@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/mcp/connect.d.ts

@@ -12,10 +12,16 @@ export interface McpRequestOptions {
 /** Options of one tool call. */
 export interface McpCallOptions extends McpRequestOptions {
     /**
-     * The call's effect id. A gate runs a keyed call once and keeps its outcome, so a re-send
-     * after a takeover joins it (F4.1). An in-process connection ignores it.
+     * The call's effect id. A gate keeps a keyed call's outcome, so a re-send after a takeover
+     * joins it (F4.1), and the server gets it in `_meta` (R5.5).
      */
     readonly key?: string;
+    /**
+     * The call's span context (R7.4), sent as the `traceparent` header on the call's requests where
+     * this process holds the connection. A client of the gates service leaves it out: the gate reads
+     * it from the call's journal row.
+     */
+    readonly traceparent?: string;
 }
 /** A page of `tools/list`, as the MCP SDK returns it. */
 export interface McpToolPage {
@@ -73,9 +79,8 @@ export type McpToolFailure = {
     readonly message: string;
     /** True when calling again may work (R2b C7). */
     readonly retryable?: boolean;
-    /** With `credential_rejected`: the server, and the scope of the vault whose credential was sent. */
+    /** With `credential_rejected`: the server. */
     readonly server?: string;
-    readonly vault?: "installation" | "user";
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 };
@@ -93,8 +98,8 @@ export type McpToolOutcome = {
  * - `mcp.forbidden`: the server answered `403`.
  * - `mcp.error`: the server answered a JSON-RPC error; the message has its code.
  * - `mcp.status`: the server answered another HTTP error status, without a JSON-RPC error.
- * - `mcp.lost`: sent, and the answer was lost, so the tool may have run. The model sees it only
- *   for a tool the server marks read-only or idempotent (Q15); any other call is `uncertain`.
+ * - `mcp.lost`: sent, and the answer was lost, so the tool may have run. The model sees it, and
+ *   decides whether to call again (R5; it replaced R2b's read-only and idempotent exception).
  * - `mcp.too-large`: the answer passed `MCP_RESULT_MAX_BYTES` (R2b C11), as an HTTP tool's
  *   answer is `http.too-large`. The tool ran; its answer was not kept.
  */
@@ -110,9 +115,8 @@ export interface McpCallFailure {
     /** The request reached the server, so it may have acted on it. */
     readonly sent: boolean;
     readonly retryable: boolean;
-    /** With `credential_rejected`: the server, and the scope of the vault whose credential was sent. */
+    /** With `credential_rejected`: the server. */
     readonly server?: string;
-    readonly vault?: "installation" | "user";
     /** How many credential values the message had in it, replaced (R2b C8). */
     readonly redacted?: number;
 }
@@ -134,16 +138,16 @@ export declare class McpCallFailed extends Error {
  */
 export declare class CredentialRejected extends McpCallFailed {
     readonly server: string;
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    readonly vault?: "installation" | "user" | undefined;
+    /** Whether a credential of the session's Environment was sent. */
+    readonly sent: boolean;
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
      */
     readonly challenge?: string | undefined;
     constructor(server: string, 
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    vault?: "installation" | "user" | undefined, 
+    /** Whether a credential of the session's Environment was sent. */
+    sent: boolean, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
@@ -162,9 +166,16 @@ export declare class McpConnectionStale extends McpCallFailed {
 }
 /** A tool call that never reached its server: its connection could not be opened. */
 export declare function unreachable(server: string, error: unknown): McpCallFailed;
+/**
+ * Where a `tools/call` carries its key (R5.5): MCP has no standard key field, and `_meta` is the
+ * spec's place for extra request data. The key is the call's effect id, the same on every send,
+ * so a server that reads it can run the call once.
+ */
+export declare const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
- * with them (R2b C8), and a failed call is an `McpCallFailed` (C7).
+ * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
+ * `_meta` (R5.5).
