@nylorun/runtime 0.37.0-beta → 0.39.0-beta

package/dist/tenant/session-model.d.ts

@@ -4,10 +4,15 @@
  * (`Session.model`): the Model Gate reads it at each call (`HostModelVault.readHostModel`) and a
  * turn's start describes it (`turn.start.model`). The Tenant's model, and every other session's,
  * stay as they are. While its provider is disconnected the session uses the Tenant's model again.
+ *
+ * What its turns call, and why, is kept too (`Session.modelRecord`, `SessionModelRecord`): set when
+ * the session opens (the manifest's model, or the Tenant's and why), when it chooses or clears its
+ * model, and again at each segment's start, when a provider was connected or disconnected or the
+ * Tenant's model changed. Each change writes `session.model`.
  */
-import { type SessionModelChoice, type SessionModelView } from "@nylorun/core/contracts";
+import { type SessionModelChoice, type SessionModelRecord, type SessionModelView } from "@nylorun/core/contracts";
 import type { Tx } from "../store/types.js";
-import { type SessionAccess, type TenantContext } from "./context.js";
+import { type Session, type SessionAccess, type TenantContext } from "./context.js";
 /** The model the session's next turn uses, and where it comes from. */
 export declare function readSessionModel(ctx: TenantContext, id: string, access: SessionAccess | undefined): Promise<SessionModelView>;
 /**
@@ -15,12 +20,36 @@ export declare function readSessionModel(ctx: TenantContext, id: string, access:
  * Tenant's. A turn calls one model: the choice changes only while no turn runs or waits.
  */
 export declare function chooseSessionModel(ctx: TenantContext, id: string, choice: SessionModelChoice | undefined, access: SessionAccess | undefined): Promise<SessionModelView>;
+/** Why a session's turns call the Tenant's model in place of the one asked for, and that one. */
+export interface ModelFallback {
+    readonly reason: NonNullable<SessionModelRecord["reason"]>;
+    readonly requested: NonNullable<SessionModelRecord["requested"]>;
+}
 /**
  * The model a new session starts with (Host feature `agent-model`): the one its version's
- * `harness.model` names, as `chooseSessionModel` would take it, or undefined when it names none or
- * one the Tenant cannot use now (a provider not connected, a model its catalog does not list), so
- * the Tenant's model applies. Never fails the session.
+ * `harness.model` names, as `chooseSessionModel` would take it (`choice`), or, when it names one
+ * the Tenant cannot use now (a provider not connected, a model its catalog does not list), why
+ * (`fallback`), so the Tenant's model applies. Undefined when it names none. Never fails the
+ * session.
  */
 export declare function agentModelOf(t: Tx, harness: {
     readonly model?: unknown;
-}): Promise<SessionModelChoice | undefined>;
+}): Promise<{
+    choice: SessionModelChoice;
+} | {
+    fallback: ModelFallback;
+} | undefined>;
+/**
+ * The model session `s`'s turns call now, and why (`SessionModelRecord`, as the Model Gate picks
+ * it: `hostCredentialRowOf`): its own model while its provider is connected (`source` `manifest`
+ * when its Agent's version named it, else `session`), else the Tenant's, with the reason when it
+ * falls back. `fallback` is why the session opened without the model its manifest names; kept
+ * from the session's record otherwise, until it chooses or clears a model. Undefined while the
+ * Tenant has no model to fall back to.
+ */
+export declare function sessionModelRecordOf(t: Tx, s: Pick<Session, "model" | "modelSource" | "modelRecord">, fallback?: ModelFallback): Promise<SessionModelRecord | undefined>;
+/**
+ * Keeps `record` as session `s`'s model record (the caller saves `s`) and, when it differs from
+ * the one it had, writes `session.model` with the one before. Returns whether it changed.
+ */
+export declare function noteSessionModel(t: Tx, s: Session, record: SessionModelRecord | undefined): Promise<boolean>;

package/dist/tenant/session-model.js

@@ -4,10 +4,16 @@
  * (`Session.model`): the Model Gate reads it at each call (`HostModelVault.readHostModel`) and a
  * turn's start describes it (`turn.start.model`). The Tenant's model, and every other session's,
  * stay as they are. While its provider is disconnected the session uses the Tenant's model again.
