@nylorun/runtime 0.38.0-beta → 0.39.0-beta

package/dist/vault/service.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, SessionModelChoice, SessionModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
+import type { CredentialCoverage, CredentialCoverageRequest, CredentialIdentity, EnvironmentSecretInject, EnvironmentSecretSlot, AgentSecretView, HostModelAuthType, HostModelProviderInfo, HostModelView, SessionModelChoice, SessionModelView, PutAgentSecretRequest, PutHostModelRequest, CustomModelSettings, ModelInput, SelectHostModelRequest } from "@nylorun/core/contracts";
 import type { AgentManifest, WorkflowManifest } from "@nylorun/core/define";
 import type { SessionStore, Tx, VaultCredentialRow } from "../store/types.js";
 export declare const HOST_VAULT_ID = "host";
@@ -43,6 +43,35 @@ export interface SealedSecretCopies {
     /** Names left behind: no slot of the fork declares them, or their slot cannot take the value. */
     readonly dropped: readonly string[];
 }
+/** A user credential's `bindingJson`: everything about it that is not secret. */
+type CredentialBinding = {
+    /** A `bearer` or `headers` credential's server URL; absent for the environment kinds. */
+    url?: string;
+    /** An `environment_secret`'s variable, hosts and header (R2c); sealed into its AAD. */
+    secretName?: string;
+    allowedHosts?: string[];
+    inject?: EnvironmentSecretInject;
+    /** An `environment_variable`'s name and plain value (R2c): not a secret. */
+    variableName?: string;
+    variableValue?: string;
+    via?: string;
+    /**
+     * `slot`: `via` is the secret slot's, copied when it was written, not the write's own
+     * (`secret-routing`): a request follows the slot of the version the Agent runs (`routingOf`).
+     * Absent: `via` is the secret's own (or, written before the marker, the slot's then).
+     */
+    viaFrom?: "slot";
+    /** How the gateway at `via` prefixes tool names (`gateway-credentials`). */
+    toolPrefix?: string;
+    identity?: CredentialIdentity;
+    /** A `headers` credential's names, lower-cased. */
+    headerNames?: string[];
+};
+/** How a secret write was made (`putEnvironmentSecret`); `null` crosses the keys wire as none. */
+export interface SecretWriteOptions {
+    /** The body's `via` is its secret slot's, not the write's own (`secret-routing`). */
+    readonly viaFromSlot?: boolean;
+}
 export type AuthorizeResult = {
     status: "unauthenticated";
     url: string;
@@ -114,8 +143,8 @@ export declare class VaultService {
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
-    /** The Environment's secrets: names, types and bindings, never values. */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string, options?: SecretWriteOptions | null): Promise<AgentSecretView>;
+    /** The Environment's secrets: names, types, bindings and the routing in force, never values. */
     listEnvironmentSecrets(environmentId: string): Promise<AgentSecretView[]>;
     getEnvironmentSecret(environmentId: string, name: string): Promise<AgentSecretView>;
     deleteEnvironmentSecret(environmentId: string, name: string, actor: string): Promise<{
@@ -232,4 +261,16 @@ export declare function hostModelAad(provider: string, model: string): Buffer;
  * binding (the hosts and header of an `environment_secret`, the URL of a `bearer` or `headers`).
  */
 export declare function slotHolds(slot: EnvironmentSecretSlot, row: Pick<VaultCredentialRow, "type" | "bindingJson">): boolean;
+/**
+ * Where a `bearer` or `headers` credential's requests go, and how the gateway there names tools,
+ * at the time of the request (Host feature `secret-routing`), under `slot`, the slot it fills of
+ * the version its Agent runs: `via` is the secret's own (written with it), else the slot's, else
+ * none (the request goes to the URL); a `via` copied from the slot (`viaFrom: "slot"`) follows the
+ * slot. `toolPrefix` is the slot's, else the secret's, and only with a `via`. The credential is
+ * chosen by the URL either way.
+ */
+export declare function routingOf(binding: Pick<CredentialBinding, "via" | "viaFrom" | "toolPrefix">, slot?: EnvironmentSecretSlot): {
+    via?: string;
+    toolPrefix?: string;
+};
 export {};

package/dist/vault/service.js

@@ -239,7 +239,7 @@ export class VaultService {
      * bound to one of its hosts or to its URL. Runs under the Environment row's lock, which also
      * orders it with session opens and deletes, and counts as the Environment's use.
