nylorun 0.9.0-beta → 0.11.0-beta

package/dist/stack/compose-file.js

@@ -23,17 +23,17 @@ import { PINNED_IMAGES } from "./images.js";
  * The combined packing (blueprint D12): the `runtime` container runs the core
  * and loop services, and the `gateway` container runs gates: the Model Gate,
  * which alone reads model credentials, and the Tool Gate (F4.1), which alone
- * holds remote MCP connections and their credentials and POSTs every Action
- * delivery. Every model call, remote MCP call and delivery of the loop crosses it
+ * holds remote MCP connections and their credentials and makes every HTTP tool
+ * request. Every model call, remote MCP call and HTTP tool call of the loop crosses it
  * (NYLORUN_GATES_URL, with NYLORUN_GATES_TOKEN from `.env`, or a run's token from the
- * harness); MCP stdio servers run in the harness container. The gateway also runs keys (F4.2): the only
+ * harness). The gateway also runs keys (F4.2): the only
  * holder of the vault key, it runs every vault write that touches a secret and signs
  * every token (NYLORUN_KEYS_URL). The gateway mounts only the Host's Tenant directory
  * (`tenant/`) and its keys directory (`keys/`, the vault key), read-only: never
  * host-credentials.json. The runtime mounts the Host root with `keys/` and `docker/`
  * covered by empty read-only mounts, so it can read neither the vault key nor
  * Restate's private key and `.env`. The runtime does not wait for the gateway: while
- * it is down, model and MCP calls fail, deliveries are retried, vault writes and
+ * it is down, model, MCP and HTTP tool calls fail, vault writes and
  * token minting answer 503, and the session takes the next message.
  *
  * The Object store (blueprint D35) is RustFS, single node and single drive, pinned by digest,
@@ -54,14 +54,12 @@ import { PINNED_IMAGES } from "./images.js";
  * CONNECT with the egress token, to the hosts the sandbox spec allows). The two HTTP listeners
  * accept that address as a Host.
  *
- * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn, MCP stdio server
- * and workspace in its own container: the runtime image with `--service harness`, connected to
- * core's Harness API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its
- * only credential, and calling models and remote MCP servers through the gateway with each
- * run's token. It mounts only the Tenant's `sandboxes/`, `plugin-data/`, `home/` and `tmp/`
- * under `/harness`, and the Host root's `plugins/` read-only at its own path (plugin roots name
- * paths on this machine; the runtime mounts it there too). NYLORUN_HARNESS=in-process in `.env`
- * rolls back to turns in the runtime container, without the harness service.
+ * The harness (F6.2, `harness: "remote"`, the default) runs every agent turn and workspace in
+ * its own container: the runtime image with `--service harness`, connected to core's Harness
+ * API (`ws://runtime:4200/nylorun/harness/v1`) with NYLORUN_HARNESS_TOKEN, its only
+ * credential, and calling models and remote MCP servers through the gateway with each run's
+ * token. It mounts only the Tenant's `sandboxes/` under `/harness`. NYLORUN_HARNESS=in-process
+ * in `.env` rolls back to turns in the runtime container, without the harness service.
  *
  * Three networks: `store` (internal: no egress) joins Postgres, s2-lite, Restate and RustFS to
  * the runtime and the gateway; `harness` joins the harness to the runtime and the gateway only;
@@ -176,14 +174,14 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
       NYLORUN_OBJECT_STORE_ENDPOINT: http://rustfs:9000
       NYLORUN_OBJECT_STORE_ACCESS_KEY: nylorun
       NYLORUN_OBJECT_STORE_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
-      # Action endpoints on this machine: \`localhost\` in a registered URL means the Docker host.
+      # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
       NYLORUN_ENDPOINT_LOOPBACK: docker-host
       # Your credential resolver, for people's own MCP credentials (DEPLOYMENT.md, Credentials);
       # unset by default. Set both in the shell that runs \`nylorun start\`.
       NYLORUN_RESOLVER_URL: \${NYLORUN_RESOLVER_URL:-}
       NYLORUN_RESOLVER_TOKEN: \${NYLORUN_RESOLVER_TOKEN:-}${sandboxes ? SANDBOXES_GATEWAY_ENV : ""}
     extra_hosts:
-      host.docker.internal: host-gateway # model servers, MCP servers and Action endpoints on this machine
+      host.docker.internal: host-gateway # model servers, MCP servers and HTTP tools on this machine
     volumes:
       # The Tenant's homes and its vault key only, read-only.
       - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant:/nylorun/tenant:ro
@@ -213,7 +211,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_PACKING: combined
       # The Tenant the Runtime creates on its first start (later starts open it).
       NYLORUN_TENANT_NAME: \${NYLORUN_TENANT_NAME:?run nylorun start}
-      # Model calls, remote MCP calls and deliveries go through the gateway, and vault writes
+      # Model calls, remote MCP calls and HTTP tool calls go through the gateway, and vault writes
       # and token signing through its keys service: this container never reads a credential
       # or the vault key.
       NYLORUN_GATES_URL: http://gateway:4100
@@ -224,11 +222,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       # Host headers the Runtime accepts: its name on the Compose network, and the
