@nylorun/runtime 0.24.0-beta → 0.26.0-beta

package/dist/vault/service.js

@@ -9,9 +9,15 @@
  * new VaultService({ store: SessionStore, kek: () => Buffer })
  *
  * // An Environment's vault, in the caller's transaction (`tenant/environments.ts`).
- * createEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>
+ * createEnvironmentVault(t: Tx, environmentId: string, actor: string, id?: string): Promise<string>
  * deleteEnvironmentVault(t: Tx, environmentId: string, actor: string): Promise<void>
  *
+ * // A fork's secrets (Q15): `Keys` seals the copies with the vault key in its own transaction,
+ * // before the fork's; the fork's transaction inserts them, so the process that forks never
+ * // holds the key.
+ * sealEnvironmentSecretCopies(from, vaultId, slots | null): Promise<SealedSecretCopies>
+ * insertEnvironmentSecretCopies(t: Tx, vaultId, from, actor, sealed): Promise<{ copied; dropped }>
+ *
  * // Its secrets (`/v1/environments/{id}/secrets`): each opens its own transaction and writes its
  * // audit rows in it. A put needs the vault key, so callers reach it through `Keys`.
  * putEnvironmentSecret(environmentId, name, body: PutEnvironmentSecretRequest, actor): Promise<EnvironmentSecretView>
@@ -78,7 +84,9 @@ import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { credentialNeeds } from "./coverage.js";
 import { checkCredentialHeaders } from "./headers.js";
-import { hostModelCatalog } from "../model/catalog.js";
+import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
+import { inputsError } from "../model/capabilities.js";
+import { readAddedInputs } from "../tenant/model-setting.js";
 import { normalizeVaultUrl } from "./url.js";
 export const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
@@ -90,10 +98,13 @@ export class VaultService {
         this.kek = options.kek;
     }
     // --- an Environment's vault (caller's transaction) ------------------------------
-    /** Creates Environment `environmentId`'s vault (D56), in the transaction that creates it. */
-    async createEnvironmentVault(t, environmentId, actor) {
+    /**
+     * Creates Environment `environmentId`'s vault (D56), in the transaction that creates it; answers
+     * its id, `id` when given (a fork's, whose secrets were sealed for it first).
+     */
+    async createEnvironmentVault(t, environmentId, actor, id = randomUUID()) {
         const row = {
-            id: randomUUID(),
+            id,
             name: environmentId,
             metadataJson: null,
             createdAt: new Date().toISOString(),
@@ -101,6 +112,7 @@ export class VaultService {
         };
         await t.insertVault(row);
         await this.audit(t, { actor, action: "create", vaultId: row.id, target: environmentId, outcome: "created" });
+        return row.id;
     }
     /**
      * Deletes Environment `environmentId`'s vault and its credentials, with their audit rows, in
@@ -123,6 +135,100 @@ export class VaultService {
         await t.deleteVault(vault.id);
         await this.audit(t, { actor, action: "delete", vaultId: vault.id, target: environmentId, outcome: "deleted" });
     }
+    /**
+     * Seals Environment `from`'s secrets again for vault `vaultId`, a fork's new vault (Q15): each
+     * value is unsealed and sealed under the new vault's and credential's ids, which its AAD binds.
+     * Needs the vault key, so callers reach it through `Keys`; it reads `from` in its own
+     * transaction and writes nothing. With `slots` (what the fork runs declares secret slots, D64),
+     * only the names it declares are sealed, each with its slot's binding; a value the slot's type
+     * cannot take is left behind. The fork's transaction inserts the copies
+     * (`insertEnvironmentSecretCopies`).
+     */
+    async sealEnvironmentSecretCopies(from, vaultId, slots) {
+        const kek = this.kek();
+        const rows = await this.store.tx(async (t) => {
+            const source = await t.vaultOfEnvironment(from);
+            return source ? (await t.credentialsForVault(source.id)).filter(isUserCredential) : [];
+        });
+        const sealed = [];
+        const dropped = [];
+        const now = new Date().toISOString();
+        for (const row of rows) {
+            const payload = readPayload(kek, row);
+            let type = row.type;
+            let binding = credentialBinding(row);
+            let value = payload;
+            if (slots) {
+                const slot = slots[row.name];
+                const rebound = slot === undefined ? undefined : rebind(row.name, slot, row, payload, binding);
+                if (rebound === undefined) {
+                    dropped.push(row.name);
+                    continue;
+                }
+                ({ type, binding, payload: value } = rebound);
+                try {
+                    conflictOf(type, binding, sealed);
+                }
+                catch (error) {
+                    if (!(error instanceof VaultError))
+                        throw error;
+                    dropped.push(row.name);
+                    continue;
+                }
+            }
+            const id = randomUUID();
+            sealed.push({
+                id,
+                vaultId,
+                name: row.name,
+                type,
+                bindingJson: JSON.stringify(binding),
+                expiresAt: row.expiresAt,
+                createdAt: now,
+                rotatedAt: null,
+                ...encryptSecret(kek, credentialAad(vaultId, id, type, binding), Buffer.from(JSON.stringify(value), "utf8")),
+            });
+        }
+        return {
+            copies: sealed.map((row) => ({
+                id: row.id,
