@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/vault/headers.js

@@ -4,6 +4,7 @@
  * Runtime sets itself, so a credential can never replace them.
  */
 import { VaultError } from "./error.js";
+import { hostTuning } from "../tuning.js";
 /** Headers the MCP transport and the HTTP tool call own. */
 const RESERVED_HEADERS = new Set([
     "host",
@@ -25,13 +26,14 @@ const RESERVED_HEADERS = new Set([
 export function credentialSecrets(headers, identity) {
     const skip = identity?.header.toLowerCase();
     const secrets = new Set();
+    const least = hostTuning().harness.scrubMinChars;
     for (const [name, value] of Object.entries(headers)) {
         if (name.toLowerCase() === skip)
             continue;
-        if (value.length >= 8)
+        if (value.length >= least)
             secrets.add(value);
         const bearer = /^bearer\s+(\S+)\s*$/iu.exec(value)?.[1];
-        if (bearer !== undefined && bearer.length >= 8)
+        if (bearer !== undefined && bearer.length >= least)
             secrets.add(bearer);
     }
     return [...secrets];

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretView, HostModelProviderInfo, HostModelView, PutEnvironmentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -101,16 +101,16 @@ export declare class VaultService {
         dropped: string[];
     }>;
     /**
-     * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
+     * `PUT /v1/agents/{id}/secrets/{name}`: creates or replaces one credential. The same
      * name and type keeps the credential's id and re-seals its value and binding; another type
      * replaces it. Refused (`409 credential_conflict`) when another credential of the vault is
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
     /** The Environment's secrets: names, types and bindings, never values. */
-    listEnvironmentSecrets(environmentId: string): Promise<EnvironmentSecretView[]>;
-    getEnvironmentSecret(environmentId: string, name: string): Promise<EnvironmentSecretView>;
+    listEnvironmentSecrets(environmentId: string): Promise<AgentSecretView[]>;
+    getEnvironmentSecret(environmentId: string, name: string): Promise<AgentSecretView>;
     deleteEnvironmentSecret(environmentId: string, name: string, actor: string): Promise<{
         id: string;
     }>;
@@ -154,9 +154,9 @@ export declare class VaultService {
         url: string;
     }): Promise<AuthorizeResult>;
     /**
-     * What a session that names `request.environmentId` would send for each URL `manifest` names
-     * (`credentialNeeds`), decided as `authorize` decides a call: the credential of the
-     * Environment's vault bound to the URL. Reads no secret, writes no audit row.
+     * What a session on Agent `request.agentId` would send for each URL `manifest` (its manifest
+     * version's loop manifest) names (`credentialNeeds`), decided as `authorize` decides a call:
+     * the credential of the Agent's vault bound to the URL. Reads no secret, writes no audit row.
      */
     coverage(manifest: AgentManifest | WorkflowManifest, request: CredentialCoverageRequest): Promise<CredentialCoverage>;
     getHostModel(): Promise<HostModelView>;
@@ -204,4 +204,9 @@ type HostSecretPayload = {
 };
 export declare function modelBinding(row: VaultCredentialRow): ModelBinding;
 export declare function hostModelAad(provider: string, model: string): Buffer;
+/**
+ * Whether the credential in `row` fills secret slot `slot` (D64): of the slot's type, with its
+ * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
+ */
+export declare function slotHolds(slot: EnvironmentSecretSlot, row: Pick<VaultCredentialRow, "type" | "bindingJson">): boolean;
 export {};

