nylorun 0.8.0-beta → 0.11.0-beta

package/CHANGELOG.md

@@ -1,5 +1,143 @@
 # nylorun
 
+## 0.11.0-beta
+
+### Minor Changes
+
+- 713e676: **Remote MCP servers only (blueprint D47).** Nylorun accepts `streamable-http` and `sse` MCP servers, declared by URL and reached through the gates; stdio servers and plugin roots are gone. See MIGRATION.md.
+
+  - **Breaking (`@nylorun/core`):** `McpServerManifest` and the manifest schema keep only `streamable-http` and `sse`. A `stdio` server is refused by `.mcp({...})` (`McpError`, code `mcp.stdio`), by `Agent.from` and by the wire schema, all with one message (`stdioMcpRefusal`): "MCP server 'x' uses stdio; Nylorun accepts remote MCP servers only (streamable-http or sse). Run the server behind an HTTP transport and declare its URL." `PutAgentRequest` loses `pluginRoots`, `CapabilityDeclaration` loses `pluginRoot`, and the Harness API's `RunRouting` loses `pluginRoots`.
+  - **Breaking (`@nylorun/agents`):** `.plugin()` and `plugin()` throw `PluginError` (code `plugin.mcp-stdio`) for a stdio server in a plugin's `mcp.json`; its remote servers and skills load as before. `saveAgent` no longer sends plugin roots. `prepareStdioLaunch`, `expandPluginPlaceholders` and `StdioLaunch` are removed.
+  - **Breaking (`@nylorun/runtime`):** no stdio MCP launcher: `PUT /v1/agents/:id` refuses a stdio server (`400`) and `pluginRoots`. `TenantConfig.childEnv`, `TenantPaths.pluginData` and `tmp`, `tenantChildEnvironment`, `startEphemeralRuntime({ baseline })` and `configForFactory`'s `baseline` and `hostConfig` are removed; the harness service no longer takes `childEnv` or `paths.pluginData`.
+  - `nylorun`: the local stack no longer mounts the Host root's `plugins/` into the runtime and harness containers, nor the Tenant's `plugin-data/`, `home/` and `tmp/` into the harness, which now mounts only `sandboxes/`.
+
+- c135267: **Action endpoints are removed (manifest-only agents, M6).** The Runtime runs no code of yours during a session: an agent's tools are HTTP tools, remote MCP servers, agents used as tools and the Runtime's built-ins. Protocol stays 8; the `action-endpoints` feature is gone, so a client that requires it is refused. See MIGRATION.md, "Action endpoints are removed".
+
+  - **Breaking (`@nylorun/core`):** the `Action`, endpoint (`PutEndpointsRequest`, `Endpoint`, `EndpointHealth`, …) and delivery schemas, `SIGNATURE_HEADER`, `OUTCOME_HEADER`, `DELIVERY_TOKEN_TYPE` and the `action.*` events (`action.pending`, `.delivered`, `.delivery_failed`, `.completed`, `.uncertain`) are removed, and `ToolDefinition.background` with them. `ActionOutcome` is renamed `EffectOutcome`. Tenant status loses `checks.endpoints`, `agents[].registered` and `agents[].endpoint`, and `counts.pendingActions`; the session view loses `actions`. A `turn.paused` interaction carries the tool call's `callId`. New `codeToolsOf` and `codeToolRefusal` name a definition's tools that would run your code. The Harness API is v2 (`HARNESS_API_VERSION = 2`): `TurnStart.options.holdMs` and `effect.resolved` are removed.
+  - **Breaking (`@nylorun/harness`):** held runs are gone: `createHarness` loses `holdMs`, and `apiHost` its `hold` option.
+  - **Breaking (`@nylorun/agents`):** `createActionHandler`, `executeAction`, `createActionSandbox`, `definitionDeclaresSandbox`, `isActionSandboxTool` and the `Action`, `ActionOutcome`, `ActionHandler`, `ActionHandlerOptions`, `RegisterOptions`, `ExecuteActionOptions` and `ExecutableDefinition` types are removed. `saveAgent` refuses a code tool (`tool({ run })`) or a flow tool stage before sending; its `implementationVersion` is optional (`NYLORUN_IMPLEMENTATION_VERSION`, else `dev`).
+  - **Breaking (`@nylorun/runtime`):** `/v1/endpoints` and `/v1/actions/*` answer `404`; delivery tokens, the deliverer, background tools, held runs (`TenantConfig.actionHoldMs`), `DurableExecution.deliver`, the Restate `NylorunAction` object, the `action_result` wake and the gates service's `/nylorun/v1/deliveries` are removed, and a migration drops the `actions` and `endpoints` tables. `PUT /v1/agents/:id` refuses a definition with a code tool or a flow tool stage (`400`); a tool the Runtime cannot run fails with `tool.unavailable`. The fixture model answers in text when the agent offers no `lookup_order` tool.
+  - **Breaking (`@nylorun/cli`):** `nylo endpoints` is removed (a usage error that says why); `nylo status` shows uncertain effects instead of pending Actions.
+  - **Breaking (`@nylorun/create-agent`):** the starter saves its agent with `saveAgent` and runs no server: no Action endpoint, `PORT` or `NYLORUN_ACTIONS_URL`. Its assistant has no tools, with a commented `http()` tool to start from.
+  - `nylorun`: the local stack's comments speak of MCP servers and HTTP tools on this machine, not Action endpoints.
+  - `@nylorun/studio`: the `action.*` event views and delivery status are removed; the chat shows `tool.completed`, and the Agent Manifest tab lists tools without a target as code tools.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [4bd2a0b]
+- Updated dependencies [a64aaca]
+- Updated dependencies [40b7648]
+- Updated dependencies [713e676]
+- Updated dependencies [c135267]
+- Updated dependencies [d36f0d9]
+- Updated dependencies [107b07d]
+  - @nylorun/core@0.15.0-beta
+
+## 0.10.0-beta
+
+### Major Changes
+
+- 7f763c3: **The Admin API and the operator listener are gone (Runtime and Management APIs, step A5).** Host work moves to the machine: `nylorun` runs `nylorun-operate` inside the runtime container, and every remote client uses the Runtime API or the Management API.
