@nylorun/runtime 0.29.0-beta → 0.30.0-beta

package/dist/tenant/transcript.d.ts

@@ -186,6 +186,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -208,6 +209,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -230,6 +232,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -252,6 +255,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -344,6 +348,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -368,6 +373,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -392,6 +398,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;
@@ -416,6 +423,7 @@ export declare function toolCompleted(request: HostEffect, value: unknown, facts
         code: string;
         message: string;
         server?: string | undefined;
+        gateway?: string | undefined;
         retryable?: boolean | undefined;
     };
     output?: undefined;

package/dist/tenant/transcript.js

@@ -151,6 +151,8 @@ export function toolCompleted(request, value, facts) {
                 message: String(outcome.message ?? ""),
                 // `credential_rejected` (R2b C1): which server.
                 ...(typeof outcome.server === "string" ? { server: outcome.server } : {}),
+                // And the gateway that refused the Runtime's workload token (#496).
+                ...(typeof outcome.gateway === "string" ? { gateway: outcome.gateway } : {}),
                 ...(typeof outcome.retryable === "boolean" ? { retryable: outcome.retryable } : {}),
             },
         }

package/dist/vault/headers.d.ts

@@ -1,3 +1,11 @@
+/** Headers that describe one hop and are never forwarded or set by a credential or a setting. */
+export declare const HOP_BY_HOP_HEADERS: ReadonlySet<string>;
+/**
+ * Why a custom model endpoint's header (`settings.headers`, `settings.callHeaders`, #493) may not
+ * be `name`, or undefined when it may: the API key's `authorization`, a hop-by-hop header, a
+ * transport header or `Nylorun-*`.
+ */
+export declare function modelHeaderError(name: string): string | undefined;
 /**
  * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
  * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names

package/dist/vault/headers.js

@@ -18,6 +18,31 @@ const RESERVED_HEADERS = new Set([
     "last-event-id",
     "idempotency-key",
 ]);
+/** Headers that describe one hop and are never forwarded or set by a credential or a setting. */
+export const HOP_BY_HOP_HEADERS = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/**
+ * Why a custom model endpoint's header (`settings.headers`, `settings.callHeaders`, #493) may not
+ * be `name`, or undefined when it may: the API key's `authorization`, a hop-by-hop header, a
+ * transport header or `Nylorun-*`.
+ */
+export function modelHeaderError(name) {
+    const lower = name.toLowerCase();
+    if (lower === "authorization")
+        return "A model header may not set authorization: the model's auth sends it";
+    if (HOP_BY_HOP_HEADERS.has(lower) || isReservedHeader(lower))
+        return `A model header may not set ${lower}`;
+    return undefined;
+}
 /**
  * The secret values of a credential's `headers`, as a server could echo them (R2b C8, Q16): each
  * value of at least 8 characters, and the token of a `Bearer …` value. The identity header names

package/dist/vault/host-model.js

@@ -24,11 +24,14 @@ export class HostModelVault {
         const payload = readHostPayload(this.kek(), row, binding);
         const credential = binding.authType === "oauth"
             ? { type: "oauth", ...payload.oauth }
-            : {
-                type: "api_key",
-                key: payload.apiKey,
-                ...(payload.env ? { env: payload.env } : {}),
-            };
+            : binding.authType === "workload"
+                ? // The workload token is read from its file at each call (#496), never stored.
+                    { type: "workload" }
+                : {
+                    type: "api_key",
+                    key: payload.apiKey,
+                    ...(payload.env ? { env: payload.env } : {}),
+                };
         return {
             provider: binding.provider,
             model: binding.model,

