nylorun 0.8.0-beta → 0.11.0-beta

package/dist/stack/compose-file.d.ts

@@ -13,8 +13,7 @@
  * database with C collation (`--locale=C`) and runs with `wal_level=logical`: the stream
  * relay feeds s2-lite from the record over logical replication (Durable Streams), and
  * `max_slot_wal_keep_size` caps the WAL a stuck relay can hold. The Runtime creates the
- * Tenant on its first start, with its name (`NYLORUN_TENANT_NAME`) and the derived
- * principals of `NYLORUN_DERIVED_PRINCIPALS` (`project` for the Project link).
+ * Tenant on its first start, with its name (`NYLORUN_TENANT_NAME`).
  *
  * Restate signs requests to the Worker endpoint with the private key in
  * `docker/restate-identity.pem`, mounted read-only; the Runtime gets the public
@@ -23,17 +22,17 @@
  * The combined packing (blueprint D12): the `runtime` container runs the core
  * and loop services, and the `gateway` container runs gates: the Model Gate,
  * which alone reads model credentials, and the Tool Gate (F4.1), which alone
- * holds remote MCP connections and their credentials and POSTs every Action
- * delivery. Every model call, remote MCP call and delivery of the loop crosses it
+ * holds remote MCP connections and their credentials and makes every HTTP tool
+ * request. Every model call, remote MCP call and HTTP tool call of the loop crosses it
  * (NYLORUN_GATES_URL, with NYLORUN_GATES_TOKEN from `.env`, or a run's token from the
- * harness); MCP stdio servers run in the harness container. The gateway also runs keys (F4.2): the only
+ * harness). The gateway also runs keys (F4.2): the only
  * holder of the vault key, it runs every vault write that touches a secret and signs
  * every token (NYLORUN_KEYS_URL). The gateway mounts only the Host's Tenant directory
  * (`tenant/`) and its keys directory (`keys/`, the vault key), read-only: never
  * host-credentials.json. The runtime mounts the Host root with `keys/` and `docker/`
  * covered by empty read-only mounts, so it can read neither the vault key nor
  * Restate's private key and `.env`. The runtime does not wait for the gateway: while
- * it is down, model and MCP calls fail, deliveries are retried, vault writes and
+ * it is down, model, MCP and HTTP tool calls fail, vault writes and
  * token minting answer 503, and the session takes the next message.
  *
  * The Object store (blueprint D35) is RustFS, single node and single drive, pinned by digest,
@@ -54,23 +53,25 @@
  * CONNECT with the egress token, to the hosts the sandbox spec allows). The two HTTP listeners
  * accept that address as a Host.
  *
- * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn, MCP stdio server
- * and workspace in its own container: the runtime image with `--service harness`, connected to
- * core's Harness API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its
- * only credential, and calling models and remote MCP servers through the gateway with each
- * run's token. It mounts only the Tenant's `sandboxes/`, `plugin-data/`, `home/` and `tmp/`
- * under `/harness`, and the Host root's `plugins/` read-only at its own path (plugin roots name
- * paths on this machine; the runtime mounts it there too). NYLORUN_HARNESS=in-process in `.env`
- * rolls back to turns in the runtime container, without the harness service.
+ * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn and workspace in
+ * its own container: the runtime image with `--service harness`, connected to core's Harness
+ * API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its only
+ * credential, and calling models and remote MCP servers through the gateway with each run's
+ * token. It mounts only the Tenant's `sandboxes/` under `/harness`. NYLORUN_HARNESS=in-process
+ * in `.env` rolls back to turns in the runtime container, without the harness service.
  *
  * Three networks: `store` (internal: no egress) joins Postgres, s2-lite, Restate and RustFS to
  * the runtime and the gateway; `harness` joins the harness to the runtime and the gateway only;
  * `default` carries egress and the published ports (runtime, gateway, Studio, sandboxes).
  * Restate's admin port (its UI, unauthenticated) is published, and Restate joins `default`,
  * only with `restateUi` (`nylorun start --restate-ui`).
+ *
+ * With `identity` (when `<Host root>/identity.yaml` exists) the runtime reads its trusted issuers
+ * from it, through the Host root mount (NYLORUN_IDENTITY_FILE=/nylorun/identity.yaml).
  */
 export declare function renderComposeFile(project: string, name: string, options?: {
     sandboxes?: true;
     harness?: "remote" | "in-process";
     restateUi?: true;
+    identity?: true;
 }): string;