+
+  - **Breaking (`@nylorun/runtime`):** `/v1/admin/*` (status, host, shutdown, keys, openapi.json) is removed; it answers like any unknown route. The operator listener, `NYLORUN_ADMIN_LISTEN_PORT`, `NYLORUN_ADMIN_LISTEN_HOST`, `NYLORUN_ADMIN_ALLOWED_HOSTS` and `host.json`'s `adminPort` are gone, and so is the `admin-openapi.json` package file. Stop the Host with SIGTERM. `nylorun-operate status [--json]` reports the version, protocol and the Tenant's id, name, state and cause, exiting 2 when the Tenant is not open. `/ready` adds `harness: { mode, connected }` while the Tenant is open. `startEphemeralRuntime` loses `operatorListener` and `adminUrl`. The admin key stays: it derives Studio's key.
+  - **Breaking (`@nylorun/admin`):** `createAdmin()` is the Management API client (`tenant`, `keys`, `models`, `vaults`, `signingKeys`, `settings`) with a management key: explicit `{ url, key }`, else `NYLORUN_RUNTIME_URL` + `NYLORUN_MANAGEMENT_KEY`, else the Project link's or the local Host root's management key. `status()`, `adminUrl`, the Admin API keys, `NYLORUN_ADMIN_URL`/`NYLORUN_ADMIN_KEY` and `OPERATOR_KEYS_FEATURE` are removed; `deriveStudioToken` and `mintStudioLoginToken` stay.
+  - **Breaking (`@nylorun/core`):** `admin-status` leaves `PROTOCOL_FEATURES` (the Host still advertises it for protocol 5–7 clients) and `operator-keys` is removed; `AdminStatusSchema`, `AdminHostStatusSchema`, `HostAggregateSchema` and `HostShutdownResponseSchema` are removed.
+  - **Breaking (`nylorun`):** no admin port: `NYLORUN_ADMIN_PORT` is no longer written or published (an existing one is ignored). `nylorun start` waits for `/ready`, and `nylorun status` reads readiness from `/ready` and the Tenant from `nylorun-operate status`.
+  - `@nylorun/cli`: `nylo status` no longer falls back to the Admin API; when the Tenant does not answer it points to `npx nylorun status`.
+
+### Minor Changes
+
+- 3b3bdc6: **The clients use management keys (Runtime and Management APIs, step A3).** The protocol stays at 7; every client keeps working against a protocol 7 Runtime's routes.
+
+  - `nylorun`: `nylorun start` keeps an application key (`project`) and a management key (`project-management`) for a Project, in `<Host root>/project-credentials.json` and the Project's `.nylorun/credentials.json` (still format 1, with new `managementKey` and `managementPrincipalId` fields). A credentials file holding only an application key gains a management key at the next start. Commands outside a project keep `cli` and `cli-management`. Keys are issued through `nylorun-operate` in the runtime container instead of the Admin API, and `nylorun key put <id> --management` puts a management key. Seeding the Tenant and `nylorun mcp connect` use the management key (`/v1/tenant/vaults`). Studio reaches the Runtime's public listener.
+  - `@nylorun/cli`: `status`, `reset`, `configure`, `doctor` and `access signing-keys` use the Management API through `@nylorun/admin` with the Project's management key, or `NYLORUN_MANAGEMENT_KEY`.
+  - `@nylorun/studio`: local Studio needs no login. A request on the published loopback address (`localhost` or `127.0.0.1` at Studio's port) acts as signed in; hosts behind a sign-in proxy and embedding keep their login, and state-changing requests still need Studio's own `Origin`. Studio learns its Tenant from `GET /v1/tenant` with its key instead of the Admin API, and its Connections page manages vaults through `@nylorun/admin/client` at `/v1/tenant/vaults`.
+  - **Breaking (`@nylorun/admin`, `@nylorun/runtime`): Studio's key is derived from the admin key alone.** `deriveStudioToken(adminKey)` takes no Tenant id (HMAC-SHA256 over `nylorun/studio/v2`). The Host registers the new key's hash at its next start, replacing the old one; an app that embeds Studio and derives its key must update.
+  - `@nylorun/core`: `ProjectCredentialsFileSchema` gains optional `managementKey` and `managementPrincipalId`.
+
+### Patch Changes
+
+- b28bdd7: **Local MCP servers work on a local Tenant, and a server that does not connect shows.** Additive; the protocol stays at 7.
+
+  - `@nylorun/runtime`: remote MCP servers (`streamable-http`, `sse`) are reached under the Host's address policy, as Action endpoints are (`NYLORUN_ENDPOINT_*`, `tenant/outbound.ts`). In the local Docker stack `localhost`, `127.0.0.1` and `[::1]` now mean the machine that runs Docker (`host.docker.internal`), so `.mcp({ x: { type: "streamable-http", url: "http://localhost:3002/x" } })` connects where it used to fail with `fetch failed`. With `NYLORUN_ENDPOINT_PRIVATE=refuse` a server on a private address is refused; with `NYLORUN_ENDPOINT_HTTP=refuse` an `http` server is refused. Redirects are still not followed. A connection failure now names its cause (`connect ECONNREFUSED …`) instead of `fetch failed`. This applies in the gateway, a harness process and an in-process Tenant. `guardedFetch` takes `stream: true`: the answer streams, unbounded, with no timeout but the caller's signal.
+  - `@nylorun/core`: new session event `mcp.discovered`, recorded once on the session's first turn with the MCP snapshot: one entry per declared server with `outcome` (`connected`, `refused`, `failed`), `message` and the number of `tools` it added (`McpDiscoveredPayloadSchema`, `McpServerOutcomeSchema`). A server that does not connect adds no tools for the session's life; this is where that shows in the event log, beside `mcpDiagnostics`.
+  - `@nylorun/agents`: `.plugin()` and `plugin()` emit a process warning (`NylorunPluginWarning`, the diagnostic's code) for each part of the package they skip, so building or registering the agent says when a plugin's MCP server was dropped. The `plugin.mcp-server-skipped` message now says why: for example, plain `http` is accepted only for `localhost`, `127.0.0.1` or `[::1]`.
+  - `@nylorun/studio`: the event list labels `mcp.discovered` and summarizes each server's outcome.
