@nylorun/runtime 0.10.0-beta → 0.12.0-beta

package/dist/host/create-host.js

@@ -1,10 +1,9 @@
 import { createServer, } from "node:http";
 import { createHash, timingSafeEqual } from "node:crypto";
-import { unlinkSync, existsSync } from "node:fs";
 import { checkCompatibility, HOST_PROTOCOL, isTenantId, PROTOCOL_HEADER, TENANT_HEADER, } from "@nylorun/core/compatibility";
 import { AdminStatusSchema, CreateTenantRequestSchema, } from "@nylorun/core/contracts";
-import { hostPaths } from "../tenant/paths.js";
 import { TenantBusyError, TenantConflictError, } from "../tenant/quarantine.js";
+import { TenantNotFoundError, } from "../tenant/types.js";
 import { EXIT_NON_LOOPBACK, EXIT_PORT_IN_USE, HostListenError, isAllowedRequestHost, isJsonContentType, isLoopbackHost, readBearer, readJsonBody, redactRoutePath, requestHasBody, sendJson, sendOpaqueNotFound, sendProtocolRejected, sendRejected, } from "./http.js";
 import { RUNTIME_VERSION } from "../version.js";
 function hashUtf8(value) {
@@ -41,15 +40,17 @@ function protocolAccepted(raw) {
 export function createHost(options) {
     const { hostRoot, module, config, credentials, logger, coreVersion, } = options;
     const pid = options.pid ?? process.pid;
-    const paths = hostPaths(hostRoot);
+    const containerListen = options.listen;
+    const bindHost = containerListen?.host ?? config.host;
+    const bindPort = containerListen?.port ?? config.port;
     let server;
     let url = "";
-    let listenPort = config.port;
+    let listenPort = bindPort;
     let closing = false;
     let closePromise;
     const adminStatusBody = async () => {
         const tenants = await module.list();
-        const aggregate = module.summarize();
+        const aggregate = await module.summarize();
         return AdminStatusSchema.parse({
             service: "nylorun-runtime",
             version: RUNTIME_VERSION,
@@ -62,7 +63,7 @@ export function createHost(options) {
             aggregate,
             host: {
                 hostId: config.hostId,
-                url,
+                url: options.publicUrl ?? url,
                 pid,
             },
         });
@@ -92,6 +93,12 @@ export function createHost(options) {
                         principalId: body.principalId,
                         credentialHash: body.credentialHash,
                         idempotencyKey: body.idempotencyKey,
+                        ...(body.studioCredentialHash
+                            ? { studioCredentialHash: body.studioCredentialHash }
+                            : {}),
+                        ...(body.derivedPrincipals?.length
+                            ? { derivedPrincipals: body.derivedPrincipals }
+                            : {}),
                     });
                     return sendJson(response, result.created ? 201 : 200, result.envelope);
                 }
@@ -132,6 +139,8 @@ export function createHost(options) {
                         return;
                     }
                     catch (error) {
+                        if (error instanceof TenantNotFoundError)
+                            return sendOpaqueNotFound(response);
                         const code = error.code;
                         if (error instanceof TenantBusyError ||
                             error.name === "TenantBusyError" ||
@@ -173,6 +182,9 @@ export function createHost(options) {
                 port: listenPort,
                 host: config.host,
                 allowNonLoopback: config.allowNonLoopback,
+                ...(containerListen
+                    ? { allowedHosts: containerListen.allowedHosts }
+                    : {}),
             })) {
                 sendRejected(response, 421, "host_rejected", "Host header is not an allowed loopback or configured address");
                 statusCode = 421;
@@ -209,11 +221,12 @@ export function createHost(options) {
             if (pathname === "/ready") {
                 const listener = Boolean(server?.listening);
                 const discovery = module.started;
-                const ready = listener && discovery && !closing;
+                const infra = await options.readiness?.();
+                const ready = listener && discovery && !closing && (infra?.ok ?? true);
                 sendJson(response, ready ? 200 : 503, {
                     status: ready ? "ready" : "not_ready",
                     service: "nylorun-runtime",
-                    checks: { listener, discovery },
+                    checks: { listener, discovery, ...infra?.checks },
                 });
                 statusCode = ready ? 200 : 503;
                 return;
@@ -262,7 +275,7 @@ export function createHost(options) {
                 statusCode = 426;
                 return;
             }
-            const resolution = module.resolve(tenantId);
+            const resolution = await module.resolve(tenantId);
             if (resolution.kind !== "open") {
                 if (resolution.kind === "quarantined") {
                     logger.warn("tenant_quarantined", {
@@ -328,7 +341,11 @@ export function createHost(options) {
     async function listen() {
         if (server)
             throw new Error("Already listening");
-        if (!config.allowNonLoopback && !isLoopbackHost(config.host)) {
+        // Container mode binds a non-loopback address behind an explicit Host
+        // allowlist; otherwise only loopback unless host.json allows more.
+        if (!containerListen &&
+            !config.allowNonLoopback &&
+            !isLoopbackHost(config.host)) {
             throw new HostListenError(`Refusing to bind non-loopback host ${config.host} without allowNonLoopback`, EXIT_NON_LOOPBACK);
         }
         server = createServer((req, res) => {
@@ -337,17 +354,17 @@ export function createHost(options) {
         await new Promise((resolve, reject) => {
             server.once("error", (error) => {
                 if (error.code === "EADDRINUSE") {
-                    reject(new HostListenError(`Port ${config.port} on ${config.host} is already in use`, EXIT_PORT_IN_USE, error));
+                    reject(new HostListenError(`Port ${bindPort} on ${bindHost} is already in use`, EXIT_PORT_IN_USE, error));
                     return;
                 }
                 reject(error);
             });
-            server.listen(config.port, config.host, resolve);
+            server.listen(bindPort, bindHost, resolve);
         });
         const address = server.address();
         listenPort =
-            typeof address === "object" && address ? address.port : config.port;
-        url = `http://${config.host}:${listenPort}`;
+            typeof address === "object" && address ? address.port : bindPort;
+        url = `http://${bindHost}:${listenPort}`;
         await module.start();
         logger.info("host_listening", {
             hostId: config.hostId,
@@ -355,6 +372,21 @@ export function createHost(options) {
             pid,
         });
     }
+    const step = async (name, run) => {
+        try {
+            await run?.();
+        }
+        catch (error) {
+            logger.error("host_shutdown_step_failed", {
+                step: name,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    };
+    let settleClosed;
+    const closed = new Promise((resolve) => {
+        settleClosed = resolve;
+    });
     async function close() {
         if (closePromise)
             return closePromise;
@@ -368,21 +400,16 @@ export function createHost(options) {
                 });
                 server = undefined;
             }
-            await module.close();
-            if (existsSync(paths.state)) {
-                try {
-                    unlinkSync(paths.state);
-                }
-                catch {
-                    /* best-effort */
-                }
-            }
-        })();
+            await step("beforeTenants", options.shutdown?.beforeTenants);
+            await step("tenants", () => module.close());
+            await step("afterTenants", options.shutdown?.afterTenants);
+        })().finally(settleClosed);
         return closePromise;
     }
     return {
         listen,
         close,
+        closed,
         get url() {
             return url;
         },

