@nylorun/runtime 0.6.0-beta → 0.7.0-beta

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.7.0-beta
+
+### Minor Changes
+
+- 3a88f51: Ship Agent-Plugins (`plugin()` / `loadPlugin`), Skills (`load_skill` / skill resources), Runtime MCP pool + vault credentials, and manifest v3 capability fields. Validate completed tool `output` against the tool output schema so ordinary tools with `outputSchema` no longer false-fail as `tool.invalid-output`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [3a88f51]
+- Updated dependencies
+  - @nylorun/core@0.2.0-beta
+  - @nylorun/harness@0.16.0-beta
+
 ## 0.6.0-beta
 
 ### Major Changes

package/README.md

@@ -14,7 +14,7 @@ NYLORUN_SERVER_KEY='<separate-secret-at-least-16-characters>' npm start --worksp
 
 Default address: `http://127.0.0.1:8787`. `HOST`, `PORT`, and `NYLORUN_SQLITE_PATH` configure binding and storage. Missing server credentials fail startup. The default model is a credential-free scripted development response. It does not simulate conversations, tools or provider compatibility.
 
-`NYLORUN_EXECUTORS_JSON` is an array of `{token, agentId, manifestHash, implementationVersion}`. Each secret must differ from the application server key and every other executor token. The manifest hash is available from `@nylorun/core/compatibility` or saved definition registration. SDK clients use `NYLORUN_RUNTIME_URL`, `NYLORUN_SERVER_KEY`, and `NYLORUN_EXECUTOR_KEY`; runtime executor scope is configured explicitly, never broadened by client input.
+`NYLORUN_EXECUTORS_JSON` is an array of `{token, agentId, implementationVersion}`. Each secret must differ from the application server key and every other executor token. An optional `manifestHash` on an existing record is ignored and does not hide or reject work. SDK clients use `NYLORUN_RUNTIME_URL`, `NYLORUN_SERVER_KEY`, and `NYLORUN_EXECUTOR_KEY`; runtime executor scope is the agent id, never broadened by client input.
 
 For a model gateway, set `NYLORUN_MODEL_GATEWAY_URL`, `NYLORUN_MODEL_GATEWAY_KEY`, and `NYLORUN_MODEL`. The gateway receives `{model, call, context}` and returns a harness ModelCandidate or string. Provider credentials remain host configuration. The generic gateway requires an implementation of this envelope; it does not claim arbitrary provider wire compatibility. Alternatively supply a `ModelProvider` to `startRuntime`.
 
@@ -36,6 +36,8 @@ SQLite transactions persist session checkpoints, command receipts, individual ef
 
 One process owns each SQLite database. A local PID lock rejects concurrent owners and recovers only when the recorded process no longer exists. Shared/network filesystems and multiple replicas are unsupported. Keep the database and its WAL/journal together; do not delete persisted effects separately from checkpoints. Invalid lock contents or PID reuse fail closed and require operator inspection. TLS and external ingress belong to deployment infrastructure.
 
+Vault credentials are a separate store from server tokens, executor tokens, and model provider keys. Each vault belongs to one `ownerUserId`. Secret values are encrypted with AES-256-GCM under a key-encryption key. Set `NYLORUN_VAULT_KEK` to 32 bytes encoded as base64, or allow the host to create `.nylorun/vault-kek` (mode 0600) on the first write. A database that already holds vault ciphertext will not open without that key. Reads of a vault or credential return metadata only.
+
 ## Local project workflow
 
 Install `@nylorun/cli` (generated projects already include it). Use `npm run configure`, then `nylorun dev` in a generated project. It loads the exported `agents` registry from `agents/index.ts`, starts this Runtime in a separate process, registers manifests, connects scoped SDK executors, and opens Studio. Use `--no-studio` or `--no-open` as needed. Runtime binds loopback on port 8787 (`PORT` override). The CLI creates separate server and executor credentials with mode 0600 in `.nylorun/local-credentials.json`; SQLite defaults to `.nylorun/runtime.sqlite`.