+
+- 7a22f7f: **`nylorun start` opens no browser.** `start` (and `up`) prints the Runtime and Studio URLs, says to run `nylorun studio` to sign a browser in to Studio, and ends with a pointer to `nylorun --help`. It no longer mints a Studio login token or opens Studio, also in a terminal. `--no-open` is still accepted and ignored. `nylorun studio` signs a browser in as before.
+- Pin core to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [3b3bdc6]
+- Updated dependencies [6576e12]
+- Updated dependencies [b28bdd7]
+- Updated dependencies [cc107b1]
+- Updated dependencies [7f763c3]
+- Updated dependencies [98b0d37]
+- Updated dependencies [c66d8ed]
+  - @nylorun/core@0.14.0-beta
+
+## 0.9.0-beta
+
+### Major Changes
+
+- bd478ee: **Subject tokens, browser keys and derived principals leave open source (F9 I3, protocol 7).** Upgrade these with the Runtime: they speak protocol 7, which this Runtime serves beside 4, 5 and 6; protocol 6 clients keep working on every route that remains. Browsers and apps present a trusted issuer's token (F9 I2), servers an operator key (F9 I1), and a person's own credentials come from the operator's credential resolver (F9 C1). See MIGRATION.md.
+
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): subject tokens are gone.** `POST /v1/tokens`, `POST /v1/access/revocations`, subject-token verification, revocation epochs and the `subject.revoked` stream signal are removed; the routes answer `404`, and a JWT no trusted issuer signed is the opaque `404`. A stream opened with a token now ends only at its expiry (`event: nylorun.closed`, reason `token_expired`; `StreamClosedFrame` loses `revoked`). Migration `0010_oss_auth_removals` drops the `subject_epochs`, `subject_usage` and `publishable_keys` tables. The `token` caller is a trusted issuer's token only: it loses `role`, `limits` and `epoch`, and `issuer` is always set; `GET /v1/me` no longer reports `via: token`. Core drops `SUBJECT_TOKEN_TYPE`, `SUBJECT_TOKEN_AUDIENCE`, `subjectTokenIssuer` (the Runtime's own tokens use `tenantTokenIssuer`, same value), `CreateTokenRequest`/`Response`, `RevokeSubject*`, `SubjectTokenClaims`, `TOKEN_TTL_MIN_SECONDS` and `TOKEN_TTL_DEFAULT_SECONDS`; `TOKEN_SCOPES` is `agents:read`, `sessions:own`, `sandboxes:write`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): the access policy and role limits are gone.** `GET`/`PUT /v1/access/policy` answer `404`, a turn is never refused with `429 limit_exceeded` for a role (limit requests at your proxy), and an existing `access.policy` setting is ignored. Core drops `AccessPolicy*`, `AccessRole*`, `RoleLimits*`, `DEFAULT_ACCESS_POLICY`, `PutAccessPolicyRequest` and `ROLE_NAME_PATTERN`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): publishable keys and the Runtime's CORS are gone.** `/v1/access/publishable-keys*` answer `404`, `Nylorun-Key` is ignored, `NYLORUN_BROWSER_ACCESS` and `browserAccess` (host.json, `createHost`, `startEphemeralRuntime`) are removed, and the Runtime sends no CORS headers. A request with `Origin` reaches the Tenant routes of the public listener with no toggle: a trusted issuer's token is served, an application key or delivery token is `403 origin_rejected`; admin routes, `/health`, `/ready` and the operator listener still refuse `Origin`. Any `OPTIONS` request is `204` with `Allow` and no CORS header: the operator's proxy answers preflights. Route declarations lose `browser` (`x-nylorun-browser` leaves the OpenAPI document) and the `publishable` credential; the token security scheme is `issuerToken`. Core drops `PUBLISHABLE_KEY_HEADER`, `PUBLISHABLE_KEY_PATTERN`, `PUBLISHABLE_KEY_ID_PATTERN`, `tenantOfPublishableKey`, `newPublishableKey`, `newPublishableKeyId`, `PublishableKey*`, `OriginEntrySchema`, `originAllowed` and `LOOPBACK_ORIGIN_WILDCARDS`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/agents`): vault routes are application-only, and `vaults:own` is retired.** Every `/v1/vaults` route takes an application key acting for no one (operator keys, Studio); a request acting for a subject or a trusted issuer's token gets `403 scope_required`. `vaults:own` leaves `SUBJECT_SCOPES`, `TOKEN_SCOPES` and the issuer scopes; `Nylorun-Scopes` may still name it and it grants nothing. Existing user vaults stay attachable to their own owner's sessions. `client.createVault` takes `{ scope: "installation" }` or `ownerUserId`, and `client.listVaults()` takes an optional owner.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/admin`, `nylorun`): derived principals are gone.** Only Studio's key is derived from the admin key. `NYLORUN_DERIVED_PRINCIPALS` is ignored and no longer written, `hostPrincipals` takes no `derived`, `startEphemeralRuntime` no `derivedPrincipals`, and `@nylorun/admin` drops `deriveTenantKey`, `PROJECT_PRINCIPAL_ID` and `admin.deriveTenantKey`. Keys an earlier Host derived stay in the database and keep working as ordinary keys; replace them with operator keys. Core renames `DERIVED_PRINCIPAL_ID_PATTERN` to `APPLICATION_KEY_ID_PATTERN`.
+  - **Breaking (`@nylorun/agents`):** `createTokenEndpoint`, `createBrowserClient` and the `@nylorun/agents/browser` entry, `client.tokens`, `TokensClient`, `PublishableKeysClient`, `client.access.getPolicy`/`putPolicy`/`revokeSubject`/`publishableKeys` and `Destination.publishableKey` are removed. `client.access.signingKeys` and `client.access.jwks()` stay, and `Destination.token` takes a trusted issuer's tokens.
+  - **Breaking (`@nylorun/cli`):** `nylo access policy|keys|revoke|token` are removed and name what replaces them; `nylo access signing-keys list|rotate|revoke` stays.
+  - **Breaking (`@nylorun/core`, `@nylorun/agents`, `@nylorun/studio`): the Studio embed message `open.babai` is now `open.session`** (`{ sessionId }`): it asks the embedding app to open that session in its own UI. Studio sends no such message itself.
+  - **Breaking (`nylorun`): Studio embedding is opt-in.** No origin may frame Studio by default; list your app's origins with `nylorun start --studio-embed-origin <origin>`. A Tenant's `.env` from an earlier nylorun keeps the origins it had until `--studio-embed-origin-reset`.
