": []
@@ -5814,29 +4925,13 @@
5814
4925
  ],
5815
4926
  "x-nylorun-scopes": "never",
5816
4927
  "parameters": [
5817
- {
5818
- "schema": {
5819
- "type": "string"
5820
- },
5821
- "required": true,
5822
- "name": "vaultId",
5823
- "in": "path"
5824
- },
5825
- {
5826
- "schema": {
5827
- "type": "string"
5828
- },
5829
- "required": true,
5830
- "name": "credentialId",
5831
- "in": "path"
5832
- },
5833
4928
  {
5834
4929
  "schema": {
5835
4930
  "type": "string",
5836
- "description": "The protocol version, `10`"
4931
+ "description": "The protocol version, `14`"
5837
4932
  },
5838
4933
  "required": true,
5839
- "description": "The protocol version, `10`",
4934
+ "description": "The protocol version, `14`",
5840
4935
  "name": "Nylorun-Protocol",
5841
4936
  "in": "header"
5842
4937
  }
@@ -5846,18 +4941,18 @@
5846
4941
  "content": {
5847
4942
  "application/json": {
5848
4943
  "schema": {
5849
- "$ref": "#/components/schemas/RotateCredentialRequest"
4944
+ "$ref": "#/components/schemas/PutToolPolicyRequest"
5850
4945
  }
5851
4946
  }
5852
4947
  }
5853
4948
  },
5854
4949
  "responses": {
5855
4950
  "200": {
5856
- "description": "The credential",
4951
+ "description": "The policy now in force",
5857
4952
  "content": {
5858
4953
  "application/json": {
5859
4954
  "schema": {
5860
- "$ref": "#/components/schemas/CredentialInfo"
4955
+ "$ref": "#/components/schemas/ToolPolicy"
5861
4956
  }
5862
4957
  }
5863
4958
  }
@@ -5902,9 +4997,6 @@
5902
4997
  }
5903
4998
  }
5904
4999
  },
5905
- "409": {
5906
- "description": "A credential's type cannot change"
5907
- },
5908
5000
  "426": {
5909
5001
  "description": "`Nylorun-Protocol` missing or unsupported",
5910
5002
  "content": {
@@ -5926,12 +5018,15 @@
5926
5018
  }
5927
5019
  }
5928
5020
  }
5929
- },
5930
- "delete": {
5021
+ }
5022
+ },
5023
+ "/v1/tenant/credential-coverage": {
5024
+ "post": {
5931
5025
  "tags": [
5932
- "Vaults"
5026
+ "Credential coverage"
5933
5027
  ],
5934
- "summary": "Delete a credential",
5028
+ "summary": "Check an agent's credentials against an Environment",
5029
+ "description": "For each remote MCP server and each HTTP tool with a `credential` that the saved agent `agentId` declares (its own, its agents used as tools' and a flow's), the credential a session that names `environmentId` would send: the Environment's secret bound to the URL (`covered`), or none (`missing`). No secret is read and no server is called.",
5935
5030
  "security": [
5936
5031
  {
5937
5032
  "managementKey": []
@@ -5942,40 +5037,34 @@
5942
5037
  ],
5943
5038
  "x-nylorun-scopes": "never",
5944
5039
  "parameters": [
5945
- {
5946
- "schema": {
5947
- "type": "string"
5948
- },
5949
- "required": true,
5950
- "name": "vaultId",
5951
- "in": "path"
5952
- },
5953
- {
5954
- "schema": {
5955
- "type": "string"
5956
- },
5957
- "required": true,
5958
- "name": "credentialId",
5959
- "in": "path"
5960
- },
5961
5040
  {
5962
5041
  "schema": {
5963
5042
  "type": "string",
5964
- "description": "The protocol version, `10`"
5043
+ "description": "The protocol version, `14`"
5965
5044
  },
5966
5045
  "required": true,
5967
- "description": "The protocol version, `10`",
5046
+ "description": "The protocol version, `14`",
5968
5047
  "name": "Nylorun-Protocol",
5969
5048
  "in": "header"
5970
5049
  }
5971
5050
  ],
5051
+ "requestBody": {
5052
+ "required": true,
5053
+ "content": {
5054
+ "application/json": {
5055
+ "schema": {
5056
+ "$ref": "#/components/schemas/CredentialCoverageRequest"
5057
+ }
5058
+ }
5059
+ }
5060
+ },
5972
5061
  "responses": {
5973
5062
  "200": {
5974
- "description": "Deleted",
5063
+ "description": "One entry per declared URL",
5975
5064
  "content": {
5976
5065
  "application/json": {
5977
5066
  "schema": {
5978
- "$ref": "#/components/schemas/DeletedResponse"
5067
+ "$ref": "#/components/schemas/CredentialCoverage"
5979
5068
  }
5980
5069
  }
5981
5070
  }
@@ -6011,7 +5100,7 @@
6011
5100
  }
6012
5101
  },
6013
5102
  "404": {
6014
- "description": "Not found (`not_found`)",