       # published port as clients on this machine address it.
       NYLORUN_ALLOWED_HOSTS: runtime:4000,localhost:\${NYLORUN_PORT},127.0.0.1:\${NYLORUN_PORT}
-      NYLORUN_PUBLIC_URL: http://localhost:\${NYLORUN_PORT} # reported by /v1/admin/status
-      # The Admin API on its own listener, published on loopback only; Studio reaches it on
-      # the Compose network. Port 4000 serves the Tenant API alone.
-      NYLORUN_ADMIN_LISTEN_PORT: "4001"
-      NYLORUN_ADMIN_ALLOWED_HOSTS: runtime:4001,localhost:\${NYLORUN_ADMIN_PORT},127.0.0.1:\${NYLORUN_ADMIN_PORT}
+      NYLORUN_PUBLIC_URL: http://localhost:\${NYLORUN_PORT}
       NYLORUN_DATABASE_URL: postgres://nylorun:\${NYLORUN_POSTGRES_PASSWORD}@postgres:5432/nylorun
       NYLORUN_RESTATE_INGRESS_URL: http://restate:8080
       NYLORUN_RESTATE_ADMIN_URL: http://restate:9070
@@ -241,7 +235,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
       NYLORUN_OBJECT_STORE_ENDPOINT: http://rustfs:9000
       NYLORUN_OBJECT_STORE_ACCESS_KEY: nylorun
       NYLORUN_OBJECT_STORE_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
-      # Action endpoints on this machine: \`localhost\` in a registered URL means the Docker host.
+      # MCP servers and HTTP tools on this machine: \`localhost\` in their URLs means the Docker host.
       NYLORUN_ENDPOINT_LOOPBACK: docker-host
       # Agent turns, MCP servers and workspaces run in the harness container, which connects to
       # this listener with NYLORUN_HARNESS_TOKEN. NYLORUN_HARNESS=in-process in .env rolls back.
@@ -264,13 +258,10 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
         read_only: true
         tmpfs: { size: 4096, mode: 0755 } # empty, and listable by the runtime user${sandboxes ? SANDBOXES_RUNTIME_MOUNT : ""}
       - workspaces:/workspaces
-      # Plugin roots on this machine, at their own path (as for the harness), for NYLORUN_HARNESS=in-process.
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:\${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:ro
     networks: [default, store, harness]
     ports:
-      - "127.0.0.1:\${NYLORUN_PORT:?run nylorun start}:4000" # Tenant API, SSE, browsers
-      - "127.0.0.1:\${NYLORUN_ADMIN_PORT:?run nylorun start}:4001" # Admin API (operators only)${sandboxes ? SANDBOXES_RUNTIME_PORT : ""}
-    healthcheck: # liveness: a Tenant that cannot open is reported by nylorun start from the Admin status, not by a 300 s wait
+      - "127.0.0.1:\${NYLORUN_PORT:?run nylorun start}:4000" # Runtime and Management APIs, SSE, browsers${sandboxes ? SANDBOXES_RUNTIME_PORT : ""}
+    healthcheck: # liveness: a Tenant that cannot open is reported by nylorun start (/ready, nylorun-operate status), not by a 300 s wait
       test: ["CMD", "node", "-e", "fetch('http://localhost:4000/health').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
       interval: 2s
       timeout: 5s
@@ -285,7 +276,7 @@ ${sandboxes ? SANDBOXES_GATES_PORT : ""}    # Egress and the stores; the harness
     depends_on:
       runtime: { condition: service_healthy }
     environment:
-      NYLORUN_RUNTIME_URL: http://runtime:4001 # the operator listener: Admin and Tenant API
+      NYLORUN_RUNTIME_URL: http://runtime:4000 # the public listener: Runtime and Management API
       NYLORUN_ADMIN_KEY_FILE: /run/nylorun/host-credentials.json
       PORT: "3000"
       # Studio's Host check accepts localhost/127.0.0.1 on the published port.
@@ -341,13 +332,13 @@ const RESTATE_UI = `    networks: [store, default]
       - "127.0.0.1:\${NYLORUN_RESTATE_PORT:?run nylorun start}:9070" # Restate UI and admin (unauthenticated): nylorun start --restate-ui
 `;
 /**
- * The harness service (F6.2): agent turns, MCP stdio servers and workspaces, apart from core.
+ * The harness service (F6.2): agent turns and workspaces, apart from core.
  * It holds the harness token only; models and remote MCP servers are reached through the
  * gateway with each run's token. Healthy once connected to core's Harness API.
  */
 function harnessService(project) {
     return `
-  harness: # agent turns, MCP servers and workspaces; holds only the harness token; not published
+  harness: # agent turns and workspaces; holds only the harness token; not published
     image: \${NYLORUN_RUNTIME_IMAGE:?run nylorun start}
     container_name: ${project}-harness
     labels: *tenant
@@ -362,13 +353,8 @@ function harnessService(project) {
       NYLORUN_GATES_URL: http://gateway:4100
       NYLORUN_HARNESS_ROOT: /harness
     volumes:
-      # The Tenant's workspaces, plugin data and the homes of MCP stdio servers; nothing else.
+      # The Tenant's workspaces; nothing else.
       - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/sandboxes:/harness/sandboxes
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/plugin-data:/harness/plugin-data
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/home:/harness/home
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/tenant/tmp:/harness/tmp
-      # Plugin roots on this machine, read-only, at their own path: agents name them so.
-      - \${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:\${NYLORUN_HOST_ROOT:?run nylorun start}/plugins:ro
     networks: [harness]
     healthcheck: # healthy once connected to core's Harness API
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4300/health').then(r=>r.json()).then(b=>process.exit(b.connected?0:1),()=>process.exit(1))"]