  */
 export declare function sdkClient(client: Client, serverName: string): McpClient;
 export declare function openMcpServer(input: {
@@ -191,7 +202,6 @@ export declare function serverInstructions(text: unknown, secrets: readonly stri
  * collides gets the hash suffix first.
  */
 export declare function listMcpTools(client: McpClient, input: {
-    capabilityId: string;
     serverName: string;
     taken: Set<string>;
     signal?: AbortSignal;
@@ -212,11 +222,5 @@ export declare function listMcpTools(client: McpClient, input: {
  * be opened again (the caller retries once), and with any error that leaves the call's fate
  * unknown.
  */
-export declare function callMcpTool(client: McpClient, serverToolName: string, args: unknown, options?: McpCallOptions & {
-    /**
-     * The tool is read-only or idempotent (`McpToolRecord.annotations`): a call whose answer was
-     * lost after it was sent is `mcp.lost` to the model. Otherwise it is left uncertain (Q15).
-     */
-    readonly retrySafe?: boolean;
-}): Promise<McpToolOutcome>;
-export declare function diagnosticFromError(capabilityId: string, serverName: string, error: unknown): McpDiagnostic;
+export declare function callMcpTool(client: McpClient, serverToolName: string, args: unknown, options?: McpCallOptions): Promise<McpToolOutcome>;
+export declare function diagnosticFromError(serverName: string, error: unknown): McpDiagnostic;

package/dist/mcp/connect.js

@@ -29,7 +29,7 @@ export class McpCallFailed extends Error {
     /** The failure the gate answered, as the class the loop's own call would have thrown. */
     static from(failure) {
         return failure.code === "credential_rejected" && failure.server !== undefined
-            ? new CredentialRejected(failure.server, failure.vault)
+            ? new CredentialRejected(failure.server, !failure.message.includes("holds none"))
             : new McpCallFailed(failure);
     }
     /** The failed tool outcome the model sees. */
@@ -41,7 +41,6 @@ export class McpCallFailed extends Error {
             message: failure.message,
             retryable: failure.retryable,
             ...(failure.server === undefined ? {} : { server: failure.server }),
-            ...(failure.vault === undefined ? {} : { vault: failure.vault }),
             ...(failure.redacted ? { redacted: failure.redacted } : {}),
         };
     }
@@ -54,11 +53,11 @@ export class McpCallFailed extends Error {
  */
 export class CredentialRejected extends McpCallFailed {
     server;
-    vault;
+    sent;
     challenge;
     constructor(server, 
-    /** The scope of the vault whose credential was sent; absent when none was. */
-    vault, 
+    /** Whether a credential of the session's Environment was sent. */
+    sent, 
     /**
      * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
      * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
@@ -66,16 +65,15 @@ export class CredentialRejected extends McpCallFailed {
     challenge) {
         super({
             code: "credential_rejected",
-            message: vault === undefined
-                ? `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's vaults hold none for it`
-                : `The MCP server '${server}' answered HTTP 401: it rejected the credential from the ${vault} vault`,
+            message: sent
+                ? `The MCP server '${server}' answered HTTP 401: it rejected the credential from the session's Environment`
+                : `The MCP server '${server}' answered HTTP 401: it needs a credential, and the session's Environment holds none for it`,
             sent: true,
             retryable: false,
             server,
-            ...(vault === undefined ? {} : { vault }),
         });
         this.server = server;
-        this.vault = vault;
+        this.sent = sent;
         this.challenge = challenge;
         this.name = "CredentialRejected";
     }
@@ -106,18 +104,26 @@ export function unreachable(server, error) {
 }
 /** The operation a request of the transport's fetch belongs to. */
 const tracking = new AsyncLocalStorage();
-function tracked(call, run) {
+function tracked(call, run, traceparent) {
     const tracker = {
         secrets: new Set(),
         sent: false,
         settled: false,
         ...(call ? { calling: new AbortController() } : {}),
+        ...(traceparent ? { traceparent } : {}),
     };
     return tracking.run(tracker, () => run(tracker));
 }
+/**
+ * Where a `tools/call` carries its key (R5.5): MCP has no standard key field, and `_meta` is the
+ * spec's place for extra request data. The key is the call's effect id, the same on every send,
+ * so a server that reads it can run the call once.