+  - `PROTOCOL_VERSION` is 7 and `HOST_PROTOCOL` 4–7; the Host features `subject-tokens`, `browser-access` and `derived-principals` are removed. `@nylorun/studio` and `@nylorun/create-agent` speak protocol 7.
+
+### Minor Changes
+
+- 8773586: **Installation vaults and a credential resolver (F9 C1).** A session's MCP credential now comes from its attached vaults, then from the operator's own credential resolver; nothing changes for existing vaults, and the protocol stays at 6.
+
+  - Installation vaults: `POST /v1/vaults` takes `scope: "installation"` (no `ownerUserId`) from an application key acting for no one; a request acting for a subject gets `403`. The vault is owned by `installation`, now a reserved subject like `host`. Any session may attach one and select its credentials. `GET /v1/vaults` from an application key lists them after the named person's vaults, and lists only them without `ownerUserId`; a request acting for a subject never sees one (the opaque `404`). The host model vault stays hidden and unattachable. Migration 0008 adds the scope.
+  - The credential resolver: `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN` on the gateway (`TenantConfig.resolver` and `startEphemeralRuntime({ resolver })` in process). When the session's vaults hold nothing for a remote MCP server's URL, the Runtime POSTs `{ owner, session, turn, target: { kind: "mcp", server, agent, url } }` with the resolver's bearer: `200 { headers, expiresAt? }` is used, `404` goes without a credential, and anything else or no answer within 5 s refuses the server with `credential_unavailable`. Owner and turn come from the session row. Answers are cached per owner and URL until `expiresAt`, at most 5 minutes (60 s without one), and concurrent misses share one request. See DEPLOYMENT.md, Credentials.
+  - `nylorun`: the gateway's Compose service passes `NYLORUN_RESOLVER_URL` and `NYLORUN_RESOLVER_TOKEN` from the shell that runs `nylorun start` (unset by default).
+  - Studio: the Vault page is now **Connections**, and creates installation vaults.
+
+- e1bfb4b: **MCP OAuth connect for installation vaults (F9 C2).** The installation can sign in once to a remote MCP server that uses OAuth, and every session that attaches the vault uses the credential. Additive; the protocol stays at 6.
+
+  - `POST /v1/vaults/{vaultId}/oauth/start` (application keys acting for no one, installation vaults only) takes `{ url, server, clientId? }` and answers `{ authorizeUrl, expiresAt }`. The Runtime discovers the server's authorization server (RFC 9728, then RFC 8414), registers itself (RFC 7591) unless `clientId` names a registered client, and starts an S256 PKCE sign-in whose `state` works once, for ten minutes. A server without registration and no `clientId` is `400 oauth_client_required`.
+  - `GET /v1/oauth/callback` takes the browser back: anonymous and unversioned like an artifact link, it exchanges the code and stores an `oauth` credential bound to the URL, named after `server` (connecting again rotates it), and answers a small HTML page. An unknown, used or expired `state` is `oauth_state_invalid`; the authorization server's refusal is `oauth_failed`. The callback's base is `NYLORUN_PUBLIC_URL` (`TenantConfig.publicUrl`), else the start request's origin.
+  - Every OAuth step runs in the gateway's keys module (F9-D14): the runtime container never sees a token, the PKCE verifier or a client secret, and makes no outbound call. Migration 0009 adds `oauth_pending`, with the verifier and secret sealed under the vault key. `Keys` gains `startOAuth` and `finishOAuth`.
+  - OAuth requests, including refresh of every OAuth vault credential, now go through `guardedFetch` (`tenant/outbound.ts`): the `NYLORUN_ENDPOINT_*` address policy checked on the address connected to, no redirects, a bounded answer. With `NYLORUN_ENDPOINT_PRIVATE=refuse` a token endpoint on a private address is refused, where refresh used to call it.
+  - `@nylorun/core`: `ERROR_CODES` adds `oauth_client_required`, `oauth_state_invalid` and `oauth_failed`; `StartOAuthRequestSchema` and `StartOAuthResponseSchema`.
+  - `nylorun mcp connect <url> --server <name> [--vault <id>] [--client-id <id>]`: creates the installation vault `mcp` if needed, opens the sign-in page and waits up to 10 minutes for the credential. See DEPLOYMENT.md, "Connecting a remote MCP server with OAuth".
+
+- 5cfaed9: **Operator keys, and project links on them (F9 I1).** The Admin API manages the Tenant's application keys by name: `PUT /v1/admin/keys/{id}` creates a key or rotates it and returns it once, `GET /v1/admin/keys` lists every key's id, role and issue time (never the keys), and `DELETE /v1/admin/keys/{id}` removes one. A rotated or deleted key stops authenticating on its next request. Ids follow `^[a-z][a-z0-9-]{0,31}$`; `studio` (derived from the admin key) is refused. Keys keep today's format (64 hex) and only their SHA-256 is stored, in the existing principals table (no migration). Host feature `operator-keys` (additive, protocol unchanged); core adds the `OperatorKey`, `ListOperatorKeysResponse`, `PutOperatorKeyResponse` and `DeleteOperatorKeyResponse` schemas.
+
+  - `@nylorun/admin`: `admin.keys.put(id)`, `admin.keys.list()` and `admin.keys.delete(id)`; they refuse with `incompatible_host` when the Host lacks `operator-keys`.
+  - `nylorun key put|list|rm <id>` manages a running local Tenant's keys; `put` prints the key once on stdout.
+  - `nylorun start` no longer derives the project's key. It keeps `.nylorun/credentials.json` while its key still reaches the Tenant (one authenticated read); otherwise it gives the project the operator key `project`, which the Host root keeps in `project-credentials.json` (0600) so every checkout linked to the Tenant shares it. An existing derived project key keeps working and is adopted.
+  - `nylorun sandbox` uses the linked project's key, or the operator key `cli` it puts once and keeps in `<Host root>/cli-credentials.json` (0600).
+  - The ephemeral Runtime (`startEphemeralRuntime`) no longer registers the derived `project` principal; pass `derivedPrincipals: ["project"]` to keep it. Derived principals (`NYLORUN_DERIVED_PRINCIPALS`, `deriveTenantKey`) still work on a Host.