package/dist/vault/service.js

@@ -18,11 +18,11 @@
  * sealEnvironmentSecretCopies(from, vaultId, slots | null): Promise<SealedSecretCopies>
  * insertEnvironmentSecretCopies(t: Tx, vaultId, from, actor, sealed): Promise<{ copied; dropped }>
  *
- * // Its secrets (`/v1/environments/{id}/secrets`): each opens its own transaction and writes its
+ * // Its secrets (`/v1/agents/{id}/secrets`): each opens its own transaction and writes its
  * // audit rows in it. A put needs the vault key, so callers reach it through `Keys`.
- * putEnvironmentSecret(environmentId, name, body: PutEnvironmentSecretRequest, actor): Promise<EnvironmentSecretView>
- * listEnvironmentSecrets(environmentId): Promise<EnvironmentSecretView[]>
- * getEnvironmentSecret(environmentId, name): Promise<EnvironmentSecretView>
+ * putEnvironmentSecret(environmentId, name, body: PutAgentSecretRequest, actor): Promise<AgentSecretView>
+ * listEnvironmentSecrets(environmentId): Promise<AgentSecretView[]>
+ * getEnvironmentSecret(environmentId, name): Promise<AgentSecretView>
  * deleteEnvironmentSecret(environmentId, name, actor): Promise<{ id: string }>
  *
  * // The shell's variables of a session's sandbox, in the caller's transaction (R2c).
@@ -231,7 +231,7 @@ export class VaultService {
     }
     // --- an Environment's secrets ----------------------------------------------------
     /**
-     * `PUT /v1/environments/{id}/secrets/{name}`: creates or replaces one credential. The same
+     * `PUT /v1/agents/{id}/secrets/{name}`: creates or replaces one credential. The same
      * name and type keeps the credential's id and re-seals its value and binding; another type
      * replaces it. Refused (`409 credential_conflict`) when another credential of the vault is
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
@@ -333,9 +333,12 @@ export class VaultService {
         if (!vault)
             return {};
         const environment = {};
+        const live = await liveFilter(t, environmentId);
         for (const row of await t.credentialsForVault(vault.id)) {
             if (row.type !== "environment_secret" && row.type !== "environment_variable")
                 continue;
+            if (!live(row))
+                continue;
             const binding = JSON.parse(row.bindingJson);
             if (row.type === "environment_secret")
                 environment[binding.secretName] = ENVIRONMENT_SECRET_SENTINEL;
@@ -398,8 +401,10 @@ export class VaultService {
                 });
                 return { result: { status: "refused", url, credentialIds: [], reason: "vault_missing" } };
             }
+            const live = await liveFilter(t, environmentId);
             const matches = (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
+                .filter(live)
                 .filter((row) => bindingUrl(row) === url)
                 .sort((a, b) => a.id.localeCompare(b.id));
             if (matches.length === 0)
@@ -466,18 +471,19 @@ export class VaultService {
     }
     // --- coverage --------------------------------------------------------------------
     /**
-     * What a session that names `request.environmentId` would send for each URL `manifest` names
-     * (`credentialNeeds`), decided as `authorize` decides a call: the credential of the
-     * Environment's vault bound to the URL. Reads no secret, writes no audit row.
+     * What a session on Agent `request.agentId` would send for each URL `manifest` (its manifest
+     * version's loop manifest) names (`credentialNeeds`), decided as `authorize` decides a call:
+     * the credential of the Agent's vault bound to the URL. Reads no secret, writes no audit row.
      */
     async coverage(manifest, request) {
-        const environmentId = request.environmentId;
+        const environmentId = request.agentId;
         return this.store.tx(async (t) => {
             const credentials = [];
-            if (environmentId !== undefined) {
+            {
                 const vault = await this.environmentVault(t, environmentId);
+                const live = await liveFilter(t, environmentId);
                 for (const row of await t.credentialsForVault(vault.id))
-                    if (isUserCredential(row))
+                    if (isUserCredential(row) && live(row))
                         credentials.push({ row, url: bindingUrl(row) });
             }
             const entries = credentialNeeds(manifest).map((need) => {
@@ -495,7 +501,6 @@ export class VaultService {
             });
             return {
                 agentId: request.agentId,
-                environmentId: environmentId ?? null,
                 complete: entries.every((entry) => entry.status === "covered"),
                 entries,
             };
@@ -634,7 +639,7 @@ export class VaultService {
             ? await t.vaultOfEnvironment(environmentId)
             : undefined;
         if (!vault)
-            throw new VaultError(404, "Environment not found");
+            throw new VaultError(404, "Agent not found");
         return vault;
     }