package/dist/core/runtime.d.ts

@@ -1,5 +1,6 @@
 import { type ExecutorScope } from "@nylorun/core/contracts";
 import { type ModelProvider } from "./provider.js";
+import { type AuthorizeResult } from "../vault/service.js";
 export interface RuntimeOptions {
     sqlitePath: string;
     serverToken: string;
@@ -8,14 +9,22 @@ export interface RuntimeOptions {
     })[];
     model?: ModelProvider;
     leaseMs?: number;
+    /** 32-byte key, or base64 of that key. `null` disables env and file lookup. */
+    vaultKek?: Buffer | string | null;
+    vaultKekPath?: string;
+    vaultFetch?: typeof fetch;
 }
 export declare class CoreRuntime {
     private readonly options;
     private readonly store;
+    private readonly vault;
+    private kek;
+    private readonly kekPath;
     private readonly running;
     private readonly pending;
     private readonly observers;
     private readonly executors;
+    private readonly mcp;
     private server?;
     private closing;
     private readonly lockPath?;
@@ -36,6 +45,14 @@ export declare class CoreRuntime {
     private sse;
     private handle;
     private view;
+    private prepareMcp;
+    private callMcpTool;
+    authorize(sessionId: string, request: {
+        url: string;
+        serverName?: string;
+    }): Promise<AuthorizeResult>;
+    private ensureKek;
+    private dispatchVault;
     listen(port?: number, hostname?: string): Promise<{
         url: string;
     }>;