+ *
+ * What its turns call, and why, is kept too (`Session.modelRecord`, `SessionModelRecord`): set when
+ * the session opens (the manifest's model, or the Tenant's and why), when it chooses or clears its
+ * model, and again at each segment's start, when a provider was connected or disconnected or the
+ * Tenant's model changed. Each change writes `session.model`.
  */
-import { agentModelChoice } from "@nylorun/core/contracts";
+import { agentModelChoice, } from "@nylorun/core/contracts";
+import { canonical } from "../store/canonical.js";
 import { catalogModel, hostModelCatalog } from "../model/catalog.js";
-import { hostCredentialRowFor, modelBinding } from "../vault/service.js";
+import { activeHostCredentialRow, hostCredentialRowFor, modelBinding } from "../vault/service.js";
 import { takesMessages } from "./commands.js";
 import { lockedSession, sessionOf } from "./context.js";
 import { fail } from "./http.js";
@@ -29,8 +35,9 @@ export async function chooseSessionModel(ctx, id, choice, access) {
             });
         if (choice)
             await checkChoice(t, choice);
-        const { model: _model, ...rest } = s;
+        const { model: _model, modelSource: _source, ...rest } = s;
         const next = choice ? { ...rest, model: { provider: choice.provider, model: choice.model } } : rest;
+        await noteSessionModel(t, next, await sessionModelRecordOf(t, next));
         await t.put("sessions", id, next);
         return next;
     });
@@ -38,15 +45,70 @@ export async function chooseSessionModel(ctx, id, choice, access) {
 }
 /**
  * The model a new session starts with (Host feature `agent-model`): the one its version's
- * `harness.model` names, as `chooseSessionModel` would take it, or undefined when it names none or
- * one the Tenant cannot use now (a provider not connected, a model its catalog does not list), so
- * the Tenant's model applies. Never fails the session.
+ * `harness.model` names, as `chooseSessionModel` would take it (`choice`), or, when it names one
+ * the Tenant cannot use now (a provider not connected, a model its catalog does not list), why
+ * (`fallback`), so the Tenant's model applies. Undefined when it names none. Never fails the
+ * session.
  */
 export async function agentModelOf(t, harness) {
     if (typeof harness.model !== "string")
         return undefined;
     const choice = agentModelChoice(harness.model);
-    return choice && (await choiceIssue(t, choice)) === undefined ? choice : undefined;
+    if (!choice)
+        return undefined;
+    const issue = await choiceIssue(t, choice);
+    return issue === undefined
+        ? { choice }
+        : { fallback: { reason: issue.reason, requested: { ...choice, by: "manifest" } } };
+}
+/**
+ * The model session `s`'s turns call now, and why (`SessionModelRecord`, as the Model Gate picks
+ * it: `hostCredentialRowOf`): its own model while its provider is connected (`source` `manifest`
+ * when its Agent's version named it, else `session`), else the Tenant's, with the reason when it
+ * falls back. `fallback` is why the session opened without the model its manifest names; kept
+ * from the session's record otherwise, until it chooses or clears a model. Undefined while the
+ * Tenant has no model to fall back to.
+ */
+export async function sessionModelRecordOf(t, s, fallback) {
+    if (s.model) {
+        const by = s.modelSource ?? "session";
+        if (await hostCredentialRowFor(t, s.model.provider))
+            return { provider: s.model.provider, model: s.model.model, source: by };
+        return tenantModelRecord(t, { reason: "provider_not_connected", requested: { ...s.model, by } });
+    }
+    const kept = fallback ??
+        (s.modelRecord?.reason !== undefined && s.modelRecord.requested?.by === "manifest"
+            ? { reason: s.modelRecord.reason, requested: s.modelRecord.requested }
+            : undefined);
+    return tenantModelRecord(t, kept);
+}
+async function tenantModelRecord(t, fallback) {
+    const row = await activeHostCredentialRow(t);
+    if (!row)
+        return undefined;
+    const binding = modelBinding(row);
+    return {
+        provider: binding.provider,
+        model: binding.model,
+        source: "tenant",
+        ...(fallback === undefined ? {} : { reason: fallback.reason, requested: { ...fallback.requested } }),
+    };
+}
+/**
+ * Keeps `record` as session `s`'s model record (the caller saves `s`) and, when it differs from
+ * the one it had, writes `session.model` with the one before. Returns whether it changed.