+
+- b906050: **Studio for a team (F9 S1).** Studio can sit behind a sign-in proxy such as oauth2-proxy. A request with no Studio session that carries a JWT, in `X-Forwarded-Access-Token` or as an `Authorization` bearer that is not a Studio session, signs in when the Runtime's `GET /v1/me` verifies it and reports the `studio` scope: Studio sets its usual signed session cookie, which records the subject for its write log and ends no later than the token (at most the usual 30 days), and serves the request. Studio never trusts the header unverified and keeps nothing else. A token without the scope gets `403` naming `studio`; a token the Runtime refuses, or one that is not a JWT, gets `401`. Admitted people get Studio's Tenant-wide view; the CLI sign-in and embedding are unchanged, and a valid embed bearer session still wins. New `NYLORUN_STUDIO_ALLOWED_HOSTS`: extra `Host` values Studio serves, comma-separated (`studio.acme.dev`); its state changes accept that host's `https` and `http` origins, and the cookie is `Secure` when the proxy sends `X-Forwarded-Proto: https`. The default is unchanged: only `localhost` and `127.0.0.1` on the published port. `nylorun start` passes `NYLORUN_STUDIO_ALLOWED_HOSTS` from its environment to the Studio container.
+- c0b604e: **Trusted issuers (F9 I2).** The Tenant API accepts JWTs from the operator's own identity provider as bearers, configured in an identity file: `NYLORUN_IDENTITY_FILE` names a YAML file listing each issuer's `name`, `issuer`, `audience`, `jwks` URL or static PEM `keys`, a `subject` template over scalar claims (`u:{sub}`), `scopes` from a claim or a fixed list, `allowedScopes`, an optional `agents` allowlist, optional `sandboxes` grant templates (`{org_id}/*`) and `maxLifetime`. A malformed file stops the boot, naming the issuer and the field; a subject template without a claim is malformed. A bearer whose unverified `iss` names an issuer is verified with RS256, ES256 or EdDSA only, up to 16 KiB, `aud` matching, `exp` and `iat` required and `exp − iat` within `maxLifetime`, and becomes a token caller (`role: issuer:<name>`) with the issuer's scopes, agents and rendered sandbox grants; subject revocation does not reach it. JWKS keys are fetched only from the configured URL (no redirects), cached by `kid`, refetched at most once a minute for an unknown `kid`; while a JWKS is unreachable cached keys keep working and a new `kid` is `401 issuer_unavailable` (new error code). A browser request with an issuer token needs no publishable key (CORS comes from the operator's proxy). New: `GET /v1/me` reports the subject, scopes, agents, sandbox grants and `via` (`application:<id>`, `subject`, `token` or `issuer:<name>`) of any credential; the issuer-only scope `studio`; `ISSUER_SCOPES`, `CALLER_SCOPES` and `MeResponseSchema` in `@nylorun/core/contracts`; `parseIdentityFile` and `createTrustedIssuers` in `@nylorun/runtime`, and an `issuers` option on `startEphemeralRuntime`; Host feature `trusted-issuers` (additive, protocol unchanged). `nylorun start` sets `NYLORUN_IDENTITY_FILE=/nylorun/identity.yaml` on the runtime container when `<Host root>/identity.yaml` exists.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin runtime to the tested release.
+- Pin studio to the tested release.
+- Updated dependencies [8773586]
+- Updated dependencies [e1bfb4b]
+- Updated dependencies [5cfaed9]
+- Updated dependencies [bd478ee]
+- Updated dependencies [c0b604e]
+  - @nylorun/core@0.13.0-beta
+
 ## 0.8.0-beta
 
 ### Major Changes

package/README.md

@@ -34,8 +34,8 @@ npx nylorun doctor                 # Node 24+, Docker, Compose v2, and the Tenan
 ## Commands
 
 ```sh
-nylorun up|start [--tenant <name>] [--no-link] [--no-studio] [--no-open] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]
-                                   # create (first run) and start the Tenant; link the project; print the URLs; open Studio signed in
+nylorun up|start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]
+                                   # create (first run) and start the Tenant; link the project; print the URLs
                                    # --restate-ui (or NYLORUN_RESTATE_UI=1): publish Restate's UI on loopback for this start
 nylorun down|stop [--tenant <name> | --all]   # stop the containers (--all: every Tenant's); keep volumes
 nylorun status [--tenant <name>] [--json]   # the Tenant, its Host root and id, services, endpoints, Runtime health
@@ -46,6 +46,10 @@ nylorun ls [--json]                # the Tenants on this machine, with their sta
 nylorun delete <tenant> --yes      # remove a Tenant: containers, volumes, Host root and vault key
 nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]   # the running Tenant's sandboxes
 nylorun sandbox rm <id> [--tenant <name>]   # delete a sandbox and its files
+nylorun key put <id> [--management] [--tenant <name>]   # create or rotate the Tenant's application key <id> (--management: a management key); prints it once
+nylorun key list [--tenant <name>] [--json] # the Tenant's keys: id, role, when issued
+nylorun key rm <id> [--tenant <name>]       # delete a key: it stops working at once
+nylorun mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]   # sign the Tenant in to a remote MCP server with OAuth
 nylorun doctor [--json]            # prerequisites and the Tenant's health
 nylorun telemetry [status|enable|disable]   # Studio's anonymous usage analytics
 nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]
@@ -131,14 +135,22 @@ recorded version.
 ## The Project link
 
 `nylorun start` in a project waits until the Tenant is open
-(`/v1/admin/status`), then writes, in a `.nylorun/` directory (mode 0700, with
+(`/ready`), then writes, in a `.nylorun/` directory (mode 0700, with
 its own `.gitignore` of `*`):
 
 - `link.json`: `{ "format": 3, "tenant", "tenantId", "hostUrl", "hostId" }`.
   `tenant` is the local Tenant's name; the Tenant id is information only:
   nothing in a request selects a Tenant.
-- `credentials.json` (mode 0600): the key of the derived principal `project`,
-  derived from the Tenant's admin key, and its id.