package/dist/stack/compose-file.js

@@ -14,8 +14,7 @@ import { PINNED_IMAGES } from "./images.js";
  * database with C collation (`--locale=C`) and runs with `wal_level=logical`: the stream
  * relay feeds s2-lite from the record over logical replication (Durable Streams), and
  * `max_slot_wal_keep_size` caps the WAL a stuck relay can hold. The Runtime creates the
- * Tenant on its first start, with its name (`NYLORUN_TENANT_NAME`) and the derived
- * principals of `NYLORUN_DERIVED_PRINCIPALS` (`project` for the Project link).
+ * Tenant on its first start, with its name (`NYLORUN_TENANT_NAME`).
  *
  * Restate signs requests to the Worker endpoint with the private key in
  * `docker/restate-identity.pem`, mounted read-only; the Runtime gets the public
@@ -24,17 +23,17 @@ import { PINNED_IMAGES } from "./images.js";
  * The combined packing (blueprint D12): the `runtime` container runs the core
  * and loop services, and the `gateway` container runs gates: the Model Gate,
  * which alone reads model credentials, and the Tool Gate (F4.1), which alone
- * holds remote MCP connections and their credentials and POSTs every Action
- * delivery. Every model call, remote MCP call and delivery of the loop crosses it
+ * holds remote MCP connections and their credentials and makes every HTTP tool
+ * request. Every model call, remote MCP call and HTTP tool call of the loop crosses it
  * (NYLORUN_GATES_URL, with NYLORUN_GATES_TOKEN from `.env`, or a run's token from the
- * harness); MCP stdio servers run in the harness container. The gateway also runs keys (F4.2): the only
+ * harness). The gateway also runs keys (F4.2): the only
  * holder of the vault key, it runs every vault write that touches a secret and signs
  * every token (NYLORUN_KEYS_URL). The gateway mounts only the Host's Tenant directory
  * (`tenant/`) and its keys directory (`keys/`, the vault key), read-only: never
  * host-credentials.json. The runtime mounts the Host root with `keys/` and `docker/`
  * covered by empty read-only mounts, so it can read neither the vault key nor
  * Restate's private key and `.env`. The runtime does not wait for the gateway: while
- * it is down, model and MCP calls fail, deliveries are retried, vault writes and
+ * it is down, model, MCP and HTTP tool calls fail, vault writes and
  * token minting answer 503, and the session takes the next message.
  *
  * The Object store (blueprint D35) is RustFS, single node and single drive, pinned by digest,
@@ -55,23 +54,25 @@ import { PINNED_IMAGES } from "./images.js";
  * CONNECT with the egress token, to the hosts the sandbox spec allows). The two HTTP listeners
  * accept that address as a Host.
  *
- * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn, MCP stdio server
- * and workspace in its own container: the runtime image with `--service harness`, connected to
- * core's Harness API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its
- * only credential, and calling models and remote MCP servers through the gateway with each
- * run's token. It mounts only the Tenant's `sandboxes/`, `plugin-data/`, `home/` and `tmp/`
- * under `/harness`, and the Host root's `plugins/` read-only at its own path (plugin roots name
- * paths on this machine; the runtime mounts it there too). NYLORUN_HARNESS=in-process in `.env`
- * rolls back to turns in the runtime container, without the harness service.
+ * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn and workspace in
+ * its own container: the runtime image with `--service harness`, connected to core's Harness
+ * API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its only
+ * credential, and calling models and remote MCP servers through the gateway with each run's
+ * token. It mounts only the Tenant's `sandboxes/` under `/harness`. NYLORUN_HARNESS=in-process
+ * in `.env` rolls back to turns in the runtime container, without the harness service.
  *
  * Three networks: `store` (internal: no egress) joins Postgres, s2-lite, Restate and RustFS to
  * the runtime and the gateway; `harness` joins the harness to the runtime and the gateway only;
  * `default` carries egress and the published ports (runtime, gateway, Studio, sandboxes).
  * Restate's admin port (its UI, unauthenticated) is published, and Restate joins `default`,
  * only with `restateUi` (`nylorun start --restate-ui`).
+ *
+ * With `identity` (when `<Host root>/identity.yaml` exists) the runtime reads its trusted issuers
+ * from it, through the Host root mount (NYLORUN_IDENTITY_FILE=/nylorun/identity.yaml).
  */
 export function renderComposeFile(project, name, options = {}) {
     const sandboxes = options.sandboxes === true;
+    const identity = options.identity === true;
     const remote = (options.harness ?? "remote") === "remote";
     const restateUi = options.restateUi === true;