+ */
+export async function noteSessionModel(t, s, record) {
+    if (canonical(record ?? null) === canonical(s.modelRecord ?? null))
+        return false;
+    const previous = s.modelRecord;
+    if (record === undefined) {
+        delete s.modelRecord;
+        return true;
+    }
+    s.modelRecord = record;
+    await t.event(s.id, s.activeTurnId, "session.model", { ...record, ...(previous ? { previous } : {}) });
+    return true;
 }
 /** A choice names a connected provider and, when its catalog lists models, one of them. */
 async function checkChoice(t, choice) {
@@ -57,19 +119,25 @@ async function checkChoice(t, choice) {
 /** Why `choice` is not one the Tenant can use now; undefined when it is. */
 async function choiceIssue(t, choice) {
     if (!/^[a-zA-Z0-9._-]+$/.test(choice.provider))
-        return { status: 400, message: "Invalid provider id", code: "invalid_request" };
+        return { status: 400, message: "Invalid provider id", code: "invalid_request", reason: "invalid_model" };
     const row = await hostCredentialRowFor(t, choice.provider);
     if (!row)
         return {
             status: 422,
             message: `Model provider ${choice.provider} is not connected: connect it in Model Settings first`,
             code: "request_rejected",
+            reason: "provider_not_connected",
         };
     // A custom endpoint serves the models it names; the provider's own model is always one.
     if (choice.provider === "custom" || modelBinding(row).model === choice.model)
         return undefined;
     const listed = hostModelCatalog().providers.find((provider) => provider.id === choice.provider);
     if (listed && listed.models.length > 0 && !catalogModel(choice.provider, choice.model))
-        return { status: 422, message: `Unknown model ${choice.model} for provider ${choice.provider}`, code: "request_rejected" };
+        return {
+            status: 422,
+            message: `Unknown model ${choice.model} for provider ${choice.provider}`,
+            code: "request_rejected",
+            reason: "not_in_catalog",
+        };
     return undefined;
 }

package/dist/tenant/sessions.js

@@ -15,7 +15,7 @@ import { openAgent, recordAttachment } from "./agents.js";
 import { harnessOf, reachesAgent, } from "./context.js";
 import { fail } from "./http.js";
 import { definitionFileIssues } from "./definition-files.js";
-import { agentModelOf } from "./session-model.js";
+import { agentModelOf, noteSessionModel, sessionModelRecordOf } from "./session-model.js";
 import { limitsInForce, readTenantLimits } from "./limits.js";
 /** A session's creation identity: everything but the request id. */
 const sessionIdentity = (value) => {
@@ -98,7 +98,8 @@ export async function openSessionIn(ctx, t, id, body, access, options = {}) {
         await requirePods(ctx.pods, `Agent ${agent.id}`);
     // The model the version names (`harness.model`, Host feature `agent-model`) is the new
     // session's own, as `chooseSessionModel` would make it, when the Tenant can use it now.
-    const model = await agentModelOf(t, version.body.harness);
+    const asked = await agentModelOf(t, version.body.harness);
+    const model = asked && "choice" in asked ? asked.choice : undefined;
     const created = {
         id,
         agentId: agent.id,
@@ -115,10 +116,16 @@ export async function openSessionIn(ctx, t, id, body, access, options = {}) {
         environmentId: agent.id,
         environmentVersion: agent.version,
         ...(pin.sandbox === undefined ? {} : { sandbox: pin.sandbox }),
-        ...(model === undefined ? {} : { model }),
+        ...(model === undefined ? {} : { model, modelSource: "manifest" }),
     };
     await t.put("sessions", id, created);
     await recordAttachment(t, id, agent.id);
+    // The model its turns call, and why: a flow's agents call theirs in their own sessions.
+    if (!isWorkflowManifest(pin.manifest)) {
+        const fallback = asked && "fallback" in asked ? asked.fallback : undefined;
+        if (await noteSessionModel(t, created, await sessionModelRecordOf(t, created, fallback)))
+            await t.put("sessions", id, created);
+    }
     return created;
 }
 /**
@@ -165,6 +172,9 @@ export async function sessionView(t, s) {
         ...(s.closedReason === undefined ? {} : { closedReason: s.closedReason }),
         mcpSnapshot: s.mcpSnapshot ?? null,
         mcpDiagnostics: s.mcpDiagnostics ?? [],
+        // As its last turn started; a session that kept none yet (older, or opened before the
+        // Tenant had a model) answers what its next turn would call.