+- `credentials.json` (mode 0600): `{ "format": 1, "applicationKey",
+  "principalId", "managementKey", "managementPrincipalId" }`, the application
+  key `project` (for the Runtime API) and the management key
+  `project-management` (for the Management API). A later `start` keeps the file
+  while both keys still reach the Tenant (one authenticated read each);
+  otherwise it writes the Tenant's `project` and `project-management` keys,
+  which the Host root keeps in `project-credentials.json` (mode 0600) so every
+  checkout linked to the Tenant shares them, or puts new ones through
+  `nylorun-operate keys`. A file from an earlier release, with only an
+  application key, keeps it and gains the management key.
 
 Later starts reuse the Tenant and rewrite the link only when the Tenant's name,
 URL, Host or id changed (after `nylorun reset`, for example). When it writes a
@@ -154,9 +166,37 @@ both share it. `--no-link` starts a Tenant without linking the working
 directory (scripts). A link of an older nylorun (format 0 to 2) counts as no
 link: `start` replaces it.
 
-The Runtime registers the derived principals of `NYLORUN_DERIVED_PRINCIPALS`
-(comma-separated, from the environment of `nylorun start`, kept in the Tenant's
-`.env`) when it creates the Tenant; `project` is always among them.
+No key is derived from the admin key but Studio's. A project holds the
+application key `project` and the management key `project-management`; a key
+an older nylorun derived for it keeps working while it authenticates and is
+replaced by the application key otherwise.
+
+## Keys
+
+Every Tenant serves the Runtime API, which takes **application keys**, and the
+Management API (`/v1/tenant/*`), which takes **management keys**
+([SELF_HOSTING.md](../SELF_HOSTING.md#keys)). `nylorun key` manages both on the
+running Tenant through `nylorun-operate` in its runtime container, so only this
+machine can issue a management key.
+
+`nylorun key put <id>` creates the application key `<id>` (or rotates it: the
+previous key stops working at once) and prints it once on stdout; with
+`--management` it puts a management key. `nylorun key list [--json]` shows each
+key's id, role and when it was issued, never the keys; `nylorun key rm <id>`
+deletes one. Ids match `^[a-z][a-z0-9-]{0,31}$`; `studio` belongs to Studio and
+`bootstrap` to `NYLORUN_MANAGEMENT_KEY_FILE`, and both are refused. Putting an
+id that holds the other role is refused. Give each app server its own
+application key. `nylorun sandbox` and `nylorun mcp` use the linked project's
+keys, or the keys `cli` and `cli-management` they put once and keep in
+`<Host root>/cli-credentials.json` (mode 0600).
+
+`nylorun mcp connect <url> --server <name>` signs the running Tenant in to a
+remote MCP server that uses OAuth: it opens the server's sign-in page in the
+browser and waits until the Runtime has stored the credential in the
+installation vault `mcp` (created if needed; `--vault <id>` picks another),
+which sessions attach with `vaultIds`. Pass `--client-id` when the server does
+not let clients register themselves. See
+[Connecting a remote MCP server with OAuth](../DEPLOYMENT.md#connecting-a-remote-mcp-server-with-oauth).
 
 ## The containers
 
@@ -174,12 +214,9 @@ project, and each has the label `dev.nylorun.tenant: <name>`. For Tenant `shop`:
 | Volumes | `nylorun-shop-postgres`, `nylorun-shop-restate`, `nylorun-shop-s2-lite`, `nylorun-shop-rustfs`, `nylorun-shop-workspaces` |
 
 The `harness` container (the Runtime image as `--service harness`) runs agent
-turns, stdio MCP servers and workspaces, apart from the `runtime` container. It
-holds only the harness token (`NYLORUN_HARNESS_TOKEN` in `.env`), mounts only
-the Tenant directory's `sandboxes/`, `plugin-data/`, `home/` and `tmp/`, and the
-Host root's `plugins/` read-only at its own path: put a plugin whose stdio MCP
-server the agent runs under `~/.nylorun/tenants/<name>/plugins/` and load it from
-there. `NYLORUN_HARNESS=in-process` in `.env` rolls back to running them in the
+turns and workspaces, apart from the `runtime` container. It holds only the
+harness token (`NYLORUN_HARNESS_TOKEN` in `.env`) and mounts only the Tenant
+directory's `sandboxes/`. `NYLORUN_HARNESS=in-process` in `.env` rolls back to running them in the
 `runtime` container (no `harness` container); `nylorun status` shows which.
 
 Postgres initialises the Tenant's database with C collation. Restate runs with
@@ -187,8 +224,8 @@ its own defaults. A running Tenant uses about 1.2 GB, most of it Restate; stop
 the Tenants you are not using (`nylorun stop`, or `nylorun stop --all`). The Runtime and Studio images are pinned by
 this release (`package.json` `nylorun.runtime` and `nylorun.studio`);
 `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them (local builds,
-CI). Ports publish on loopback only: the Runtime on `8787`, its operator
-listener (Admin API) on `8788` and Studio on `4161`, or free ports chosen on the
+CI). Ports publish on loopback only: the Runtime on `8787` and Studio on
+`4161`, or free ports chosen on the
 Tenant's first start, avoiding the ports other Tenants keep, and kept in its
 `.env`. Restate's UI and admin API (unauthenticated) are not published; `nylorun
 start --restate-ui` (or `NYLORUN_RESTATE_UI=1`) publishes them for that start on
@@ -196,14 +233,18 @@ start --restate-ui` (or `NYLORUN_RESTATE_UI=1`) publishes them for that start on
 
 `start`, `status`, `ls` and `nylorun studio` give Studio as
 `http://localhost:<port>` (`studio.url` in `status --json`). Studio has no
-password: in a terminal (not in CI, and not with `--no-open`), `start` asks the
-Studio container for a single-use login token with the admin key (`POST
-/_studio/login-tokens`) and opens `http://localhost:<port>/login?token=…` on the
-Tenant's page in the browser. That sets a session cookie for 30 days, which
-survives Studio restarts, so the printed URL keeps working in that browser. The
-token itself is never printed unless no browser starts. Otherwise `start` says
-to run `nylorun studio`, which signs a browser in the same way; `nylorun studio
---no-open` prints the login URL (it works once, for two minutes) instead.
+password, and `start` opens no browser: it prints the URLs and says to run
+`nylorun studio` to sign a browser in (`--no-open` is accepted and ignored).
+`nylorun studio` asks the Studio container for a single-use login token with the
+admin key (`POST /_studio/login-tokens`) and opens
+`http://localhost:<port>/login?token=…` on the Tenant's page in the browser.