     return `# Written by \`nylorun start\`; rewritten on every start. Settings live in .env.
@@ -173,10 +174,14 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
       NYLORUN_OBJECT_STORE_ENDPOINT: http://rustfs:9000
       NYLORUN_OBJECT_STORE_ACCESS_KEY: nylorun
       NYLORUN_OBJECT_STORE_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
-      # Action endpoints on this machine: \`localhost\` in a registered URL means the Docker host.
-      NYLORUN_ENDPOINT_LOOPBACK: docker-host${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
+      # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
+      NYLORUN_ENDPOINT_LOOPBACK: docker-host
+      # Your credential resolver, for people's own MCP credentials (DEPLOYMENT.md, Credentials);
+      # unset by default. Set both in the shell that runs \`nylorun start\`.
+      NYLORUN_RESOLVER_URL: \${NYLORUN_RESOLVER_URL:-}
+      NYLORUN_RESOLVER_TOKEN: \${NYLORUN_RESOLVER_TOKEN:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
     extra_hosts:
-      host.docker.internal: host-gateway # model servers, MCP servers and Action endpoints on this machine
+      host.docker.internal: host-gateway # model servers, MCP servers and HTTP tools on this machine
     volumes:
       # The Tenant's homes and its vault key only, read-only.
       - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant:/nylorun/tenant:ro
@@ -206,8 +211,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_PACKING: combined
       # The Tenant the Runtime creates on its first start (later starts open it).
       NYLORUN_TENANT_NAME: \${NYLORUN_TENANT_NAME:?run nylorun start}
-      NYLORUN_DERIVED_PRINCIPALS: \${NYLORUN_DERIVED_PRINCIPALS:-project}
-      # Model calls, remote MCP calls and deliveries go through the gateway, and vault writes
+      # Model calls, remote MCP calls and HTTP tool calls go through the gateway, and vault writes
       # and token signing through its keys service: this container never reads a credential
       # or the vault key.
       NYLORUN_GATES_URL: http://gateway:4100
@@ -218,11 +222,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       # Host headers the Runtime accepts: its name on the Compose network, and the
       # published port as clients on this machine address it.
       NYLORUN_ALLOWED_HOSTS: runtime:4000,localhost:\${NYLORUN_PORT},127.0.0.1:\${NYLORUN_PORT}
-      NYLORUN_PUBLIC_URL: http://localhost:\${NYLORUN_PORT} # reported by /v1/admin/status
-      # The Admin API on its own listener, published on loopback only; Studio reaches it on
-      # the Compose network. Port 4000 serves the Tenant API alone.
-      NYLORUN_ADMIN_LISTEN_PORT: "4001"
-      NYLORUN_ADMIN_ALLOWED_HOSTS: runtime:4001,localhost:\${NYLORUN_ADMIN_PORT},127.0.0.1:\${NYLORUN_ADMIN_PORT}
+      NYLORUN_PUBLIC_URL: http://localhost:\${NYLORUN_PORT}
       NYLORUN_DATABASE_URL: postgres://nylorun:\${NYLORUN_POSTGRES_PASSWORD}@postgres:5432/nylorun
       NYLORUN_RESTATE_INGRESS_URL: http://restate:8080
       NYLORUN_RESTATE_ADMIN_URL: http://restate:9070
@@ -235,14 +235,14 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_OBJECT_STORE_ENDPOINT: http://rustfs:9000
       NYLORUN_OBJECT_STORE_ACCESS_KEY: nylorun
       NYLORUN_OBJECT_STORE_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
-      # Action endpoints on this machine: \`localhost\` in a registered URL means the Docker host.
+      # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
       NYLORUN_ENDPOINT_LOOPBACK: docker-host
       # Agent turns, MCP servers and workspaces run in the harness container, which connects to
       # this listener with NYLORUN_HARNESS_TOKEN. NYLORUN_HARNESS=in-process in .env rolls back.
       NYLORUN_HARNESS: \${NYLORUN_HARNESS:-remote}
       NYLORUN_HARNESS_LISTEN_PORT: "4200"
       NYLORUN_HARNESS_ALLOWED_HOSTS: runtime:4200${sandboxes ? SANDBOXES_HARNESS_HOST : ""}
-      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}
+      NYLORUN_HARNESS_TOKEN: \${NYLORUN_HARNESS_TOKEN:?run nylorun start}${sandboxes ? SANDBOXES_RUNTIME_ENV : ""}${identity ? IDENTITY_RUNTIME_ENV : ""}
     extra_hosts:
       host.docker.internal: host-gateway # the Docker host, also on Linux Docker Engine
     volumes:
@@ -258,13 +258,10 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
         read_only: true
         tmpfs: { size: 4096, mode: 0755 } # empty, and listable by the runtime user${sandboxes ? SANDBOXES_RUNTIME_MOUNT : ""}
       - workspaces:/workspaces
-      # Plugin roots on this machine, at their own path (as for the harness), for NYLORUN_HARNESS=in-process.
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:\${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:ro
     networks: [default, store, harness]
     ports:
-      - "127.0.0.1:\${NYLORUN_PORT:?run nylorun start}:4000" # Tenant API, SSE, browsers