5103
+ "description": "No such agent, or no such Environment",
6015
5104
  "content": {
6016
5105
  "application/json": {
6017
5106
  "schema": {
@@ -6049,7 +5138,7 @@
6049
5138
  "MCP servers"
6050
5139
  ],
6051
5140
  "summary": "Preview an MCP server's tools",
6052
- "description": "Connects to the remote MCP server at `url` with the installation vault's credential for that URL (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.",
5141
+ "description": "Connects to the remote MCP server at `url` with the credential for that URL in the vault of `environmentId`, if given (its headers and `via`; never an identity header), under the Host's address policy, lists its tools within 15 s and closes the connection. It never calls a tool. Each tool comes with the name the model would call it (`modelName`, made with `name`), its annotations and its input schema's size. A server that answers `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any: it needs a person's sign-in, so reach it through a gateway (`via`), or with a key. No credential value is in the answer.",
6053
5142
  "security": [
6054
5143
  {
6055
5144
  "managementKey": []
@@ -6063,10 +5152,10 @@
6063
5152
  {
6064
5153
  "schema": {
6065
5154
  "type": "string",
6066
- "description": "The protocol version, `10`"
5155
+ "description": "The protocol version, `14`"
6067
5156
  },
6068
5157
  "required": true,
6069
- "description": "The protocol version, `10`",
5158
+ "description": "The protocol version, `14`",
6070
5159
  "name": "Nylorun-Protocol",
6071
5160
  "in": "header"
6072
5161
  }
@@ -6133,7 +5222,7 @@
6133
5222
  }
6134
5223
  },
6135
5224
  "409": {
6136
- "description": "Several installation vaults hold a credential for the URL (name one with `vaultId`), or the one there cannot be used",
5225
+ "description": "The Environment's credential for the URL cannot be used",
6137
5226
  "content": {
6138
5227
  "application/json": {
6139
5228
  "schema": {
@@ -6194,10 +5283,10 @@
6194
5283
  {
6195
5284
  "schema": {
6196
5285
  "type": "string",
6197
- "description": "The protocol version, `10`"
5286
+ "description": "The protocol version, `14`"
6198
5287
  },
6199
5288
  "required": true,
6200
- "description": "The protocol version, `10`",
5289
+ "description": "The protocol version, `14`",
6201
5290
  "name": "Nylorun-Protocol",
6202
5291
  "in": "header"
6203
5292
  }
@@ -6296,10 +5385,10 @@
6296
5385
  {
6297
5386
  "schema": {
6298
5387
  "type": "string",
6299
- "description": "The protocol version, `10`"
5388
+ "description": "The protocol version, `14`"
6300
5389
  },
6301
5390
  "required": true,
6302
- "description": "The protocol version, `10`",
5391
+ "description": "The protocol version, `14`",
6303
5392
  "name": "Nylorun-Protocol",
6304
5393
  "in": "header"
6305
5394
  }
@@ -6418,10 +5507,10 @@
6418
5507
  {
6419
5508
  "schema": {
6420
5509
  "type": "string",
6421
- "description": "The protocol version, `10`"
5510
+ "description": "The protocol version, `14`"
6422
5511
  },
6423
5512
  "required": true,
6424
- "description": "The protocol version, `10`",
5513
+ "description": "The protocol version, `14`",
6425
5514
  "name": "Nylorun-Protocol",
6426
5515
  "in": "header"
6427
5516
  }
@@ -6518,7 +5607,7 @@
6518
5607
  "tags": [
6519
5608
  "Settings"
6520
5609
  ],
6521
- "summary": "Get the Tenant's sandbox configuration",
5610
+ "summary": "Get the Tenant's sandbox backend and Environment settings",
6522
5611
  "security": [
6523
5612
  {
6524
5613
  "managementKey": []
@@ -6532,10 +5621,10 @@
6532
5621
  {
6533
5622
  "schema": {
6534
5623
  "type": "string",
6535
- "description": "The protocol version, `10`"
5624
+ "description": "The protocol version, `14`"
6536
5625
  },
6537
5626
  "required": true,
6538
- "description": "The protocol version, `10`",
5627
+ "description": "The protocol version, `14`",
6539
5628
  "name": "Nylorun-Protocol",
6540
5629
  "in": "header"
6541
5630
  }
@@ -6617,8 +5706,8 @@
6617
5706
  "tags": [
6618
5707
  "Settings"
6619