      */
-    async putEnvironmentSecret(environmentId, name, body, actor) {
+    async putEnvironmentSecret(environmentId, name, body, actor, options) {
         const invalid = environmentSecretNameError(body.type, name);
         if (invalid)
             throw new VaultError(400, invalid);
@@ -252,6 +252,8 @@ export class VaultService {
             // A workload credential holds no value: the bearer is the Runtime's workload token (#496).
             payload = body.type === "workload" ? {} : payloadOf(body);
             binding = bindingOf(url, payload, body);
+            if (options?.viaFromSlot === true && binding.via !== undefined && body.type !== "workload")
+                binding.viaFrom = "slot";
         }
         const kek = this.kek();
         return this.store.tx(async (t) => {
@@ -289,17 +291,18 @@ export class VaultService {
                 await this.audit(t, { actor, action: "create", vaultId: vault.id, credentialId: id, outcome: "created" });
             }
             await t.updateEnvironment(environmentId, { lastUsedAt: now }, now);
-            return secretViewOf(row);
+            return secretViewOf(row, slotOf(await appliedSlots(t, environmentId), row));
         });
     }
-    /** The Environment's secrets: names, types and bindings, never values. */
+    /** The Environment's secrets: names, types, bindings and the routing in force, never values. */
     async listEnvironmentSecrets(environmentId) {
         return this.store.tx(async (t) => {
             const vault = await this.environmentVault(t, environmentId);
+            const slots = await appliedSlots(t, environmentId);
             return (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
                 .sort((a, b) => a.name.localeCompare(b.name))
-                .map(secretViewOf);
+                .map((row) => secretViewOf(row, slotOf(slots, row)));
         });
     }
     async getEnvironmentSecret(environmentId, name) {
@@ -308,7 +311,7 @@ export class VaultService {
             const row = await t.credentialByName(vault.id, name);
             if (!row || !isUserCredential(row))
                 throw new VaultError(404, "Secret not found");
-            return secretViewOf(row);
+            return secretViewOf(row, slotOf(await appliedSlots(t, environmentId), row));
         });
     }
     async deleteEnvironmentSecret(environmentId, name, actor) {
@@ -404,7 +407,8 @@ export class VaultService {
                 });
                 return { result: { status: "refused", url, credentialIds: [], reason: "vault_missing" } };
             }
-            const live = await liveFilter(t, environmentId);
+            const slots = await appliedSlots(t, environmentId);
+            const live = liveFilterOf(slots);
             const matches = (await t.credentialsForVault(vault.id))
                 .filter(isUserCredential)
                 .filter(live)
@@ -426,7 +430,9 @@ export class VaultService {
                     result: { status: "refused", url, credentialIds: matches.map((row) => row.id), reason: "ambiguous" },
                 };
             }
-            return { row: matches[0] };
+            const row = matches[0];
+            const slot = slotOf(slots, row);
+            return slot === undefined ? { row } : { row, slot };
         });
         if ("result" in decided)
             return decided.result;
@@ -468,8 +474,8 @@ export class VaultService {
             status: "authorized",
             url,
             headers,
-            ...(binding.via === undefined ? {} : { via: binding.via }),
-            ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+            // The secret's via, else its slot's; the slot's tool prefix, else the secret's (`secret-routing`).
+            ...routingOf(binding, decided.slot),
             ...(row.type === "workload" ? { workload: true } : {}),
             ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         };
@@ -486,10 +492,13 @@ export class VaultService {
             const credentials = [];
             {
                 const vault = await this.environmentVault(t, environmentId);
-                const live = await liveFilter(t, environmentId);
+                const slots = environmentId === undefined ? undefined : await appliedSlots(t, environmentId);
+                const live = liveFilterOf(slots);
                 for (const row of await t.credentialsForVault(vault.id))
-                    if (isUserCredential(row) && live(row))
-                        credentials.push({ row, url: bindingUrl(row) });
+                    if (isUserCredential(row) && live(row)) {
+                        const slot = slotOf(slots, row);
+                        credentials.push({ row, url: bindingUrl(row), ...(slot === undefined ? {} : { slot }) });
+                    }
             }
             const entries = credentialNeeds(manifest).map((need) => {
                 let url;
@@ -502,7 +511,7 @@ export class VaultService {
                     return coverageEntry(need, need.url, undefined, environmentId, error.message);
                 }
                 const bound = credentials.find((item) => item.url === url);
-                return coverageEntry(need, url, bound && coverageCredential(environmentId, bound.row), environmentId);
+                return coverageEntry(need, url, bound && coverageCredential(environmentId, bound.row, bound.slot), environmentId);
             });
             return {
                 agentId: request.agentId,
@@ -791,9 +800,9 @@ function isUserCredential(row) {
 function bindingUrl(row) {
     return JSON.parse(row.bindingJson).url;
 }
-/** Where a credential is, for coverage: never its value. */
-function coverageCredential(environmentId, row) {
-    const via = JSON.parse(row.bindingJson).via;
+/** Where a credential is, for coverage, with the `via` in force (`routingOf`): never its value. */
+function coverageCredential(environmentId, row, slot) {
+    const { via } = routingOf(credentialBinding(row), slot);
     return { agentId: environmentId, name: row.name, ...(via === undefined ? {} : { via }) };
 }
 /** One coverage entry, with the sentence that says what the session would do. */
@@ -853,9 +862,13 @@ function conflictOf(type, binding, others) {
 function credentialBinding(row) {
     return JSON.parse(row.bindingJson);
 }
-/** A secret as `GET .../secrets/{name}` shows it: never its value. */
-function secretViewOf(row) {
+/**
+ * A secret as `GET .../secrets/{name}` shows it, with the routing in force under `slot`, the
+ * slot of the version its Agent runs that it fills (`routingOf`): never its value.
