@nylorun/runtime 0.29.0-beta → 0.30.0-beta

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/dist/api/components.d.ts +76 -2
  3. package/dist/gates/egress-credentials.js +2 -13
  4. package/dist/gates/handler.js +2 -1
  5. package/dist/gates/in-process.d.ts +9 -0
  6. package/dist/gates/in-process.js +21 -0
  7. package/dist/host/main.js +2 -0
  8. package/dist/host/stack-config.d.ts +10 -0
  9. package/dist/host/stack-config.js +36 -0
  10. package/dist/management-openapi.json +359 -5
  11. package/dist/mcp/connect.d.ts +34 -5
  12. package/dist/mcp/connect.js +75 -14
  13. package/dist/mcp/gateway-outcomes.d.ts +14 -0
  14. package/dist/mcp/gateway-outcomes.js +46 -0
  15. package/dist/mcp/pool.js +5 -0
  16. package/dist/model/call-headers.d.ts +15 -0
  17. package/dist/model/call-headers.js +9 -0
  18. package/dist/model/models.d.ts +7 -0
  19. package/dist/model/models.js +3 -0
  20. package/dist/model/pi-model.d.ts +6 -0
  21. package/dist/model/pi-model.js +29 -3
  22. package/dist/openapi.json +79 -2
  23. package/dist/store/postgres/schema.d.ts +2 -2
  24. package/dist/store/postgres/schema.js +1 -1
  25. package/dist/tenant/agents.js +7 -3
  26. package/dist/tenant/transcript.d.ts +8 -0
  27. package/dist/tenant/transcript.js +2 -0
  28. package/dist/vault/headers.d.ts +8 -0
  29. package/dist/vault/headers.js +25 -0
  30. package/dist/vault/host-model.js +8 -5
  31. package/dist/vault/service.d.ts +12 -5
  32. package/dist/vault/service.js +43 -6
  33. package/dist/vault/sources.js +22 -1
  34. package/dist/vault/workload-token.d.ts +16 -0
  35. package/dist/vault/workload-token.js +58 -0
  36. package/dist/version.d.ts +1 -1
  37. package/dist/version.js +1 -1
  38. package/package.json +3 -3
package/dist/management-openapi.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "openapi": "3.2.0",
3
3
  "info": {
4
4
  "title": "Nylorun Management API",
5
- "version": "0.29.0-beta",
5
+ "version": "0.30.0-beta",
6
6
  "x-nylorun-protocol": {
7
7
  "min": 16,
8
8
  "max": 18,
@@ -32,7 +32,8 @@
32
32
  "environment-disk-versions",
33
33
  "tool-policy",
34
34
  "traces",
35
- "artifact-reads"
35
+ "artifact-reads",
36
+ "gateway-credentials"
36
37
  ]
37
38
  },
38
39
  "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."
@@ -423,7 +424,8 @@
423
424
  "type": "string",
424
425
  "enum": [
425
426
  "api_key",
426
- "oauth"
427
+ "oauth",
428
+ "workload"
427
429
  ]
428
430
  },
429
431
  "baseUrl": {
@@ -460,6 +462,70 @@
460
462
  "compat": {
461
463
  "type": "object",
462
464
  "additionalProperties": {}
465
+ },
466
+ "headers": {
467
+ "type": "object",
468
+ "additionalProperties": {
469
+ "type": "string",
470
+ "minLength": 1
471
+ }
472
+ },
473
+ "callHeaders": {
474
+ "type": "object",
475
+ "additionalProperties": {
476
+ "oneOf": [
477
+ {
478
+ "type": "object",
479
+ "properties": {
480
+ "from": {
481
+ "type": "string",
482
+ "enum": [
483
+ "agent.label"
484
+ ]
485
+ },