     async ensureHostVault(t) {
@@ -749,18 +754,18 @@ function bindingUrl(row) {
 /** Where a credential is, for coverage: never its value. */
 function coverageCredential(environmentId, row) {
     const via = JSON.parse(row.bindingJson).via;
-    return { environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
+    return { agentId: environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
 }
 /** One coverage entry, with the sentence that says what the session would do. */
 function coverageEntry(need, url, credential, environmentId, invalid) {
     const required = need.kind === "http";
     const where = environmentId === undefined
-        ? "Without an Environment, no credential is sent"
-        : `Environment ${environmentId} holds no credential for this URL`;
+        ? "Without an Agent, no credential is sent"
+        : `Agent ${environmentId} holds no credential for this URL`;
     const message = invalid !== undefined
         ? `No credential can be bound to this URL (${invalid}).`
         : credential !== undefined
-            ? `Sends '${credential.name}' from Environment ${credential.environmentId}${credential.via ? ` through ${credential.via}` : ""}.`
+            ? `Sends '${credential.name}' from Agent ${credential.agentId}${credential.via ? ` through ${credential.via}` : ""}.`
             : required
                 ? `${where}: each call fails with http.credential.`
                 : `${where}: the server is called without one, which only a public server accepts.`;
@@ -1027,6 +1032,45 @@ async function environmentSecretsFor(t, environmentId, host) {
     const vault = await t.vaultOfEnvironment(environmentId);
     if (!vault)
         return [];
+    const live = await liveFilter(t, environmentId);
     return (await t.credentialsForVault(vault.id)).filter((row) => row.type === "environment_secret" &&
+        live(row) &&
         (credentialBinding(row).allowedHosts ?? []).includes(lower));
 }
+/**
+ * Whether the credential in `row` fills secret slot `slot` (D64): of the slot's type, with its
+ * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
+ */
+export function slotHolds(slot, row) {
+    if (row.type !== slot.type)
+        return false;
+    const binding = JSON.parse(row.bindingJson);
+    if (slot.type === "environment_variable")
+        return true;
+    if (slot.type === "environment_secret") {
+        const hosts = (list) => canonical([...(list ?? [])].map((host) => host.toLowerCase()).sort());
+        const inject = slot.inject ? { header: slot.inject.header, format: slot.inject.format } : null;
+        return hosts(slot.allowedHosts) === hosts(binding.allowedHosts) && canonical(inject) === canonical(binding.inject ?? null);
+    }
+    try {
+        return normalizeVaultUrl(slot.url) === binding.url;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Which of Agent `environmentId`'s credentials are live (track T3, D73): with secret slots in the
+ * runtime it applies, only those that fill a slot of the name (`slotHolds`). Another stays in the
+ * vault, dormant: a slot the version dropped, or one whose binding changed until it gets a value
+ * again. Without slots, every one.
+ */
+async function liveFilter(t, environmentId) {
+    const slots = (await t.environment(environmentId))?.applied.secrets;
+    if (slots === undefined)
+        return () => true;
+    return (row) => {
+        const slot = slots[row.name];
+        return slot !== undefined && slotHolds(slot, row);
+    };
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.26.0-beta";
+export declare const RUNTIME_VERSION = "0.28.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.26.0-beta";
+export const RUNTIME_VERSION = "0.28.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.26.0-beta",
+  "version": "0.28.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -61,17 +61,18 @@
   "dependencies": {
     "@ag-ui/core": "~1.0.2",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
-    "@earendil-works/pi-ai": "0.99.1",
-    "@hono/node-server": "^2.1.3",
+    "@earendil-works/pi-ai": "1.2.0",
+    "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.22.0-beta",
-    "@nylorun/harness": "0.27.1-beta",
-    "@restatedev/restate-sdk": "1.17.2",
-    "@restatedev/restate-sdk-clients": "1.17.2",
+    "@nylorun/core": "0.24.0-beta",
+    "@nylorun/harness": "0.29.0-beta",
+    "@restatedev/restate-sdk": "1.17.3",
+    "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",
     "aws4fetch": "1.0.20",
-    "drizzle-orm": "^0.45.3",
+    "croner": "^9.1.0",
+    "drizzle-orm": "^0.45.4",
     "hono": "^4.13.13",
     "jose": "^6.2.12",
     "just-bash": "3.6.0",
@@ -80,18 +81,18 @@
     "postgres": "^3.4.9",
     "ws": "^8.22.0",
     "yaml": "^2.9.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
     "@ag-ui/client": "1.0.2",
-    "@scalar/openapi-parser": "^0.29.11",
-    "@types/node": "^26.6.4",
+    "@scalar/openapi-parser": "^0.29.13",
+    "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",
     "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.4"
   }
 }