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -10,9 +10,9 @@ export type HostModelSecret = {
     settings?: CustomModelSettings;
     /** The inputs the operator added to catalog models, by `<provider>/<model>` (protocol 12). */
     addedInputs?: Readonly<Record<string, readonly ModelInput[]>>;
-    authType: "api_key" | "oauth";
+    authType: HostModelAuthType;
     credential: {
-        type: "api_key" | "oauth";
+        type: HostModelAuthType;
         key?: string;
         env?: Record<string, string>;
         refresh?: string;
@@ -22,7 +22,7 @@ export type HostModelSecret = {
     };
 };
 type UserCredentialRow = VaultCredentialRow & {
-    type: "bearer" | "headers" | "environment_secret" | "environment_variable";
+    type: "bearer" | "headers" | "workload" | "environment_secret" | "environment_variable";
 };
 /**
  * A fork's secrets sealed for its new vault (`sealEnvironmentSecretCopies`): each copy's
@@ -54,6 +54,13 @@ export type AuthorizeResult = {
     headers: Record<string, string>;
     /** Where the request goes instead of `url` (a gateway), when the credential has one. */
     via?: string;
+    /** How the gateway at `via` prefixes the server's tool names, when it does. */
+    toolPrefix?: string;
+    /**
+     * A `workload` credential (#496): `sessionCredentials` adds the Runtime's workload token as
+     * the bearer, on the gate side, where `via`'s origin is one the operator lists.
+     */
+    workload?: true;
     /** The header that names the session owner; `sessionCredentials` adds it. */
     identity?: CredentialIdentity;
 } | {
@@ -195,7 +202,7 @@ type ModelBinding = {
     model: string;
     baseUrl?: string;
     settings?: CustomModelSettings;
-    authType: "api_key" | "oauth";
+    authType: HostModelAuthType;
 };
 type HostSecretPayload = {
     apiKey?: string;

package/dist/vault/service.js

@@ -83,7 +83,7 @@ import { canonical } from "../store/canonical.js";
 import { decryptSecret, encryptSecret, VaultCryptoError } from "./crypto.js";
 import { VaultError } from "./error.js";
 import { credentialNeeds } from "./coverage.js";
-import { checkCredentialHeaders } from "./headers.js";
+import { checkCredentialHeaders, modelHeaderError } from "./headers.js";
 import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
 import { inputsError } from "../model/capabilities.js";
 import { readAddedInputs } from "../tenant/model-setting.js";
@@ -247,7 +247,8 @@ export class VaultService {
             ({ payload, binding } = environmentCredential(name, body));
         else {
             const url = normalizeVaultUrl(body.url);
-            payload = payloadOf(body);
+            // A workload credential holds no value: the bearer is the Runtime's workload token (#496).
+            payload = body.type === "workload" ? {} : payloadOf(body);
             binding = bindingOf(url, payload, body);
         }
         const kek = this.kek();
@@ -466,6 +467,8 @@ export class VaultService {
             url,
             headers,
             ...(binding.via === undefined ? {} : { via: binding.via }),
+            ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+            ...(row.type === "workload" ? { workload: true } : {}),
             ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         };
     }
@@ -541,15 +544,20 @@ export class VaultService {
         const kek = this.kek();
         return this.store.tx((t) => this.replay(t, `host-model:${body.idempotencyKey}`, body, async () => {
             this.validateHostModel(body);
+            if (body.auth.type === "workload" && body.provider !== "custom")
+                throw new VaultError(400, "The workload token authenticates a custom provider only.");
             await this.ensureHostVault(t);
             const credentialId = hostModelCredentialId(body.provider);
             await this.deleteHostProviderRows(t, body.provider);
+            // The workload token is read on every call and never stored (#496).
             const payload = body.auth.type === "api_key"
                 ? {
                     apiKey: body.auth.key,
                     ...(body.auth.env ? { env: body.auth.env } : {}),
                 }
-                : { oauth: body.auth };
+                : body.auth.type === "oauth"
+                    ? { oauth: body.auth }
+                    : {};
             await this.insertHostCredential(t, kek, {
                 id: credentialId,
                 provider: body.provider,
@@ -673,6 +681,7 @@ export class VaultService {
             }
             if (!["http:", "https:"].includes(url.protocol))
                 throw new VaultError(400, "Base URL must be an HTTP(S) URL.");
+            checkModelHeaders(body.settings);
             return;
         }
         if (body.baseUrl)
@@ -800,8 +809,9 @@ function conflictOf(type, binding, others) {
                 });
         }
     }
-    else if (type === "bearer" || type === "headers") {
-        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers") && credentialBinding(row).url === binding.url);
+    else if (type === "bearer" || type === "headers" || type === "workload") {
+        const existing = others.find((row) => (row.type === "bearer" || row.type === "headers" || row.type === "workload") &&
+            credentialBinding(row).url === binding.url);
         if (existing)
             throw new VaultError(409, `${existing.name} is already bound to ${binding.url}`, {
                 code: "credential_conflict",
@@ -828,6 +838,7 @@ function secretViewOf(row) {
                 : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
         ...(binding.via === undefined ? {} : { via: binding.via }),
+        ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
@@ -909,6 +920,23 @@ export function readHostPayload(kek, row, binding) {
         plaintext.fill(0);
     }
 }
+/**
+ * A custom endpoint's `headers` and `callHeaders` (#493): no name the model's auth or the
+ * transport sets, and each name once across both maps, whatever its case.
+ */
+function checkModelHeaders(settings) {
+    const names = [...Object.keys(settings?.headers ?? {}), ...Object.keys(settings?.callHeaders ?? {})];
+    const seen = new Set();
+    for (const name of names) {
+        const refused = modelHeaderError(name);
+        if (refused)
+            throw new VaultError(400, refused);
+        const lower = name.toLowerCase();
+        if (seen.has(lower))
+            throw new VaultError(400, `The model header ${lower} is set twice`);
+        seen.add(lower);
+    }
+}
 /** The sealed part of a tool credential: a token, or a header map with lower-cased names. */
 function payloadOf(auth) {
     if (auth.type === "bearer")
@@ -924,12 +952,16 @@ function bindingOf(url, payload, routing) {
     return {
         url,
         ...(routing.via ? { via: routing.via } : {}),
+        ...(routing.via && routing.toolPrefix ? { toolPrefix: routing.toolPrefix } : {}),
         ...(routing.identity ? { identity: { header: routing.identity.header.toLowerCase() } } : {}),
         ...(payload.headers ? { headerNames: sent } : {}),
     };
 }
 /** The headers a credential sends, or undefined when its payload holds none. */
 function sendHeaders(row, payload) {
+    // Its bearer is the Runtime's workload token, which `sessionCredentials` adds.
+    if (row.type === "workload")
+        return {};
     if (row.type === "headers")
         return payload.headers && Object.keys(payload.headers).length > 0
             ? { ...payload.headers }
@@ -999,7 +1031,12 @@ function rebind(name, slot, row, payload, binding) {
             return undefined;
         const sealed = payloadOf(auth);
         const routing = slot;
-        return { type, payload: sealed, binding: bindingOf(normalizeVaultUrl(routing.url), sealed, routing) };
+        // The gateway's tool prefix is the vault's, not the slot's: it stays while the slot keeps `via`.
+        return {
+            type,
+            payload: sealed,
+            binding: bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, toolPrefix: binding.toolPrefix ?? null }),
+        };
     }
     catch (error) {
         if (error instanceof VaultError)