package/dist/host/execution.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The Host's Durable Session Execution (architecture §6, §12.3, §14.8): one per process,
+ * shared by every Tenant the Host opens.
+ *
+ * - `tenantExecution` is what the Host passes to each Tenant it opens
+ *   (`TenantOpenHooks.execution`): the execution, the `TenantWorkers` registry its handlers
+ *   dispatch through (with `resolve` opening a Tenant on demand when an invocation arrives for
+ *   one that is not open), and the Tenant status hook for stuck invocations.
+ * - `start` serves the Worker endpoint for `--role worker|all` (`infra/workers.ts`) and does
+ *   nothing for `api`, whose wakes, timers and sweep arming go through Restate's ingress.
+ * - `armAll` re-arms every Tenant's sweep at startup. Arming is idempotent, so it is safe on
+ *   every start, and it is what recovers from lost Restate state: the sweep re-wakes `runnable`
+ *   sessions without a live owner (§14.8).
+ * - `disarm` stops a deleted Tenant's sweep.
+ *
+ * **Order at startup.** Call `start` before opening any Tenant. Opening a Tenant arms its
+ * sweep through Restate's ingress, which answers 404 until a Worker has registered the
+ * services, so the open would fail. An api-role process relies on a Worker having registered
+ * them first.
+ *
+ * **One Worker URL.** `start` registers the Worker endpoint (`NYLORUN_WORKER_URL`) with
+ * Restate once. Restate sends new invocations to the latest registered deployment, so
+ * several Workers that each register their own URL do not share load: the last one to start
+ * takes every new invocation. The V1 stack runs a single `runtime` container with
+ * `--role all`. A deployment with several Worker processes (Helm, Cloud) must advertise one
+ * load-balanced `NYLORUN_WORKER_URL` shared by all of them.
+ */
+import type { DurableExecution } from "../execution/types.js";
+import type { Logger } from "../tenant/types.js";
+import { type TenantExecution, type TenantWorker } from "../tenant/worker.js";
+import type { RuntimeRole } from "./stack-config.js";
+export interface CreateHostExecutionOptions {
+    execution: DurableExecution;
+    role: RuntimeRole;
+    /** Finds or opens a Tenant an invocation arrived for that is not open on this process. */
+    resolve: (tenantId: string) => Promise<TenantWorker | undefined>;
+    logger?: Logger;
+    /**
+     * How long one advance may run before its signal aborts and it settles
+     * (`tenant/worker.ts`). Default 50 minutes, below Restate's timeouts.
+     */
+    advanceDeadlineMs?: number;
+    /** How long an aborted advance has to return before it is abandoned. Default 30 s. */
+    advanceGraceMs?: number;
+}
+export interface HostExecution {
+    /** Pass to every Tenant the Host opens (`TenantOpenHooks.execution`). */
+    readonly tenantExecution: TenantExecution;
+    /** Serves the Worker endpoint for the worker and all roles. Idempotent. */
+    start(): Promise<void>;
+    /** Stops serving: aborts running advances and waits for them. Idempotent. */
+    stop(): Promise<void>;
+    /**
+     * Arms every listed Tenant's sweep (idempotent). Tries them all; rejects with an
+     * `AggregateError` of the failures after logging each.
+     */
+    armAll(tenantIds: readonly string[]): Promise<void>;
+    /** Stops re-arming a deleted Tenant's sweep. */
+    disarm(tenantId: string): Promise<void>;
+}
+export declare function createHostExecution(options: CreateHostExecutionOptions): HostExecution;

