@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/vault/service.d.ts

@@ -1,12 +1,15 @@
-import type { CreateCredentialRequest, CreateVaultRequest, CredentialIdentity, CredentialInfo, CredentialSelection, HostModelProviderInfo, HostModelView, PutHostModelRequest, CustomModelSettings, RotateCredentialRequest, SelectHostModelRequest, VaultInfo } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretView, HostModelProviderInfo, HostModelView, PutEnvironmentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
 export type HostModelSecret = {
     provider: string;
     model: string;
     baseUrl?: string;
-    /** A custom endpoint's window, output limit, reasoning and pi-ai compat (Model Calls §7). */
+    /** A custom endpoint's window, output limit, reasoning, inputs and pi-ai compat (Model Calls §7). */
     settings?: CustomModelSettings;
+    /** The inputs the operator added to catalog models, by `<provider>/<model>` (protocol 12). */
+    addedInputs?: Readonly<Record<string, readonly ModelInput[]>>;
     authType: "api_key" | "oauth";
     credential: {
         type: "api_key" | "oauth";
@@ -18,6 +21,28 @@ export type HostModelSecret = {
         [key: string]: unknown;
     };
 };
+type UserCredentialRow = VaultCredentialRow & {
+    type: "bearer" | "headers" | "environment_secret" | "environment_variable";
+};
+/**
+ * A fork's secrets sealed for its new vault (`sealEnvironmentSecretCopies`): each copy's
+ * ciphertext, base64 so it crosses the keys service's JSON, and what about it is not secret.
+ */
+export interface SealedSecretCopies {
+    readonly copies: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly type: UserCredentialRow["type"];
+        readonly bindingJson: string;
+        readonly expiresAt: string | null;
+        readonly kekId: string;
+        readonly nonce: string;
+        readonly ciphertext: string;
+        readonly wrappedDek: string;
+    }[];
+    /** Names left behind: no slot of the fork declares them, or their slot cannot take the value. */
+    readonly dropped: readonly string[];
+}
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -31,8 +56,6 @@ export type AuthorizeResult = {
     via?: string;
     /** The header that names the session owner; `sessionCredentials` adds it. */
     identity?: CredentialIdentity;
-    /** The scope of the vault the credential is in. */
-    vault: "installation" | "user";
 } | {
     status: "refused";
     url: string;
@@ -48,54 +71,64 @@ export declare class VaultService {
     private readonly store;
     private readonly kek;
     constructor(options: VaultServiceOptions);
-    createVault(body: CreateVaultRequest): Promise<VaultInfo>;
     /**
-     * One person's vaults, then (with `installation`) the installation vaults. No owner lists
-     * the installation vaults only.
+     * Creates Environment `environmentId`'s vault (D56), in the transaction that creates it; answers
+     * its id, `id` when given (a fork's, whose secrets were sealed for it first).
      */
-    listVaults(ownerUserId: string | undefined, options?: {
-        installation?: boolean;
-    }): Promise<VaultInfo[]>;
-    getVault(id: string): Promise<VaultInfo>;
-    deleteVault(id: string): Promise<{
-        id: string;
-    }>;
-    createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>;
-    listCredentials(vaultId: string): Promise<CredentialInfo[]>;
-    getCredential(vaultId: string, id: string): Promise<CredentialInfo>;
-    rotateCredential(vaultId: string, id: string, body: RotateCredentialRequest): Promise<CredentialInfo>;
-    deleteCredential(vaultId: string, id: string): Promise<{
-        id: string;
+    createEnvironmentVault(t: Tx, environmentId: string, actor: string, id?: string): Promise<string>;
+    /**
+     * Deletes Environment `environmentId`'s vault and its credentials, with their audit rows, in
+     * the transaction that deletes the Environment: no release or tool call finds them after it
+     * commits.
+     */
+    deleteEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>;
+    /**
+     * Seals Environment `from`'s secrets again for vault `vaultId`, a fork's new vault (Q15): each
+     * value is unsealed and sealed under the new vault's and credential's ids, which its AAD binds.
+     * Needs the vault key, so callers reach it through `Keys`; it reads `from` in its own
+     * transaction and writes nothing. With `slots` (what the fork runs declares secret slots, D64),
+     * only the names it declares are sealed, each with its slot's binding; a value the slot's type
+     * cannot take is left behind. The fork's transaction inserts the copies
+     * (`insertEnvironmentSecretCopies`).
+     */
+    sealEnvironmentSecretCopies(from: string, vaultId: string, slots?: Readonly<Record<string, Record<string, unknown>>> | null): Promise<SealedSecretCopies>;
+    /**
+     * Inserts a fork's sealed copies (`sealEnvironmentSecretCopies`) into vault `vaultId`, in the
+     * transaction that creates the fork, with an audit row each naming `from`. Reads no secret.