+ */
+export const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
 /**
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
- * with them (R2b C8), and a failed call is an `McpCallFailed` (C7).
+ * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
+ * `_meta` (R5.5).
  */
 export function sdkClient(client, serverName) {
     return {
@@ -133,7 +139,10 @@ export function sdkClient(client, serverName) {
         callTool: (params, options) => tracked(true, async (tracker) => {
             const lost = tracker.calling.signal;
             try {
-                const result = (await client.callTool(params, undefined, {
+                const keyed = options?.key === undefined
+                    ? params
+                    : { ...params, _meta: { [IDEMPOTENCY_META_KEY]: options.key } };
+                const result = (await client.callTool(keyed, undefined, {
                     signal: options?.signal ? AbortSignal.any([options.signal, lost]) : lost,
                 }));
                 // An answer the stream did not count (an `sse` server answers on its event stream).
@@ -151,7 +160,7 @@ export function sdkClient(client, serverName) {
             finally {
                 tracker.settled = true;
             }
-        }),
+        }, options?.traceparent),
     };
 }
 export async function openMcpServer(input) {
@@ -275,9 +284,7 @@ export async function listMcpTools(client, input) {
             continue;
         const { tool, inputSchema } = candidate;
         const outputSchema = tool.outputSchema ? usableSchema(tool.outputSchema) : undefined;
-        const annotations = retryHints(tool.annotations);
         tools.push({
-            capabilityId: input.capabilityId,
             serverName: input.serverName,
             serverToolName: tool.name,
             name,
@@ -286,7 +293,6 @@ export async function listMcpTools(client, input) {
                 : {}),
             inputSchema,
             ...(outputSchema === undefined ? {} : { outputSchema }),
-            ...(annotations === undefined ? {} : { annotations }),
         });
     }
     return { tools, omitted, renamed, disabled, unknownTools };
@@ -307,6 +313,7 @@ export async function callMcpTool(client, serverToolName, args, options = {}) {
         }, {
             ...(options.key === undefined ? {} : { key: options.key }),
             ...(options.signal ? { signal: options.signal } : {}),
+            ...(options.traceparent === undefined ? {} : { traceparent: options.traceparent }),
         });
     }
     catch (error) {
@@ -315,11 +322,7 @@ export async function callMcpTool(client, serverToolName, args, options = {}) {
         // The connection's to handle: its holder opens it again and sends the call once more.
         if (error instanceof McpConnectionStale)
             throw error;
-        // Sent, then lost: the tool may have run. Calling it again is the model's choice only for a
-        // tool the server says is safe to repeat; any other waits for an operator.
-        if (error.code === "mcp.lost" && !options.retrySafe)
-            throw new Error(error.message);
-        // Otherwise the outcome is known: the model sees it.
+        // The model sees it, `mcp.lost` included: sent, then lost, so the tool may have run (R5).
         return error.outcome();
     }
     const { result } = answer;
@@ -349,14 +352,13 @@ function onlyText(content) {
     return (Array.isArray(content) &&
         content.every((part) => !!part && typeof part === "object" && part.type === "text"));
 }
-export function diagnosticFromError(capabilityId, serverName, error) {
+export function diagnosticFromError(serverName, error) {
     const credentialIds = error && typeof error === "object" && "credentialIds" in error
         ? error.credentialIds
         : undefined;
     const refused = error instanceof Error && error.message.startsWith("MCP authorization refused");
     if (refused) {
         return {
-            capabilityId,
             serverName,
             outcome: "refused",
             message: error.message,
@@ -370,7 +372,6 @@ export function diagnosticFromError(capabilityId, serverName, error) {
         code === 401 ||
         (error instanceof Error && /\b401\b/.test(error.message));
     return {
-        capabilityId,
         serverName,
         outcome: "failed",
         message: unauthorized
@@ -418,6 +419,9 @@ function authorizedFetch(server, endpoint, authorize, policy) {
             for (const [key, value] of Object.entries(result.headers))
                 headers.set(key, value);
         const tracker = tracking.getStore();
+        // The tool call's span (R7.4): per request, so a pooled connection carries each call's own.