package/dist/core/runtime.js

@@ -2,11 +2,17 @@ import { createServer, } from "node:http";
 import { randomUUID, timingSafeEqual } from "node:crypto";
 import { mkdirSync, openSync, closeSync, unlinkSync, writeFileSync, readFileSync, } from "node:fs";
 import { dirname } from "node:path";
-import { AgentManifestSchema, PutAgentRequestSchema, PutSessionRequestSchema, SessionCommandSchema, ActionClaimRequestSchema, ActionHeartbeatRequestSchema, } from "@nylorun/core/contracts";
+import { AgentManifestSchema, CreateCredentialRequestSchema, CreateVaultRequestSchema, PutAgentRequestSchema, PutSessionRequestSchema, RotateCredentialRequestSchema, SessionCommandSchema, ActionClaimRequestSchema, ActionHeartbeatRequestSchema, } from "@nylorun/core/contracts";
 import { createDurableCheckpoint, runDurable, } from "@nylorun/harness/run";
 import { hashManifest } from "@nylorun/core/compatibility";
+import { schemaFromJSON, } from "@nylorun/core/define";
 import { Store, canonical } from "./store.js";
 import { scriptedModel } from "./provider.js";
+import { scrub } from "../redact.js";
+import { createKekFile, defaultKekPath, readVaultKek } from "../vault/kek.js";
+import { VaultError } from "../vault/error.js";
+import { VaultService } from "../vault/service.js";
+import { McpPool } from "../mcp/pool.js";
 class HttpError extends Error {
     status;
     constructor(status, message) {
@@ -17,10 +23,82 @@ class HttpError extends Error {
 const fail = (status, message) => {
     throw new HttpError(status, message);
 };
+function sessionToolsOf(snapshot) {
+    if (!snapshot?.mcpTools.length)
+        return undefined;
+    return snapshot.mcpTools.map((tool) => ({
+        capabilityId: tool.capabilityId,
+        name: tool.name,
+        ...(tool.description === undefined
+            ? {}
+            : { description: tool.description }),
+        inputSchema: tool.inputSchema,
+        ...(tool.outputSchema === undefined
+            ? {}
+            : { outputSchema: tool.outputSchema }),
+    }));
+}
+function mcpToolOf(session, capabilityId, toolName) {
+    return session.mcpSnapshot?.mcpTools.find((tool) => tool.capabilityId === capabilityId && tool.name === toolName);
+}
+function pinnedTool(manifest, capabilityId, toolName) {
+    const capability = manifest.capabilities.find((item) => item.id === capabilityId);
+    return capability?.tools?.find((tool) => tool.name === toolName);
+}
+function acceptedToolResult(action, command) {
+    if (action.kind !== "tool" || !action.outputSchema)
+        return command;
+    const value = command.outcome.value;
+    if (isFailedToolValue(value))
+        return command;
+    // Executors wrap successful tool output as `{ kind: "completed", output }`.
+    // Validate the tool payload, not the outcome envelope.
+    const candidate = completedToolOutput(value);
+    let matches = false;
+    try {
+        matches = schemaFromJSON(action.outputSchema).validate(candidate).ok;
+    }
+    catch {
+        matches = false;
+    }
+    if (matches)
+        return command;
+    return {
+        ...command,
+        outcome: {
+            ...command.outcome,
+            value: {
+                kind: "failed",
+                code: "tool.invalid-output",
+                message: "Tool result does not match the output schema stored on the action",
+            },
+        },
+    };
+}
+function completedToolOutput(value) {
+    if (value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        value.kind === "completed" &&
+        "output" in value) {
+        return value.output;
+    }
+    return value;
+}
+function isFailedToolValue(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        value.kind === "failed");
+}
 const semantic = (value) => {
     const { requestId: _, ...body } = value;
     return canonical(body);
 };
+const sessionIdentity = (value) => {
+    const { requestId: _requestId, vaultIds: _vaultIds, credentialSelections: _selections, ...body } = value ?? {};
+    return canonical(body);
+};
 const equals = (a, b) => {
     const aa = Buffer.from(a), bb = Buffer.from(b);
     return aa.length === bb.length && timingSafeEqual(aa, bb);
@@ -28,10 +106,14 @@ const equals = (a, b) => {
 export class CoreRuntime {
     options;
     store;
+    vault;
+    kek;
+    kekPath;
     running = new Map();
     pending = new Set();
     observers = new Map();
     executors = new Set();
+    mcp;
     server;
     closing = false;
     lockPath;
@@ -49,9 +131,8 @@ export class CoreRuntime {
         if (options.executors.some((e) => e.token.length < 16 ||
             equals(e.token, options.serverToken) ||
             !e.agentId ||
-            !e.manifestHash ||
             !e.implementationVersion))
-            throw new Error("Executor tokens require independent credentials and exact definition scope");
+            throw new Error("Executor tokens require independent credentials and an agent id");
         if (options.sqlitePath !== ":memory:") {
             mkdirSync(dirname(options.sqlitePath), { recursive: true });
             this.lockPath = options.sqlitePath + ".runtime-lock";
@@ -78,14 +159,29 @@ export class CoreRuntime {
             writeFileSync(fd, String(process.pid));
             closeSync(fd);
         }
+        this.kekPath = options.vaultKekPath ?? defaultKekPath();
+        let store;
         try {
-            this.store = new Store(options.sqlitePath);
+            store = new Store(options.sqlitePath);
+            this.kek = readVaultKek({
+                vaultKek: options.vaultKek,
+                vaultKekPath: this.kekPath,
+            });
+            if (store.credentialCount() > 0 && !this.kek)