package/dist/vault/sources.js

@@ -8,6 +8,7 @@
  * and Tool Gate). The session comes from its row, never from the harness.
  */
 import { isSubject } from "@nylorun/core/contracts";
+import { workloadOriginRefused, workloadToken, WorkloadTokenUnavailable } from "./workload-token.js";
 /**
  * The credential of one request made for `session`: the answer of its Environment's vault
  * (`VaultService.authorize`). A credential with an identity header (R2b C2)
@@ -16,11 +17,12 @@ import { isSubject } from "@nylorun/core/contracts";
  * person (the reserved `installation`) sends none (Q3).
  */
 export async function sessionCredentials(vault, session, request) {
-    const result = await vault.authorize({
+    const authorized = await vault.authorize({
         sessionId: session.id,
         ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
         url: request.url,
     });
+    const result = authorized.status === "authorized" && authorized.workload ? await withWorkloadToken(authorized) : authorized;
     if (result.status !== "authorized" || !result.identity || !isSubject(session.ownerUserId))
         return result;
     return {
@@ -28,3 +30,22 @@ export async function sessionCredentials(vault, session, request) {
         headers: { ...result.headers, [result.identity.header]: session.ownerUserId },
     };
 }
+/**
+ * A `workload` credential's request with the Runtime's workload token as its bearer, read now
+ * (#496), or refused: when `via`'s origin is not one the operator lists, or the token cannot be
+ * read. Never sent without it.
+ */
+async function withWorkloadToken(result) {
+    const refused = (reason) => ({ status: "refused", url: result.url, credentialIds: [], reason });
+    const origin = result.via === undefined ? "a workload credential needs via" : workloadOriginRefused(result.via);
+    if (origin !== undefined)
+        return refused(origin);
+    try {
+        return { ...result, headers: { ...result.headers, authorization: `Bearer ${await workloadToken()}` } };
+    }
+    catch (error) {
+        if (error instanceof WorkloadTokenUnavailable)
+            return refused(error.message);
+        throw error;
+    }
+}