486
+ "key": {
487
+ "type": "string",
488
+ "minLength": 1
489
+ }
490
+ },
491
+ "required": [
492
+ "from",
493
+ "key"
494
+ ],
495
+ "additionalProperties": false
496
+ },
497
+ {
498
+ "type": "object",
499
+ "properties": {
500
+ "from": {
501
+ "type": "string",
502
+ "enum": [
503
+ "agent.id"
504
+ ]
505
+ }
506
+ },
507
+ "required": [
508
+ "from"
509
+ ],
510
+ "additionalProperties": false
511
+ },
512
+ {
513
+ "type": "object",
514
+ "properties": {
515
+ "from": {
516
+ "type": "string",
517
+ "enum": [
518
+ "session.owner"
519
+ ]
520
+ }
521
+ },
522
+ "required": [
523
+ "from"
524
+ ],
525
+ "additionalProperties": false
526
+ }
527
+ ]
528
+ }
463
529
  }
464
530
  },
465
531
  "additionalProperties": false
@@ -930,6 +996,70 @@
930
996
  "compat": {
931
997
  "type": "object",
932
998
  "additionalProperties": {}
999
+ },
1000
+ "headers": {
1001
+ "type": "object",
1002
+ "additionalProperties": {
1003
+ "type": "string",
1004
+ "minLength": 1
1005
+ }
1006
+ },
1007
+ "callHeaders": {
1008
+ "type": "object",
1009
+ "additionalProperties": {
1010
+ "oneOf": [
1011
+ {
1012
+ "type": "object",
1013
+ "properties": {
1014
+ "from": {
1015
+ "type": "string",
1016
+ "enum": [
1017
+ "agent.label"
1018
+ ]
1019
+ },
1020
+ "key": {
1021
+ "type": "string",
1022
+ "minLength": 1
1023
+ }
1024
+ },
1025
+ "required": [
1026
+ "from",
1027
+ "key"
1028
+ ],
1029
+ "additionalProperties": false
1030
+ },
1031
+ {
1032
+ "type": "object",
1033
+ "properties": {
1034
+ "from": {
1035
+ "type": "string",
1036
+ "enum": [
1037
+ "agent.id"
1038
+ ]
1039
+ }
1040
+ },
1041
+ "required": [
1042
+ "from"
1043
+ ],
1044
+ "additionalProperties": false
1045
+ },
1046
+ {
1047
+ "type": "object",
1048
+ "properties": {
1049
+ "from": {
1050
+ "type": "string",
1051
+ "enum": [
1052
+ "session.owner"
1053
+ ]
1054
+ }
1055
+ },
1056
+ "required": [
1057
+ "from"
1058
+ ],
1059
+ "additionalProperties": false
1060
+ }
1061
+ ]
1062
+ }
933
1063
  }
934
1064
  },
935
1065
  "additionalProperties": false
@@ -990,6 +1120,21 @@
990
1120
  "expires"
991
1121
  ],
992
1122
  "additionalProperties": {}
1123
+ },
1124
+ {
1125
+ "type": "object",
1126
+ "properties": {
1127
+ "type": {
1128
+ "type": "string",
1129
+ "enum": [
1130
+ "workload"
1131
+ ]
1132
+ }
1133
+ },
1134
+ "required": [
1135
+ "type"
1136
+ ],
1137
+ "additionalProperties": false
993
1138
  }
994
1139
  ]
995
1140
  }
@@ -2505,7 +2650,8 @@
2505
2650
  "type": "string",
2506
2651
  "enum": [
2507
2652
  "api_key",
2508
- "oauth"
2653
+ "oauth",
2654
+ "workload"
2509
2655
  ]
2510
2656
  },
2511
2657
  "baseUrl": {
@@ -2542,6 +2688,70 @@
2542
2688
  "compat": {
2543
2689
  "type": "object",
2544
2690
  "additionalProperties": {}
2691
+ },
2692
+ "headers": {
2693
+ "type": "object",
2694
+ "additionalProperties": {
2695
+ "type": "string",
2696
+ "minLength": 1
2697
+ }
2698
+ },
2699
+ "callHeaders": {
2700
+ "type": "object",
2701
