@nylorun/runtime 0.28.0-beta → 0.30.0-beta

package/dist/api/http/routes/tenant.js

@@ -307,7 +307,10 @@ export function tenantRoutes(api) {
         path: "/v1/tenant/tool-policy",
         tags: ["Tenant"],
         summary: "Get the Tenant's tool policy",
-        responses: { 200: json(ToolPolicy, "The rules the Tool Gate applies to every MCP and HTTP tool call") },
+        responses: {
+            200: json(ToolPolicy, "The rules the Tool Gate applies to every MCP and HTTP tool call"),
+            409: { description: "A stored rule names an MCP tool by its model-facing `server__tool` name: every call is refused until the policy is set again" },
+        },
     }, async (c) => {
         try {
             return jsonResponse(200, await c.env.tenant.store.tx((t) => readToolPolicy(t)));
@@ -325,7 +328,7 @@ export function tenantRoutes(api) {
         path: "/v1/tenant/tool-policy",
         tags: ["Tenant"],
         summary: "Set the Tenant's tool policy",
-        description: "Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). Sandbox tools never cross the gate. An empty list allows every call.",
+        description: "Replaces every rule. The Tool Gate applies them to each MCP and HTTP tool call of every harness, before it sends the call: the strictest rule that matches decides. `deny` refuses the call (the model gets `tool.denied`), `ask` holds it and pauses the turn until a person answers it with an `approve` command on the session, `allow` runs it. A call no rule matches runs. A rule matches when every selector it sets matches: `tool` (the tool's identity: an MCP tool's own name on its `server`, or an HTTP tool's declared name, never the name the model calls it by; `*` matches any run of characters), `server` (an MCP server's name), `kind` (`mcp` or `http`), `agent` (the agent that calls it: the agent manifest's name, or the id of an agent used as a tool or of a flow's agent, never an Agent's id) and `when` (fields of the call's input by dotted path, each tested with `equals`, `in`, `gt`, `gte`, `lt`, `lte` or `matches`). A `tool` with `__` in it, a model-facing `server__tool` name, is refused (`400`): name an MCP tool by `server` and `tool`. A stored policy with such a rule refuses every call until it is set again. Sandbox tools never cross the gate. An empty list allows every call.",
         request: { body: body(PutToolPolicyRequest) },
         responses: { 200: json(ToolPolicy, "The policy now in force") },
     }, async (c) => {