-      - "127.0.0.1:\${NYLORUN_ADMIN_PORT:?run nylorun start}:4001" # Admin API (operators only)${sandboxes ? SANDBOXES_RUNTIME_PORT : ""}
-    healthcheck: # liveness: a Tenant that cannot open is reported by nylorun start from the Admin status, not by a 300 s wait
+      - "127.0.0.1:\${NYLORUN_PORT:?run nylorun start}:4000" # Runtime and Management APIs, SSE, browsers${sandboxes ? SANDBOXES_RUNTIME_PORT : ""}
+    healthcheck: # liveness: a Tenant that cannot open is reported by nylorun start (/ready, nylorun-operate status), not by a 300 s wait
       test: ["CMD", "node", "-e", "fetch('http://localhost:4000/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
       interval: 2s
       timeout: 5s
@@ -279,7 +276,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
     depends_on:
       runtime: { condition: service_healthy }
     environment:
-      NYLORUN_RUNTIME_URL: http://runtime:4001 # the operator listener: Admin and Tenant API
+      NYLORUN_RUNTIME_URL: http://runtime:4000 # the public listener: Runtime and Management API
       NYLORUN_ADMIN_KEY_FILE: /run/nylorun/host-credentials.json
       PORT: "3000"
       # Studio's Host check accepts localhost/127.0.0.1 on the published port.
@@ -287,10 +284,13 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       # Browsers share cookies across ports of one host: a cookie per Tenant keeps the
       # sessions of two Studios on localhost apart.
       NYLORUN_STUDIO_SESSION_COOKIE: nylorun_studio_${name}
-      # Exact origins that may frame Studio (Babai Desktop); kept in .env.
+      # Exact origins that may frame Studio (none by default: embedding is opt-in); kept in .env.
       NYLORUN_STUDIO_FRAME_ANCESTORS: \${NYLORUN_STUDIO_FRAME_ANCESTORS:-}
       # Studio's anonymous usage analytics; empty when telemetry is off.
       NYLORUN_STUDIO_ANALYTICS_ID: \${NYLORUN_STUDIO_ANALYTICS_ID:-}
+      # Extra Host values Studio serves behind a sign-in proxy (studio.acme.dev),
+      # comma-separated; from the environment of nylorun start.
+      NYLORUN_STUDIO_ALLOWED_HOSTS: \${NYLORUN_STUDIO_ALLOWED_HOSTS:-}
     volumes:
       - \${NYLORUN_HOST_ROOT}/host-credentials.json:/run/nylorun/host-credentials.json:ro
     networks: [default]
@@ -332,13 +332,13 @@ const RESTATE_UI = `    networks: [store, default]
       - "127.0.0.1:\${NYLORUN_RESTATE_PORT:?run nylorun start}:9070" # Restate UI and admin (unauthenticated): nylorun start --restate-ui
 `;
 /**
- * The harness service (F6.2): agent turns, MCP stdio servers and workspaces, apart from core.
+ * The harness service (F6.2): agent turns and workspaces, apart from core.
  * It holds the harness token only; models and remote MCP servers are reached through the
  * gateway with each run's token. Healthy once connected to core's Harness API.
  */
 function harnessService(project) {
     return `
-  harness: # agent turns, MCP servers and workspaces; holds only the harness token; not published
+  harness: # agent turns and workspaces; holds only the harness token; not published
     image: \${NYLORUN_RUNTIME_IMAGE:?run nylorun start}
     container_name: ${project}-harness
     labels: *tenant
@@ -353,13 +353,8 @@ function harnessService(project) {
       NYLORUN_GATES_URL: http://gateway:4100
       NYLORUN_HARNESS_ROOT: /harness
     volumes:
-      # The Tenant's workspaces, plugin data and the homes of MCP stdio servers; nothing else.
+      # The Tenant's workspaces; nothing else.
       - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/sandboxes:/harness/sandboxes
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/plugin-data:/harness/plugin-data
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/home:/harness/home
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/tmp:/harness/tmp
-      # Plugin roots on this machine, read-only, at their own path: agents name them so.
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:\${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:ro
     networks: [harness]
     healthcheck: # healthy once connected to core's Harness API
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4300/health').then(r=>r.json()).then(b=>process.exit(b.connected?0:1),()=>process.exit(1))"]
@@ -373,6 +368,10 @@ function harnessService(project) {
  * The runtime reaches the sandboxes service on the Compose network with its token, and serves
  * the Harness API to sandbox pods (F7.2) on the Docker host's address.
  */
+/** The identity file (`<Host root>/identity.yaml`): the trusted issuers, read at boot. */
+const IDENTITY_RUNTIME_ENV = `
+      # Trusted issuers (<Host root>/identity.yaml): JWTs from the operator's identity provider.
+      NYLORUN_IDENTITY_FILE: /nylorun/identity.yaml`;
 const SANDBOXES_RUNTIME_ENV = `
       # The sandboxes service (nylorun sandbox enable): pods on the Tenant's cluster.
       NYLORUN_SANDBOXES_URL: http://sandboxes:4300