+ "additionalProperties": {
2702
+ "oneOf": [
2703
+ {
2704
+ "type": "object",
2705
+ "properties": {
2706
+ "from": {
2707
+ "type": "string",
2708
+ "enum": [
2709
+ "agent.label"
2710
+ ]
2711
+ },
2712
+ "key": {
2713
+ "type": "string",
2714
+ "minLength": 1
2715
+ }
2716
+ },
2717
+ "required": [
2718
+ "from",
2719
+ "key"
2720
+ ],
2721
+ "additionalProperties": false
2722
+ },
2723
+ {
2724
+ "type": "object",
2725
+ "properties": {
2726
+ "from": {
2727
+ "type": "string",
2728
+ "enum": [
2729
+ "agent.id"
2730
+ ]
2731
+ }
2732
+ },
2733
+ "required": [
2734
+ "from"
2735
+ ],
2736
+ "additionalProperties": false
2737
+ },
2738
+ {
2739
+ "type": "object",
2740
+ "properties": {
2741
+ "from": {
2742
+ "type": "string",
2743
+ "enum": [
2744
+ "session.owner"
2745
+ ]
2746
+ }
2747
+ },
2748
+ "required": [
2749
+ "from"
2750
+ ],
2751
+ "additionalProperties": false
2752
+ }
2753
+ ]
2754
+ }
2545
2755
  }
2546
2756
  },
2547
2757
  "additionalProperties": false
@@ -2620,7 +2830,8 @@
2620
2830
  "type": "string",
2621
2831
  "enum": [
2622
2832
  "api_key",
2623
- "oauth"
2833
+ "oauth",
2834
+ "workload"
2624
2835
  ]
2625
2836
  },
2626
2837
  "baseUrl": {
@@ -2657,6 +2868,70 @@
2657
2868
  "compat": {
2658
2869
  "type": "object",
2659
2870
  "additionalProperties": {}
2871
+ },
2872
+ "headers": {
2873
+ "type": "object",
2874
+ "additionalProperties": {
2875
+ "type": "string",
2876
+ "minLength": 1
2877
+ }
2878
+ },
2879
+ "callHeaders": {
2880
+ "type": "object",
2881
+ "additionalProperties": {
2882
+ "oneOf": [
2883
+ {
2884
+ "type": "object",
2885
+ "properties": {
2886
+ "from": {
2887
+ "type": "string",
2888
+ "enum": [
2889
+ "agent.label"
2890
+ ]
2891
+ },
2892
+ "key": {
2893
+ "type": "string",
2894
+ "minLength": 1
2895
+ }
2896
+ },
2897
+ "required": [
2898
+ "from",
2899
+ "key"
2900
+ ],
2901
+ "additionalProperties": false
2902
+ },
2903
+ {
2904
+ "type": "object",
2905
+ "properties": {
2906
+ "from": {
2907
+ "type": "string",
2908
+ "enum": [
2909
+ "agent.id"
2910
+ ]
2911
+ }
2912
+ },
2913
+ "required": [
2914
+ "from"
2915
+ ],
2916
+ "additionalProperties": false
2917
+ },
2918
+ {
2919
+ "type": "object",
2920
+ "properties": {
2921
+ "from": {
2922
+ "type": "string",
2923
+ "enum": [
2924
+ "session.owner"
2925
+ ]
2926
+ }
2927
+ },
2928
+ "required": [
2929
+ "from"
2930
+ ],
2931
+ "additionalProperties": false
2932
+ }
2933
+ ]
2934
+ }
2660
2935
  }
2661
2936
  },
2662
2937
  "additionalProperties": false
@@ -2727,6 +3002,70 @@
2727
3002
  "compat": {
2728
3003
  "type": "object",
2729
3004
  "additionalProperties": {}
3005
+ },
3006
+ "headers": {
3007
+ "type": "object",
3008
+ "additionalProperties": {
3009
+ "type": "string",
3010
+ "minLength": 1
3011
+ }
3012
+ },
3013
+ "callHeaders": {
3014
+ "type": "object",
3015
+ "additionalProperties": {
3016
+ "oneOf": [
3017
+ {
3018
+ "type": "object",
3019
+ "properties": {
3020
+ "from": {
3021
+ "type": "string",