+                throw new Error("Vault key-encryption key is required to open this database");
+            this.store = store;
         }
         catch (e) {
+            store?.db.close();
             if (this.lockPath)
                 unlinkSync(this.lockPath);
             throw e;
         }
+        this.vault = new VaultService(this.store.db, (fn) => this.store.tx(fn), () => this.ensureKek(), options.vaultFetch ?? globalThis.fetch);
+        this.mcp = new McpPool({
+            dataDir: dirname(options.sqlitePath),
+            authorize: (sessionId, request) => this.authorize(sessionId, request),
+        });
         this.store.tx(() => {
             for (const effect of this.store.all("effects"))
                 if (effect.status === "invoking") {
@@ -166,10 +262,13 @@ export class CoreRuntime {
         const controller = new AbortController();
         this.running.set(id, controller);
         try {
+            await this.prepareMcp(id, controller.signal);
+            const current = this.session(id);
             const result = await runDurable({
-                manifest: s.manifest,
-                checkpoint: s.checkpoint,
+                manifest: current.manifest,
+                checkpoint: current.checkpoint,
                 signal: controller.signal,
+                sessionTools: sessionToolsOf(current.mcpSnapshot),
                 host: {
                     resolveEffect: (e) => this.resolveEffect(e, controller.signal),
                 },
@@ -259,7 +358,7 @@ export class CoreRuntime {
         }
     }
     async resolveEffect(request, signal) {
-        let invoke = false;
+        let invoke;
         let notify = false;
         let event;
         const resolution = this.store.tx(() => {
@@ -281,14 +380,20 @@ export class CoreRuntime {
                             : "pending",
                     };
             }
+            const mcpTool = request.kind === "tool"
+                ? mcpToolOf(s, request.capabilityId, request.toolName)
+                : undefined;
             this.store.put("effects", request.effectId, {
                 request,
-                status: request.kind === "model" ? "invoking" : "pending",
+                status: request.kind === "model" || mcpTool ? "invoking" : "pending",
             });
-            if (request.kind === "model") {
-                invoke = true;
+            if (request.kind === "model" || mcpTool) {
+                invoke = mcpTool ? "mcp" : "model";
                 return undefined;
             }
+            const tool = request.kind === "tool"
+                ? pinnedTool(s.manifest, request.capabilityId, request.toolName)
+                : undefined;
             const action = {
                 actionId: request.effectId,
                 sessionId: request.sessionId,
@@ -299,6 +404,8 @@ export class CoreRuntime {
                 kind: request.kind,
                 capabilityId: request.capabilityId,
                 ...(request.toolName ? { toolName: request.toolName } : {}),
+                ...(tool?.inputSchema ? { inputSchema: tool.inputSchema } : {}),
+                ...(tool?.outputSchema ? { outputSchema: tool.outputSchema } : {}),
                 input: request.input,
                 context: request.context,
                 status: "pending",
@@ -323,7 +430,9 @@ export class CoreRuntime {
         if (!invoke)
             return resolution;
         try {
-            const value = await (this.options.model ?? scriptedModel())(request, signal);
+            const value = invoke === "mcp"
+                ? await this.callMcpTool(request)
+                : await (this.options.model ?? scriptedModel())(request, signal);
             return this.store.tx(() => {
                 const s = this.session(request.sessionId);
                 if (s.status === "cancelled" ||
@@ -367,10 +476,7 @@ export class CoreRuntime {
         return executor;
     }
     scoped(scope, action) {
-        if (scope === "server" ||
-            scope.agentId !== action.agentId ||
-            scope.manifestHash !== action.manifestHash ||
-            scope.implementationVersion !== action.implementationVersion)
+        if (scope === "server" || scope.agentId !== action.agentId)
             fail(403, "Executor scope does not authorize this action");
     }
     async body(request) {
@@ -387,21 +493,23 @@ export class CoreRuntime {
             return fail(400, "Invalid JSON");
         }
     }
-    command(id, command, scope) {
+    command(id, input, scope) {
         let event;
         let schedule = false;
         const response = this.store.tx(() => {
             const s = this.session(id);
-            const key = JSON.stringify([id, command.idempotencyKey]);
+            let command = input;
             if (command.type === "action_result") {
                 const a = this.store.get("actions", command.actionId) ??
                     fail(404, "Action not found");
                 if (a.sessionId !== id)
                     fail(403, "Action belongs to another session");
                 this.scoped(scope, a);
+                command = acceptedToolResult(a, command);
             }
             else if (scope !== "server")
                 fail(403, "Application credential required");
+            const key = JSON.stringify([id, command.idempotencyKey]);
             const existing = this.store.get("commands", key);
             if (existing) {
                 if (semantic(existing.command) !== semantic(command))
@@ -544,7 +652,7 @@ export class CoreRuntime {
         });
         if (event)
             this.publish(event);
-        if (command.type === "cancel")
+        if (input.type === "cancel")
             this.running.get(id)?.abort();