package/dist/host/execution.js

@@ -0,0 +1,69 @@
+import { startWorker, stopWorker } from "../infra/workers.js";
+import { TenantWorkers, } from "../tenant/worker.js";
+/** How many sweep arms `armAll` sends at once. */
+const ARM_CONCURRENCY = 16;
+export function createHostExecution(options) {
+    const { execution, role, logger } = options;
+    const workers = new TenantWorkers({
+        resolve: options.resolve,
+        ...(options.advanceDeadlineMs !== undefined
+            ? { advanceDeadlineMs: options.advanceDeadlineMs }
+            : {}),
+        ...(options.advanceGraceMs !== undefined
+            ? { advanceGraceMs: options.advanceGraceMs }
+            : {}),
+        ...(logger ? { logger } : {}),
+    });
+    const tenantExecution = {
+        execution,
+        workers,
+        ...(execution.stuckInvocations
+            ? {
+                stuckInvocations: (tenantId) => execution.stuckInvocations(tenantId),
+            }
+            : {}),
+    };
+    let started;
+    return {
+        tenantExecution,
+        async start() {
+            started ??= startWorker({ role, execution, handlers: workers.handlers });
+            try {
+                await started;
+            }
+            catch (error) {
+                started = undefined;
+                throw error;
+            }
+        },
+        async stop() {
+            const handle = await started?.catch(() => undefined);
+            if (handle)
+                await stopWorker(handle);
+        },
+        async armAll(tenantIds) {
+            const queue = [...new Set(tenantIds)];
+            const failures = [];
+            const next = async () => {
+                for (let id = queue.shift(); id !== undefined; id = queue.shift()) {
+                    try {
+                        await execution.armSweep(id);
+                    }
+                    catch (error) {
+                        failures.push(error);
+                        logger?.warn("tenant sweep arm failed", {
+                            tenantId: id,
+                            message: error instanceof Error ? error.message : String(error),
+                        });
+                    }
+                }
+            };
+            await Promise.all(Array.from({ length: Math.min(ARM_CONCURRENCY, queue.length) }, next));
+            if (failures.length > 0)
+                throw new AggregateError(failures, `Arming ${failures.length} Tenant sweep(s) failed`);
+        },
+        async disarm(tenantId) {
+            await execution.disarmSweep(tenantId);
+        },
+    };
+}