3022
+ "enum": [
3023
+ "agent.label"
3024
+ ]
3025
+ },
3026
+ "key": {
3027
+ "type": "string",
3028
+ "minLength": 1
3029
+ }
3030
+ },
3031
+ "required": [
3032
+ "from",
3033
+ "key"
3034
+ ],
3035
+ "additionalProperties": false
3036
+ },
3037
+ {
3038
+ "type": "object",
3039
+ "properties": {
3040
+ "from": {
3041
+ "type": "string",
3042
+ "enum": [
3043
+ "agent.id"
3044
+ ]
3045
+ }
3046
+ },
3047
+ "required": [
3048
+ "from"
3049
+ ],
3050
+ "additionalProperties": false
3051
+ },
3052
+ {
3053
+ "type": "object",
3054
+ "properties": {
3055
+ "from": {
3056
+ "type": "string",
3057
+ "enum": [
3058
+ "session.owner"
3059
+ ]
3060
+ }
3061
+ },
3062
+ "required": [
3063
+ "from"
3064
+ ],
3065
+ "additionalProperties": false
3066
+ }
3067
+ ]
3068
+ }
2730
3069
  }
2731
3070
  },
2732
3071
  "additionalProperties": false
@@ -2787,6 +3126,21 @@
2787
3126
  "expires"
2788
3127
  ],
2789
3128
  "additionalProperties": {}
3129
+ },
3130
+ {
3131
+ "type": "object",
3132
+ "properties": {
3133
+ "type": {
3134
+ "type": "string",
3135
+ "enum": [
3136
+ "workload"
3137
+ ]
3138
+ }
3139
+ },
3140
+ "required": [
3141
+ "type"
3142
+ ],
3143
+ "additionalProperties": false
2790
3144
  }
2791
3145
  ]
2792
3146
  }
package/dist/mcp/connect.d.ts CHANGED
@@ -42,6 +42,8 @@ export interface McpToolPage {
42
42
  readonly annotations?: Readonly<Record<string, unknown>>;
43
43
  }[];
44
44
  readonly nextCursor?: string;
45
+ /** What the server, or a gateway in front of it, says besides the tools (MCP `_meta`). */
46
+ readonly _meta?: Readonly<Record<string, unknown>>;
45
47
  }
46
48
  /**
47
49
  * A `tools/call` answer: the raw `CallToolResult`, with each credential value sent for the call
@@ -90,6 +92,8 @@ export type McpToolFailure = {
90
92
  readonly retryable?: boolean;
91
93
  /** With `credential_rejected`: the server. */
92
94
  readonly server?: string;
95
+ /** With `credential_rejected` of the workload token: the gateway that refused it (#496). */
96
+ readonly gateway?: string;
93
97
  /** How many credential values the message had in it, replaced (R2b C8). */
94
98
  readonly redacted?: number;
95
99
  };
@@ -103,7 +107,8 @@ export type McpToolOutcome = {
103
107
  * How a tool call failed at the transport or the server (R2b C7), as the gate answers it:
104
108
  * - `mcp.unreachable`: never sent (address policy, DNS, refused connection, TLS, a connection
105
109
  * that could not be opened). Calling again may work.
106
- * - `credential_rejected`: the server answered `401` (C1).
110
+ * - `credential_rejected`: the server answered `401` (C1), or the gateway of a credential's `via`
111
+ * reported that the server behind it did (#495).
107
112
  * - `mcp.forbidden`: the server answered `403`.
108
113
  * - `mcp.error`: the server answered a JSON-RPC error; the message has its code.
109
114
  * - `mcp.status`: the server answered another HTTP error status, without a JSON-RPC error.