package/dist/stack/env-file.d.ts

@@ -1,8 +1,8 @@
 /**
- * Origins that may embed Studio by default: Babai Desktop's `nylorun` scheme on
- * macOS and Linux, and its WebView2 origin on Windows (Studio §8.9).
+ * Origins that may embed Studio by default: none. Embedding is opt-in: the operator lists
+ * the exact origins of the app that frames Studio (`--studio-embed-origin`, Studio §8.9).
  */
-export declare const DEFAULT_STUDIO_FRAME_ANCESTORS: readonly ["nylorun://localhost", "http://nylorun.localhost"];
+export declare const DEFAULT_STUDIO_FRAME_ANCESTORS: readonly string[];
 /**
  * Settings in `docker/.env` (mode 0600). Ports, the password and the gates token
  * persist; the Restate identity public key is derived from `restate-identity.pem`.
@@ -10,8 +10,6 @@ export declare const DEFAULT_STUDIO_FRAME_ANCESTORS: readonly ["nylorun://localh
 export interface StackEnv {
     /** Published Runtime port (loopback): the Tenant API. */
     runtimePort: number;
-    /** Published operator port (loopback): the Admin API. */
-    adminPort: number;
     /** Published Studio port (loopback). */
     studioPort: number;
     /** Restate UI and admin port (loopback), published only with `restateUi`. */
@@ -57,11 +55,6 @@ export interface StackEnv {
     studioAnalyticsId: string;
     /** The Tenant's name, which the Runtime gives the Tenant it creates. */
     tenantName: string;
-    /**
-     * Derived principals the Runtime registers on its Tenant, comma-separated (persists);
-     * always includes `project`, the Project link's principal.
-     */
-    derivedPrincipals: string;
     /** Present once `nylorun sandbox enable` ran for the Tenant (F7.2). */
     sandboxes?: SandboxStackEnv;
 }
@@ -84,17 +77,11 @@ export interface SandboxStackEnv {
 }
 export type HarnessMode = "remote" | "in-process";
 export declare function renderEnvFile(env: StackEnv): string;
-/**
- * `NYLORUN_DERIVED_PRINCIPALS`: comma-separated principal ids, as the Runtime accepts them
- * (not `studio`), with `project` first so the Project link's key always works.
- */
-export declare function parseDerivedPrincipals(raw: string, source: string): string[];
 /** Parse KEY=value lines; comments and blank lines are skipped. */
 export declare function parseEnvLines(text: string): Map<string, string>;
 /** The settings that persist across starts, from an existing .env. */
 export interface PersistedStackEnv {
     runtimePort?: number;
-    adminPort?: number;
     studioPort?: number;
     restatePort?: number;
     /** Whether the last start published Restate's UI (`NYLORUN_RESTATE_UI=1`). */
@@ -106,7 +93,6 @@ export interface PersistedStackEnv {
     objectStoreSecretKey?: string;
     /** Validated origins; absent when the line is missing (an older .env). */
     studioFrameAncestors?: string[];
-    derivedPrincipals?: string[];
     sandboxes?: SandboxStackEnv;
 }
 export declare function parsePersisted(text: string): PersistedStackEnv;