package/dist/host/http.d.ts

@@ -19,11 +19,15 @@ export declare function sendProtocolRejected(response: ServerResponse, protocol?
 /**
  * D§11 Host allowlist: loopback forms with the listening port, plus the
  * configured host when `allowNonLoopback` is set.
+ *
+ * An explicit `allowedHosts` list (container mode) replaces that rule: only
+ * those exact `name:port` values are accepted.
  */
 export declare function isAllowedRequestHost(hostHeader: string | undefined, options: {
     port: number;
     host: string;
     allowNonLoopback?: boolean;
+    allowedHosts?: readonly string[];
 }): boolean;
 export declare function isJsonContentType(value: string | undefined): boolean;
 /** True when the request carries a body (Content-Length > 0 or chunked). */

package/dist/host/http.js

@@ -48,11 +48,17 @@ export function sendProtocolRejected(response, protocol = HOST_PROTOCOL) {
 /**
  * D§11 Host allowlist: loopback forms with the listening port, plus the
  * configured host when `allowNonLoopback` is set.
+ *
+ * An explicit `allowedHosts` list (container mode) replaces that rule: only
+ * those exact `name:port` values are accepted.
  */
 export function isAllowedRequestHost(hostHeader, options) {
     if (hostHeader === undefined)
         return false;
     const normalized = hostHeader.trim().toLowerCase();
+    if (options.allowedHosts !== undefined) {
+        return options.allowedHosts.some((entry) => entry.trim().toLowerCase() === normalized);
+    }
     const port = String(options.port);
     const allowed = new Set([
         `127.0.0.1:${port}`,

package/dist/host/index.d.ts

@@ -1,6 +1,8 @@
-export type { HostConfigFile, HostCredentialsFile, HostStateFile, } from "./config.js";
+export type { HostConfigFile, HostCredentialsFile, } from "./config.js";
 export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, } from "./environment.js";
 export { createHost, adminKeyMatches, type CreateHostOptions, type HostServer } from "./create-host.js";
 export { createHostLogger } from "./logger.js";
 export { configForFactory } from "./config-for.js";
+export { createHostExecution, type CreateHostExecutionOptions, type HostExecution, } from "./execution.js";
+export { parseStackConfig, StackConfigError, type ContainerListen, type RuntimeRole, type StackConfig, type StackEndpoints, } from "./stack-config.js";
 export { EXIT_PORT_IN_USE, EXIT_NON_LOOPBACK, HostListenError, OPAQUE_NOT_FOUND, } from "./http.js";

package/dist/host/index.js

@@ -2,4 +2,6 @@ export { baselineEnvironment, hostProcessEnvironment, tenantChildEnvironment, }
 export { createHost, adminKeyMatches } from "./create-host.js";
 export { createHostLogger } from "./logger.js";
 export { configForFactory } from "./config-for.js";
+export { createHostExecution, } from "./execution.js";
+export { parseStackConfig, StackConfigError, } from "./stack-config.js";
 export { EXIT_PORT_IN_USE, EXIT_NON_LOOPBACK, HostListenError, OPAQUE_NOT_FOUND, } from "./http.js";