+                name: row.name,
+                type: row.type,
+                bindingJson: row.bindingJson,
+                expiresAt: row.expiresAt,
+                kekId: row.kekId,
+                nonce: Buffer.from(row.nonce).toString("base64"),
+                ciphertext: Buffer.from(row.ciphertext).toString("base64"),
+                wrappedDek: Buffer.from(row.wrappedDek).toString("base64"),
+            })),
+            dropped: dropped.sort(),
+        };
+    }
+    /**
+     * Inserts a fork's sealed copies (`sealEnvironmentSecretCopies`) into vault `vaultId`, in the
+     * transaction that creates the fork, with an audit row each naming `from`. Reads no secret.
+     */
+    async insertEnvironmentSecretCopies(t, vaultId, from, actor, sealed) {
+        const now = new Date().toISOString();
+        for (const copy of sealed.copies) {
+            await t.insertCredential({
+                id: copy.id,
+                vaultId,
+                name: copy.name,
+                type: copy.type,
+                bindingJson: copy.bindingJson,
+                expiresAt: copy.expiresAt,
+                createdAt: now,
+                rotatedAt: null,
+                kekId: copy.kekId,
+                nonce: Buffer.from(copy.nonce, "base64"),
+                ciphertext: Buffer.from(copy.ciphertext, "base64"),
+                wrappedDek: Buffer.from(copy.wrappedDek, "base64"),
+            });
+            await this.audit(t, { actor, action: "create", vaultId, credentialId: copy.id, target: from, outcome: "copied" });
+        }
+        return { copied: sealed.copies.map((copy) => copy.name).sort(), dropped: [...sealed.dropped] };
+    }
     // --- an Environment's secrets ----------------------------------------------------
     /**
      * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
@@ -402,9 +508,11 @@ export class VaultService {
     async listHostProviders() {
         return this.store.tx(async (t) => {
             const active = await activeProviderId(t);
+            const added = await readAddedInputs(t);
             const catalog = new Map(hostModelCatalog().providers.map((provider) => [provider.id, provider.name]));
             const providers = (await hostModelRows(t)).map((row) => {
                 const binding = modelBinding(row);
+                const inputs = inputsOfHostModel({ configured: true, ...binding }, added);
                 return {
                     id: binding.provider,
                     name: catalog.get(binding.provider) ??
@@ -415,6 +523,7 @@ export class VaultService {
                     authType: binding.authType,
                     ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
                     ...(binding.settings ? { settings: binding.settings } : {}),
+                    ...(inputs ? { inputs } : {}),
                     lastUpdated: row.rotatedAt ?? row.createdAt,
                     active: binding.provider === active,
                 };
@@ -541,8 +650,13 @@ export class VaultService {
     }
     validateHostModel(body) {
         if (body.settings && body.provider !== "custom")
-            throw new VaultError(400, "Model settings (context window, output limit, reasoning, compat) apply only to a custom provider.");
+            throw new VaultError(400, "Model settings (context window, output limit, reasoning, inputs, compat) apply only to a custom provider.");
         if (body.provider === "custom") {
+            // A custom endpoint is OpenAI-compatible: it reads only what that API carries (protocol 12).
+            const inputsRefused = body.settings?.inputs &&
+                inputsError({ api: "openai-completions", input: ["text", "image"] }, body.settings.inputs);
+            if (inputsRefused)
+                throw new VaultError(400, inputsRefused);
             if (!body.baseUrl)
                 throw new VaultError(400, "A base URL is required for a custom provider.");
             let url;
@@ -855,6 +969,39 @@ function credentialAad(vaultId, credentialId, type, binding) {
         }
         : { vaultId, credentialId, type, url: binding.url }), "utf8");
 }
+/**
+ * A copied credential's type, binding and payload under a slot of the fork (D64): its value with
+ * the slot's binding, or undefined when the slot's type cannot take it.
+ */
+function rebind(name, slot, row, payload, binding) {
+    const type = slot.type;
+    const value = row.type === "environment_variable" ? binding.variableValue : row.type === "bearer" ? payload.token : payload.value;
+    try {
+        if (type === "environment_secret" || type === "environment_variable") {
+            if (value === undefined)
+                return undefined;
+            const made = environmentCredential(name, { ...slot, type, value });
+            return { type, ...made };
+        }
+        const auth = type === "headers"
+            ? payload.headers === undefined
+                ? undefined
+                : { type, headers: payload.headers }
+            : value === undefined
+                ? undefined
+                : { type: "bearer", value };
+        if (auth === undefined)
+            return undefined;
+        const sealed = payloadOf(auth);
+        const routing = slot;
+        return { type, payload: sealed, binding: bindingOf(normalizeVaultUrl(routing.url), sealed, routing) };
+    }
+    catch (error) {
+        if (error instanceof VaultError)
+            return undefined;
+        throw error;
+    }
+}
 /** The sealed payload and unsealed binding of a shell credential named `name` (R2c). */
 function environmentCredential(name, body) {
     if (body.type === "environment_variable")