package/dist/api/http/routes/environment-manifests.d.ts

@@ -1,9 +0,0 @@
-/**
- * Environment manifests (`/v1/environment-manifests/**`, protocol 14, D63): save, read, list and
- * delete the named, versioned definitions Environments are made from. A save never changes an
- * Environment. Reading needs what reading an Environment needs; saving and deleting need
- * `environments:write`, from any client (Q12).
- */
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { TenantEnv } from "../app.js";
-export declare function environmentManifestRoutes(api: OpenAPIHono<TenantEnv>): void;

package/dist/api/http/routes/environment-manifests.js

@@ -1,118 +0,0 @@
-import { z } from "zod";
-import { isEnvironmentManifestName, PutEnvironmentManifestRequestSchema } from "@nylorun/core/contracts";
-import { DeleteEnvironmentManifestResponse, EnvironmentManifestPlan, EnvironmentManifestVersions, EnvironmentManifestView, ListEnvironmentManifestsResponse, PutEnvironmentManifestRequest, SaveEnvironmentManifestResponse, } from "../../components.js";
-import { fail } from "../../../tenant/http.js";
-import { deleteEnvironmentManifest, environmentManifestVersions, getEnvironmentManifest, listEnvironmentManifests, saveEnvironmentManifest, } from "../../../tenant/environment-manifests.js";
-import { readJson } from "../body.js";
-import { tenantRoute } from "../define.js";
-import { jsonResponse } from "../respond.js";
-const READ = {
-    credentials: ["application", "subject", "token"],
-    scopes: ["sessions:own", "environments:write"],
-};
-const WRITE = {
-    credentials: ["application", "subject", "token"],
-    scopes: ["environments:write"],
-};
-const json = (schema, description) => ({
-    description,
-    content: { "application/json": { schema } },
-});
-const namePath = z.object({
-    name: z.string().meta({ description: "The environment manifest's name, such as `analyst-box`" }),
-});
-function nameOf(value) {
-    if (!isEnvironmentManifestName(value))
-        return fail(400, "An environment manifest's name is 1-64 letters, digits, '.', '_' and '-', starting with a letter or digit");
-    return value;
-}
-function versionOf(value) {
-    const version = Number(value);
-    if (!Number.isInteger(version) || version < 1)
-        return fail(400, "version is a positive integer");
-    return version;
-}
-/** `If-Match: <version>` (or `"<version>"`), when sent. */
-function ifMatchOf(value) {
-    if (value === undefined || value.trim() === "")
-        return undefined;
-    const version = Number(value.trim().replace(/^W\//, "").replace(/^"|"$/g, ""));
-    if (!Number.isInteger(version) || version < 0)
-        return fail(400, "If-Match is the version you read: a whole number, 0 for none yet");
-    return version;
-}
-export function environmentManifestRoutes(api) {
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests",
-        tags: ["Environment manifests"],
-        summary: "List environment manifests",
-        description: "Each manifest's latest version, by name, with how many Environments were made from it.",
-        responses: { 200: json(ListEnvironmentManifestsResponse, "The manifests") },
-    }, async (c) => jsonResponse(200, await listEnvironmentManifests(c.env.tenant)));
-    tenantRoute(api, WRITE, {
-        method: "put",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Save an environment manifest",
-        description: "Saves the manifest as its next version, or answers the latest unchanged when nothing differs. No Environment changes: an Environment keeps the version it was made from, and a fork moves it to another (D63). `If-Match: <version>` refuses the save with `412 manifest_changed` when the latest version is no longer the one you read (`0` for a manifest that does not exist yet). With `?dryRun=true` the answer is the plan: the changes, every reason a save would be refused (`errors`), warnings, and how many Environments stay on older versions; nothing is saved. Clients drop a file's `$schema` before they send it.",
-        request: {
-            params: namePath,
-            query: z.object({