+        if (tracker?.traceparent)
+            headers.set("traceparent", tracker.traceparent);
         if (tracker && result.status === "authorized")
             for (const secret of credentialSecrets(result.headers, result.identity))
                 tracker.secrets.add(secret);
@@ -436,7 +440,7 @@ function authorizedFetch(server, endpoint, authorize, policy) {
             tracker.sent = true;
         if (response.status === 401) {
             await response.body?.cancel().catch(() => undefined);
-            throw new CredentialRejected(server.name, result.status === "authorized" ? result.vault : undefined, response.headers.get("www-authenticate") ?? undefined);
+            throw new CredentialRejected(server.name, result.status === "authorized", response.headers.get("www-authenticate") ?? undefined);
         }
         // The server ended the connection's session: the tool never saw the request.
         if (post && response.status === 404 && headers.has("mcp-session-id")) {
@@ -622,14 +626,6 @@ function rpcErrorOf(body) {
     }
     return undefined;
 }
-/** The hints that calling a tool again is safe, when the server gives any. */
-function retryHints(annotations) {
-    const readOnly = annotations?.readOnlyHint === true;
-    const idempotent = annotations?.idempotentHint === true;
-    if (!readOnly && !idempotent)
-        return undefined;
-    return { ...(readOnly ? { readOnlyHint: true } : {}), ...(idempotent ? { idempotentHint: true } : {}) };
-}
 function sameOrigin(requestUrl, serverUrl) {
     try {
         return new URL(requestUrl).origin === new URL(serverUrl).origin;

package/dist/mcp/pool.d.ts

@@ -51,15 +51,14 @@ export declare class McpPool {
     call(input: {
         sessionId: string;
         agentId?: string;
-        capabilityId: string;
         serverName: string;
         serverToolName: string;
         args: unknown;
         manifest: AgentManifest;
         /** The effect id: a gate runs the call once under it (F4.1). */
         effectId?: string;
-        /** The tool is read-only or idempotent: a lost answer is the model's to retry (R2b C7). */
-        retrySafe?: boolean;
+        /** The call's span context (R7.4), sent as `traceparent` on a connection this process holds. */
+        traceparent?: string;
         signal?: AbortSignal;
     }): Promise<McpToolOutcome>;
     /** The session's connection to the server, opened when there is none, or why it cannot be. */
@@ -85,7 +84,6 @@ export interface McpServerRef {
     readonly sessionId: string;
     /** The agent used as a tool that declares the server; absent for the session's root agent. */
     readonly agentId?: string;
-    readonly capabilityId: string;
     readonly serverName: string;
 }
 export interface DeclaredServer {
@@ -93,9 +91,8 @@ export interface DeclaredServer {
     readonly agentId?: string;
     /** The manifest of the agent that declares the server. */
     readonly manifest: AgentManifest;
-    readonly capabilityId: string;
     readonly server: McpServerManifest;
 }
 /** Servers of the root agent, then of each agent it uses as a tool. */
 export declare function serversOf(manifest: AgentManifest): DeclaredServer[];
-export declare function findServer(manifest: AgentManifest, agentId: string | undefined, capabilityId: string, serverName: string): DeclaredServer | undefined;
+export declare function findServer(manifest: AgentManifest, agentId: string | undefined, serverName: string): DeclaredServer | undefined;

package/dist/mcp/pool.js

@@ -34,7 +34,6 @@ export class McpPool {
                 if (!taken.has(declared.agentId))
                     taken.set(declared.agentId, declaredToolNames(declared.manifest));
                 const listed = await listMcpTools(opened.connection.client, {
-                    capabilityId: declared.capabilityId,
                     serverName: declared.server.name,
                     taken: taken.get(declared.agentId),
