@nylorun/runtime 0.24.0-beta → 0.25.0-beta

package/dist/vault/host-model.d.ts

@@ -17,7 +17,10 @@ export declare class HostModelVault {
     private readonly store;
     private readonly kek;
     constructor(options: HostModelVaultOptions);
-    /** Reads the active host model secret. Decrypts after the read commits. */
+    /**
+     * Reads the active host model secret, with the inputs the operator added to catalog models
+     * (protocol 12). Decrypts after the read commits.
+     */
     readHostModel(): Promise<HostModelSecret | undefined>;
     /** Replaces the active host model's secret, keeping its binding. */
     updateHostCredential(credential: {

package/dist/vault/host-model.js

@@ -1,3 +1,4 @@
+import { readAddedInputs } from "../tenant/model-setting.js";
 import { encryptSecret } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { activeHostCredentialRow, HOST_VAULT_ID, hostModelAad, modelBinding, readHostPayload, } from "./service.js";
@@ -8,9 +9,15 @@ export class HostModelVault {
         this.store = options.store;
         this.kek = options.kek;
     }
-    /** Reads the active host model secret. Decrypts after the read commits. */
+    /**
+     * Reads the active host model secret, with the inputs the operator added to catalog models
+     * (protocol 12). Decrypts after the read commits.
+     */
     async readHostModel() {
-        const row = await this.store.tx((t) => activeHostCredentialRow(t));
+        const { row, addedInputs } = await this.store.tx(async (t) => ({
+            row: await activeHostCredentialRow(t),
+            addedInputs: await readAddedInputs(t),
+        }));
         if (!row)
             return undefined;
         const binding = modelBinding(row);
@@ -27,6 +34,7 @@ export class HostModelVault {
             model: binding.model,
             ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
             ...(binding.settings ? { settings: binding.settings } : {}),
+            addedInputs,
             authType: binding.authType,
             credential,
         };

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretView, HostModelProviderInfo, HostModelView, PutEnvironmentSecretRequest, PutHostModelRequest, CustomModelSettings, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretView, HostModelProviderInfo, HostModelView, PutEnvironmentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -6,8 +6,10 @@ export type HostModelSecret = {
     provider: string;
     model: string;
     baseUrl?: string;
-    /** A custom endpoint's window, output limit, reasoning and pi-ai compat (Model Calls §7). */
+    /** A custom endpoint's window, output limit, reasoning, inputs and pi-ai compat (Model Calls §7). */
     settings?: CustomModelSettings;
+    /** The inputs the operator added to catalog models, by `<provider>/<model>` (protocol 12). */
+    addedInputs?: Readonly<Record<string, readonly ModelInput[]>>;
     authType: "api_key" | "oauth";
     credential: {
         type: "api_key" | "oauth";
@@ -19,6 +21,28 @@ export type HostModelSecret = {
         [key: string]: unknown;
     };
 };
+type UserCredentialRow = VaultCredentialRow & {
+    type: "bearer" | "headers" | "environment_secret" | "environment_variable";
+};
+/**
+ * A fork's secrets sealed for its new vault (`sealEnvironmentSecretCopies`): each copy's
+ * ciphertext, base64 so it crosses the keys service's JSON, and what about it is not secret.
+ */
+export interface SealedSecretCopies {
+    readonly copies: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly type: UserCredentialRow["type"];
+        readonly bindingJson: string;
+        readonly expiresAt: string | null;
+        readonly kekId: string;
+        readonly nonce: string;
+        readonly ciphertext: string;
+        readonly wrappedDek: string;
+    }[];
+    /** Names left behind: no slot of the fork declares them, or their slot cannot take the value. */
+    readonly dropped: readonly string[];
+}
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -47,14 +71,35 @@ export declare class VaultService {
     private readonly store;
     private readonly kek;
     constructor(options: VaultServiceOptions);
-    /** Creates Environment `environmentId`'s vault (D56), in the transaction that creates it. */
-    createEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>;
+    /**
+     * Creates Environment `environmentId`'s vault (D56), in the transaction that creates it; answers
+     * its id, `id` when given (a fork's, whose secrets were sealed for it first).
+     */
+    createEnvironmentVault(t: Tx, environmentId: string, actor: string, id?: string): Promise<string>;
     /**
      * Deletes Environment `environmentId`'s vault and its credentials, with their audit rows, in
      * the transaction that deletes the Environment: no release or tool call finds them after it
      * commits.
      */
     deleteEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>;
+    /**
+     * Seals Environment `from`'s secrets again for vault `vaultId`, a fork's new vault (Q15): each
+     * value is unsealed and sealed under the new vault's and credential's ids, which its AAD binds.
+     * Needs the vault key, so callers reach it through `Keys`; it reads `from` in its own
+     * transaction and writes nothing. With `slots` (what the fork runs declares secret slots, D64),
+     * only the names it declares are sealed, each with its slot's binding; a value the slot's type
+     * cannot take is left behind. The fork's transaction inserts the copies
+     * (`insertEnvironmentSecretCopies`).
+     */
+    sealEnvironmentSecretCopies(from: string, vaultId: string, slots?: Readonly<Record<string, Record<string, unknown>>> | null): Promise<SealedSecretCopies>;
+    /**
+     * Inserts a fork's sealed copies (`sealEnvironmentSecretCopies`) into vault `vaultId`, in the
+     * transaction that creates the fork, with an audit row each naming `from`. Reads no secret.
+     */
+    insertEnvironmentSecretCopies(t: Tx, vaultId: string, from: string, actor: string, sealed: SealedSecretCopies): Promise<{
+        copied: string[];
+        dropped: string[];
+    }>;
     /**
      * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
      * name and type keeps the credential's id and re-seals its value and binding; another type