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.24.0-beta";
+export declare const RUNTIME_VERSION = "0.26.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.24.0-beta";
+export const RUNTIME_VERSION = "0.26.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.24.0-beta",
+  "version": "0.26.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.20.0-beta",
-    "@nylorun/harness": "0.26.0-beta",
+    "@nylorun/core": "0.22.0-beta",
+    "@nylorun/harness": "0.27.1-beta",
     "@restatedev/restate-sdk": "1.17.2",
     "@restatedev/restate-sdk-clients": "1.17.2",
     "@s2-dev/streamstore": "0.28.0",

package/dist/sandbox/capability.d.ts

@@ -1,3 +0,0 @@
-import { type AgentManifest, type CapabilityManifest } from "@nylorun/core/define";
-/** The sandbox capability that owns this tool call, when the call is a built-in sandbox tool. */
-export declare function sandboxCapabilityOf(manifest: AgentManifest | undefined, capabilityId: string | undefined, toolName: string | undefined): CapabilityManifest | undefined;

package/dist/sandbox/capability.js

@@ -1,10 +0,0 @@
-import { isSandboxToolName, } from "@nylorun/core/define";
-/** The sandbox capability that owns this tool call, when the call is a built-in sandbox tool. */
-export function sandboxCapabilityOf(manifest, capabilityId, toolName) {
-    if (!manifest || !capabilityId || !toolName || !isSandboxToolName(toolName))
-        return undefined;
-    const capability = manifest.capabilities.find((item) => item.id === capabilityId);
-    return capability?.sandbox && capability.tools?.some((tool) => tool.name === toolName)
-        ? capability
-        : undefined;
-}