@nylorun/runtime 0.29.0-beta → 0.30.0-beta

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.30.0-beta
+
+### Minor Changes
+
+- fce0c9b: Headers for a custom model endpoint (#493). A custom endpoint's `settings` (`PUT /v1/tenant/model`) take `headers`, sent on every call, and `callHeaders`, whose values the Runtime resolves per call from the calling Agent: one of its labels (`{ from: "agent.label", key: "org" }`), its id (`agent.id`) or the session's owner when it is a person (`session.owner`). A source with no value sends no header. A Runtime that serves several orgs' Agents can then send each call's org (`x-nylorun-org` from the `org` label), so a model gateway attributes and budgets it while the call is made, in process and through the gates service alike. They are settings, read back by `GET /v1/tenant/model`: neither map may set `authorization`, a hop-by-hop or transport header, or `Nylorun-*`, and a name appears once across both. Studio keeps them when it saves the model.
+- ab7c08a: A gateway's tool prefix (#494, Host feature `gateway-credentials`). A `bearer` or `headers` credential with `via`, written to an Agent's vault, may add `toolPrefix`: what the gateway at `via` puts before each tool name it lists, such as LiteLLM's `github-`. The Runtime lists the server's tools without it, so tool names (`github__create_issue`), a manifest's `tools` settings and tool policy rules name the server's own tools whether or not a gateway is in between, and calls each tool by the name the gateway listed. A listed tool that lacks the prefix keeps its name, and the server's `mcp.discovered` message names it. `toolPrefix` needs `via`, and secret views carry it. It is the installation's routing, never a manifest's: a manifest's secret slot cannot name it, and a slot's value write (`{ headers, toolPrefix }`) adds it. A fork keeps it while the new slot keeps `via`. No protocol change.
+- 4a563e7: The workload token (#496). A Runtime given `NYLORUN_WORKLOAD_TOKEN_FILE`, a token a platform rotates through a file, reads it at each use and keeps nothing, so a rotation applies to the next request with no restart; a missing, unreadable or empty file fails the request, naming the variable, and nothing is sent without it. A custom model with `auth: { type: "workload" }` sends it as the endpoint's bearer. A new credential type, `workload` (`{ url, via, identity?, toolPrefix? }`, no value), sends `Authorization: Bearer <token>` to its `via` only, and only when `via`'s origin is in `NYLORUN_WORKLOAD_TOKEN_ORIGINS`, since an Agent's writer chooses `via`. A gateway's `401` is `credential_rejected` with `gateway`, its origin. The token stays in the process that makes the call: never in a sandbox, the model, an event or a log. Studio shows the credential and the model's auth.
+
+### Patch Changes
+
+- 8c82ed9: An MCP gateway's report of an upstream `401` is `credential_rejected` (#495). Through a credential's `via`, a gateway that answers HTTP 200 but reports that the server behind it answered `401` is read like a `401`. LiteLLM does this for a token the provider revoked: a `tools/list` with no tools and `"auth_required"` for the server in `_meta["litellm.ai/server_outcomes"]` makes the server's `mcp.discovered` outcome `failed` ("MCP server returned 401"), and a tool error carrying that outcome, or LiteLLM's `HTTPStatusError: Client error '401 Unauthorized'` text, completes as `credential_rejected` with `retryable: false`, naming the server. A server reached without `via` is read as before.
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [fce0c9b]
+- Updated dependencies [ab7c08a]
+- Updated dependencies [4a563e7]
+- Updated dependencies
+  - @nylorun/core@0.26.0-beta
+  - @nylorun/harness@0.29.2-beta
+
 ## 0.29.0-beta
 