5708
  ],
6620
- "summary": "Set the Tenant's sandbox configuration",
6621
- "description": "What a session gets when it names no sandbox, and the limits every session's sandbox must fit.",
5709
+ "summary": "Set the Tenant's Environment settings",
5710
+ "description": "The limits every Environment's recipe must fit, the pods' stop grace and where harnesses may run (Tenant setting `environments.config`).",
6622
5711
  "security": [
6623
5712
  {
6624
5713
  "managementKey": []
@@ -6632,10 +5721,10 @@
6632
5721
  {
6633
5722
  "schema": {
6634
5723
  "type": "string",
6635
- "description": "The protocol version, `10`"
5724
+ "description": "The protocol version, `14`"
6636
5725
  },
6637
5726
  "required": true,
6638
- "description": "The protocol version, `10`",
5727
+ "description": "The protocol version, `14`",
6639
5728
  "name": "Nylorun-Protocol",
6640
5729
  "in": "header"
6641
5730
  }
@@ -6645,7 +5734,7 @@
6645
5734
  "content": {
6646
5735
  "application/json": {
6647
5736
  "schema": {
6648
- "$ref": "#/components/schemas/PutTenantSandboxRequest"
5737
+ "$ref": "#/components/schemas/PutTenantEnvironmentsRequest"
6649
5738
  }
6650
5739
  }
6651
5740
  }
@@ -6743,10 +5832,10 @@
6743
5832
  {
6744
5833
  "schema": {
6745
5834
  "type": "string",
6746
- "description": "The protocol version, `10`"
5835
+ "description": "The protocol version, `14`"
6747
5836
  },
6748
5837
  "required": true,
6749
- "description": "The protocol version, `10`",
5838
+ "description": "The protocol version, `14`",
6750
5839
  "name": "Nylorun-Protocol",
6751
5840
  "in": "header"
6752
5841
  }
@@ -6843,10 +5932,10 @@
6843
5932
  {
6844
5933
  "schema": {
6845
5934
  "type": "string",
6846
- "description": "The protocol version, `10`"
5935
+ "description": "The protocol version, `14`"
6847
5936
  },
6848
5937
  "required": true,
6849
- "description": "The protocol version, `10`",
5938
+ "description": "The protocol version, `14`",
6850
5939
  "name": "Nylorun-Protocol",
6851
5940
  "in": "header"
6852
5941
  }
@@ -6948,15 +6037,19 @@
6948
6037
  },
6949
6038
  {
6950
6039
  "name": "Models",
6951
- "description": "Model providers, their credentials, the model the Tenant uses, what it spent, every model call for export, and the budgets that cap it. `admin.models`."
6040
+ "description": "Model providers, their credentials, the model the Tenant uses, what each model reads, what it spent, every model call for export, and the budgets that cap it. `admin.models`."
6041
+ },
6042
+ {
6043
+ "name": "Tool policy",
6044
+ "description": "The rules the Tool Gate applies to every MCP and HTTP tool call of every harness: refuse it, hold it for a person's approval, or run it. `admin.toolPolicy`."
6952
6045
  },
6953
6046
  {
6954
- "name": "Vaults",
6955
- "description": "The installation's and each person's credentials for agents' tools: API keys, bound to the URL they are sent to. Sessions attach a vault by id. `admin.vaults`."
6047
+ "name": "Credential coverage",
6048
+ "description": "Which secret of an Environment each of an agent's MCP servers and HTTP tools would get, before a session opens. The secrets themselves are written on the Runtime API. `admin.coverage`."
6956
6049
  },
6957
6050
  {
6958
6051
  "name": "MCP servers",
6959
- "description": "See a remote MCP server's tools before an agent names it, with the installation vault's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`."
6052
+ "description": "See a remote MCP server's tools before an agent names it, with an Environment's credential for its URL: their model names, sizes and annotations, or that it needs a person's sign-in. `admin.mcp`."
6960
6053
  },
6961
6054
  {
6962
6055
  "name": "Signing keys",
@@ -6964,7 +6057,7 @@
6964
6057
  },
6965
6058
  {
6966
6059
  "name": "Settings",
6967
- "description": "The Tenant's sandbox and artifact settings. `admin.settings`."
6060
+ "description": "The Tenant's sandbox backend, Environment and artifact settings. `admin.settings`."
6968
6061
  }
6969
6062
  ]
6970
6063
  }