package/dist/stack/env-file.d.ts

@@ -10,8 +10,6 @@ export declare const DEFAULT_STUDIO_FRAME_ANCESTORS: readonly string[];
 export interface StackEnv {
     /** Published Runtime port (loopback): the Tenant API. */
     runtimePort: number;
-    /** Published operator port (loopback): the Admin API. */
-    adminPort: number;
     /** Published Studio port (loopback). */
     studioPort: number;
     /** Restate UI and admin port (loopback), published only with `restateUi`. */
@@ -84,7 +82,6 @@ export declare function parseEnvLines(text: string): Map<string, string>;
 /** The settings that persist across starts, from an existing .env. */
 export interface PersistedStackEnv {
     runtimePort?: number;
-    adminPort?: number;
     studioPort?: number;
     restatePort?: number;
     /** Whether the last start published Restate's UI (`NYLORUN_RESTATE_UI=1`). */

package/dist/stack/env-file.js

@@ -16,7 +16,6 @@ const SANDBOX_KEYS = {
 };
 const KEYS = {
     runtimePort: "NYLORUN_PORT",
-    adminPort: "NYLORUN_ADMIN_PORT",
     studioPort: "NYLORUN_STUDIO_PORT",
     restatePort: "NYLORUN_RESTATE_PORT",
     restateUi: "NYLORUN_RESTATE_UI",
@@ -63,7 +62,6 @@ export function renderEnvFile(env) {
         "",
         "# Published on 127.0.0.1; clients use http://localhost:<port>.",
         line("runtimePort"),
-        line("adminPort"),
         line("studioPort"),
         "# Restate's UI and admin (unauthenticated) are published only with",
         "# nylorun start --restate-ui (or NYLORUN_RESTATE_UI=1); decided on every start.",
@@ -171,9 +169,6 @@ export function parsePersisted(text) {
     const runtimePort = port(values.get(KEYS.runtimePort));
     if (runtimePort)
         out.runtimePort = runtimePort;
-    const adminPort = port(values.get(KEYS.adminPort));
-    if (adminPort)
-        out.adminPort = adminPort;
     const studioPort = port(values.get(KEYS.studioPort));
     if (studioPort)
         out.studioPort = studioPort;

package/dist/stack/host-files.d.ts

@@ -13,8 +13,6 @@ export interface HostConfigFile {
     hostId: string;
     host: string;
     port: number;
-    /** The operator listener's published port (the Admin API); absent on older Host roots. */
-    adminPort?: number;
     runtimeVersion?: string;
     [field: string]: unknown;
 }
@@ -29,7 +27,6 @@ export declare function readHostConfig(paths: StackPaths): Promise<Record<string
  */
 export declare function writeStackHostConfig(paths: StackPaths, input: {
     port: number;
-    adminPort?: number;
     runtimeVersion: string | undefined;
 }): Promise<HostConfigFile>;
 export declare function readAdminKey(paths: StackPaths): Promise<string | undefined>;