         if (schedule)
             this.schedule(id);
@@ -612,10 +720,7 @@ export class CoreRuntime {
                     return json({
                         actions: this.store
                             .all("actions")
-                            .filter((a) => a.status === "pending" &&
-                            a.agentId === scope.agentId &&
-                            a.manifestHash === scope.manifestHash &&
-                            a.implementationVersion === scope.implementationVersion),
+                            .filter((a) => a.status === "pending" && a.agentId === scope.agentId),
                     });
                 const actionId = path[2];
                 if (!actionId)
@@ -627,10 +732,7 @@ export class CoreRuntime {
                         fail(404, "Action not found");
                     this.scoped(scope, action);
                     if (method === "POST" && path[3] === "claim") {
-                        const claim = ActionClaimRequestSchema.parse(body);
-                        if (claim.manifestHash !== action.manifestHash ||
-                            claim.implementationVersion !== action.implementationVersion)
-                            fail(409, "Definition mismatch");
+                        ActionClaimRequestSchema.parse(body);
                         if (action.status !== "pending" ||
                             this.session(action.sessionId).status === "cancelled" ||
                             this.session(action.sessionId).activeTurnId !== action.turnId)
@@ -671,13 +773,13 @@ export class CoreRuntime {
                 path[3] === "commands" &&
                 method === "POST")
                 return json(this.command(path[2], SessionCommandSchema.parse(await this.body(request)), scope));
+            if (path[1] === "vaults")
+                return json(await this.dispatchVault(scope, method, path, url, request));
             if (scope !== "server")
                 fail(403, "Application credential required");
             if (path[1] === "agents" && path.length === 2 && method === "GET")
                 return json({
-                    agents: this.store
-                        .all("definitions")
-                        .map((d) => ({
+                    agents: this.store.all("definitions").map((d) => ({
                         agentId: d.manifest.id,
                         manifest: d.manifest,
                         manifestHash: d.manifestHash,
@@ -723,11 +825,19 @@ export class CoreRuntime {
                 const id = path[2];
                 if (method === "PUT" && path.length === 3) {
                     const body = PutSessionRequestSchema.parse(await this.body(request));
+                    const vaultIds = body.vaultIds ?? [];
+                    const credentialSelections = body.credentialSelections ?? [];
                     const result = this.store.tx(() => {
+                        this.vault.assertAttachment(body.ownerUserId, vaultIds, credentialSelections);
                         const prior = this.store.get("sessions", id);
                         if (prior) {
-                            if (semantic(prior.creation) !== semantic(body))
+                            if (sessionIdentity(prior.creation) !== sessionIdentity(body))
                                 fail(409, "Session already exists with different creation parameters");
+                            prior.vaultIds = vaultIds;
+                            prior.credentialSelections = credentialSelections;
+                            prior.creation = body;
+                            this.store.put("sessions", id, prior);
+                            this.vault.recordAttachment(id, vaultIds);
                             return prior;
                         }
                         const definition = this.store.get("definitions", body.agentId) ??
@@ -743,8 +853,12 @@ export class CoreRuntime {
                             status: "idle",
                             activeTurnId: null,
                             creation: body,
+                            vaultIds,
+                            credentialSelections,
+                            pluginRoots: definition.pluginRoots ?? {},
                         };
                         this.store.put("sessions", id, s);
+                        this.vault.recordAttachment(id, vaultIds);
                         return s;
                     });
                     return json(this.view(result));
@@ -775,7 +889,7 @@ export class CoreRuntime {
                 response.end();
                 return;
             }
-            const status = error instanceof HttpError
+            const status = error instanceof HttpError || error instanceof VaultError
                 ? error.status
                 : error?.name === "ZodError" ||
                     error?.message === "Invalid cursor"
@@ -799,6 +913,10 @@ export class CoreRuntime {
             implementationVersion: s.implementationVersion,
             status: s.status,
             activeTurnId: s.activeTurnId,
+            vaultIds: s.vaultIds ?? [],
+            credentialSelections: s.credentialSelections ?? [],
+            mcpSnapshot: s.mcpSnapshot ?? null,
+            mcpDiagnostics: s.mcpDiagnostics ?? [],
             waits: Array.isArray(s.waits)
                 ? s.waits.map((call) => ({
                     invocationId: call.invocationId,
@@ -823,6 +941,136 @@ export class CoreRuntime {
             })),
         };
     }
+    async prepareMcp(id, signal) {
+        const s = this.session(id);
+        const declared = s.manifest.capabilities.some((capability) => capability.mcpServers !== undefined &&