 ### Minor Changes

package/dist/api/components.d.ts

@@ -897,6 +897,7 @@ export declare const PutAgentSecretValueRequest: z.ZodObject<{
     requestId: z.ZodOptional<z.ZodString>;
     value: z.ZodOptional<z.ZodString>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    toolPrefix: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const AgentSnapshot: z.ZodObject<{
     agentId: z.ZodString;
@@ -4447,6 +4448,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             code: z.ZodString;
             message: z.ZodString;
             server: z.ZodOptional<z.ZodString>;
+            gateway: z.ZodOptional<z.ZodString>;
             retryable: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$loose>>;
         redacted: z.ZodOptional<z.ZodNumber>;
@@ -7179,6 +7181,7 @@ export declare const SessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             code: z.ZodString;
             message: z.ZodString;
             server: z.ZodOptional<z.ZodString>;
+            gateway: z.ZodOptional<z.ZodString>;
             retryable: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$loose>>;
         redacted: z.ZodOptional<z.ZodNumber>;
@@ -9914,6 +9917,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
                 server: z.ZodOptional<z.ZodString>;
+                gateway: z.ZodOptional<z.ZodString>;
                 retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
             redacted: z.ZodOptional<z.ZodNumber>;
@@ -12646,6 +12650,7 @@ export declare const SessionItemsResponse: z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
                 server: z.ZodOptional<z.ZodString>;
+                gateway: z.ZodOptional<z.ZodString>;
                 retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
             redacted: z.ZodOptional<z.ZodNumber>;
@@ -13224,6 +13229,7 @@ export declare const TenantStatus: z.ZodObject<{
         authType: z.ZodEnum<{
             api_key: "api_key";
             oauth: "oauth";
+            workload: "workload";
         }>;
         baseUrl: z.ZodOptional<z.ZodString>;
         settings: z.ZodOptional<z.ZodObject<{
@@ -13239,6 +13245,15 @@ export declare const TenantStatus: z.ZodObject<{
                 video: "video";
             }>>>;
             compat: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            callHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                from: z.ZodLiteral<"agent.label">;
+                key: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"agent.id">;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"session.owner">;
+            }, z.core.$strict>], "from">>>;
         }, z.core.$strict>>;
     }, z.core.$strict>]>;
     agents: z.ZodArray<z.ZodObject<{
@@ -13357,6 +13372,15 @@ export declare const SeedTenantConfigRequest: z.ZodObject<{
                 video: "video";
             }>>>;
             compat: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            callHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                from: z.ZodLiteral<"agent.label">;
+                key: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"agent.id">;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"session.owner">;
+            }, z.core.$strict>], "from">>>;
         }, z.core.$strict>>;
         auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
             type: z.ZodLiteral<"api_key">;
@@ -13367,7 +13391,9 @@ export declare const SeedTenantConfigRequest: z.ZodObject<{
             refresh: z.ZodString;
             access: z.ZodString;
             expires: z.ZodNumber;
-        }, z.core.$loose>], "type">;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"workload">;
+        }, z.core.$strict>], "type">;
     }, z.core.$strict>>;
     fixtureModel: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
@@ -13626,6 +13652,7 @@ export declare const ListProvidersResponse: z.ZodObject<{
         authType: z.ZodEnum<{
             api_key: "api_key";
             oauth: "oauth";
+            workload: "workload";
         }>;
         baseUrl: z.ZodOptional<z.ZodString>;
         settings: z.ZodOptional<z.ZodObject<{
@@ -13641,6 +13668,15 @@ export declare const ListProvidersResponse: z.ZodObject<{
                 video: "video";
             }>>>;
             compat: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            callHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                from: z.ZodLiteral<"agent.label">;
+                key: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"agent.id">;
+            }, z.core.$strict>, z.ZodObject<{
+                from: z.ZodLiteral<"session.owner">;
+            }, z.core.$strict>], "from">>>;
         }, z.core.$strict>>;
         inputs: z.ZodOptional<z.ZodArray<z.ZodEnum<{
             audio: "audio";
@@ -13663,6 +13699,7 @@ export declare const HostModelView: z.ZodUnion<readonly [z.ZodObject<{
     authType: z.ZodEnum<{
         api_key: "api_key";
         oauth: "oauth";
+        workload: "workload";