package/dist/api/http/routes/triggers.js

@@ -44,7 +44,7 @@ export function triggerRoutes(api) {
     }, async (c) => {
         const id = idOf(c.req.param("agentId"));
         assertReaches(c.get("scope"), id);
-        return jsonResponse(200, await listTriggers(c.env.tenant, id, originOf(c.req.url)));
+        return jsonResponse(200, await listTriggers(c.env.tenant, id, originOf(c)));
     });
     for (const action of ["pause", "resume"])
         tenantRoute(api, WRITE, {
@@ -63,7 +63,7 @@ export function triggerRoutes(api) {
         }, async (c) => {
             const id = idOf(c.req.param("agentId"));
             assertReaches(c.get("scope"), id);
-            return jsonResponse(200, await setTriggerStatus(c.env.tenant, id, c.req.param("triggerId"), action, originOf(c.req.url)));
+            return jsonResponse(200, await setTriggerStatus(c.env.tenant, id, c.req.param("triggerId"), action, originOf(c)));
         });
     tenantRoute(api, WRITE, {
         method: "post",
@@ -111,7 +111,7 @@ export function triggerRoutes(api) {
 }
 /** A delivery: no credential, no protocol header, any body; the endpoint id and the signature are the grant. */
 const DELIVERY = {
-    credentials: ["application", "subject", "token"],
+    credentials: [],
     scopes: "any",
     anonymous: true,
     unversioned: true,
@@ -132,20 +132,20 @@ export function webhookRoutes(api) {
     }, async (c) => {
         const id = idOf(c.req.param("agentId"));
         assertReaches(c.get("scope"), id);
-        return jsonResponse(200, await rotateWebhookSecret(c.env.tenant, id, c.req.param("triggerId"), originOf(c.req.url)));
+        return jsonResponse(200, await rotateWebhookSecret(c.env.tenant, id, c.req.param("triggerId"), originOf(c)));
     });
     tenantRoute(api, DELIVERY, {
         method: "post",
         path: "/v1/webhooks/{endpointId}",
         tags: ["Triggers"],
         summary: "Deliver to a webhook trigger",
-        description: "A sender's delivery, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp` within 5 minutes by default, `webhook-signature`): no credential and no `Nylorun-Protocol`. The body, any media type, at most the Runtime limit `webhookBodyBytes`, is read as bytes and verified before anything else. It runs the trigger once per `webhook-id`: a retry answers the first run. The body reaches the model as data under the trigger's prompt. Other senders (GitHub, Stripe, Slack) are relayed by an app.",
+        description: "A sender's delivery, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp` within 5 minutes by default, `webhook-signature`): no credential (an `Authorization` header is ignored) and no `Nylorun-Protocol`. The body, any media type, at most the Runtime limit `webhookBodyBytes`, is read as bytes and verified before anything else. It runs the trigger once per `webhook-id`: a retry answers the first run. The body reaches the model as data under the trigger's prompt. Other senders (GitHub, Stripe, Slack) are relayed by an app.",
         request: {
             params: z.object({ endpointId: z.string().meta({ description: "The trigger's endpoint id, `wh_…`" }) }),
             headers: z.object({
-                "webhook-id": z.string().optional().meta({ description: "The delivery's id; a retry sends the same" }),
-                "webhook-timestamp": z.string().optional().meta({ description: "Seconds since the epoch" }),
-                "webhook-signature": z.string().optional().meta({ description: "`v1,<base64>`, space-separated" }),
+                "webhook-id": z.string().meta({ description: "The delivery's id; a retry sends the same" }),
+                "webhook-timestamp": z.string().meta({ description: "Seconds since the epoch" }),
+                "webhook-signature": z.string().meta({ description: "`v1,<base64>`, space-separated" }),
             }),
             body: {
                 required: true,
@@ -155,7 +155,7 @@ export function webhookRoutes(api) {
         },
         responses: {
             202: json(WebhookAcceptedResponse, "The run it made: started, queued, skipped or failed"),
-            401: { description: "Not signed with the endpoint's secret, or a timestamp out of tolerance" },
+            401: { description: "Unsigned, not signed with the endpoint's secret, or a timestamp out of tolerance" },
             404: { description: "No endpoint has this id" },
             409: { description: "The trigger is paused (`trigger_paused`)" },
             413: { description: "Over `webhookBodyBytes`" },
@@ -174,7 +174,10 @@ export function webhookRoutes(api) {
         }));
     });
 }
-/** The origin a request reached: where its webhook URLs live. */
-function originOf(url) {
-    return new URL(url).origin;
+/**
+ * Where its webhook URLs live: the Runtime's public URL (`NYLORUN_PUBLIC_URL`), else the origin
+ * the request reached, which behind a proxy that rewrites `Host` is the Runtime's own.
+ */
+function originOf(c) {
+    return c.env.tenant.config.publicUrl ?? new URL(c.req.url).origin;
 }