-                dryRun: z.enum(["true", "false"]).optional().meta({ description: "`true`: answer the plan and save nothing" }),
-            }),
-            body: { required: true, content: { "application/json": { schema: PutEnvironmentManifestRequest } } },
-        },
-        responses: {
-            200: json(z.union([SaveEnvironmentManifestResponse, EnvironmentManifestPlan]), "The version saved, or the plan with dryRun"),
-            400: { description: "The manifest breaks the Tenant's limits or names files the Runtime cannot use" },
-            412: { description: "If-Match named a version that is no longer the latest (`manifest_changed`)" },
-        },
-    }, async (c) => {
-        const name = nameOf(c.req.param("name"));
-        const body = PutEnvironmentManifestRequestSchema.parse(await readJson(c.req.raw));
-        const ifMatch = ifMatchOf(c.req.header("if-match"));
-        const options = ifMatch === undefined ? {} : { ifMatch };
-        return jsonResponse(200, c.req.query("dryRun") === "true"
-            ? await saveEnvironmentManifest(c.env.tenant, name, body, c.get("scope"), { ...options, dryRun: true })
-            : await saveEnvironmentManifest(c.env.tenant, name, body, c.get("scope"), options));
-    });
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Get an environment manifest",
-        description: "Its latest version.",
-        request: { params: namePath },
-        responses: { 200: json(EnvironmentManifestView, "The latest version") },
-    }, async (c) => jsonResponse(200, await getEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")))));
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}/versions",
-        tags: ["Environment manifests"],
-        summary: "List an environment manifest's versions",
-        description: "Every version, newest first, with who saved it and how many Environments were made from it.",
-        request: { params: namePath },
-        responses: { 200: json(EnvironmentManifestVersions, "The versions") },
-    }, async (c) => jsonResponse(200, await environmentManifestVersions(c.env.tenant, nameOf(c.req.param("name")))));
-    tenantRoute(api, READ, {
-        method: "get",
-        path: "/v1/environment-manifests/{name}/versions/{version}",
-        tags: ["Environment manifests"],
-        summary: "Get one version of an environment manifest",
-        request: { params: namePath.extend({ version: z.string().meta({ description: "The version number" }) }) },
-        responses: { 200: json(EnvironmentManifestView, "The version") },
-    }, async (c) => jsonResponse(200, await getEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")), versionOf(c.req.param("version")))));
-    tenantRoute(api, WRITE, {
-        method: "delete",
-        path: "/v1/environment-manifests/{name}",
-        tags: ["Environment manifests"],
-        summary: "Delete an environment manifest",
-        description: "Deletes every version. Refused while any Environment was made from one (`409 manifest_in_use`).",
-        request: { params: namePath },
-        responses: {
-            200: json(DeleteEnvironmentManifestResponse, "Deleted, or there was none"),
-            409: { description: "An Environment was made from one of its versions (`manifest_in_use`)" },
-        },
-    }, async (c) => jsonResponse(200, await deleteEnvironmentManifest(c.env.tenant, nameOf(c.req.param("name")))));
-}

package/dist/api/http/routes/environments.d.ts

@@ -1,11 +0,0 @@
-/**
- * Environments (`/v1/environments/**`, protocol 11, D55, D56): create, find or change one by id,
- * read it, list them by label, read its lifecycle stream, stop, reset and delete it, and write
- * its vault's secrets. Ids may hold `/`, sent percent-encoded as one path segment
- * (`users%2Falice%2Fweb`). A token caller reaches only the ids its Environment grants match,
- * and changes them only with `environments:write`. Secret values are write-only: no route reads
- * one back.
- */
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import type { TenantEnv } from "../app.js";
-export declare function environmentRoutes(api: OpenAPIHono<TenantEnv>): void;