package/dist/stack/host-files.js

@@ -33,7 +33,6 @@ export async function ensureHostLayout(paths) {
         paths.tmp,
         paths.tenant,
         ...Object.values(paths.harness),
-        paths.plugins,
         paths.keys,
         paths.docker,
     ])
@@ -63,7 +62,8 @@ export async function readHostConfig(paths) {
  * runtimeVersion when `runtimeVersion` is undefined; refuses a newer format.
  */
 export async function writeStackHostConfig(paths, input) {
-    const existing = (await readHostConfig(paths)) ?? {};
+    // An older Host root's operator port (`adminPort`) is dropped: there is no operator listener.
+    const { adminPort: _, ...existing } = (await readHostConfig(paths)) ?? {};
     const format = existing.format;
     if (format !== undefined &&
         (typeof format !== "number" || !Number.isInteger(format) || format > KNOWN_FORMAT))
@@ -77,7 +77,6 @@ export async function writeStackHostConfig(paths, input) {
         hostId,
         host: STACK_CLIENT_HOST,
         port: input.port,
-        ...(input.adminPort === undefined ? {} : { adminPort: input.adminPort }),
         ...(input.runtimeVersion !== undefined ? { runtimeVersion: input.runtimeVersion } : {}),
     };
     await writeAtomic(paths.config, `${JSON.stringify(config, null, 2)}\n`);

package/dist/stack/keys.d.ts

@@ -1,4 +1,4 @@
 import { type StackDeps } from "./commands.js";
-export declare const keyUsage = "  key put <id> [--tenant <name>]     create the Tenant's key <id>, or rotate it (the old key stops working); prints the key once\n  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)\n  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
+export declare const keyUsage = "  key put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a management key), or\n                                      rotate it (the old key stops working); prints the key once\n  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)\n  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
 /** `nylorun key <put|list|rm> ...` */
 export declare function keyCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/keys.js

@@ -1,27 +1,30 @@
 /**
- * `nylorun key put | list | rm`: the running local Tenant's operator keys (F9 I1, Host feature
- * `operator-keys`), through its Admin API with the admin key. Revocable application keys by
- * name, for app servers and other clients; none of these starts the Tenant.
+ * `nylorun key put | list | rm`: the running local Tenant's keys, through `nylorun-operate` in its
+ * runtime container. Revocable application keys by name, for app servers and other clients, and
+ * management keys (`--management`), which only this machine issues; none of these starts the
+ * Tenant.
  */
 import { CliError } from "../errors.js";
-import { parseStackFlags, runningAdmin } from "./commands.js";
+import { parseStackFlags, runningOperate } from "./commands.js";
 import { deleteOperatorKey, listOperatorKeys, putOperatorKey } from "./operator-keys.js";
-export const keyUsage = `  key put <id> [--tenant <name>]     create the Tenant's key <id>, or rotate it (the old key stops working); prints the key once
+export const keyUsage = `  key put <id> [--management] [--tenant <name>]
+                                      create the Tenant's application key <id> (--management: a management key), or
+                                      rotate it (the old key stops working); prints the key once
   key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)
   key rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
 const usageError = (message) => new CliError(message, 2);
 async function put(deps, args) {
-    const usage = "nylorun key put <id> [--tenant <name>]";
-    const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
+    const usage = "nylorun key put <id> [--management] [--tenant <name>]";
+    const flags = parseStackFlags(args, { booleans: ["--management"], values: ["--tenant"] }, usage);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${usage}`);
     const id = flags.rest[0];
     const name = flags.values.get("--tenant");
-    const admin = await runningAdmin(deps, name === undefined ? {} : { name });
-    const key = await putOperatorKey(admin, id);
+    const running = await runningOperate(deps, name === undefined ? {} : { name });
+    const key = await putOperatorKey(running, id, flags.booleans.has("--management") ? "management" : "application");
     // The key alone on stdout, for scripts; it is not shown again.
     deps.out(key.key);
-    deps.err(`${key.rotated ? "Rotated" : "Created"} key ${key.id} on Tenant ${admin.name}${key.rotated ? " (the previous key no longer works)" : ""}. Store it now: it is not shown again.`);
+    deps.err(`${key.rotated ? "Rotated" : "Created"} ${key.role} key ${key.id} on Tenant ${running.name}${key.rotated ? " (the previous key no longer works)" : ""}. Store it now: it is not shown again.`);
     return 0;
 }
 async function list(deps, args) {
@@ -30,8 +33,7 @@ async function list(deps, args) {
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
     const name = flags.values.get("--tenant");
-    const admin = await runningAdmin(deps, name === undefined ? {} : { name });
-    const keys = await listOperatorKeys(admin);
+    const keys = await listOperatorKeys(await runningOperate(deps, name === undefined ? {} : { name }));
     if (flags.booleans.has("--json")) {
         deps.out(JSON.stringify(keys, null, 2));
         return 0;
@@ -51,9 +53,9 @@ async function rm(deps, args) {
         throw usageError(`Usage: ${usage}`);
     const id = flags.rest[0];
     const name = flags.values.get("--tenant");
-    const admin = await runningAdmin(deps, name === undefined ? {} : { name });
-    if (!(await deleteOperatorKey(admin, id))) {
-        deps.err(`No key ${id} on Tenant ${admin.name}.`);
+    const running = await runningOperate(deps, name === undefined ? {} : { name });
+    if (!(await deleteOperatorKey(running, id))) {
+        deps.err(`No key ${id} on Tenant ${running.name}.`);
         return 1;
     }
     deps.out(`Deleted key ${id}: it no longer works.`);