                     server: declared.server,
@@ -43,13 +42,11 @@ export class McpPool {
                 tools.push(...listed.tools.map((tool) => owned(declared, tool)));
                 if (opened.connection.instructions)
                     notes.push(owned(declared, {
-                        capabilityId: declared.capabilityId,
                         serverName: declared.server.name,
                         instructions: opened.connection.instructions,
                     }));
                 diagnostics.push({
                     ...ownerOf(declared),
-                    capabilityId: declared.capabilityId,
                     serverName: declared.server.name,
                     outcome: "connected",
                     message: [
@@ -67,7 +64,7 @@ export class McpPool {
             }
             catch (error) {
                 await opened.connection.close().catch(() => { });
-                diagnostics.push(owned(declared, diagnosticFromError(declared.capabilityId, declared.server.name, error)));
+                diagnostics.push(owned(declared, diagnosticFromError(declared.server.name, error)));
             }
         }
         return {
@@ -84,7 +81,7 @@ export class McpPool {
         const diagnostics = [];
         const seen = new Set();
         for (const tool of input.tools) {
-            const key = this.liveKey(input.sessionId, tool.agentId, tool.capabilityId, tool.serverName);
+            const key = this.liveKey(input.sessionId, tool.agentId, tool.serverName);
             if (seen.has(key))
                 continue;
             seen.add(key);
@@ -95,11 +92,10 @@ export class McpPool {
                 continue;
             }
             input.signal?.throwIfAborted();
-            const declared = findServer(input.manifest, tool.agentId, tool.capabilityId, tool.serverName);
+            const declared = findServer(input.manifest, tool.agentId, tool.serverName);
             if (!declared) {
                 diagnostics.push({
                     ...(tool.agentId === undefined ? {} : { agentId: tool.agentId }),
-                    capabilityId: tool.capabilityId,
                     serverName: tool.serverName,
                     outcome: "failed",
                     message: "Declared MCP server is missing from the pinned manifest",
@@ -116,7 +112,7 @@ export class McpPool {
         return diagnostics;
     }
     async call(input) {
-        const key = this.liveKey(input.sessionId, input.agentId, input.capabilityId, input.serverName);
+        const key = this.liveKey(input.sessionId, input.agentId, input.serverName);
         for (let attempt = 0;; attempt += 1) {
             const live = await this.liveFor(input, key);
             // No connection, so no call was sent: the model sees why, a 401 included (R2b C1, C7).
@@ -126,8 +122,8 @@ export class McpPool {
             try {
                 return await callMcpTool(live.connection.client, input.serverToolName, input.args, {
                     ...(input.effectId === undefined ? {} : { key: input.effectId }),
-                    ...(input.retrySafe ? { retrySafe: true } : {}),
                     ...(input.signal ? { signal: input.signal } : {}),
+                    ...(input.traceparent === undefined ? {} : { traceparent: input.traceparent }),
                 });
             }
             catch (error) {
@@ -152,7 +148,7 @@ export class McpPool {
         const live = this.live.get(key);
         if (live)
             return live;
-        const declared = findServer(input.manifest, input.agentId, input.capabilityId, input.serverName);
+        const declared = findServer(input.manifest, input.agentId, input.serverName);
         if (!declared)
             throw new Error(`MCP server '${input.serverName}' is not declared`);
         let opening = this.opening.get(key);
@@ -196,7 +192,7 @@ export class McpPool {
     }
     /** Keeps the connection, or closes it when the server is already connected for the session. */