+        model: isWorkflowManifest(s.manifest) ? null : (s.modelRecord ?? (await sessionModelRecordOf(t, s)) ?? null),
         waits,
         error: s.error,
         uncertainEffects: uncertain.map((e) => ({

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, SessionModelChoice, SessionModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretInject, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, SessionModelChoice, SessionModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -43,6 +43,35 @@ export interface SealedSecretCopies {
     /** Names left behind: no slot of the fork declares them, or their slot cannot take the value. */
     readonly dropped: readonly string[];
 }
+/** A user credential's `bindingJson`: everything about it that is not secret. */
+type CredentialBinding = {
+    /** A `bearer` or `headers` credential's server URL; absent for the environment kinds. */
+    url?: string;
+    /** An `environment_secret`'s variable, hosts and header (R2c); sealed into its AAD. */
+    secretName?: string;
+    allowedHosts?: string[];
+    inject?: EnvironmentSecretInject;
+    /** An `environment_variable`'s name and plain value (R2c): not a secret. */
+    variableName?: string;
+    variableValue?: string;
+    via?: string;
+    /**
+     * `slot`: `via` is the secret slot's, copied when it was written, not the write's own
+     * (`secret-routing`): a request follows the slot of the version the Agent runs (`routingOf`).
+     * Absent: `via` is the secret's own (or, written before the marker, the slot's then).
+     */
+    viaFrom?: "slot";
+    /** How the gateway at `via` prefixes tool names (`gateway-credentials`). */
+    toolPrefix?: string;
+    identity?: CredentialIdentity;
+    /** A `headers` credential's names, lower-cased. */
+    headerNames?: string[];
+};
+/** How a secret write was made (`putEnvironmentSecret`); `null` crosses the keys wire as none. */
+export interface SecretWriteOptions {
+    /** The body's `via` is its secret slot's, not the write's own (`secret-routing`). */
+    readonly viaFromSlot?: boolean;
+}
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -114,8 +143,8 @@ export declare class VaultService {
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
-    /** The Environment's secrets: names, types and bindings, never values. */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string, options?: SecretWriteOptions | null): Promise<AgentSecretView>;
+    /** The Environment's secrets: names, types, bindings and the routing in force, never values. */
     listEnvironmentSecrets(environmentId: string): Promise<AgentSecretView[]>;
     getEnvironmentSecret(environmentId: string, name: string): Promise<AgentSecretView>;
     deleteEnvironmentSecret(environmentId: string, name: string, actor: string): Promise<{
@@ -232,4 +261,16 @@ export declare function hostModelAad(provider: string, model: string): Buffer;
  * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
  */
 export declare function slotHolds(slot: EnvironmentSecretSlot, row: Pick<VaultCredentialRow, "type" | "bindingJson">): boolean;
+/**
+ * Where a `bearer` or `headers` credential's requests go, and how the gateway there names tools,
+ * at the time of the request (Host feature `secret-routing`), under `slot`, the slot it fills of
+ * the version its Agent runs: `via` is the secret's own (written with it), else the slot's, else
+ * none (the request goes to the URL); a `via` copied from the slot (`viaFrom: "slot"`) follows the
+ * slot. `toolPrefix` is the slot's, else the secret's, and only with a `via`. The credential is
+ * chosen by the URL either way.
+ */
+export declare function routingOf(binding: Pick<CredentialBinding, "via" | "viaFrom" | "toolPrefix">, slot?: EnvironmentSecretSlot): {
+    via?: string;
+    toolPrefix?: string;
+};
 export {};

package/dist/vault/service.js

@@ -239,7 +239,7 @@ export class VaultService {
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    async putEnvironmentSecret(environmentId, name, body, actor) {
+    async putEnvironmentSecret(environmentId, name, body, actor, options) {
         const invalid = environmentSecretNameError(body.type, name);
         if (invalid)
             throw new VaultError(400, invalid);
@@ -252,6 +252,8 @@ export class VaultService {
             // A workload credential holds no value: the bearer is the Runtime's workload token (#496).