package/dist/stack/mcp.js

@@ -1,6 +1,6 @@
 /**
  * `nylorun mcp connect <url> --server <name>`: signs the running local Tenant in to a remote MCP
- * server with OAuth (F9 C2), through its Tenant API with an operator key (`runningTenantApi`).
+ * server with OAuth (F9 C2), through its Management API with a management key (`runningTenantApi`).
  * The Runtime's keys module runs discovery, registration and the code exchange and seals the
  * credential in an installation vault (`mcp` unless `--vault` names one); this command only
  * opens the browser and waits for the credential to appear. It never starts the Tenant.
@@ -21,7 +21,7 @@ async function call(deps, api, method, path, body) {
     const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
         method,
         headers: {
-            authorization: `Bearer ${api.applicationKey}`,
+            authorization: `Bearer ${api.managementKey}`,
             [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
             accept: "application/json",
             ...(body === undefined ? {} : { "content-type": "application/json" }),
@@ -52,12 +52,12 @@ function bindingUrl(input) {
 }
 /** The installation vault named `mcp`, created when there is none. */
 async function mcpVault(deps, api) {
-    const { vaults } = await call(deps, api, "GET", "/v1/vaults");
+    const { vaults } = await call(deps, api, "GET", "/v1/tenant/vaults");
     const found = vaults.find((vault) => vault.ownerUserId === "installation" && vault.name === MCP_VAULT_NAME);
     if (found)
         return found;
     const key = `nylorun-mcp-${randomUUID()}`;
-    return await call(deps, api, "POST", "/v1/vaults", {
+    return await call(deps, api, "POST", "/v1/tenant/vaults", {
         requestId: key,
         idempotencyKey: key,
         name: MCP_VAULT_NAME,
@@ -66,7 +66,7 @@ async function mcpVault(deps, api) {
 }
 /** Each credential of the vault bound to `url`, by id, with when it last changed. */
 async function credentialsFor(deps, api, vaultId, url) {
-    const { credentials } = await call(deps, api, "GET", `/v1/vaults/${encodeURIComponent(vaultId)}/credentials`);
+    const { credentials } = await call(deps, api, "GET", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/credentials`);
     return new Map(credentials
         .filter((item) => item.type === "oauth" && item.binding.url === url)
         .map((item) => [item.id, item.rotatedAt ?? item.createdAt]));
@@ -85,7 +85,7 @@ async function connect(deps, args) {
     const api = await runningTenantApi(deps, name === undefined ? {} : { name });
     const vaultId = flags.values.get("--vault") ?? (await mcpVault(deps, api)).id;
     const before = await credentialsFor(deps, api, vaultId, url);
-    const started = await call(deps, api, "POST", `/v1/vaults/${encodeURIComponent(vaultId)}/oauth/start`, { url, server, ...(clientId === undefined ? {} : { clientId }) });
+    const started = await call(deps, api, "POST", `/v1/tenant/vaults/${encodeURIComponent(vaultId)}/oauth/start`, { url, server, ...(clientId === undefined ? {} : { clientId }) });
     deps.out(`Sign in to ${server} in your browser:`);
     deps.out(`  ${started.authorizeUrl}`);
     if (!flags.booleans.has("--no-open"))