package/dist/vault/service.js

@@ -9,9 +9,15 @@
  * new VaultService({ store: SessionStore, kek: () => Buffer })
  *
  * // An Environment's vault, in the caller's transaction (`tenant/environments.ts`).
- * createEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>
+ * createEnvironmentVault(t: Tx, environmentId: string, actor: string, id?: string): Promise<string>
  * deleteEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>
  *
+ * // A fork's secrets (Q15): `Keys` seals the copies with the vault key in its own transaction,
+ * // before the fork's; the fork's transaction inserts them, so the process that forks never
+ * // holds the key.
+ * sealEnvironmentSecretCopies(from, vaultId, slots | null): Promise<SealedSecretCopies>
+ * insertEnvironmentSecretCopies(t: Tx, vaultId, from, actor, sealed): Promise<{ copied; dropped }>
+ *
  * // Its secrets (`/v1/environments/{id}/secrets`): each opens its own transaction and writes its
  * // audit rows in it. A put needs the vault key, so callers reach it through `Keys`.
  * putEnvironmentSecret(environmentId, name, body: PutEnvironmentSecretRequest, actor): Promise<EnvironmentSecretView>
@@ -78,7 +84,9 @@ import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { credentialNeeds } from "./coverage.js";
 import { checkCredentialHeaders } from "./headers.js";
-import { hostModelCatalog } from "../model/catalog.js";
+import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
+import { inputsError } from "../model/capabilities.js";
+import { readAddedInputs } from "../tenant/model-setting.js";
 import { normalizeVaultUrl } from "./url.js";
 export const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
@@ -90,10 +98,13 @@ export class VaultService {
         this.kek = options.kek;
     }
     // --- an Environment's vault (caller's transaction) ------------------------------
-    /** Creates Environment `environmentId`'s vault (D56), in the transaction that creates it. */
-    async createEnvironmentVault(t, environmentId, actor) {
+    /**
+     * Creates Environment `environmentId`'s vault (D56), in the transaction that creates it; answers
+     * its id, `id` when given (a fork's, whose secrets were sealed for it first).
+     */
+    async createEnvironmentVault(t, environmentId, actor, id = randomUUID()) {
         const row = {
-            id: randomUUID(),
+            id,
             name: environmentId,
             metadataJson: null,
             createdAt: new Date().toISOString(),
@@ -101,6 +112,7 @@ export class VaultService {
         };
         await t.insertVault(row);
         await this.audit(t, { actor, action: "create", vaultId: row.id, target: environmentId, outcome: "created" });
+        return row.id;
     }
     /**
      * Deletes Environment `environmentId`'s vault and its credentials, with their audit rows, in
@@ -123,6 +135,100 @@ export class VaultService {
         await t.deleteVault(vault.id);
         await this.audit(t, { actor, action: "delete", vaultId: vault.id, target: environmentId, outcome: "deleted" });
     }
+    /**
+     * Seals Environment `from`'s secrets again for vault `vaultId`, a fork's new vault (Q15): each
+     * value is unsealed and sealed under the new vault's and credential's ids, which its AAD binds.
+     * Needs the vault key, so callers reach it through `Keys`; it reads `from` in its own
+     * transaction and writes nothing. With `slots` (what the fork runs declares secret slots, D64),
+     * only the names it declares are sealed, each with its slot's binding; a value the slot's type
+     * cannot take is left behind. The fork's transaction inserts the copies
+     * (`insertEnvironmentSecretCopies`).
+     */
+    async sealEnvironmentSecretCopies(from, vaultId, slots) {
+        const kek = this.kek();
+        const rows = await this.store.tx(async (t) => {
+            const source = await t.vaultOfEnvironment(from);
+            return source ? (await t.credentialsForVault(source.id)).filter(isUserCredential) : [];
+        });
+        const sealed = [];
+        const dropped = [];
+        const now = new Date().toISOString();
+        for (const row of rows) {
+            const payload = readPayload(kek, row);
+            let type = row.type;
+            let binding = credentialBinding(row);
+            let value = payload;
+            if (slots) {
+                const slot = slots[row.name];
+                const rebound = slot === undefined ? undefined : rebind(row.name, slot, row, payload, binding);
+                if (rebound === undefined) {
+                    dropped.push(row.name);
+                    continue;
+                }
+                ({ type, binding, payload: value } = rebound);
+                try {
+                    conflictOf(type, binding, sealed);
+                }
+                catch (error) {
+                    if (!(error instanceof VaultError))
+                        throw error;
+                    dropped.push(row.name);
+                    continue;
+                }
+            }
+            const id = randomUUID();
+            sealed.push({
+                id,
+                vaultId,
+                name: row.name,
+                type,
+                bindingJson: JSON.stringify(binding),
+                expiresAt: row.expiresAt,
+                createdAt: now,
+                rotatedAt: null,
+                ...encryptSecret(kek, credentialAad(vaultId, id, type, binding), Buffer.from(JSON.stringify(value), "utf8")),
+            });
+        }
+        return {
+            copies: sealed.map((row) => ({
+                id: row.id,
+                name: row.name,