     remember(sessionId, declared, connection) {
-        const key = this.liveKey(sessionId, declared.agentId, declared.capabilityId, declared.server.name);
+        const key = this.liveKey(sessionId, declared.agentId, declared.server.name);
         const existing = this.live.get(key);
         if (existing) {
             if (existing.connection !== connection)
@@ -204,7 +200,6 @@ export class McpPool {
             return existing;
         }
         const live = {
-            capabilityId: declared.capabilityId,
             serverName: declared.server.name,
             connection,
             lastUsedAt: this.now(),
@@ -213,8 +208,8 @@ export class McpPool {
         this.live.set(key, live);
         return live;
     }
-    liveKey(sessionId, agentId, capabilityId, serverName) {
-        return JSON.stringify([sessionId, agentId ?? null, capabilityId, serverName]);
+    liveKey(sessionId, agentId, serverName) {
+        return JSON.stringify([sessionId, agentId ?? null, serverName]);
     }
     async connectDeclared(input, declared) {
         try {
@@ -222,7 +217,6 @@ export class McpPool {
                 const connection = await this.options.openRemote({
                     sessionId: input.sessionId,
                     ...ownerOf(declared),
-                    capabilityId: declared.capabilityId,
                     serverName: declared.server.name,
                 });
                 return { ok: true, connection };
@@ -242,7 +236,7 @@ export class McpPool {
             return {
                 ok: false,
                 error,
-                diagnostic: owned(declared, diagnosticFromError(declared.capabilityId, declared.server.name, error)),
+                diagnostic: owned(declared, diagnosticFromError(declared.server.name, error)),
             };
         }
     }
@@ -251,24 +245,16 @@ export class McpPool {
 export function serversOf(manifest) {
     const servers = [];
     const add = (agent, agentId) => {
-        for (const capability of agent.capabilities)
-            for (const server of Object.values(capability.mcpServers ?? {}))
-                servers.push({
-                    ...(agentId === undefined ? {} : { agentId }),
-                    manifest: agent,
-                    capabilityId: capability.id,
-                    server,
-                });
+        for (const server of Object.values(agent.mcpServers ?? {}))
+            servers.push({ ...(agentId === undefined ? {} : { agentId }), manifest: agent, server });
     };
     add(manifest);
     for (const child of delegatesOf(manifest))
         add(child.manifest, child.manifest.id);
     return servers;
 }
-export function findServer(manifest, agentId, capabilityId, serverName) {
-    return serversOf(manifest).find((item) => item.agentId === agentId &&
-        item.capabilityId === capabilityId &&
-        item.server.name === serverName);
+export function findServer(manifest, agentId, serverName) {
+    return serversOf(manifest).find((item) => item.agentId === agentId && item.server.name === serverName);
 }
 function ownerOf(declared) {
     return declared.agentId === undefined ? {} : { agentId: declared.agentId };

package/dist/mcp/preview.d.ts

@@ -1,9 +1,9 @@
 /**
  * A remote MCP server's tools before an agent names it (R2b C12, `POST /v1/tenant/mcp/preview`,
- * `nylorun mcp inspect`, Studio's Credentials page). It runs where plaintext credentials live:
+ * `nylorun mcp inspect`, an Environment's Secrets tab in Studio). It runs where plaintext credentials live:
  * the keys service (`keys/keys.ts`, `previewMcp`), in the gateway or in process.
  *
- * One connection: `initialize` and `tools/list` with the installation vault's credential for the
+ * One connection: `initialize` and `tools/list` with the Environment's credential for the
  * URL (its headers, and its `via`), under the Host's address policy, within 15 s; then it closes.