     }>;
     baseUrl: z.ZodOptional<z.ZodString>;
     settings: z.ZodOptional<z.ZodObject<{
@@ -13678,6 +13715,15 @@ export declare const HostModelView: z.ZodUnion<readonly [z.ZodObject<{
             video: "video";
         }>>>;
         compat: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        callHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            from: z.ZodLiteral<"agent.label">;
+            key: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            from: z.ZodLiteral<"agent.id">;
+        }, z.core.$strict>, z.ZodObject<{
+            from: z.ZodLiteral<"session.owner">;
+        }, z.core.$strict>], "from">>>;
     }, z.core.$strict>>;
 }, z.core.$strict>]>;
 export declare const PutHostModelRequest: z.ZodObject<{
@@ -13699,6 +13745,15 @@ export declare const PutHostModelRequest: z.ZodObject<{
             video: "video";
         }>>>;
         compat: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        callHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            from: z.ZodLiteral<"agent.label">;
+            key: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            from: z.ZodLiteral<"agent.id">;
+        }, z.core.$strict>, z.ZodObject<{
+            from: z.ZodLiteral<"session.owner">;
+        }, z.core.$strict>], "from">>>;
     }, z.core.$strict>>;
     auth: z.ZodDiscriminatedUnion<[z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
@@ -13709,7 +13764,9 @@ export declare const PutHostModelRequest: z.ZodObject<{
         refresh: z.ZodString;
         access: z.ZodString;
         expires: z.ZodNumber;
-    }, z.core.$loose>], "type">;
+    }, z.core.$loose>, z.ZodObject<{
+        type: z.ZodLiteral<"workload">;
+    }, z.core.$strict>], "type">;
 }, z.core.$strict>;
 export declare const SelectHostModelRequest: z.ZodObject<{
     requestId: z.ZodString;
@@ -13740,6 +13797,7 @@ export declare const PutAgentSecretRequest: z.ZodDiscriminatedUnion<[z.ZodObject
     type: z.ZodLiteral<"bearer">;
     url: z.ZodString;
     value: z.ZodString;
+    toolPrefix: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     via: z.ZodOptional<z.ZodString>;
     identity: z.ZodOptional<z.ZodObject<{
@@ -13749,6 +13807,16 @@ export declare const PutAgentSecretRequest: z.ZodDiscriminatedUnion<[z.ZodObject
     type: z.ZodLiteral<"headers">;
     url: z.ZodString;
     headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    toolPrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    requestId: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"workload">;
+    url: z.ZodString;
+    via: z.ZodString;
+    identity: z.ZodOptional<z.ZodObject<{
+        header: z.ZodString;
+    }, z.core.$strict>>;
+    toolPrefix: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>], "type">;
 export declare const AgentSecretView: z.ZodObject<{
     name: z.ZodString;
@@ -13757,6 +13825,7 @@ export declare const AgentSecretView: z.ZodObject<{
         environment_secret: "environment_secret";
         environment_variable: "environment_variable";
         headers: "headers";
+        workload: "workload";
     }>;
     binding: z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
@@ -13768,6 +13837,7 @@ export declare const AgentSecretView: z.ZodObject<{
     }, z.core.$strict>;
     headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
     via: z.ZodOptional<z.ZodString>;
+    toolPrefix: z.ZodOptional<z.ZodString>;
     identity: z.ZodOptional<z.ZodObject<{
         header: z.ZodString;
     }, z.core.$strict>>;
@@ -13782,6 +13852,7 @@ export declare const ListAgentSecretsResponse: z.ZodObject<{
             environment_secret: "environment_secret";
             environment_variable: "environment_variable";
             headers: "headers";
+            workload: "workload";
         }>;
         binding: z.ZodObject<{
             url: z.ZodOptional<z.ZodString>;
@@ -13793,6 +13864,7 @@ export declare const ListAgentSecretsResponse: z.ZodObject<{
         }, z.core.$strict>;
         headerNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
         via: z.ZodOptional<z.ZodString>;
+        toolPrefix: z.ZodOptional<z.ZodString>;
         identity: z.ZodOptional<z.ZodObject<{
             header: z.ZodString;
         }, z.core.$strict>>;
@@ -16210,6 +16282,7 @@ export declare const HistoryPage: z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
                 server: z.ZodOptional<z.ZodString>;
+                gateway: z.ZodOptional<z.ZodString>;
                 retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
             redacted: z.ZodOptional<z.ZodNumber>;
@@ -18942,6 +19015,7 @@ export declare const HistoryPage: z.ZodObject<{
                 code: z.ZodString;
                 message: z.ZodString;
                 server: z.ZodOptional<z.ZodString>;
+                gateway: z.ZodOptional<z.ZodString>;
                 retryable: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$loose>>;
             redacted: z.ZodOptional<z.ZodNumber>;