+                type: row.type,
+                bindingJson: row.bindingJson,
+                expiresAt: row.expiresAt,
+                kekId: row.kekId,
+                nonce: Buffer.from(row.nonce).toString("base64"),
+                ciphertext: Buffer.from(row.ciphertext).toString("base64"),
+                wrappedDek: Buffer.from(row.wrappedDek).toString("base64"),
+            })),
+            dropped: dropped.sort(),
+        };
+    }
+    /**
+     * Inserts a fork's sealed copies (`sealEnvironmentSecretCopies`) into vault `vaultId`, in the
+     * transaction that creates the fork, with an audit row each naming `from`. Reads no secret.
+     */
+    async insertEnvironmentSecretCopies(t, vaultId, from, actor, sealed) {
+        const now = new Date().toISOString();
+        for (const copy of sealed.copies) {
+            await t.insertCredential({
+                id: copy.id,
+                vaultId,
+                name: copy.name,
+                type: copy.type,
+                bindingJson: copy.bindingJson,
+                expiresAt: copy.expiresAt,
+                createdAt: now,
+                rotatedAt: null,
+                kekId: copy.kekId,
+                nonce: Buffer.from(copy.nonce, "base64"),
+                ciphertext: Buffer.from(copy.ciphertext, "base64"),
+                wrappedDek: Buffer.from(copy.wrappedDek, "base64"),
+            });
+            await this.audit(t, { actor, action: "create", vaultId, credentialId: copy.id, target: from, outcome: "copied" });
+        }
+        return { copied: sealed.copies.map((copy) => copy.name).sort(), dropped: [...sealed.dropped] };
+    }
     // --- an Environment's secrets ----------------------------------------------------
     /**
      * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
@@ -402,9 +508,11 @@ export class VaultService {
     async listHostProviders() {
         return this.store.tx(async (t) => {
             const active = await activeProviderId(t);
+            const added = await readAddedInputs(t);
             const catalog = new Map(hostModelCatalog().providers.map((provider) => [provider.id, provider.name]));
             const providers = (await hostModelRows(t)).map((row) => {
                 const binding = modelBinding(row);
+                const inputs = inputsOfHostModel({ configured: true, ...binding }, added);
                 return {
                     id: binding.provider,
                     name: catalog.get(binding.provider) ??
@@ -415,6 +523,7 @@ export class VaultService {
                     authType: binding.authType,
                     ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
                     ...(binding.settings ? { settings: binding.settings } : {}),
+                    ...(inputs ? { inputs } : {}),
                     lastUpdated: row.rotatedAt ?? row.createdAt,
                     active: binding.provider === active,
                 };
@@ -541,8 +650,13 @@ export class VaultService {
     }
     validateHostModel(body) {
         if (body.settings && body.provider !== "custom")
-            throw new VaultError(400, "Model settings (context window, output limit, reasoning, compat) apply only to a custom provider.");
+            throw new VaultError(400, "Model settings (context window, output limit, reasoning, inputs, compat) apply only to a custom provider.");
         if (body.provider === "custom") {
+            // A custom endpoint is OpenAI-compatible: it reads only what that API carries (protocol 12).
+            const inputsRefused = body.settings?.inputs &&
+                inputsError({ api: "openai-completions", input: ["text", "image"] }, body.settings.inputs);
+            if (inputsRefused)
+                throw new VaultError(400, inputsRefused);
             if (!body.baseUrl)
                 throw new VaultError(400, "A base URL is required for a custom provider.");
             let url;
@@ -855,6 +969,39 @@ function credentialAad(vaultId, credentialId, type, binding) {
         }
         : { vaultId, credentialId, type, url: binding.url }), "utf8");
 }
+/**
+ * A copied credential's type, binding and payload under a slot of the fork (D64): its value with
+ * the slot's binding, or undefined when the slot's type cannot take it.
+ */
+function rebind(name, slot, row, payload, binding) {
+    const type = slot.type;
+    const value = row.type === "environment_variable" ? binding.variableValue : row.type === "bearer" ? payload.token : payload.value;
+    try {
+        if (type === "environment_secret" || type === "environment_variable") {
+            if (value === undefined)
+                return undefined;
+            const made = environmentCredential(name, { ...slot, type, value });
+            return { type, ...made };
+        }
+        const auth = type === "headers"
+            ? payload.headers === undefined
+                ? undefined
+                : { type, headers: payload.headers }
+            : value === undefined
+                ? undefined
+                : { type: "bearer", value };
+        if (auth === undefined)
+            return undefined;
+        const sealed = payloadOf(auth);
+        const routing = slot;
+        return { type, payload: sealed, binding: bindingOf(normalizeVaultUrl(routing.url), sealed, routing) };
+    }
+    catch (error) {
+        if (error instanceof VaultError)
+            return undefined;
+        throw error;
+    }
+}
 /** The sealed payload and unsealed binding of a shell credential named `name` (R2c). */
 function environmentCredential(name, body) {
     if (body.type === "environment_variable")

