@nylorun/runtime 0.32.0-beta → 0.34.0-beta

package/dist/tuning.d.ts

@@ -240,6 +240,12 @@ export declare const HostTuningSchema: z.ZodObject<{
         credentialsHeadersTimeoutMs: z.ZodDefault<z.ZodNumber>;
         credentialsMaxSockets: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strict>>;
+    credentialProvider: z.ZodPrefault<z.ZodObject<{
+        cacheMs: z.ZodDefault<z.ZodNumber>;
+        retryMs: z.ZodDefault<z.ZodNumber>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        cacheEntries: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     pods: z.ZodPrefault<z.ZodObject<{
         readyDeadlineMs: z.ZodDefault<z.ZodNumber>;
         pollMs: z.ZodDefault<z.ZodNumber>;

package/dist/tuning.js

@@ -386,6 +386,20 @@ export const HostTuningSchema = z
         /** The upstream sockets one such tunnel opens at once. */
         credentialsMaxSockets: count(8),
     }),
+    /**
+     * The outside credential provider (`NYLORUN_CREDENTIAL_PROVIDER_URL`), which egress-gate asks
+     * for an Agent's connected hosts and core for its variables (`gates/credential-provider.ts`).
+     */
+    credentialProvider: group({
+        /** How long an Agent's answer (hosts, or variables) is reused. */
+        cacheMs: ms(15_000, 0),
+        /** How long a failed answer (nothing) is reused before the provider is asked again. */
+        retryMs: ms(5_000, 0),
+        /** How long one `hosts` or `environment` call may take. */
+        timeoutMs: ms(3_000),
+        /** How many Agents' answers are kept. */
+        cacheEntries: count(4_096),
+    }),
     /** Sandbox pods through the sandboxes service (F7.2). */
     pods: group({
         /** How long a pod may take to be ready before its start fails. */

package/dist/vault/host-identity.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The Host's identity for model calls (ADR-71): a model credential of type `host_identity` holds
+ * no secret, only the Google Cloud project and location. The model gate calls Agent Platform with
+ * the Host's Google Application Default Credentials, which Google's client library finds at each
+ * call (`GOOGLE_APPLICATION_CREDENTIALS`, gcloud's file, or the metadata server on Google Cloud).
+ * Nothing of them is stored, logged or passed to a sandbox.
+ *
+ * Off unless the Host's operator lends it, per provider, with `NYLORUN_MODEL_HOST_IDENTITY` on the
+ * process that runs the gates. Every Tenant on the Host may then use it, so a Host that serves
+ * several organizations must not set it.
+ */
+/** The providers that can use the Host's identity. */
+export declare const HOST_IDENTITY_PROVIDERS: readonly ["google-vertex"];
+/**
+ * What pi-ai's Vertex AI client takes in place of an API key to use Application Default
+ * Credentials, with the project and location in the call's `env`.
+ */
+export declare const VERTEX_ADC_MARKER = "gcp-vertex-credentials";
+/** Sets the providers this process lends the Host's identity to (at startup). */
+export declare function useHostIdentity(providers: readonly string[]): void;
+/** Why a model of `provider` may not use the Host's identity here, or undefined when it may. */
+export declare function hostIdentityRefused(provider: string): string | undefined;
+/** The call's `env` for a `host_identity` credential: where Agent Platform runs it. */
+export declare function hostIdentityEnv(project: string, location: string): Record<string, string>;

package/dist/vault/host-identity.js

@@ -0,0 +1,35 @@
+/**
+ * The Host's identity for model calls (ADR-71): a model credential of type `host_identity` holds
+ * no secret, only the Google Cloud project and location. The model gate calls Agent Platform with
+ * the Host's Google Application Default Credentials, which Google's client library finds at each
+ * call (`GOOGLE_APPLICATION_CREDENTIALS`, gcloud's file, or the metadata server on Google Cloud).
+ * Nothing of them is stored, logged or passed to a sandbox.
+ *
+ * Off unless the Host's operator lends it, per provider, with `NYLORUN_MODEL_HOST_IDENTITY` on the
+ * process that runs the gates. Every Tenant on the Host may then use it, so a Host that serves
+ * several organizations must not set it.
+ */
+/** The providers that can use the Host's identity. */
+export const HOST_IDENTITY_PROVIDERS = ["google-vertex"];
+/**
+ * What pi-ai's Vertex AI client takes in place of an API key to use Application Default
+ * Credentials, with the project and location in the call's `env`.
+ */
+export const VERTEX_ADC_MARKER = "gcp-vertex-credentials";
+let lent = [];
+/** Sets the providers this process lends the Host's identity to (at startup). */
+export function useHostIdentity(providers) {
+    lent = [...providers];
+}
+/** Why a model of `provider` may not use the Host's identity here, or undefined when it may. */
+export function hostIdentityRefused(provider) {
+    if (!HOST_IDENTITY_PROVIDERS.includes(provider))
+        return `The Host's identity authenticates ${HOST_IDENTITY_PROVIDERS.join(", ")} only, not ${provider}.`;
+    if (!lent.includes(provider))
+        return `This Host doesn't lend its identity to ${provider}: its operator sets NYLORUN_MODEL_HOST_IDENTITY=${provider}.`;
+    return undefined;
+}
+/** The call's `env` for a `host_identity` credential: where Agent Platform runs it. */
+export function hostIdentityEnv(project, location) {
+    return { GOOGLE_CLOUD_PROJECT: project, GOOGLE_CLOUD_LOCATION: location };
+}