package/dist/api/openapi.js

@@ -112,7 +112,7 @@ const RUNTIME_TAGS = [
     {
         name: "Agent manifests",
         group: "Agents",
-        description: "Named, versioned agent manifests (protocol 16): one document with what runs inside an agent's loop (`harness`) and what the Runtime provides around it (`runtime`), checked against each other when it is saved. Save one with a plan first (`?dryRun=true`) and `If-Match`; an Agent is made from one version and keeps it, so a save changes no Agent. `client.agentManifests` in `@nylorun/agents`, and `nylorun apply`.",
+        description: "Named, versioned agent manifests (protocol 16): one document with what runs inside an agent's loop (`harness`) and what the Runtime provides around it (`runtime`), checked against each other when it is saved. Save one with a plan first (`?dryRun=true`) and `If-Match`; an Agent runs one version at a time, and a save moves every Agent that tracks the manifest to the new version, while a pinned one stays. `client.agentManifests` in `@nylorun/agents`, and `nylorun apply`.",
         operations: [
             "PUT /v1/agent-manifests/{name}",
             "GET /v1/agent-manifests",
@@ -155,7 +155,7 @@ const RUNTIME_TAGS = [
     {
         name: "Triggers",
         group: "Agents",
-        description: "What starts an Agent's turns with no client connected (track T4, D74): the schedules, one-shot times and webhook endpoints its manifest's `runtime.triggers` declare. Each trigger's status is the Agent's: pause and resume it, run it now, make a webhook trigger's signing secret, and read its runs (`started`, `queued`, `skipped` or `failed`, with a reason). In `@nylorun/agents` and `nylorun agents triggers`.",
+        description: "What starts an Agent's turns with no client connected: the schedules, one-shot times and webhook endpoints its manifest's `runtime.triggers` declare. Each trigger's status is the Agent's: pause and resume it, run it now, make a webhook trigger's signing secret, and read its runs (`started`, `queued`, `skipped` or `failed`, with a reason). In `@nylorun/agents` and `nylorun agents triggers`.",
         operations: [
             "GET /v1/agents/{agentId}/triggers",
             "POST /v1/agents/{agentId}/triggers/{triggerId}/pause",
@@ -169,7 +169,7 @@ const RUNTIME_TAGS = [
     {
         name: "Memory",
         group: "Agents",
-        description: "An Agent's memories (track T5, D72): Markdown files under `/memories` it keeps across sessions, wakes and upgrades, shaped like Anthropic's memory stores. List and read them, write one whole (with a `content_sha256` precondition), delete one or a folder, and read the version every change leaves, with who made it. In `@nylorun/agents` and `nylorun agents memories`.",
+        description: "An Agent's memories: Markdown files under `/memories` it keeps across sessions, wakes and upgrades, shaped like Anthropic's memory stores. List and read them, write one whole (with a `content_sha256` precondition), delete one or a folder, and read the version every change leaves, with who made it. In `@nylorun/agents` and `nylorun agents memories`.",
         operations: [
             "GET /v1/agents/{agentId}/memories",
             "GET /v1/agents/{agentId}/memories/{path}",

package/dist/gates/egress-credentials.js

@@ -19,26 +19,15 @@ import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
 import { hostTuning } from "../tuning.js";
+import { HOP_BY_HOP_HEADERS } from "../vault/headers.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
-/** Headers that describe one hop and are never forwarded. */
-const HOP_BY_HOP = new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "proxy-connection",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
 /** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
 function forwardable(raw, drop) {
     const headers = {};
     for (let i = 0; i + 1 < raw.length; i += 2) {
         const name = raw[i].toLowerCase();
-        if (HOP_BY_HOP.has(name) || name === drop)
+        if (HOP_BY_HOP_HEADERS.has(name) || name === drop)
             continue;
         (headers[name] ??= []).push(raw[i + 1]);
     }

package/dist/gates/handler.js

@@ -6,7 +6,7 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
+import { callCaller, callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
@@ -28,6 +28,7 @@ export function createModelCallHandler(options) {
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
+                    caller: callCaller(vault.store),
                 });
                 outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));
             }

package/dist/gates/http-tool.js

@@ -198,7 +198,7 @@ export async function runHttpTool(tenant, call, options) {
             if (authorized.status === "refused")
                 return failed("http.credential", `The credential '${http.credential}' was refused: ${authorized.reason}`);
             if (authorized.status === "unauthenticated")
-                return failed("http.credential", `The session's Environment holds no credential '${http.credential}' for ${authorized.url}`);
+                return failed("http.credential", `The session's Agent holds no credential '${http.credential}' for ${authorized.url}`);
             credential = authorized.headers;
             identity = authorized.identity;
             // A credential with `via` sends the call there, a gateway (R2b C2, Q9): to its one URL, so