package/dist/vault/workload-token.d.ts

@@ -0,0 +1,16 @@
+export interface WorkloadTokenSettings {
+    /** The token's file (`NYLORUN_WORKLOAD_TOKEN_FILE`). */
+    readonly file?: string;
+    /** The origins a `workload` credential's `via` may name (`NYLORUN_WORKLOAD_TOKEN_ORIGINS`). */
+    readonly origins?: readonly string[];
+}
+/** Why the workload token could not be used: the message names the setting, never the token. */
+export declare class WorkloadTokenUnavailable extends Error {
+    constructor(message: string);
+}
+/** Sets where this process reads the workload token and where it may send it (at startup). */
+export declare function useWorkloadToken(next: WorkloadTokenSettings): void;
+/** The workload token, read from its file now. */
+export declare function workloadToken(): Promise<string>;
+/** Why the workload token may not go to `via`, or undefined when its origin is listed. */
+export declare function workloadOriginRefused(via: string): string | undefined;

package/dist/vault/workload-token.js

@@ -0,0 +1,58 @@
+/**
+ * The Runtime's workload token (#496): a short-lived token a platform gives each installation and
+ * rotates through a file, so a gateway trusts the workload instead of a stored key. The file
+ * (`NYLORUN_WORKLOAD_TOKEN_FILE`) is read on every use and nothing of it is kept, so a rotation
+ * applies to the next request with no restart. A missing, unreadable or empty file fails the
+ * request, never sends it unauthenticated.
+ *
+ * Only the gate side reads it: the model call and the MCP and HTTP tool requests a `workload`
+ * credential makes. It never reaches a sandbox (`NYLORUN_*` is not passed to one), the model, an
+ * event or a log, and requests scrub it like any credential value. An Agent's writer chooses a
+ * credential's `via`, so the token goes only to the origins the operator lists
+ * (`NYLORUN_WORKLOAD_TOKEN_ORIGINS`), checked on every use; the model's `baseUrl` is the
+ * operator's own.
+ */
+import { readFile } from "node:fs/promises";
+/** Why the workload token could not be used: the message names the setting, never the token. */
+export class WorkloadTokenUnavailable extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkloadTokenUnavailable";
+    }
+}
+let settings = {};
+/** Sets where this process reads the workload token and where it may send it (at startup). */
+export function useWorkloadToken(next) {
+    settings = { ...next };
+}
+/** The workload token, read from its file now. */
+export async function workloadToken() {
+    const file = settings.file;
+    if (file === undefined)
+        throw new WorkloadTokenUnavailable("The Runtime has no workload token: set NYLORUN_WORKLOAD_TOKEN_FILE");
+    let text;
+    try {
+        text = await readFile(file, "utf8");
+    }
+    catch (error) {
+        const code = error.code ?? "unreadable";
+        throw new WorkloadTokenUnavailable(`The workload token file ${file} (NYLORUN_WORKLOAD_TOKEN_FILE) cannot be read: ${code}`);
+    }
+    const token = text.trim();
+    if (token.length === 0)
+        throw new WorkloadTokenUnavailable(`The workload token file ${file} (NYLORUN_WORKLOAD_TOKEN_FILE) is empty`);
+    return token;
+}
+/** Why the workload token may not go to `via`, or undefined when its origin is listed. */
+export function workloadOriginRefused(via) {
+    let origin;
+    try {
+        origin = new URL(via).origin;
+    }
+    catch {
+        return `${via} is not a URL`;
+    }
+    return (settings.origins ?? []).includes(origin)
+        ? undefined
+        : `The workload token may not go to ${origin}: list it in NYLORUN_WORKLOAD_TOKEN_ORIGINS`;
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.29.0-beta";
+export declare const RUNTIME_VERSION = "0.30.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.29.0-beta";
+export const RUNTIME_VERSION = "0.30.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.29.0-beta",
+  "version": "0.30.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.25.0-beta",
-    "@nylorun/harness": "0.29.1-beta",
+    "@nylorun/core": "0.26.0-beta",
+    "@nylorun/harness": "0.29.2-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",