             payload = body.type === "workload" ? {} : payloadOf(body);
             binding = bindingOf(url, payload, body);
+            if (options?.viaFromSlot === true && binding.via !== undefined && body.type !== "workload")
+                binding.viaFrom = "slot";
         }
         const kek = this.kek();
         return this.store.tx(async (t) => {
@@ -289,17 +291,18 @@ export class VaultService {
                 await this.audit(t, { actor, action: "create", vaultId: vault.id, credentialId: id, outcome: "created" });
             }
             await t.updateEnvironment(environmentId, { lastUsedAt: now }, now);
-            return secretViewOf(row);
+            return secretViewOf(row, slotOf(await appliedSlots(t, environmentId), row));
         });
     }
-    /** The Environment's secrets: names, types and bindings, never values. */
+    /** The Environment's secrets: names, types, bindings and the routing in force, never values. */
     async listEnvironmentSecrets(environmentId) {
         return this.store.tx(async (t) => {
             const vault = await this.environmentVault(t, environmentId);
+            const slots = await appliedSlots(t, environmentId);
             return (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
                 .sort((a, b) => a.name.localeCompare(b.name))
-                .map(secretViewOf);
+                .map((row) => secretViewOf(row, slotOf(slots, row)));
         });
     }
     async getEnvironmentSecret(environmentId, name) {
@@ -308,7 +311,7 @@ export class VaultService {
             const row = await t.credentialByName(vault.id, name);
             if (!row || !isUserCredential(row))
                 throw new VaultError(404, "Secret not found");
-            return secretViewOf(row);
+            return secretViewOf(row, slotOf(await appliedSlots(t, environmentId), row));
         });
     }
     async deleteEnvironmentSecret(environmentId, name, actor) {
@@ -404,7 +407,8 @@ export class VaultService {
                 });
                 return { result: { status: "refused", url, credentialIds: [], reason: "vault_missing" } };
             }
-            const live = await liveFilter(t, environmentId);
+            const slots = await appliedSlots(t, environmentId);
+            const live = liveFilterOf(slots);
             const matches = (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
                 .filter(live)
@@ -426,7 +430,9 @@ export class VaultService {
                     result: { status: "refused", url, credentialIds: matches.map((row) => row.id), reason: "ambiguous" },
                 };
             }
-            return { row: matches[0] };
+            const row = matches[0];
+            const slot = slotOf(slots, row);
+            return slot === undefined ? { row } : { row, slot };
         });
         if ("result" in decided)
             return decided.result;
@@ -468,8 +474,8 @@ export class VaultService {
             status: "authorized",
             url,
             headers,
-            ...(binding.via === undefined ? {} : { via: binding.via }),
-            ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+            // The secret's via, else its slot's; the slot's tool prefix, else the secret's (`secret-routing`).
+            ...routingOf(binding, decided.slot),
             ...(row.type === "workload" ? { workload: true } : {}),
             ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         };
@@ -486,10 +492,13 @@ export class VaultService {
             const credentials = [];
             {
                 const vault = await this.environmentVault(t, environmentId);
-                const live = await liveFilter(t, environmentId);
+                const slots = environmentId === undefined ? undefined : await appliedSlots(t, environmentId);
+                const live = liveFilterOf(slots);
                 for (const row of await t.credentialsForVault(vault.id))
-                    if (isUserCredential(row) && live(row))
-                        credentials.push({ row, url: bindingUrl(row) });
+                    if (isUserCredential(row) && live(row)) {
+                        const slot = slotOf(slots, row);
+                        credentials.push({ row, url: bindingUrl(row), ...(slot === undefined ? {} : { slot }) });
+                    }
             }
             const entries = credentialNeeds(manifest).map((need) => {
                 let url;
@@ -502,7 +511,7 @@ export class VaultService {
                     return coverageEntry(need, need.url, undefined, environmentId, error.message);
                 }
                 const bound = credentials.find((item) => item.url === url);
-                return coverageEntry(need, url, bound && coverageCredential(environmentId, bound.row), environmentId);
+                return coverageEntry(need, url, bound && coverageCredential(environmentId, bound.row, bound.slot), environmentId);
             });
             return {
                 agentId: request.agentId,
@@ -791,9 +800,9 @@ function isUserCredential(row) {
 function bindingUrl(row) {
     return JSON.parse(row.bindingJson).url;
 }
-/** Where a credential is, for coverage: never its value. */
-function coverageCredential(environmentId, row) {
-    const via = JSON.parse(row.bindingJson).via;
+/** Where a credential is, for coverage, with the `via` in force (`routingOf`): never its value. */
+function coverageCredential(environmentId, row, slot) {
+    const { via } = routingOf(credentialBinding(row), slot);
     return { agentId: environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
 }
 /** One coverage entry, with the sentence that says what the session would do. */
@@ -853,9 +862,13 @@ function conflictOf(type, binding, others) {
 function credentialBinding(row) {
     return JSON.parse(row.bindingJson);
 }
-/** A secret as `GET .../secrets/{name}` shows it: never its value. */
-function secretViewOf(row) {
+/**
+ * A secret as `GET .../secrets/{name}` shows it, with the routing in force under `slot`, the
+ * slot of the version its Agent runs that it fills (`routingOf`): never its value.