package/dist/stack/env-file.js

@@ -1,14 +1,10 @@
-import { DERIVED_PRINCIPAL_ID_PATTERN } from "@nylorun/core/compatibility";
 import { parseFrameAncestors } from "@nylorun/core/contracts";
 import { CliError } from "../errors.js";
 /**
- * Origins that may embed Studio by default: Babai Desktop's `nylorun` scheme on
- * macOS and Linux, and its WebView2 origin on Windows (Studio §8.9).
+ * Origins that may embed Studio by default: none. Embedding is opt-in: the operator lists
+ * the exact origins of the app that frames Studio (`--studio-embed-origin`, Studio §8.9).
  */
-export const DEFAULT_STUDIO_FRAME_ANCESTORS = [
-    "nylorun://localhost",
-    "http://nylorun.localhost",
-];
+export const DEFAULT_STUDIO_FRAME_ANCESTORS = [];
 const SANDBOX_KEYS = {
     token: "NYLORUN_SANDBOXES_TOKEN",
     image: "NYLORUN_SANDBOXES_IMAGE",
@@ -20,7 +16,6 @@ const SANDBOX_KEYS = {
 };
 const KEYS = {
     runtimePort: "NYLORUN_PORT",
-    adminPort: "NYLORUN_ADMIN_PORT",
     studioPort: "NYLORUN_STUDIO_PORT",
     restatePort: "NYLORUN_RESTATE_PORT",
     restateUi: "NYLORUN_RESTATE_UI",
@@ -38,7 +33,6 @@ const KEYS = {
     studioFrameAncestors: "NYLORUN_STUDIO_FRAME_ANCESTORS",
     studioAnalyticsId: "NYLORUN_STUDIO_ANALYTICS_ID",
     tenantName: "NYLORUN_TENANT_NAME",
-    derivedPrincipals: "NYLORUN_DERIVED_PRINCIPALS",
 };
 /** Compose .env values: single quotes keep a value literal (no interpolation). */
 function quote(key, value) {
@@ -68,7 +62,6 @@ export function renderEnvFile(env) {
         "",
         "# Published on 127.0.0.1; clients use http://localhost:<port>.",
         line("runtimePort"),
-        line("adminPort"),
         line("studioPort"),
         "# Restate's UI and admin (unauthenticated) are published only with",
         "# nylorun start --restate-ui (or NYLORUN_RESTATE_UI=1); decided on every start.",
@@ -104,8 +97,8 @@ export function renderEnvFile(env) {
         line("runtimeImage"),
         line("studioImage"),
         "",
-        "# Exact origins that may show Studio in a frame (Babai Desktop). Kept across",
-        "# starts; change with nylorun start --studio-embed-origin <origin>.",
+        "# Exact origins that may show Studio in a frame; none by default. Kept across",
+        "# starts; add with nylorun start --studio-embed-origin <origin>.",
         line("studioFrameAncestors"),
         "",
         "# Studio's anonymous usage analytics; empty when off. Set on every start: turn",
@@ -113,10 +106,8 @@ export function renderEnvFile(env) {
         line("studioAnalyticsId"),
         "",
         "# The Tenant's name, which the Runtime gives the Tenant it creates on the first",
-        "# start, and the derived principals it registers on that Tenant (keys derived",
-        "# from the admin key; `project` is the Project link's).",
+        "# start.",
         line("tenantName"),
-        line("derivedPrincipals"),
         "",
         ...(sandboxes
             ? [
@@ -134,20 +125,6 @@ export function renderEnvFile(env) {
             : []),
     ].join("\n");
 }
-/**
- * `NYLORUN_DERIVED_PRINCIPALS`: comma-separated principal ids, as the Runtime accepts them
- * (not `studio`), with `project` first so the Project link's key always works.
- */
-export function parseDerivedPrincipals(raw, source) {
-    const ids = raw
-        .split(",")
-        .map((entry) => entry.trim())
-        .filter((entry) => entry !== "");
-    for (const id of ids)
-        if (!DERIVED_PRINCIPAL_ID_PATTERN.test(id) || id === "studio")
-            throw new CliError(`${source} has '${id}': each entry must match ${DERIVED_PRINCIPAL_ID_PATTERN} and not be studio.`, 2);
-    return [...new Set(["project", ...ids])];
-}
 /** Parse KEY=value lines; comments and blank lines are skipped. */
 export function parseEnvLines(text) {
     const values = new Map();
@@ -192,9 +169,6 @@ export function parsePersisted(text) {
     const runtimePort = port(values.get(KEYS.runtimePort));
     if (runtimePort)
         out.runtimePort = runtimePort;
-    const adminPort = port(values.get(KEYS.adminPort));
-    if (adminPort)
-        out.adminPort = adminPort;
     const studioPort = port(values.get(KEYS.studioPort));
     if (studioPort)
         out.studioPort = studioPort;
@@ -218,15 +192,6 @@ export function parsePersisted(text) {
     const objectStoreSecretKey = values.get(KEYS.objectStoreSecretKey);
     if (objectStoreSecretKey && /^[0-9a-f]{64}$/i.test(objectStoreSecretKey))
         out.objectStoreSecretKey = objectStoreSecretKey;
-    const principals = values.get(KEYS.derivedPrincipals);
-    if (principals !== undefined) {
-        try {
-            out.derivedPrincipals = parseDerivedPrincipals(principals, `${KEYS.derivedPrincipals} in docker/.env`);
-        }
-        catch {
-            /* rewritten from the default on the next start */
-        }
-    }
     const sandboxes = parseSandboxes(values);
     if (sandboxes)
         out.sandboxes = sandboxes;