package/dist/gates/egress-credentials.js

@@ -19,26 +19,15 @@ import { createServer } from "node:http";
 import { Agent, request } from "node:https";
 import { createSecureContext, TLSSocket } from "node:tls";
 import { hostTuning } from "../tuning.js";
+import { HOP_BY_HOP_HEADERS } from "../vault/headers.js";
 /** The answer to a CONNECT the gate serves; a tunnel's byte counts leave it out. */
 export const CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
-/** Headers that describe one hop and are never forwarded. */
-const HOP_BY_HOP = new Set([
-    "connection",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "proxy-connection",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
 /** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
 function forwardable(raw, drop) {
     const headers = {};
     for (let i = 0; i + 1 < raw.length; i += 2) {
         const name = raw[i].toLowerCase();
-        if (HOP_BY_HOP.has(name) || name === drop)
+        if (HOP_BY_HOP_HEADERS.has(name) || name === drop)
             continue;
         (headers[name] ??= []).push(raw[i + 1]);
     }

package/dist/gates/handler.js

@@ -6,7 +6,7 @@
  * the Tenant's ledger. Logs one line per call, never the prompt, the output or a credential.
  */
 import { classifyThrown } from "../model/classify.js";
-import { callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
+import { callCaller, callFiles, inProcessModelGate, modelCallSettings, serve } from "./in-process.js";
 import { createMeter } from "./meter.js";
 import { GateRefusal } from "./tenant-vaults.js";
 export function createModelCallHandler(options) {
@@ -28,6 +28,7 @@ export function createModelCallHandler(options) {
                     // The Tenant's Runtime limits `model*`, read for this call.
                     settings: await modelCallSettings(vault.store),
                     ...(blobs ? { files: callFiles(vault.store, blobs) } : {}),
+                    caller: callCaller(vault.store),
                 });
                 outcome = await meter.call(vault.store, call, () => serve(vault.store, gate, call, signal));
             }

package/dist/gates/in-process.d.ts

@@ -11,6 +11,7 @@ import type { HostModelSecret } from "../vault/service.js";
 import type { ModelGate, ModelGateRequest } from "./model-gate.js";
 import { type FileResolver } from "../artifacts/files.js";
 import type { BlobStore } from "../blob/index.js";
+import type { ModelCaller } from "../model/call-headers.js";
 export interface InProcessModelGateOptions {
     /** The Tenant's home: `piModel` redacts secrets it finds there from failure messages. */
     readonly root?: string;
@@ -20,6 +21,8 @@ export interface InProcessModelGateOptions {
     readonly settings?: ModelCallSettings;
     /** Reads the files a call's prompt names (protocol 6): artifacts, for model-gate. */
     readonly files?: (request: ModelGateRequest) => FileResolver;
+    /** Reads who makes a call, for a custom endpoint's per-call headers (#493). */
+    readonly caller?: (request: ModelGateRequest) => Promise<ModelCaller | undefined>;
 }
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
@@ -27,6 +30,12 @@ export interface InProcessModelGateOptions {
  * gate's route puts on the request (F5). A request without a session reads no file at all.
  */
 export declare function callFiles(store: SessionStore, blobs: BlobStore): (request: Pick<ModelGateRequest, "sessionId">) => FileResolver;
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export declare function callCaller(store: SessionStore): (request: Pick<ModelGateRequest, "sessionId">) => Promise<ModelCaller | undefined>;
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the

package/dist/gates/in-process.js

@@ -5,6 +5,7 @@ import { createMeter } from "./meter.js";
 import { artifactFiles } from "../artifacts/files.js";
 import { usesFixtureModel } from "../tenant/model-setting.js";
 import { fixtureAnswer } from "./fixture-model.js";
+import { isSubject } from "@nylorun/core/contracts";
 /**
  * The files a call names, from the Tenant's artifacts, limited to the call's session: in
  * process, the loop's own request; over HTTP, the session of the run token's claims, which the
@@ -13,6 +14,24 @@ import { fixtureAnswer } from "./fixture-model.js";
 export function callFiles(store, blobs) {
     return (request) => artifactFiles({ store, blobs, sessionId: request.sessionId });
 }
+/**
+ * Who makes a call, from the Tenant's store: the Agent its session runs on, with its labels, and
+ * the session's owner when it is a person. The session is the loop's own in process, and the run
+ * token's over HTTP; the request's `agentId` names the manifest's agent, not the Agent.
+ */
+export function callCaller(store) {
+    return (request) => store.tx(async (t) => {
+        const session = await t.get("sessions", request.sessionId);
+        const agent = session && (await t.environment(session.agentId));
+        if (!session || !agent)
+            return undefined;
+        return {
+            agentId: agent.id,
+            labels: agent.labels,
+            ...(isSubject(session.ownerUserId) ? { owner: session.ownerUserId } : {}),
+        };
+    });
+}
 /**
  * The in-process gate of an open Tenant: reads its host model from its own vault and records
  * each call in its usage ledger. Only a Runtime without the gates service (embedding, the
@@ -30,6 +49,7 @@ export function tenantModelGate(options) {
                 writeHostCredential: (credential) => vault.updateHostCredential(credential),
                 settings: await modelCallSettings(options.store),
                 ...(options.blobs ? { files: callFiles(options.store, options.blobs) } : {}),
+                caller: callCaller(options.store),
             });
             return serve(options.store, gate, request, signal);
         }),
@@ -58,6 +78,7 @@ export function inProcessModelGate(options) {
                 writeHostCredential: options.writeHostCredential,
                 ...(options.settings ? { settings: options.settings } : {}),
                 ...(options.files ? { files: options.files(request) } : {}),
+                ...(options.caller ? { caller: () => options.caller(request) } : {}),
             });
             return adapter(request.call, {
                 // The Runtime never journals the provider request (harness `durable.ts`), and