@@ -121,6 +126,8 @@ export interface McpCallFailure {
121
126
  readonly retryable: boolean;
122
127
  /** With `credential_rejected`: the server. */
123
128
  readonly server?: string;
129
+ /** With `credential_rejected` of the workload token: the gateway that refused it (#496). */
130
+ readonly gateway?: string;
124
131
  /** How many credential values the message had in it, replaced (R2b C8). */
125
132
  readonly redacted?: number;
126
133
  }
@@ -136,7 +143,8 @@ export declare class McpCallFailed extends Error {
136
143
  }
137
144
  /**
138
145
  * A request the server answered `401` (R2b C1): it rejected the vault's credential, or wanted one
139
- * and got none. Never retried, since nothing the gate holds changes between tries (Q4). A tool
146
+ * and got none. Through a credential's `via`, also a gateway's answer reporting that the server
147
+ * behind it did (`gateway-outcomes.ts`, #495). Never retried, since nothing the gate holds changes between tries (Q4). A tool
140
148
  * call that meets it fails with `credential_rejected` for the model to see; at discovery it is the
141
149
  * server's `failed` diagnostic.
142
150
  */
@@ -149,6 +157,8 @@ export declare class CredentialRejected extends McpCallFailed {
149
157
  * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
150
158
  */
151
159
  readonly challenge?: string | undefined;
160
+ /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
161
+ readonly gateway?: string | undefined;
152
162
  constructor(server: string,
153
163
  /** Whether a credential of the session's Agent was sent. */
154
164
  sent: boolean,
@@ -156,7 +166,9 @@ export declare class CredentialRejected extends McpCallFailed {
156
166
  * The answer's `WWW-Authenticate`, which may name the server's protected-resource metadata
157
167
  * (RFC 9728 `resource_metadata`): a tool preview reads it (R2b C12). Never shown to the model.
158
168
  */
159
- challenge?: string | undefined);
169
+ challenge?: string | undefined,
170
+ /** The gateway at `via` that refused the Runtime's workload token (#496): an expired or unrotated token. */
171
+ gateway?: string | undefined);
160
172
  }
161
173
  /**
162
174
  * A request its connection can no longer make, refused before it reached a tool: the server
@@ -180,12 +192,27 @@ export declare function unreachable(server: string, error: unknown, chars?: numb
180
192
  * so a server that reads it can run the call once.
181
193
  */
182
194
  export declare const IDEMPOTENCY_META_KEY = "nylorun/idempotency-key";
195
+ /** How a connection reaches its server through a gateway: the credential's routing. */
196
+ export interface GatewayRouting {
197
+ /** Where the server's requests go (the credential's `via`). */
198
+ readonly via: string;
199
+ /** What the gateway puts before each tool name it lists (the credential's `toolPrefix`, #494). */
200
+ readonly toolPrefix?: string;
201
+ }
202
+ /**
203
+ * Where a `tools/list` page names the tools a gateway listed without the credential's
204
+ * `toolPrefix` (#494): kept under their listed names, for discovery's diagnostic.
205
+ */
206
+ export declare const UNPREFIXED_TOOLS_META_KEY = "nylorun/unprefixed-tools";
183
207
  /**
184
208
  * An SDK `Client` as an `McpClient`. Its answers and failures carry no credential value sent
185
209
  * with them (R2b C8), and a failed call is an `McpCallFailed` (C7). A keyed call sends its key in
186
- * `_meta` (R5.5).
210
+ * `_meta` (R5.5). Through a `gateway`, an answer that reports the server refused the credential
211
+ * is `CredentialRejected`, as a `401` is (#495), and a gateway's `toolPrefix` is taken off the
212
+ * tools it lists and put back on the calls (#494): everything after this client names the
213
+ * server's own tools.
187
214
  */
188
- export declare function sdkClient(client: Client, serverName: string, errorChars: number): McpClient;
215
+ export declare function sdkClient(client: Client, serverName: string, errorChars: number, gateway?: GatewayRouting): McpClient;
189
216
  export declare function openMcpServer(input: {
190
217
  server: McpServerManifest;
191
218
  authorize: (url: string) => Promise<AuthorizeResult>;
@@ -225,6 +252,8 @@ export declare function listMcpTools(client: McpClient, input: {
225
252
  omitted: string[];
226
253
  disabled: number;
227
254
  unknownTools: string[];
255
+ /** The tools a gateway listed without the credential's `toolPrefix`, as it named them (#494). */
256
+ unprefixed: string[];
228
257
  }>;
229
258
  /**
230
259
  * One tool call and what it came to. Rejects with `McpConnectionStale` when the connection must