package/dist/stack/operator-keys.d.ts

@@ -1,39 +1,39 @@
 import type { OperatorKey, PutOperatorKeyResponse } from "@nylorun/core/contracts";
 import { type KeyCredentials } from "../project/link.js";
+import type { DockerResult } from "./docker.js";
 import type { FetchLike } from "./studio-login.js";
-/** Where a local Tenant's Admin API answers, and its admin key. */
-export interface AdminEndpoint {
+/** A local Tenant: `nylorun-operate` in its runtime container, and a fetch to probe keys. */
+export interface OperateEndpoint {
     fetch: FetchLike;
-    adminUrl: string;
-    adminKey: string;
+    /** Runs `nylorun-operate <args>` in the runtime container. */
+    operate(args: readonly string[]): Promise<DockerResult>;
 }
-/** The key `nylorun start` gives the projects it links. */
+/** The keys `nylorun start` gives the projects it links (and `-management`). */
 export declare const PROJECT_KEY_ID = "project";
-/** The key nylorun commands use outside a linked project. */
+/** The keys nylorun commands use outside a linked project (and `-management`). */
 export declare const CLI_KEY_ID = "cli";
-/** Creates key `id` or rotates it; the answer holds the key, this once. */
-export declare function putOperatorKey(admin: AdminEndpoint, id: string): Promise<PutOperatorKeyResponse>;
-export declare function listOperatorKeys(admin: AdminEndpoint): Promise<OperatorKey[]>;
+/** Creates key `id` with `role` or rotates it; the answer holds the key, this once. */
+export declare function putOperatorKey(endpoint: OperateEndpoint, id: string, role: "application" | "management"): Promise<PutOperatorKeyResponse>;
+export declare function listOperatorKeys(endpoint: OperateEndpoint): Promise<OperatorKey[]>;
 /** Deletes key `id`: false when there is none. */
-export declare function deleteOperatorKey(admin: AdminEndpoint, id: string): Promise<boolean>;
+export declare function deleteOperatorKey(endpoint: OperateEndpoint, id: string): Promise<boolean>;
 /**
- * Whether `key` reaches the Tenant API at `runtimeUrl`: one authenticated read
- * (`GET /v1/tenant`). An unknown key is the opaque 404; another answer is an error.
+ * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
+ * every key reaches). An unknown key is the opaque 404; another answer is an error.
  */
 export declare function keyAuthenticates(fetch: FetchLike, runtimeUrl: string, key: string): Promise<boolean>;
 /**
- * The operator key `id` kept in the Host root file `file` (0600): the file's key while it
- * still authenticates, else `adopt` when it does (a key a project already holds), else a new
- * key put through the Admin API and written to the file. One process at a time (`lock`), so
- * concurrent commands share one key instead of rotating each other's.
+ * The keys `id` (application) and `id-management` (management) kept in the Host root file
+ * `file` (0600): each of the file's keys while it still authenticates, else `adopt`'s when it
+ * does (keys a project already holds), else a new key put through `nylorun-operate`, written to
+ * the file. One process at a time (`lock`), so concurrent commands share one key instead of
+ * rotating each other's.
  */
 export declare function hostKey(options: {
-    admin: AdminEndpoint;
+    endpoint: OperateEndpoint;
     runtimeUrl: string;
     id: string;
     file: string;
     lock: string;
     adopt?: KeyCredentials;
-}): Promise<KeyCredentials & {
-    put: boolean;
-}>;
+}): Promise<Required<KeyCredentials>>;