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.24.0-beta";
+export declare const RUNTIME_VERSION = "0.25.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.24.0-beta";
+export const RUNTIME_VERSION = "0.25.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.24.0-beta",
+  "version": "0.25.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.20.0-beta",
-    "@nylorun/harness": "0.26.0-beta",
+    "@nylorun/core": "0.21.0-beta",
+    "@nylorun/harness": "0.27.0-beta",
     "@restatedev/restate-sdk": "1.17.2",
     "@restatedev/restate-sdk-clients": "1.17.2",
     "@s2-dev/streamstore": "0.28.0",

package/dist/sandbox/capability.d.ts

@@ -1,3 +0,0 @@
-import { type AgentManifest, type CapabilityManifest } from "@nylorun/core/define";
-/** The sandbox capability that owns this tool call, when the call is a built-in sandbox tool. */
-export declare function sandboxCapabilityOf(manifest: AgentManifest | undefined, capabilityId: string | undefined, toolName: string | undefined): CapabilityManifest | undefined;

package/dist/sandbox/capability.js

@@ -1,10 +0,0 @@
-import { isSandboxToolName, } from "@nylorun/core/define";
-/** The sandbox capability that owns this tool call, when the call is a built-in sandbox tool. */
-export function sandboxCapabilityOf(manifest, capabilityId, toolName) {
-    if (!manifest || !capabilityId || !toolName || !isSandboxToolName(toolName))
-        return undefined;
-    const capability = manifest.capabilities.find((item) => item.id === capabilityId);
-    return capability?.sandbox && capability.tools?.some((tool) => tool.name === toolName)
-        ? capability
-        : undefined;
-}