package/dist/vault/host-model.d.ts

@@ -18,11 +18,15 @@ export declare class HostModelVault {
     private readonly kek;
     constructor(options: HostModelVaultOptions);
     /**
-     * Reads the active host model secret, with the inputs the operator added to catalog models
-     * (protocol 12). Decrypts after the read commits.
+     * Reads the host model secret a call uses, with the inputs the operator added to catalog
+     * models (protocol 12): the session's own model while its provider is connected (Host feature
+     * `session-model`), else the Tenant's active one. Decrypts after the read commits.
+     */
+    readHostModel(sessionId?: string): Promise<HostModelSecret | undefined>;
+    /**
+     * Replaces a host model's secret, keeping its binding: `provider`'s, the one the refreshed
+     * credential was read for, else the active one's.
      */
-    readHostModel(): Promise<HostModelSecret | undefined>;
-    /** Replaces the active host model's secret, keeping its binding. */
     updateHostCredential(credential: {
         type: "api_key" | "oauth";
         key?: string;
@@ -30,5 +34,5 @@ export declare class HostModelVault {
         refresh?: string;
         access?: string;
         expires?: number;
-    }): Promise<void>;
+    }, provider?: string): Promise<void>;
 }

package/dist/vault/host-model.js

@@ -1,7 +1,7 @@
 import { readAddedInputs } from "../tenant/model-setting.js";
 import { encryptSecret } from "./crypto.js";
 import { VaultError } from "./error.js";
-import { activeHostCredentialRow, HOST_VAULT_ID, hostModelAad, modelBinding, readHostPayload, } from "./service.js";
+import { activeHostCredentialRow, hostCredentialRowFor, hostCredentialRowOf, HOST_VAULT_ID, hostModelAad, modelBinding, readHostPayload, } from "./service.js";
 export class HostModelVault {
     store;
     kek;
@@ -10,28 +10,36 @@ export class HostModelVault {
         this.kek = options.kek;
     }
     /**
-     * Reads the active host model secret, with the inputs the operator added to catalog models
-     * (protocol 12). Decrypts after the read commits.
+     * Reads the host model secret a call uses, with the inputs the operator added to catalog
+     * models (protocol 12): the session's own model while its provider is connected (Host feature
+     * `session-model`), else the Tenant's active one. Decrypts after the read commits.
      */
-    async readHostModel() {
-        const { row, addedInputs } = await this.store.tx(async (t) => ({
-            row: await activeHostCredentialRow(t),
-            addedInputs: await readAddedInputs(t),
-        }));
-        if (!row)
+    async readHostModel(sessionId) {
+        const { found, addedInputs } = await this.store.tx(async (t) => {
+            const session = sessionId === undefined ? undefined : await t.get("sessions", sessionId);
+            return {
+                found: await hostCredentialRowOf(t, session?.model),
+                addedInputs: await readAddedInputs(t),
+            };
+        });
+        if (!found)
             return undefined;
-        const binding = modelBinding(row);
-        const payload = readHostPayload(this.kek(), row, binding);
+        const { row, binding } = found;
+        // The row's own binding seals its secret; a session's model only changes what is called.
+        const payload = readHostPayload(this.kek(), row, modelBinding(row));
         const credential = binding.authType === "oauth"
             ? { type: "oauth", ...payload.oauth }
             : binding.authType === "workload"
                 ? // The workload token is read from its file at each call (#496), never stored.
                     { type: "workload" }
-                : {
-                    type: "api_key",
-                    key: payload.apiKey,
-                    ...(payload.env ? { env: payload.env } : {}),
-                };
+                : binding.authType === "host_identity"
+                    ? // The Host's identity is found at each call (ADR-71): only where the calls go is kept.
+                        { type: "host_identity", ...(payload.env ? { env: payload.env } : {}) }
+                    : {
+                        type: "api_key",
+                        key: payload.apiKey,
+                        ...(payload.env ? { env: payload.env } : {}),
+                    };
         return {
             provider: binding.provider,
             model: binding.model,
@@ -42,11 +50,14 @@ export class HostModelVault {
             credential,
         };
     }
-    /** Replaces the active host model's secret, keeping its binding. */
-    async updateHostCredential(credential) {
+    /**
+     * Replaces a host model's secret, keeping its binding: `provider`'s, the one the refreshed
+     * credential was read for, else the active one's.
+     */
+    async updateHostCredential(credential, provider) {
         const kek = this.kek();
         await this.store.tx(async (t) => {
-            const row = await activeHostCredentialRow(t);
+            const row = provider === undefined ? await activeHostCredentialRow(t) : await hostCredentialRowFor(t, provider);
             if (!row)
                 throw new VaultError(404, "Model provider is not configured");
             const binding = modelBinding(row);