package/dist/stack/operator-keys.js

@@ -1,76 +1,54 @@
 /**
- * Operator keys (F9 I1, Host feature `operator-keys`) as the nylorun commands use them: the
- * Admin API's `/v1/admin/keys` on a local Tenant's operator listener, with its admin key, and
- * the keys nylorun keeps in the Host root (`project`, `cli`). nylorun depends on
- * `@nylorun/core` only, so these are plain requests (`admin.keys` in `@nylorun/admin` makes
- * the same).
+ * A local Tenant's keys as the nylorun commands use them: `nylorun-operate keys … --json` in its
+ * runtime container (`docker compose exec`), and the keys nylorun keeps in the Host root
+ * (`project` and `project-management`, `cli` and `cli-management`). nylorun depends on
+ * `@nylorun/core` only, so key probes are plain requests.
  */
 import { open, rm, stat } from "node:fs/promises";
 import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
 import { CliError } from "../errors.js";
 import { readCredentialsFile, writeCredentialsFile, } from "../project/link.js";
-/** The key `nylorun start` gives the projects it links. */
+/** The keys `nylorun start` gives the projects it links (and `-management`). */
 export const PROJECT_KEY_ID = "project";
-/** The key nylorun commands use outside a linked project. */
+/** The keys nylorun commands use outside a linked project (and `-management`). */
 export const CLI_KEY_ID = "cli";
-async function adminRequest(admin, method, path) {
-    let response;
-    try {
-        response = await admin.fetch(`${admin.adminUrl}${path}`, {
-            method,
-            headers: {
-                authorization: `Bearer ${admin.adminKey}`,
-                [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-                accept: "application/json",
-            },
-            redirect: "error",
-            signal: AbortSignal.timeout(15_000),
-        });
-    }
-    catch (error) {
-        throw new CliError(`The Admin API at ${admin.adminUrl} did not answer ${method} ${path} (${error instanceof Error ? error.message : String(error)}).`, 7);
+/** `nylorun-operate keys <args> --json`: its JSON answer, or exit 1 refused, 2 Tenant not open. */
+async function operateKeys(endpoint, args) {
+    const result = await endpoint.operate(["keys", ...args, "--json"]);
+    const message = result.stderr.trim();
+    if (result.code === 0) {
+        try {
+            return JSON.parse(result.stdout);
+        }
+        catch {
+            /* below */
+        }
     }
-    const body = (await response.json().catch(() => ({})));
-    return { status: response.status, body };
+    if (result.code === 1)
+        throw new CliError(message, 1);
+    if (result.code === 2)
+        throw new CliError(`The Tenant is not open: ${message}`, 7);
+    throw new CliError(`nylorun-operate keys ${args.join(" ")} failed (exit ${result.code})${message ? `: ${message}` : ""}`, 1);
 }
-function refused(method, path, answer) {
-    const message = typeof answer.body.message === "string" ? `: ${answer.body.message}` : "";
-    // An older Runtime has no key routes: the Admin API's "Route not found".
-    if (answer.status === 404 && answer.body.message === "Route not found")
-        return new CliError(`The Runtime does not serve operator keys (Host feature operator-keys). Update it: npx nylorun@latest start.`, 1);
-    return new CliError(`${method} ${path} returned ${answer.status}${message}`, 1);
+/** Creates key `id` with `role` or rotates it; the answer holds the key, this once. */
+export async function putOperatorKey(endpoint, id, role) {
+    return (await operateKeys(endpoint, ["put", id, "--role", role]));
 }
-const keyPath = (id) => `/v1/admin/keys/${encodeURIComponent(id)}`;
-/** Creates key `id` or rotates it; the answer holds the key, this once. */
-export async function putOperatorKey(admin, id) {
-    const answer = await adminRequest(admin, "PUT", keyPath(id));
-    if (answer.status !== 200 || typeof answer.body.key !== "string")
-        throw refused("PUT", keyPath(id), answer);
-    return answer.body;
-}
-export async function listOperatorKeys(admin) {
-    const answer = await adminRequest(admin, "GET", "/v1/admin/keys");
-    if (answer.status !== 200 || !Array.isArray(answer.body.keys))
-        throw refused("GET", "/v1/admin/keys", answer);
-    return answer.body.keys;
+export async function listOperatorKeys(endpoint) {
+    return (await operateKeys(endpoint, ["list"])).keys;
 }
 /** Deletes key `id`: false when there is none. */
-export async function deleteOperatorKey(admin, id) {
-    const answer = await adminRequest(admin, "DELETE", keyPath(id));
-    if (answer.status === 200)
-        return true;
-    if (answer.status === 404 && answer.body.message === `No key ${id}`)
-        return false;
-    throw refused("DELETE", keyPath(id), answer);
+export async function deleteOperatorKey(endpoint, id) {
+    return (await operateKeys(endpoint, ["rm", id])).deleted;
 }
 /**
- * Whether `key` reaches the Tenant API at `runtimeUrl`: one authenticated read
- * (`GET /v1/tenant`). An unknown key is the opaque 404; another answer is an error.