+            Object.keys(capability.mcpServers).length > 0);
+        if (!declared)
+            return;
+        if (!s.mcpSnapshot) {
+            const found = await this.mcp.discover({
+                sessionId: id,
+                manifest: s.manifest,
+                manifestHash: s.manifestHash,
+                pluginRoots: s.pluginRoots ?? {},
+                signal,
+            });
+            this.store.tx(() => {
+                const current = this.session(id);
+                if (current.mcpSnapshot)
+                    return;
+                current.mcpSnapshot = found.snapshot;
+                current.mcpDiagnostics = found.diagnostics;
+                this.store.put("sessions", id, current);
+            });
+            return;
+        }
+        const diagnostics = await this.mcp.reconnect({
+            sessionId: id,
+            manifest: s.manifest,
+            pluginRoots: s.pluginRoots ?? {},
+            tools: s.mcpSnapshot.mcpTools,
+            signal,
+        });
+        if (diagnostics.length === 0)
+            return;
+        this.store.tx(() => {
+            const current = this.session(id);
+            const prior = [...(current.mcpDiagnostics ?? [])];
+            for (const item of diagnostics) {
+                const index = prior.findIndex((existing) => existing.capabilityId === item.capabilityId &&
+                    existing.serverName === item.serverName);
+                if (index >= 0)
+                    prior[index] = item;
+                else
+                    prior.push(item);
+            }
+            current.mcpDiagnostics = prior;
+            this.store.put("sessions", id, current);
+        });
+    }
+    async callMcpTool(request) {
+        const s = this.session(request.sessionId);
+        const tool = mcpToolOf(s, request.capabilityId, request.toolName);
+        if (!tool)
+            throw new Error(`MCP tool '${request.toolName ?? ""}' is not in the session snapshot`);
+        return this.mcp.call({
+            sessionId: s.id,
+            capabilityId: tool.capabilityId,
+            serverName: tool.serverName,
+            serverToolName: tool.serverToolName,
+            args: request.input,
+            manifest: s.manifest,
+            pluginRoots: s.pluginRoots ?? {},
+        });
+    }
+    async authorize(sessionId, request) {
+        const s = this.session(sessionId);
+        const result = await this.vault.authorize({
+            sessionId,
+            vaultIds: s.vaultIds ?? [],
+            credentialSelections: s.credentialSelections ?? [],
+            url: request.url,
+            serverName: request.serverName,
+        });
+        if (result.status === "authorized") {
+            const token = result.headers.authorization.slice("Bearer ".length);
+            scrub({ authorization: result.headers.authorization, url: result.url }, [
+                token,
+            ]);
+        }
+        return result;
+    }
+    ensureKek() {
+        if (this.kek)
+            return this.kek;
+        if (this.options.vaultKek === null)
+            throw new Error("Vault key-encryption key is required");
+        this.kek = createKekFile(this.kekPath);
+        return this.kek;
+    }
+    async dispatchVault(scope, method, path, url, request) {
+        if (scope !== "server") {
+            this.vault.reject(path.join("/"));
+            fail(403, "Application credential required");
+        }
+        if (path.length === 2 && method === "POST") {
+            const body = CreateVaultRequestSchema.parse(await this.body(request));
+            return this.vault.createVault(body);
+        }
+        if (path.length === 2 && method === "GET") {
+            const ownerUserId = url.searchParams.get("ownerUserId") ??
+                fail(400, "ownerUserId is required");
+            return { vaults: this.vault.listVaults(ownerUserId) };
+        }
+        const vaultId = path[2];
+        if (!vaultId)
+            fail(404, "Vault not found");
+        if (path.length === 3 && method === "GET")
+            return this.vault.getVault(vaultId);
+        if (path.length === 3 && method === "DELETE")
+            return this.vault.deleteVault(vaultId);
+        if (path[3] !== "credentials")
+            fail(404, "Route not found");
+        if (path.length === 4 && method === "POST") {
+            const body = CreateCredentialRequestSchema.parse(await this.body(request));
+            return this.vault.createCredential(vaultId, body);
+        }
+        if (path.length === 4 && method === "GET")
+            return { credentials: this.vault.listCredentials(vaultId) };
+        const credentialId = path[4];
+        if (!credentialId)
+            fail(404, "Credential not found");
+        if (path.length === 5 && method === "GET")
+            return this.vault.getCredential(vaultId, credentialId);
+        if (path.length === 5 && method === "POST") {
+            const body = RotateCredentialRequestSchema.parse(await this.body(request));
+            return this.vault.rotateCredential(vaultId, credentialId, body);
+        }
+        if (path.length === 5 && method === "DELETE")
+            return this.vault.deleteCredential(vaultId, credentialId);
+        fail(404, "Route not found");
+    }
     async listen(port = 8787, hostname = "127.0.0.1") {
         if (this.server)
             throw new Error("Already listening");
@@ -843,6 +1091,7 @@ export class CoreRuntime {
         clearInterval(this.timer);
         for (const c of this.running.values())
             c.abort();
+        await this.mcp.close();
         for (const r of this.executors)
             r.end();
         for (const set of this.observers.values())