+ */
+function secretViewOf(row, slot) {
     const binding = credentialBinding(row);
+    const routing = routingOf(binding, slot);
     return {
         name: row.name,
         type: row.type,
@@ -868,8 +881,7 @@ function secretViewOf(row) {
                 ? {}
                 : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
-        ...(binding.via === undefined ? {} : { via: binding.via }),
-        ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+        ...routing,
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
@@ -1074,11 +1086,15 @@ function rebind(name, slot, row, payload, binding) {
             return undefined;
         const sealed = payloadOf(auth);
         const routing = slot;
-        // The gateway's tool prefix is the vault's, not the slot's: it stays while the slot keeps `via`.
+        // The secret's own via goes with it (`secret-routing`); else the fork's slot's, which its
+        // sessions then follow. The gateway's tool prefix is the vault's; the slot's is read at use.
+        const own = binding.via !== undefined && binding.viaFrom !== "slot" ? binding.via : undefined;
+        const via = own ?? routing.via ?? null;
+        const rebound = bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, via, toolPrefix: binding.toolPrefix ?? null });
         return {
             type,
             payload: sealed,
-            binding: bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, toolPrefix: binding.toolPrefix ?? null }),
+            binding: own === undefined && rebound.via !== undefined ? { ...rebound, viaFrom: "slot" } : rebound,
         };
     }
     catch (error) {
@@ -1146,11 +1162,36 @@ export function slotHolds(slot, row) {
  * again. Without slots, every one.
  */
 async function liveFilter(t, environmentId) {
-    const slots = (await t.environment(environmentId))?.applied.secrets;
+    return liveFilterOf(await appliedSlots(t, environmentId));
+}
+/** `liveFilter` under `slots`, the secret slots of the runtime an Agent applies. */
+function liveFilterOf(slots) {
     if (slots === undefined)
         return () => true;
-    return (row) => {
-        const slot = slots[row.name];
-        return slot !== undefined && slotHolds(slot, row);
-    };
+    return (row) => slotOf(slots, row) !== undefined;
+}
+/** The secret slots of the runtime Agent `environmentId` applies; undefined when it declares none. */
+async function appliedSlots(t, environmentId) {
+    return (await t.environment(environmentId))?.applied.secrets;
+}
+/** The slot of `slots` that the credential in `row` fills (`slotHolds`), if any. */
+function slotOf(slots, row) {
+    const slot = slots?.[row.name];
+    return slot !== undefined && slotHolds(slot, row) ? slot : undefined;
+}
+/**
+ * Where a `bearer` or `headers` credential's requests go, and how the gateway there names tools,
+ * at the time of the request (Host feature `secret-routing`), under `slot`, the slot it fills of
+ * the version its Agent runs: `via` is the secret's own (written with it), else the slot's, else
+ * none (the request goes to the URL); a `via` copied from the slot (`viaFrom: "slot"`) follows the
+ * slot. `toolPrefix` is the slot's, else the secret's, and only with a `via`. The credential is
+ * chosen by the URL either way.
+ */
+export function routingOf(binding, slot) {
+    const routed = slot?.type === "bearer" || slot?.type === "headers" ? slot : undefined;
+    const via = binding.viaFrom === "slot" && routed !== undefined ? routed.via : (binding.via ?? routed?.via);
+    if (via === undefined)
+        return {};
+    const toolPrefix = routed?.toolPrefix ?? binding.toolPrefix;
+    return toolPrefix === undefined ? { via } : { via, toolPrefix };
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.37.0-beta";
+export declare const RUNTIME_VERSION = "0.39.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.37.0-beta";
+export const RUNTIME_VERSION = "0.39.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.37.0-beta",
+  "version": "0.39.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.32.0-beta",
-    "@nylorun/harness": "0.30.0-beta",
+    "@nylorun/core": "0.34.0-beta",
+    "@nylorun/harness": "0.31.0-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",