+ * Whether `key` reaches the Tenant at `runtimeUrl`: one authenticated read (`GET /v1/me`, which
+ * every key reaches). An unknown key is the opaque 404; another answer is an error.
  */
 export async function keyAuthenticates(fetch, runtimeUrl, key) {
     let response;
     try {
-        response = await fetch(`${runtimeUrl}/v1/tenant`, {
+        response = await fetch(`${runtimeUrl}/v1/me`, {
             headers: {
                 authorization: `Bearer ${key}`,
                 [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
@@ -88,7 +66,7 @@ export async function keyAuthenticates(fetch, runtimeUrl, key) {
         return true;
     if (response.status === 401 || response.status === 403 || response.status === 404)
         return false;
-    throw new CliError(`GET ${runtimeUrl}/v1/tenant returned ${response.status}.`, 7);
+    throw new CliError(`GET ${runtimeUrl}/v1/me returned ${response.status}.`, 7);
 }
 const LOCK_TIMEOUT_MS = 30_000;
 /** A lock older than this was left by a process that died. */
@@ -123,24 +101,38 @@ async function withLock(path, fn) {
     }
 }
 /**
- * The operator key `id` kept in the Host root file `file` (0600): the file's key while it
- * still authenticates, else `adopt` when it does (a key a project already holds), else a new
- * key put through the Admin API and written to the file. One process at a time (`lock`), so
- * concurrent commands share one key instead of rotating each other's.
+ * The keys `id` (application) and `id-management` (management) kept in the Host root file
+ * `file` (0600): each of the file's keys while it still authenticates, else `adopt`'s when it
+ * does (keys a project already holds), else a new key put through `nylorun-operate`, written to
+ * the file. One process at a time (`lock`), so concurrent commands share one key instead of
+ * rotating each other's.
  */
 export async function hostKey(options) {
-    const { admin, runtimeUrl, id, file } = options;
+    const { endpoint, runtimeUrl, id, file, adopt } = options;
+    const reaches = (key) => key === undefined ? Promise.resolve(false) : keyAuthenticates(endpoint.fetch, runtimeUrl, key);
     return await withLock(options.lock, async () => {
         const kept = await readCredentialsFile(file);
-        if (kept && (await keyAuthenticates(admin.fetch, runtimeUrl, kept.applicationKey)))
-            return { ...kept, put: false };
-        if (options.adopt && (await keyAuthenticates(admin.fetch, runtimeUrl, options.adopt.applicationKey))) {
-            await writeCredentialsFile(file, options.adopt);
-            return { ...options.adopt, put: false };
+        let application = kept && (await reaches(kept.applicationKey)) ? kept : undefined;
+        if (!application && adopt && (await reaches(adopt.applicationKey)))
+            application = adopt;
+        if (!application) {
+            const put = await putOperatorKey(endpoint, id, "application");
+            application = { applicationKey: put.key, principalId: put.id };
+        }
+        let management = (await reaches(kept?.management?.key)) ? kept.management : undefined;
+        if (!management && (await reaches(adopt?.management?.key)))
+            management = adopt.management;
+        if (!management) {
+            const put = await putOperatorKey(endpoint, `${id}-management`, "management");
+            management = { key: put.key, principalId: put.id };
         }
-        const put = await putOperatorKey(admin, id);
-        const credentials = { applicationKey: put.key, principalId: put.id };
-        await writeCredentialsFile(file, credentials);
-        return { ...credentials, put: true };
+        const credentials = {
+            applicationKey: application.applicationKey,
+            principalId: application.principalId,
+            management,
+        };
+        if (JSON.stringify(kept) !== JSON.stringify(credentials))
+            await writeCredentialsFile(file, credentials);
+        return credentials;
     });
 }

package/dist/stack/paths.d.ts

@@ -27,23 +27,12 @@ export interface StackPaths {
      * runtime reads it at boot (`NYLORUN_IDENTITY_FILE`).
      */
     identity: string;
-    /** The Tenant directory: homes, sandboxes, plugin data, logs. */
+    /** The Tenant directory: home, sandboxes, logs. */
     tenant: string;
-    /**
-     * The Tenant directory's parts the harness container mounts (F6.2): workspaces, plugin data,
-     * and the home and temporary directory of MCP stdio servers.
-     */
+    /** The Tenant directory's parts the harness container mounts (F6.2): workspaces. */
     harness: {
         sandboxes: string;
-        pluginData: string;
-        home: string;
-        tmp: string;
     };
-    /**
-     * Plugin roots on this machine (`plugins/`), mounted read-only at the same path into the
-     * runtime and harness containers, so a stdio MCP server's plugin root resolves there.
-     */
-    plugins: string;
     /** The keys directory, mounted only into the gateway (F4.2). */
     keys: string;
     /** The Tenant's vault key (KEK), `keys/vault-kek`. */