package/dist/core/store.d.ts

@@ -9,6 +9,7 @@ export declare class Store {
     all<T = any>(table: string): T[];
     put(table: string, id: string, body: unknown): void;
     event(sessionId: string, turnId: string | null, type: string, payload: unknown): LiveEvent;
+    credentialCount(): number;
     history(sessionId: string, cursor?: string): {
         items: LiveEvent[];
         cursor: string | null;

package/dist/core/store.js

@@ -26,7 +26,46 @@ export class Store {
       CREATE TABLE IF NOT EXISTS effects(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS actions(id TEXT PRIMARY KEY, body TEXT NOT NULL);
       CREATE TABLE IF NOT EXISTS events(sequence INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, body TEXT NOT NULL);
-      CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);`);
+      CREATE INDEX IF NOT EXISTS events_session ON events(session_id, sequence);
+      CREATE TABLE IF NOT EXISTS vaults(
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        owner_user_id TEXT NOT NULL,
+        metadata_json TEXT,
+        created_at TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS vaults_owner ON vaults(owner_user_id);
+      CREATE TABLE IF NOT EXISTS vault_credentials(
+        id TEXT PRIMARY KEY,
+        vault_id TEXT NOT NULL REFERENCES vaults(id) ON DELETE CASCADE,
+        name TEXT NOT NULL,
+        type TEXT NOT NULL,
+        binding_json TEXT NOT NULL,
+        expires_at TEXT,
+        created_at TEXT NOT NULL,
+        rotated_at TEXT,
+        kek_id TEXT NOT NULL,
+        nonce BLOB NOT NULL,
+        ciphertext BLOB NOT NULL,
+        wrapped_dek BLOB NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS vault_credentials_vault ON vault_credentials(vault_id);
+      CREATE TABLE IF NOT EXISTS vault_audit(
+        id TEXT PRIMARY KEY,
+        at TEXT NOT NULL,
+        actor TEXT NOT NULL,
+        action TEXT NOT NULL,
+        vault_id TEXT,
+        credential_id TEXT,
+        session_id TEXT,
+        target TEXT,
+        outcome TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS vault_idempotency(
+        id TEXT PRIMARY KEY,
+        body_hash TEXT NOT NULL,
+        response TEXT NOT NULL
+      );`);
     }
     tx(fn) {
         this.db.exec("BEGIN IMMEDIATE");
@@ -76,6 +115,12 @@ export class Store {
             .run(JSON.stringify(event), result.lastInsertRowid);
         return event;
     }
+    credentialCount() {
+        const row = this.db
+            .prepare("SELECT COUNT(*) AS n FROM vault_credentials")
+            .get();
+        return Number(row.n);
+    }
     history(sessionId, cursor) {
         let sequence = 0;
         if (cursor) {