+     */
+    insertEnvironmentSecretCopies(t: Tx, vaultId: string, from: string, actor: string, sealed: SealedSecretCopies): Promise<{
+        copied: string[];
+        dropped: string[];
     }>;
     /**
-     * Checks a session's vaults and selections. Run in the session PUT transaction. `opaque`
-     * (a request acting for a subject) reports another owner's vault as the 404 of a missing one.
+     * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
+     * name and type keeps the credential's id and re-seals its value and binding; another type
+     * replaces it. Refused (`409 credential_conflict`) when another credential of the vault is
+     * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
+     * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: {
-        opaque?: boolean;
-    }): Promise<void>;
-    /** Writes the `attach` audit row. Run in the session PUT transaction. */
-    recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
+    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
+    /** The Environment's secrets: names, types and bindings, never values. */
+    listEnvironmentSecrets(environmentId: string): Promise<EnvironmentSecretView[]>;
+    getEnvironmentSecret(environmentId: string, name: string): Promise<EnvironmentSecretView>;
+    deleteEnvironmentSecret(environmentId: string, name: string, actor: string): Promise<{
+        id: string;
+    }>;
     /**
      * The variables a session's sandbox commands get (R2c, D50): each `environment_secret`'s name
-     * set to the sentinel, each `environment_variable`'s value, and each host a secret is bound to
-     * with that secret's credential id. `conflict` says why they are ambiguous: two credentials with one variable name, or two
-     * secrets bound to one host. Reads rows only; no plaintext. Run in the caller's transaction.
+     * set to the sentinel, and each `environment_variable`'s value, from the Environment's vault.
+     * Reads rows only; no plaintext. Run in the caller's transaction.
      */
-    sessionEnvironment(t: Tx, vaultIds: readonly string[]): Promise<{
-        environment: Record<string, string>;
-        secretHosts: Record<string, string>;
-        conflict?: string;
-    }>;
+    environmentVariables(t: Tx, environmentId: string | undefined): Promise<Record<string, string>>;
     /**
-     * The header egress-gate sets on a request from `sandboxId` to `host` (R2c, D50): the
-     * `environment_secret` bound to `host` among the vaults of the sessions using the sandbox, its
-     * value unsealed and rendered into its format. `none` when no secret is bound to the host;
-     * `refused` when two are, or the sealed value cannot be read. One query and one unseal per
-     * call; nothing is cached (E3). Plaintext exists only in the returned header.
+     * The header egress-gate sets on a request from Environment `environmentId`'s sandbox to
+     * `host` (R2c, D50): the `environment_secret` of its vault bound to `host`, its value unsealed
+     * and rendered into its format. `none` when no secret is bound to the host; `refused` when the
+     * sealed value cannot be read. One query and one unseal per call; nothing is cached (E3).
+     * Plaintext exists only in the returned header.
      */
     releaseEnvironmentSecret(input: {
-        sandboxId: string;
+        environmentId: string;
         host: string;
     }): Promise<{
         status: "none";
@@ -108,16 +141,24 @@ export declare class VaultService {
         status: "refused";
         reason: "ambiguous" | "unreadable";
     }>;
-    /** Whether any `environment_secret` of the sessions using `sandboxId` is bound to `host`. */
-    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** Whether an `environment_secret` of Environment `environmentId` is bound to `host`. */
+    environmentSecretBound(environmentId: string, host: string): Promise<boolean>;
+    /**
+     * The headers a request to `url` carries: the credential of the Environment's vault bound to
+     * it, or none (`unauthenticated`) without an Environment or such a credential.
+     */
     authorize(input: {
         /** The session the request is made for; absent for a tool preview (R2b C12). */
         sessionId?: string;
-        vaultIds: readonly string[];
-        credentialSelections: readonly CredentialSelection[];
+        environmentId?: string;
         url: string;
-        serverName?: string;
     }): Promise<AuthorizeResult>;
+    /**
+     * What a session that names `request.environmentId` would send for each URL `manifest` names
+     * (`credentialNeeds`), decided as `authorize` decides a call: the credential of the
+     * Environment's vault bound to the URL. Reads no secret, writes no audit row.
+     */
+    coverage(manifest: AgentManifest | WorkflowManifest, request: CredentialCoverageRequest): Promise<CredentialCoverage>;
     getHostModel(): Promise<HostModelView>;
     listHostProviders(): Promise<{
         providers: HostModelProviderInfo[];
@@ -127,14 +168,17 @@ export declare class VaultService {
     private replay;
     /** Re-seals a user credential's payload with its new binding and returns the updated row. */
     private writePayload;
-    private vaultInfo;
+    /**
+     * The vault of a live Environment (not being deleted), or the 404 of a missing one. With
+     * `lock`, the Environment's row is locked until the transaction ends.
+     */
+    private environmentVault;
     private ensureHostVault;
     private validateHostModel;
     private insertHostCredential;
     private hostModelView;
     private setActiveProvider;
     private deleteHostProviderRows;
-    private credentialRow;
     private audit;
 }
 /** The host vault's model credential rows that parse. */