@nylorun/runtime 0.24.0-beta → 0.26.0-beta

package/dist/host/gates.js

@@ -178,8 +178,8 @@ export async function startEgress(options) {
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
         // Each connection on the Tenant's record (R7.3): the gates' one write into it.
         record: {
-            holder: async (environmentId) => storeEgressRecord((await tenant.open()).store).holder(environmentId),
-            write: async (holder, connection) => storeEgressRecord((await tenant.open()).store).write(holder, connection),
+            runningTurns: async (environmentId) => storeEgressRecord((await tenant.open()).store).runningTurns(environmentId),
+            write: async (connection) => storeEgressRecord((await tenant.open()).store).write(connection),
         },
         credentials: {
             bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),

package/dist/host/stack-config.js

@@ -459,7 +459,7 @@ function parseSandboxes(env) {
         return undefined;
     const token = read(env, "NYLORUN_SANDBOXES_TOKEN");
     if (token === undefined || token.length < 32)
-        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun sandbox enable` sets both)");
+        throw new StackConfigError("NYLORUN_SANDBOXES_TOKEN (at least 32 characters) is required with NYLORUN_SANDBOXES_URL (`nylorun local sandbox enable` sets both)");
     const harnessImage = read(env, "NYLORUN_SANDBOX_HARNESS_IMAGE");
     if (harnessImage === undefined || /\s/.test(harnessImage))
         throw new StackConfigError("NYLORUN_SANDBOX_HARNESS_IMAGE is required with NYLORUN_SANDBOXES_URL: the Runtime image sandbox pods copy the engine from (`nylorun start` sets it)");

package/dist/keys/contract.d.ts

@@ -4,7 +4,7 @@
  * gates token. Internal: only core calls it, so it is not in the published OpenAPI documents.
  *
  * `200 {result}` when the operation succeeded, `200 {error}` when it refused: a vault error or
- * a Tenant API error with its status, code and details, so the route that called it answers
+ * a Runtime or Management API error with its status, code and details, so the route that called it answers
  * exactly what it answered when the operation ran in its own process.
  */
 export declare const KEYS_PATH = "/nylorun/v1/keys";

package/dist/keys/contract.js

@@ -4,7 +4,7 @@
  * gates token. Internal: only core calls it, so it is not in the published OpenAPI documents.
  *
  * `200 {result}` when the operation succeeded, `200 {error}` when it refused: a vault error or
- * a Tenant API error with its status, code and details, so the route that called it answers
+ * a Runtime or Management API error with its status, code and details, so the route that called it answers
  * exactly what it answered when the operation ran in its own process.
  */
 export const KEYS_PATH = "/nylorun/v1/keys";

package/dist/keys/keys.d.ts

@@ -2,7 +2,7 @@ import type { EnvironmentSecretView, HostModelView, McpPreview, McpPreviewReques
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
-import type { VaultService } from "../vault/service.js";
+import type { SealedSecretCopies, VaultService } from "../vault/service.js";
 /** One JWT to sign: its `typ` and every claim, `iss`, `aud`, `sub`, `iat`, `exp` and `jti` included. */
 export interface SignRequest {
     readonly typ: string;
@@ -18,6 +18,13 @@ export interface Keys {
     putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
+    /**
+     * Environment `from`'s secrets sealed again for a fork's new vault `vaultId`, limited to
+     * `slots` when given (`VaultService.sealEnvironmentSecretCopies`, Q15). Writes nothing: the
+     * fork's transaction inserts the copies; call it before that transaction opens. `null`, not
+     * `undefined`, crosses the wire.
+     */
+    sealEnvironmentSecretCopies(from: string, vaultId: string, slots: Readonly<Record<string, Record<string, unknown>>> | null): Promise<SealedSecretCopies>;
     /** Signs with the current key, creating the Tenant's keys if it has none. */
     sign(request: SignRequest): Promise<Signed>;
     /** Rotates the signing keys (`SigningKeys.rotate`); 409 while the previous key may verify live tokens. */
@@ -41,7 +48,7 @@ export interface Keys {
     signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
+export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sealEnvironmentSecretCopies", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -1,7 +1,8 @@
 /**
  * The keys seam (blueprint §14, F4.2): everything that needs the vault key. Vault writes that
  * touch a secret (writing an Environment's secret, setting and selecting the host model;
- * rotation and selection decrypt the old secret first) and all token signing (capability
+ * rotation and selection decrypt the old secret first; sealing a fork's copies of its source's
+ * secrets, which the fork's transaction then inserts) and all token signing (capability
  * links, run and host tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
@@ -21,6 +22,7 @@ export const KEYS_OPERATIONS = [
     "putEnvironmentSecret",
     "putHostModel",
     "selectHostModel",
+    "sealEnvironmentSecretCopies",
     "sign",
     "rotateSigningKeys",
     "ensureSigningKeys",
@@ -35,6 +37,7 @@ export function inProcessKeys(options) {
         putEnvironmentSecret: (environmentId, name, body, actor) => vault.putEnvironmentSecret(environmentId, name, body, actor),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
+        sealEnvironmentSecretCopies: (from, vaultId, slots) => vault.sealEnvironmentSecretCopies(from, vaultId, slots),
         async sign(request) {
             const key = kek();
             const row = await store.tx((t) => signingKeys.ensure(t, key));