+ */
+function secretViewOf(row, slot) {
     const binding = credentialBinding(row);
+    const routing = routingOf(binding, slot);
     return {
         name: row.name,
         type: row.type,
@@ -868,8 +881,7 @@ function secretViewOf(row) {
                 ? {}
                 : { url: binding.url },
         ...(binding.headerNames === undefined ? {} : { headerNames: binding.headerNames }),
-        ...(binding.via === undefined ? {} : { via: binding.via }),
-        ...(binding.toolPrefix === undefined ? {} : { toolPrefix: binding.toolPrefix }),
+        ...routing,
         ...(binding.identity === undefined ? {} : { identity: binding.identity }),
         createdAt: row.createdAt,
         ...(row.rotatedAt ? { rotatedAt: row.rotatedAt } : {}),
@@ -1074,11 +1086,15 @@ function rebind(name, slot, row, payload, binding) {
             return undefined;
         const sealed = payloadOf(auth);
         const routing = slot;
-        // The gateway's tool prefix is the vault's, not the slot's: it stays while the slot keeps `via`.
+        // The secret's own via goes with it (`secret-routing`); else the fork's slot's, which its
+        // sessions then follow. The gateway's tool prefix is the vault's; the slot's is read at use.
+        const own = binding.via !== undefined && binding.viaFrom !== "slot" ? binding.via : undefined;
+        const via = own ?? routing.via ?? null;
+        const rebound = bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, via, toolPrefix: binding.toolPrefix ?? null });
         return {
             type,
             payload: sealed,
-            binding: bindingOf(normalizeVaultUrl(routing.url), sealed, { ...routing, toolPrefix: binding.toolPrefix ?? null }),
+            binding: own === undefined && rebound.via !== undefined ? { ...rebound, viaFrom: "slot" } : rebound,
         };
     }
     catch (error) {
@@ -1146,11 +1162,36 @@ export function slotHolds(slot, row) {
  * again. Without slots, every one.
  */
 async function liveFilter(t, environmentId) {
-    const slots = (await t.environment(environmentId))?.applied.secrets;
+    return liveFilterOf(await appliedSlots(t, environmentId));
+}
+/** `liveFilter` under `slots`, the secret slots of the runtime an Agent applies. */
+function liveFilterOf(slots) {
     if (slots === undefined)
         return () => true;
-    return (row) => {
-        const slot = slots[row.name];
-        return slot !== undefined && slotHolds(slot, row);
-    };
+    return (row) => slotOf(slots, row) !== undefined;
+}
+/** The secret slots of the runtime Agent `environmentId` applies; undefined when it declares none. */
+async function appliedSlots(t, environmentId) {
+    return (await t.environment(environmentId))?.applied.secrets;
+}
+/** The slot of `slots` that the credential in `row` fills (`slotHolds`), if any. */
+function slotOf(slots, row) {
+    const slot = slots?.[row.name];
+    return slot !== undefined && slotHolds(slot, row) ? slot : undefined;
+}
+/**
+ * Where a `bearer` or `headers` credential's requests go, and how the gateway there names tools,
+ * at the time of the request (Host feature `secret-routing`), under `slot`, the slot it fills of
+ * the version its Agent runs: `via` is the secret's own (written with it), else the slot's, else
+ * none (the request goes to the URL); a `via` copied from the slot (`viaFrom: "slot"`) follows the
+ * slot. `toolPrefix` is the slot's, else the secret's, and only with a `via`. The credential is
+ * chosen by the URL either way.
+ */
+export function routingOf(binding, slot) {
+    const routed = slot?.type === "bearer" || slot?.type === "headers" ? slot : undefined;
+    const via = binding.viaFrom === "slot" && routed !== undefined ? routed.via : (binding.via ?? routed?.via);
+    if (via === undefined)
+        return {};
+    const toolPrefix = routed?.toolPrefix ?? binding.toolPrefix;
+    return toolPrefix === undefined ? { via } : { via, toolPrefix };
 }

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.38.0-beta";
+export declare const RUNTIME_VERSION = "0.39.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.38.0-beta";
+export const RUNTIME_VERSION = "0.39.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.38.0-beta",
+  "version": "0.39.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.33.0-beta",
-    "@nylorun/harness": "0.30.1-beta",
+    "@nylorun/core": "0.34.0-beta",
+    "@nylorun/harness": "0.31.0-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",