package/dist/stack/host-files.d.ts

@@ -13,8 +13,6 @@ export interface HostConfigFile {
     hostId: string;
     host: string;
     port: number;
-    /** The operator listener's published port (the Admin API); absent on older Host roots. */
-    adminPort?: number;
     runtimeVersion?: string;
     [field: string]: unknown;
 }
@@ -29,7 +27,6 @@ export declare function readHostConfig(paths: StackPaths): Promise<Record<string
  */
 export declare function writeStackHostConfig(paths: StackPaths, input: {
     port: number;
-    adminPort?: number;
     runtimeVersion: string | undefined;
 }): Promise<HostConfigFile>;
 export declare function readAdminKey(paths: StackPaths): Promise<string | undefined>;

package/dist/stack/host-files.js

@@ -33,7 +33,6 @@ export async function ensureHostLayout(paths) {
         paths.tmp,
         paths.tenant,
         ...Object.values(paths.harness),
-        paths.plugins,
         paths.keys,
         paths.docker,
     ])
@@ -63,7 +62,8 @@ export async function readHostConfig(paths) {
  * runtimeVersion when `runtimeVersion` is undefined; refuses a newer format.
  */
 export async function writeStackHostConfig(paths, input) {
-    const existing = (await readHostConfig(paths)) ?? {};
+    // An older Host root's operator port (`adminPort`) is dropped: there is no operator listener.
+    const { adminPort: _, ...existing } = (await readHostConfig(paths)) ?? {};
     const format = existing.format;
     if (format !== undefined &&
         (typeof format !== "number" || !Number.isInteger(format) || format > KNOWN_FORMAT))
@@ -77,7 +77,6 @@ export async function writeStackHostConfig(paths, input) {
         hostId,
         host: STACK_CLIENT_HOST,
         port: input.port,
-        ...(input.adminPort === undefined ? {} : { adminPort: input.adminPort }),
         ...(input.runtimeVersion !== undefined ? { runtimeVersion: input.runtimeVersion } : {}),
     };
     await writeAtomic(paths.config, `${JSON.stringify(config, null, 2)}\n`);

package/dist/stack/index.d.ts

@@ -10,6 +10,12 @@ export declare function stackCommand(name: string, args: readonly string[], env:
 /** Entry for `nylorun sandbox ls|rm`. */
 export declare function sandboxCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
 export { sandboxUsage } from "./sandbox.js";
+/** Entry for `nylorun mcp connect`. */
+export declare function mcpCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
+export { mcpUsage } from "./mcp.js";
+/** Entry for `nylorun key put|list|rm`. */
+export declare function keyCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
+export { keyUsage } from "./keys.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function studioCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>, options?: {
     next?: string;

package/dist/stack/index.js

@@ -2,7 +2,9 @@ import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
+import { keyCommand as runKeyCommand } from "./keys.js";
 import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
+import { mcpCommand as runMcpCommand } from "./mcp.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
 export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
@@ -20,7 +22,6 @@ function browserCommand(env) {
  */
 const STACK_ENV_OWNED = [
     "NYLORUN_TENANT_NAME",
-    "NYLORUN_DERIVED_PRINCIPALS",
     "NYLORUN_STUDIO_ANALYTICS_ID",
 ];
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
@@ -85,6 +86,16 @@ export async function sandboxCommand(args, env) {
     return await runSandboxCommand(defaultStackDeps(env), args);
 }
 export { sandboxUsage } from "./sandbox.js";
+/** Entry for `nylorun mcp connect`. */
+export async function mcpCommand(args, env) {
+    return await runMcpCommand(defaultStackDeps(env), args);
+}
+export { mcpUsage } from "./mcp.js";
+/** Entry for `nylorun key put|list|rm`. */
+export async function keyCommand(args, env) {
+    return await runKeyCommand(defaultStackDeps(env), args);
+}
+export { keyUsage } from "./keys.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/keys.d.ts