package/dist/gates/in-process.d.ts

@@ -11,6 +11,7 @@ import type { HostModelSecret } from "../vault/service.js";
 import type { ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type FileResolver } from "../artifacts/files.js";
 import type { BlobStore } from "../blob/index.js";
+import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
@@ -20,6 +21,8 @@ export interface InProcessModelGateOptions {
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;
+    /** Reads who makes a call, for a custom endpoint's per-call headers (#493). */
+    readonly caller?: (request: ModelGateRequest) => Promise<ModelCaller | undefined>;
 }
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
@@ -27,6 +30,12 @@ export interface InProcessModelGateOptions {
  * gate's route puts on the request (F5). A request without a session reads no file at all.
  */
 export declare function callFiles(store: SessionStore, blobs: BlobStore): (request: Pick<ModelGateRequest, "sessionId">) => FileResolver;
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export declare function callCaller(store: SessionStore): (request: Pick<ModelGateRequest, "sessionId">) => Promise<ModelCaller | undefined>;
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the

package/dist/gates/in-process.js

@@ -5,6 +5,7 @@ import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
 import { fixtureAnswer } from "./fixture-model.js";
+import { isSubject } from "@nylorun/core/contracts";
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
  * process, the loop's own request; over HTTP, the session of the run token's claims, which the
@@ -13,6 +14,24 @@ import { fixtureAnswer } from "./fixture-model.js";
 export function callFiles(store, blobs) {
     return (request) => artifactFiles({ store, blobs, sessionId: request.sessionId });
 }
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export function callCaller(store) {
+    return (request) => store.tx(async (t) => {
+        const session = await t.get("sessions", request.sessionId);
+        const agent = session && (await t.environment(session.agentId));
+        if (!session || !agent)
+            return undefined;
+        return {
+            agentId: agent.id,
+            labels: agent.labels,
+            ...(isSubject(session.ownerUserId) ? { owner: session.ownerUserId } : {}),
+        };
+    });
+}
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the
@@ -30,6 +49,7 @@ export function tenantModelGate(options) {
                 writeHostCredential: (credential) => vault.updateHostCredential(credential),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
+                caller: callCaller(options.store),
             });
             return serve(options.store, gate, request, signal);
         }),
@@ -58,6 +78,7 @@ export function inProcessModelGate(options) {
                 writeHostCredential: options.writeHostCredential,
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
+                ...(options.caller ? { caller: () => options.caller(request) } : {}),
             });
             return adapter(request.call, {
                 // The Runtime never journals the provider request (harness `durable.ts`), and

package/dist/gates/meter.js

@@ -142,6 +142,22 @@ export function usageRow(request, outcome, at, timing) {
         ...(typeof firstTokenMs === "number" && Number.isFinite(firstTokenMs) && firstTokenMs >= 0
             ? { firstTokenMs: Math.round(firstTokenMs) }
             : {}),
+        ...costSplitColumns(outcome.evidence?.extras?.costSplit),
+    };
+}
+/** The ledger's cost-by-kind columns from the adapter's `costSplit`; none unless all four are costs. */
+function costSplitColumns(split) {
+    if (!split || typeof split !== "object" || Array.isArray(split))
+        return {};
+    const { input, cacheRead, cacheWrite, output } = split;
+    const parts = [input, cacheRead, cacheWrite, output];
+    if (!parts.every((part) => typeof part === "number" && Number.isFinite(part) && part >= 0))
+        return {};
+    return {
+        costInputUsd: input,
+        costCacheReadUsd: cacheRead,
+        costCacheWriteUsd: cacheWrite,
+        costOutputUsd: output,
     };
 }
 /** The ledger rows a budget counts for `request`; undefined when it doesn't apply. */