  * It never calls a tool, and sends no identity header: no person asked. A server that answers
  * `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any,
@@ -16,7 +16,7 @@ import { openMcpServer } from "./connect.js";
 /** How long a preview may take, `initialize` and every `tools/list` page together. */
 export declare const MCP_PREVIEW_TIMEOUT_MS = 15000;
 export interface McpPreviewOptions {
-    readonly vault: Pick<VaultService, "authorize" | "getVault" | "listVaults">;
+    readonly vault: Pick<VaultService, "authorize" | "listEnvironmentSecrets">;
     /** The Host's address policy for developer URLs (`TenantConfig.delivery`). */
     readonly policy: OutboundPolicy;
     /** Default `MCP_PREVIEW_TIMEOUT_MS`. */

package/dist/mcp/preview.js

@@ -1,15 +1,15 @@
 /**
  * A remote MCP server's tools before an agent names it (R2b C12, `POST /v1/tenant/mcp/preview`,
- * `nylorun mcp inspect`, Studio's Credentials page). It runs where plaintext credentials live:
+ * `nylorun mcp inspect`, an Environment's Secrets tab in Studio). It runs where plaintext credentials live:
  * the keys service (`keys/keys.ts`, `previewMcp`), in the gateway or in process.
  *
- * One connection: `initialize` and `tools/list` with the installation vault's credential for the
+ * One connection: `initialize` and `tools/list` with the Environment's credential for the
  * URL (its headers, and its `via`), under the Host's address policy, within 15 s; then it closes.
  * It never calls a tool, and sends no identity header: no person asked. A server that answers
  * `401` is `authRequired`, with its RFC 9728 protected-resource metadata when it publishes any,
  * read under the same policy. No credential value sent is in the answer (`scrubValues`, C8).
  */
-import { INSTALLATION_OWNER, McpPreviewRequestSchema, } from "@nylorun/core/contracts";
+import { McpPreviewRequestSchema, } from "@nylorun/core/contracts";
 import { scrubValues } from "../redact.js";
 import { HttpError } from "../tenant/http.js";
 import { guardedFetch, OutboundRefused } from "../tenant/outbound.js";
@@ -72,7 +72,6 @@ export async function previewMcpServer(body, options) {
             callTool: () => Promise.reject(new Error("A preview never calls a tool")),
         };
         const listed = await listMcpTools(listing, {
-            capabilityId: "preview",
             serverName: name,
             taken: new Set(),
             signal,
@@ -119,28 +118,18 @@ export async function previewMcpServer(body, options) {
     }
 }
 /**
- * The installation vault credential for the URL: from `vaultId`, else from every installation
- * vault. None is a preview without one; two or more without `vaultId` is a refusal that names
- * them.
+ * The credential of Environment `environmentId`'s vault for the URL; none without an
+ * Environment (a preview without a credential). An Environment that does not exist is a 404.
  */
 async function credentialFor(vault, request) {
-    let vaultIds;
-    if (request.vaultId !== undefined) {
-        const found = await vault.getVault(request.vaultId);
-        if (found.ownerUserId !== INSTALLATION_OWNER)
-            throw new VaultError(400, "A preview uses an installation vault's credential: no person asked for it");
-        vaultIds = [found.id];
-    }
-    else
-        vaultIds = (await vault.listVaults(undefined, { installation: true })).map((found) => found.id);
-    if (vaultIds.length === 0)
+    if (request.environmentId === undefined)
         return { status: "unauthenticated", url: request.url, headers: {} };
-    const result = await vault.authorize({ vaultIds, credentialSelections: [], url: request.url });
+    // The 404 of a missing Environment, before any request leaves.
+    await vault.listEnvironmentSecrets(request.environmentId);
+    const result = await vault.authorize({ environmentId: request.environmentId, url: request.url });
     if (result.status !== "refused")
         return result;
-    throw new HttpError(409, result.reason === "ambiguous"
-        ? "Several installation vaults hold a credential for this URL: name one with vaultId"
-        : `The installation vault's credential for this URL cannot be used (${result.reason})`, { code: "request_rejected", details: { reason: result.reason, credentialIds: result.credentialIds } });
+    throw new HttpError(409, `Environment ${request.environmentId}'s credential for this URL cannot be used (${result.reason})`, { code: "request_rejected", details: { reason: result.reason, credentialIds: result.credentialIds } });
 }
 /** A preview that listed nothing: `mcp_preview_failed`, with the code a tool call would have had. */
 function failed(server, error, signal, secrets, timeoutMs) {