@@ -0,0 +1,4 @@
+import { type StackDeps } from "./commands.js";
+export declare const keyUsage = "  key put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a management key), or\n                                      rotate it (the old key stops working); prints the key once\n  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)\n  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
+/** `nylorun key <put|list|rm> ...` */
+export declare function keyCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/keys.js

@@ -0,0 +1,74 @@
+/**
+ * `nylorun key put | list | rm`: the running local Tenant's keys, through `nylorun-operate` in its
+ * runtime container. Revocable application keys by name, for app servers and other clients, and
+ * management keys (`--management`), which only this machine issues; none of these starts the
+ * Tenant.
+ */
+import { CliError } from "../errors.js";
+import { parseStackFlags, runningOperate } from "./commands.js";
+import { deleteOperatorKey, listOperatorKeys, putOperatorKey } from "./operator-keys.js";
+export const keyUsage = `  key put <id> [--management] [--tenant <name>]
+                                      create the Tenant's application key <id> (--management: a management key), or
+                                      rotate it (the old key stops working); prints the key once
+  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)
+  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
+const usageError = (message) => new CliError(message, 2);
+async function put(deps, args) {
+    const usage = "nylorun key put <id> [--management] [--tenant <name>]";
+    const flags = parseStackFlags(args, { booleans: ["--management"], values: ["--tenant"] }, usage);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${usage}`);
+    const id = flags.rest[0];
+    const name = flags.values.get("--tenant");
+    const running = await runningOperate(deps, name === undefined ? {} : { name });
+    const key = await putOperatorKey(running, id, flags.booleans.has("--management") ? "management" : "application");
+    // The key alone on stdout, for scripts; it is not shown again.
+    deps.out(key.key);
+    deps.err(`${key.rotated ? "Rotated" : "Created"} ${key.role} key ${key.id} on Tenant ${running.name}${key.rotated ? " (the previous key no longer works)" : ""}. Store it now: it is not shown again.`);
+    return 0;
+}
+async function list(deps, args) {
+    const usage = "nylorun key list [--tenant <name>] [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const name = flags.values.get("--tenant");
+    const keys = await listOperatorKeys(await runningOperate(deps, name === undefined ? {} : { name }));
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(keys, null, 2));
+        return 0;
+    }
+    const rows = [["ID", "ROLE", "CREATED"], ...keys.map((key) => [key.id, key.role, key.createdAt])];
+    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+    for (const row of rows)
+        deps.out(row
+            .map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column])))
+            .join("  "));
+    return 0;
+}
+async function rm(deps, args) {
+    const usage = "nylorun key rm <id> [--tenant <name>]";
+    const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${usage}`);
+    const id = flags.rest[0];
+    const name = flags.values.get("--tenant");
+    const running = await runningOperate(deps, name === undefined ? {} : { name });
+    if (!(await deleteOperatorKey(running, id))) {
+        deps.err(`No key ${id} on Tenant ${running.name}.`);
+        return 1;
+    }
+    deps.out(`Deleted key ${id}: it no longer works.`);
+    return 0;
+}
+/** `nylorun key <put|list|rm> ...` */
+export async function keyCommand(deps, args) {
+    const [sub, ...rest] = args;
+    if (sub === "put")
+        return put(deps, rest);
+    if (sub === "list" || sub === "ls")
+        return list(deps, rest);
+    if (sub === "rm" || sub === "delete")
+        return rm(deps, rest);
+    throw usageError(`Usage:\n${keyUsage}`);
+}

package/dist/stack/mcp.d.ts

@@ -0,0 +1,8 @@
+import { type StackDeps } from "./commands.js";
+export declare const mcpUsage = "  mcp connect <url> --server <name> [--vault <id>] [--client-id <id>] [--tenant <name>] [--no-open]\n                                      sign the Tenant in to a remote MCP server with OAuth; the credential goes to the\n                                      installation vault mcp (or --vault), which sessions attach";
+/** The installation vault `connect` uses unless `--vault` names one. */
+export declare const MCP_VAULT_NAME = "mcp";
+/** How long `connect` waits for the browser sign-in: the Runtime keeps it for ten minutes. */
+export declare const CONNECT_TIMEOUT_MS: number;
+/** `nylorun mcp <connect> ...` */
+export declare function mcpCommand(deps: StackDeps, args: readonly string[]): Promise<number>;