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, SessionModelChoice, SessionModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -166,7 +166,13 @@ export declare class VaultService {
      * the credential of the Agent's vault bound to the URL. Reads no secret, writes no audit row.
      */
     coverage(manifest: AgentManifest | WorkflowManifest, request: CredentialCoverageRequest): Promise<CredentialCoverage>;
-    getHostModel(): Promise<HostModelView>;
+    /**
+     * The Tenant's model, or the model a session's turns use (`choice`, its own, while its provider
+     * is connected).
+     */
+    getHostModel(choice?: SessionModelChoice): Promise<HostModelView>;
+    /** The model a session's next turn uses, and where it comes from (Host feature `session-model`). */
+    getSessionModel(choice?: SessionModelChoice): Promise<SessionModelView>;
     listHostProviders(): Promise<{
         providers: HostModelProviderInfo[];
     }>;
@@ -194,6 +200,16 @@ export declare function hostModelRows(t: Tx): Promise<VaultCredentialRow[]>;
 export declare function hostCredentialRowFor(t: Tx, provider: string): Promise<VaultCredentialRow | undefined>;
 /** The provider the host model selection names, or the only (or legacy) one configured. */
 export declare function activeProviderId(t: Tx): Promise<string | undefined>;
+/**
+ * The host model credential row a session's calls use (ciphertext), in `t`, with the binding
+ * they call: its own model (`choice`) on its provider's row while that provider is connected,
+ * else the Tenant's active one. `row`'s own binding seals its secret (`readHostPayload`).
+ */
+export declare function hostCredentialRowOf(t: Tx, choice: SessionModelChoice | undefined): Promise<{
+    row: VaultCredentialRow;
+    binding: ModelBinding;
+    source: "session" | "tenant";
+} | undefined>;
 /** The active host model credential row (ciphertext), in `t`. */
 export declare function activeHostCredentialRow(t: Tx): Promise<VaultCredentialRow | undefined>;
 export declare function readHostPayload(kek: Buffer, row: VaultCredentialRow, binding: ModelBinding): HostSecretPayload;