package/dist/gates/tenant-vaults.d.ts

@@ -29,7 +29,7 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the vault of the session's Environment.
+     * credential from the vault of the session's Agent.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */

package/dist/host/config-for.d.ts

@@ -14,4 +14,6 @@ export declare function configForFactory(options: {
     delivery?: TenantConfig["delivery"];
     /** The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`). */
     issuers?: TenantConfig["issuers"];
+    /** The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`). */
+    publicUrl?: string;
 }): (id: string) => TenantConfig;

package/dist/host/config-for.js

@@ -16,6 +16,7 @@ export function configForFactory(options) {
             model: options.model ?? { kind: "vault" },
             ...(options.delivery ? { delivery: options.delivery } : {}),
             ...(options.issuers ? { issuers: options.issuers } : {}),
+            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
             logger: {
                 info: (message, fields) => options.logger.info(message, { tenantId: id, ...fields }),
                 warn: (message, fields) => options.logger.warn(message, { tenantId: id, ...fields }),

package/dist/host/main.js

@@ -65,6 +65,7 @@ import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -218,6 +219,7 @@ export async function main() {
     // Read once, before any service starts: each reads the parts it uses where it uses them.
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
+    useWorkloadToken(stack.workloadToken ?? {});
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))
@@ -279,6 +281,7 @@ export async function main() {
         logger,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
         ...(issuers ? { issuers } : {}),
+        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.

package/dist/host/stack-config.d.ts

@@ -178,6 +178,16 @@ export interface HarnessServiceConfig {
 export interface StackConfig {
     /** The Runtime services this process runs. */
     services: RuntimeServices;
+    /**
+     * `NYLORUN_WORKLOAD_TOKEN_FILE`, the file of the Runtime's workload token, which a platform
+     * rotates and the Runtime reads at each use, and `NYLORUN_WORKLOAD_TOKEN_ORIGINS`, the
+     * comma-separated origins a `workload` credential's `via` may send it to (#496,
+     * `vault/workload-token.ts`). Absent: no workload token.
+     */
+    workloadToken?: {
+        file?: string;
+        origins?: string[];
+    };
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -47,6 +47,7 @@
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
+import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
@@ -325,6 +326,7 @@ export function parseStackConfig(env, argv) {
         throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT");
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
+    const workloadToken = parseWorkloadToken(env);
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -347,6 +349,7 @@ export function parseStackConfig(env, argv) {
         ...(sandboxes ? { sandboxes } : {}),
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
+        ...(workloadToken ? { workloadToken } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -454,6 +457,39 @@ function parseTenant(env) {
         ...(managementKeyFile ? { managementKeyFile } : {}),
     };
 }
+/**
+ * `StackConfig.workloadToken` (#496): the Runtime's workload token, which the gates read for a
+ * custom model and for `workload` credentials, and the in-process Tenant does without them.
+ */
+function parseWorkloadToken(env) {
+    const file = read(env, "NYLORUN_WORKLOAD_TOKEN_FILE");
+    const origins = parseOrigins(read(env, "NYLORUN_WORKLOAD_TOKEN_ORIGINS"));
+    if (file === undefined && origins === undefined)
+        return undefined;
+    return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
+}
+/** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
+function parseOrigins(raw) {
+    if (raw === undefined)
+        return undefined;
+    return raw
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item !== "")
+        .map((item) => {
+        let url;
+        try {
+            url = new URL(item);
+        }
+        catch {
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} is not a URL`);
+        }
+        const loopback = url.protocol === "http:" && LOOPBACK_HOSTS.test(url.hostname);
+        if ((url.protocol !== "https:" && !loopback) || url.origin !== item.replace(/\/$/, ""))
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} must be an https origin, such as https://gateway.example.com`);
+        return url.origin;
+    });
+}
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
 /** `NYLORUN_HARNESS`: `in-process` (the default when unset) or `remote`. */
 function parseHarnessMode(env) {