package/dist/host/main.js

@@ -65,6 +65,7 @@ import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
 import { retry } from "../retry.js";
 import { hostTuning, useHostTuning } from "../tuning.js";
+import { useWorkloadToken } from "../vault/workload-token.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -218,6 +219,7 @@ export async function main() {
     // Read once, before any service starts: each reads the parts it uses where it uses them.
     if (stack.tuning)
         useHostTuning(stack.tuning.values, stack.tuning.overrides);
+    useWorkloadToken(stack.workloadToken ?? {});
     if (stack.services.has("gates") || stack.services.has("keys") || stack.services.has("egress"))
         return runGates(stack);
     if (stack.services.has("harness"))

package/dist/host/stack-config.d.ts

@@ -178,6 +178,16 @@ export interface HarnessServiceConfig {
 export interface StackConfig {
     /** The Runtime services this process runs. */
     services: RuntimeServices;
+    /**
+     * `NYLORUN_WORKLOAD_TOKEN_FILE`, the file of the Runtime's workload token, which a platform
+     * rotates and the Runtime reads at each use, and `NYLORUN_WORKLOAD_TOKEN_ORIGINS`, the
+     * comma-separated origins a `workload` credential's `via` may send it to (#496,
+     * `vault/workload-token.ts`). Absent: no workload token.
+     */
+    workloadToken?: {
+        file?: string;
+        origins?: string[];
+    };
     /** Present when the process runs gates. */
     gates?: GatesConfig;
     /** Present when the process runs egress. */

package/dist/host/stack-config.js

@@ -47,6 +47,7 @@
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
+import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
@@ -325,6 +326,7 @@ export function parseStackConfig(env, argv) {
         throw new StackConfigError("NYLORUN_HARNESS_LISTEN_PORT must differ from NYLORUN_LISTEN_PORT");
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
+    const workloadToken = parseWorkloadToken(env);
     const objectStore = parseObjectStore(env);
     const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
@@ -347,6 +349,7 @@ export function parseStackConfig(env, argv) {
         ...(sandboxes ? { sandboxes } : {}),
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
+        ...(workloadToken ? { workloadToken } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
         ...(tuning ? { tuning } : {}),
@@ -454,6 +457,39 @@ function parseTenant(env) {
         ...(managementKeyFile ? { managementKeyFile } : {}),
     };
 }
+/**
+ * `StackConfig.workloadToken` (#496): the Runtime's workload token, which the gates read for a
+ * custom model and for `workload` credentials, and the in-process Tenant does without them.
+ */
+function parseWorkloadToken(env) {
+    const file = read(env, "NYLORUN_WORKLOAD_TOKEN_FILE");
+    const origins = parseOrigins(read(env, "NYLORUN_WORKLOAD_TOKEN_ORIGINS"));
+    if (file === undefined && origins === undefined)
+        return undefined;
+    return { ...(file ? { file } : {}), ...(origins ? { origins } : {}) };
+}
+/** `NYLORUN_WORKLOAD_TOKEN_ORIGINS`: each an `https` origin (`http` only to a loopback host). */
+function parseOrigins(raw) {
+    if (raw === undefined)
+        return undefined;
+    return raw
+        .split(",")
+        .map((item) => item.trim())
+        .filter((item) => item !== "")
+        .map((item) => {
+        let url;
+        try {
+            url = new URL(item);
+        }
+        catch {
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} is not a URL`);
+        }
+        const loopback = url.protocol === "http:" && LOOPBACK_HOSTS.test(url.hostname);
+        if ((url.protocol !== "https:" && !loopback) || url.origin !== item.replace(/\/$/, ""))
+            throw new StackConfigError(`NYLORUN_WORKLOAD_TOKEN_ORIGINS: ${item} must be an https origin, such as https://gateway.example.com`);
+        return url.origin;
+    });
+}
 const GATES_TOKEN = /^[0-9a-f]{64,}$/i;
 /** `NYLORUN_HARNESS`: `in-process` (the default when unset) or `remote`. */
 function parseHarnessMode(env) {