package/dist/vault/service.js

@@ -39,7 +39,8 @@
  * coverage(manifest: AgentManifest | WorkflowManifest, request: CredentialCoverageRequest): Promise<CredentialCoverage>
  *
  * // Host model credential: each opens its own transaction.
- * getHostModel(): Promise<HostModelView>
+ * getHostModel(choice?: SessionModelChoice): Promise<HostModelView>
+ * getSessionModel(choice?: SessionModelChoice): Promise<SessionModelView>
  * listHostProviders(): Promise<{ providers: HostModelProviderInfo[] }>
  * putHostModel(body: PutHostModelRequest): Promise<HostModelView>
  * selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>
@@ -88,6 +89,7 @@ import { hostModelCatalog, inputsOfHostModel } from "../model/catalog.js";
 import { inputsError } from "../model/capabilities.js";
 import { readAddedInputs } from "../tenant/model-setting.js";
 import { normalizeVaultUrl } from "./url.js";
+import { hostIdentityEnv, hostIdentityRefused } from "./host-identity.js";
 export const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
 export class VaultService {
@@ -510,8 +512,29 @@ export class VaultService {
         });
     }
     // --- host model ----------------------------------------------------------------
-    async getHostModel() {
-        return this.store.tx((t) => this.hostModelView(t));
+    /**
+     * The Tenant's model, or the model a session's turns use (`choice`, its own, while its provider
+     * is connected).
+     */
+    async getHostModel(choice) {
+        return this.store.tx((t) => this.hostModelView(t, choice));
+    }
+    /** The model a session's next turn uses, and where it comes from (Host feature `session-model`). */
+    async getSessionModel(choice) {
+        return this.store.tx(async (t) => {
+            const found = await hostCredentialRowOf(t, choice);
+            const kept = choice ? { choice } : {};
+            if (!found)
+                return { configured: false, ...kept };
+            return {
+                configured: true,
+                source: found.source,
+                provider: found.binding.provider,
+                model: found.binding.model,
+                ...(found.binding.baseUrl ? { baseUrl: found.binding.baseUrl } : {}),
+                ...kept,
+            };
+        });
     }
     async listHostProviders() {
         return this.store.tx(async (t) => {
@@ -546,10 +569,16 @@ export class VaultService {
             this.validateHostModel(body);
             if (body.auth.type === "workload" && body.provider !== "custom")
                 throw new VaultError(400, "The workload token authenticates a custom provider only.");
+            if (body.auth.type === "host_identity") {
+                const refused = hostIdentityRefused(body.provider);
+                if (refused)
+                    throw new VaultError(400, refused);
+            }
             await this.ensureHostVault(t);
             const credentialId = hostModelCredentialId(body.provider);
             await this.deleteHostProviderRows(t, body.provider);
-            // The workload token is read on every call and never stored (#496).
+            // The workload token is read on every call and never stored (#496); the Host's identity
+            // too (ADR-71), which keeps only where its calls go.
             const payload = body.auth.type === "api_key"
                 ? {
                     apiKey: body.auth.key,
@@ -557,7 +586,9 @@ export class VaultService {
                 }
                 : body.auth.type === "oauth"
                     ? { oauth: body.auth }
-                    : {};
+                    : body.auth.type === "host_identity"
+                        ? { env: hostIdentityEnv(body.auth.project, body.auth.location) }
+                        : {};
             await this.insertHostCredential(t, kek, {
                 id: credentialId,
                 provider: body.provider,
@@ -714,11 +745,11 @@ export class VaultService {
             ...sealed,
         });
     }
-    async hostModelView(t) {
-        const row = await activeHostCredentialRow(t);
-        if (!row)
+    async hostModelView(t, choice) {
+        const found = await hostCredentialRowOf(t, choice);
+        if (!found)
             return { configured: false };
-        const binding = modelBinding(row);
+        const { binding } = found;
         return {
             configured: true,
             provider: binding.provider,
@@ -904,6 +935,18 @@ export async function activeProviderId(t) {
         return modelBinding(legacy).provider;
     return modelBinding(rows[0]).provider;
 }
+/**
+ * The host model credential row a session's calls use (ciphertext), in `t`, with the binding
+ * they call: its own model (`choice`) on its provider's row while that provider is connected,
+ * else the Tenant's active one. `row`'s own binding seals its secret (`readHostPayload`).
+ */
+export async function hostCredentialRowOf(t, choice) {
+    const chosen = choice && (await hostCredentialRowFor(t, choice.provider));
+    if (chosen)
+        return { row: chosen, binding: { ...modelBinding(chosen), model: choice.model }, source: "session" };
+    const row = await activeHostCredentialRow(t);
+    return row && { row, binding: modelBinding(row), source: "tenant" };
+}
 /** The active host model credential row (ciphertext), in `t`. */
 export async function activeHostCredentialRow(t) {
     const active = await activeProviderId(t);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.32.0-beta";
+export declare const RUNTIME_VERSION = "0.34.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.32.0-beta";
+export const RUNTIME_VERSION = "0.34.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.32.0-beta",
+  "version": "0.34.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,14 +59,14 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@ag-ui/core": "~1.0.2",
+    "@ag-ui/core": "~1.0.3",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
-    "@earendil-works/pi-ai": "1.2.0",
+    "@earendil-works/pi-ai": "1.3.0",
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.28.0-beta",
-    "@nylorun/harness": "0.29.4-beta",
+    "@nylorun/core": "0.30.0-beta",
+    "@nylorun/harness": "0.29.6-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",
@@ -85,7 +85,7 @@
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
-    "@ag-ui/client": "1.0.2",
+    "@ag-ui/client": "1.0.3",
     "@scalar/openapi-parser": "^0.29.13",
     "@types/node": "^26.6.5",
     "@types/pg": "^8.23.1",