+That sets a session cookie for 30 days, which survives Studio restarts, so the
+printed URL keeps working in that browser. The token itself is never printed
+unless no browser starts; `nylorun studio --no-open` prints the login URL (it
+works once, for two minutes) instead.
+Studio needs no login on its published loopback address (`localhost` or
+`127.0.0.1` at its port): a browser on this machine is served as signed in. A
+host behind a sign-in proxy and an embedding app keep their sign-in.
 
 Browsers share cookies across the ports of one host, so each Tenant's Studio
 sets its own session cookie, `nylorun_studio_<name>`
@@ -212,14 +253,16 @@ out of another.
 
 ### Embedding Studio in a desktop app
 
-A desktop app such as Babai Desktop can show Studio inside its own window, in
-an iframe loaded from Studio's URL (`studio.url` in `nylorun status --json`).
-Only exact origins listed in `NYLORUN_STUDIO_FRAME_ANCESTORS` (in
-`~/.nylorun/tenants/<name>/docker/.env`) may frame it. The default is Babai's
-`nylorun://localhost http://nylorun.localhost`; `nylorun status` lists them
-under `Embeds`. While building such an app, add its dev server once with
-`nylorun start --studio-embed-origin http://localhost:1420`; the list is kept
-across starts until `--studio-embed-origin-reset`. Wildcards are refused.
+A desktop or web app can show Studio inside its own window, in an iframe loaded
+from Studio's URL (`studio.url` in `nylorun status --json`). Embedding is
+opt-in: only exact origins listed in `NYLORUN_STUDIO_FRAME_ANCESTORS` (in
+`~/.nylorun/tenants/<name>/docker/.env`) may frame it, and the list is empty by
+default. Add the app's origins once with `nylorun start --studio-embed-origin
+<origin>` (for example `app://localhost`, or a dev server's
+`http://localhost:1420`); the list is kept across starts until
+`--studio-embed-origin-reset`, and `nylorun status` shows it under `Embeds`.
+Wildcards are refused. A Tenant started by an older nylorun keeps the origins it
+had.
 
 The app's backend mints a single-use login token for the Tenant with
 `mintStudioLoginToken` from `@nylorun/admin` (it needs the admin key), and its
@@ -279,8 +322,9 @@ The **Host root** is `~/.nylorun/tenants/<name>/`, or `NYLORUN_HOME`. It is
 bind-mounted into the Runtime and Studio containers, and holds `tenant.json`
 (`{ "format": 1, "name", "project"? }`: the Tenant's name and the project it
 was created for), `host.json` (the client-facing host and port),
-`host-credentials.json` (the admin key, mode 0600), the Docker Compose files in
-`docker/`, the Tenant directory `tenant/` (homes, logs) and `keys/vault-kek`,
+`host-credentials.json` (the admin key, mode 0600), `project-credentials.json`
+and `cli-credentials.json` (the keys `project` and `project-management`, `cli`
+and `cli-management`, mode 0600, when they were put), the Docker Compose files in `docker/`, the Tenant directory `tenant/` (homes, logs) and `keys/vault-kek`,
 the Tenant's vault key, which only the gateway container mounts. The Tenant's data lives in its Postgres, Restate and S2 volumes.
 
 `nylorun reset` deletes the selected Tenant's volumes, `tenant/` and `keys/`, and keeps

package/dist/cli.js

@@ -2,12 +2,14 @@
 import "./baseline.js";
 import { baselineEnv } from "./baseline.js";
 import { CliError } from "./errors.js";
-import { isStackCommand, sandboxCommand, sandboxUsage, stackCommand, stackUsage, studioCommand, } from "./stack/index.js";
-const usage = `nylorun <up|down|start|stop|status|logs|studio|reset|ls|delete|sandbox|doctor|telemetry>
+import { isStackCommand, keyCommand, keyUsage, mcpCommand, mcpUsage, sandboxCommand, sandboxUsage, stackCommand, stackUsage, studioCommand, } from "./stack/index.js";
+const usage = `nylorun <up|down|start|stop|status|logs|studio|reset|ls|delete|sandbox|key|mcp|doctor|telemetry>
 
 Local Tenants (Docker Compose), one per project:
 ${stackUsage}
 ${sandboxUsage}
+${keyUsage}
+${mcpUsage}
   doctor [--json]                     check Node, Docker and Compose v2, and the Tenant's health
   telemetry [status|enable|disable]   Studio's anonymous usage analytics (on unless disabled,
                                       NYLORUN_TELEMETRY_DISABLED=1, DO_NOT_TRACK=1 or CI)
@@ -50,6 +52,14 @@ async function main() {
         process.exitCode = await sandboxCommand(args, baselineEnv());
         return;
     }
+    if (command === "mcp") {
+        process.exitCode = await mcpCommand(args, baselineEnv());
+        return;
+    }
+    if (command === "key") {
+        process.exitCode = await keyCommand(args, baselineEnv());
+        return;
+    }
     if (isStackCommand(command)) {
         process.exitCode = await stackCommand(command, args, baselineEnv());
         return;

package/dist/doctor.js

@@ -42,7 +42,7 @@ export async function doctorStack(options) {
         (!report.tenant.runtime.healthy ||
             !report.tenant.gateway.healthy ||
             (report.tenant.harness.mode === "remote" && !report.tenant.harness.healthy) ||
-            report.tenant.tenant?.cause !== undefined);
+            (report.tenant.tenant !== undefined && report.tenant.tenant.state !== "open"));
     const failed = !nodeOk || !checks.docker.ok || checks.compose?.ok === false || broken;
     if (options.json) {
         log(JSON.stringify(report, null, 2));
@@ -103,7 +103,7 @@ export async function doctorStack(options) {
                     "tenant id",
                     local.tenant.state === "open"
                         ? `✓ ${local.tenant.id ?? "?"} open`
-                        : `✗ ${local.tenant.id ?? "?"} unavailable${local.tenant.cause ? `: ${local.tenant.cause.code}: ${local.tenant.cause.repair}` : " (opening)"}`,
+                        : `✗ ${local.tenant.id ?? "?"} unavailable${local.tenant.cause || local.tenant.message ? `: ${[local.tenant.cause, local.tenant.message].filter(Boolean).join(": ")}` : " (opening)"}`,
                 ]);
             rows.push(["studio", `${local.studio.url ?? "?"} · ${local.studio.state}`]);
         }

package/dist/project/link.d.ts

@@ -22,13 +22,27 @@ export declare function writeProjectLink(projectRoot: string, link: {
     hostId: string;
     tenantId: string;
 }): Promise<void>;
-/** The Project's application key and principal, or undefined when absent or unreadable. */
-export declare function readProjectCredentials(projectRoot: string): Promise<{
+/**
+ * An application key and its principal, and the management key and its principal when the file
+ * has one: `credentials.json`'s content (format 1).
+ */
+export interface KeyCredentials {
     applicationKey: string;
     principalId: string;
-} | undefined>;
+    management?: {
+        key: string;
+        principalId: string;
+    };
+}
+/** The Project's keys, or undefined when absent or unreadable. */
+export declare function readProjectCredentials(projectRoot: string): Promise<KeyCredentials | undefined>;
+/**
+ * A credentials file (`{ format: 1, applicationKey, principalId, managementKey?,
+ * managementPrincipalId? }`): the Project's, or one the nylorun commands keep in the Host root.
+ * Undefined when absent or unreadable.
+ */
+export declare function readCredentialsFile(path: string): Promise<KeyCredentials | undefined>;
 /** `.nylorun/credentials.json` (format 1, mode 0600). */
-export declare function writeProjectCredentials(projectRoot: string, credentials: {
-    applicationKey: string;
-    principalId: string;
-}): Promise<void>;
+export declare function writeProjectCredentials(projectRoot: string, credentials: KeyCredentials): Promise<void>;
+/** A credentials file (format 1), written atomically with mode 0600. */
+export declare function writeCredentialsFile(path: string, credentials: KeyCredentials): Promise<void>;

package/dist/project/link.js

@@ -67,13 +67,27 @@ export async function writeProjectLink(projectRoot, link) {
         tenantId: link.tenantId,
     });
 }
-/** The Project's application key and principal, or undefined when absent or unreadable. */
+/** The Project's keys, or undefined when absent or unreadable. */
 export async function readProjectCredentials(projectRoot) {
+    return await readCredentialsFile(credentialsPath(projectRoot));
+}
+/**
+ * A credentials file (`{ format: 1, applicationKey, principalId, managementKey?,
+ * managementPrincipalId? }`): the Project's, or one the nylorun commands keep in the Host root.
+ * Undefined when absent or unreadable.
+ */
+export async function readCredentialsFile(path) {
     try {
-        const value = JSON.parse(await readFile(credentialsPath(projectRoot), "utf8"));
-        return typeof value.applicationKey === "string" && typeof value.principalId === "string"
-            ? { applicationKey: value.applicationKey, principalId: value.principalId }
-            : undefined;
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (typeof value.applicationKey !== "string" || typeof value.principalId !== "string")
+            return undefined;
+        return {
+            applicationKey: value.applicationKey,
+            principalId: value.principalId,
+            ...(typeof value.managementKey === "string" && typeof value.managementPrincipalId === "string"
+                ? { management: { key: value.managementKey, principalId: value.managementPrincipalId } }
+                : {}),
+        };
     }
     catch {
         return undefined;
@@ -82,9 +96,19 @@ export async function readProjectCredentials(projectRoot) {
 /** `.nylorun/credentials.json` (format 1, mode 0600). */
 export async function writeProjectCredentials(projectRoot, credentials) {
     await ensureProjectDir(projectRoot);
-    await writePrivate(credentialsPath(projectRoot), {
+    await writeCredentialsFile(credentialsPath(projectRoot), credentials);
+}
+/** A credentials file (format 1), written atomically with mode 0600. */
+export async function writeCredentialsFile(path, credentials) {
+    await writePrivate(path, {
         format: 1,
         applicationKey: credentials.applicationKey,
         principalId: credentials.principalId,
+        ...(credentials.management
+            ? {
+                managementKey: credentials.management.key,
+                managementPrincipalId: credentials.management.principalId,
+            }
+            : {}),
     });
 }

package/dist/project/seed.d.ts

@@ -21,7 +21,8 @@ export declare function readProjectEnv(projectRoot: string): Record<string, stri
 export declare function seedTenant(input: {
     fetch: FetchLike;
     runtimeUrl: string;
-    applicationKey: string;
+    /** The Project's management key: seeding is the Management API's. */
+    managementKey: string;
     projectRoot: string;
 }): Promise<SeedResult>;
 export {};

package/dist/project/seed.js

@@ -45,11 +45,11 @@ function modelFromEnv(env, projectRoot) {
     }
     return undefined;
 }
-async function call(fetch, url, applicationKey, init = {}) {
+async function call(fetch, url, managementKey, init = {}) {
     const response = await fetch(url, {
         ...(init.method ? { method: init.method } : {}),
         headers: {
-            authorization: `Bearer ${applicationKey}`,
+            authorization: `Bearer ${managementKey}`,
             [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
             accept: "application/json",
             ...(init.body === undefined ? {} : { "content-type": "application/json" }),
@@ -76,7 +76,7 @@ export async function seedTenant(input) {
     const result = { applied: [], kept: [] };
     const sandbox = env.NYLORUN_SANDBOX?.trim();
     if (sandbox === "auto" || sandbox === "virtual") {
-        const body = (await call(input.fetch, `${base}/v1/tenant/config/seed`, input.applicationKey, {
+        const body = (await call(input.fetch, `${base}/v1/tenant/config/seed`, input.managementKey, {
             method: "PUT",
             body: { requestId: randomUUID(), sandbox: { backend: sandbox } },
         }));
@@ -90,12 +90,12 @@ export async function seedTenant(input) {
     const seeded = modelFromEnv(env, input.projectRoot);
     if (!seeded)
         return result;
-    const current = (await call(input.fetch, `${base}/v1/tenant/model`, input.applicationKey));
+    const current = (await call(input.fetch, `${base}/v1/tenant/model`, input.managementKey));
     if (current.configured === true) {
         result.kept.push("model");
         return result;
     }
-    await call(input.fetch, `${base}/v1/tenant/model`, input.applicationKey, {
+    await call(input.fetch, `${base}/v1/tenant/model`, input.managementKey, {
         method: "PUT",
         body: {
             requestId: randomUUID(),