package/dist/host/main.js

@@ -1,27 +1,34 @@
 /**
  * Runtime Host process entry (`@nylorun/runtime/server`).
  *
- * Reads only `NYLORUN_HOME` from the environment (falls back to `~/.nylorun`).
- * Absolute Host root is resolved once and passed down.
+ * Reads `NYLORUN_HOME` (falls back to `~/.nylorun`), and hands an environment
+ * snapshot and argv to `parseStackConfig` (container listen mode, `--role`,
+ * stack endpoints). Absolute Host root is resolved once and passed down.
+ *
+ * Composition: `createInfra` builds the Postgres pool, Durable Session
+ * Execution and Durable Streams from the endpoints; `createHostExecution`
+ * shares one execution across the Tenants; the Tenant store is Postgres
+ * (`NYLORUN_DATABASE_URL`, required); `/ready` reports the infrastructure
+ * checks. See the startup order in `main()`. Tests compose a Host without this
+ * entry, with `createHost` and an injected Tenant module.
  */
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync, mkdirSync, existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { hostPaths } from "../tenant/paths.js";
+import { hostPaths, trashSqliteTenants } from "../tenant/paths.js";
 import { createTenantModule } from "../tenant/module.js";
-import { createFsTenantStore } from "../tenant/store-fs.js";
+import { createPostgresTenantStore } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
-import { bootstrapPrincipal } from "../tenant/principals.js";
-import { migrateTenantDatabase } from "../tenant/schema.js";
+import { createTenantStreams, deleteTenantStreams } from "../tenant/streams.js";
 import { configForFactory } from "./config-for.js";
 import { createHost } from "./create-host.js";
-import { baselineEnvironment, hostProcessEnvironment, } from "./environment.js";
+import { createHostExecution } from "./execution.js";
+import { baselineEnvironment } from "./environment.js";
 import { HostListenError, EXIT_PORT_IN_USE, EXIT_NON_LOOPBACK, } from "./http.js";
 import { createHostLogger } from "./logger.js";
-import { RUNTIME_VERSION } from "../version.js";
-const entry = fileURLToPath(import.meta.url);
+import { describeEndpoints, parseStackConfig } from "./stack-config.js";
+import { createExecution, createInfra } from "../infra/index.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -40,51 +47,89 @@ function resolveHostRoot() {
     return resolve(root);
 }
 export async function main() {
+    const stack = parseStackConfig(process.env, process.argv.slice(2));
     const hostRoot = resolveHostRoot();
     const paths = hostPaths(hostRoot);
     mkdirSync(paths.home, { recursive: true });
     mkdirSync(paths.tmp, { recursive: true });
     mkdirSync(paths.tenants, { recursive: true });
     if (!existsSync(paths.config)) {
-        throw new Error(`Missing host.json at ${paths.config}; run \`nylorun runtime up\` first`);
+        throw new Error(`Missing host.json at ${paths.config}; run \`nylorun start\` first`);
     }
     if (!existsSync(paths.credentials)) {
-        throw new Error(`Missing host-credentials.json at ${paths.credentials}; run \`nylorun runtime up\` first`);
+        throw new Error(`Missing host-credentials.json at ${paths.credentials}; run \`nylorun start\` first`);
+    }
+    // Tenants are Postgres schemas. Only a Host outside a container (a local
+    // development Host) may run without S2, on in-process streams.
+    if (!stack.endpoints.databaseUrl) {
+        throw new Error("NYLORUN_DATABASE_URL is required: the Postgres URL of the Session Store (`nylorun start` sets it)");
+    }
+    if (stack.listen && !stack.endpoints.s2Endpoint) {
+        throw new Error("NYLORUN_S2_ENDPOINT is required in container mode: the S2 endpoint of Durable Streams (`nylorun start` sets it)");
     }
     const config = loadJson(paths.config);
     const credentials = loadJson(paths.credentials);
     const logger = createHostLogger();
+    logger.info("host_stack_config", {
+        role: stack.role,
+        mode: stack.listen ? "container" : "local",
+        endpoints: describeEndpoints(stack.endpoints),
+    });
+    // Tenants from the SQLite Runtime are not migrated: move them out of the way.
+    trashSqliteTenants(hostRoot, logger);
+    const infra = createInfra(stack, { logger });
+    const database = infra.database;
+    if (!database)
+        throw new Error("NYLORUN_DATABASE_URL did not yield a Postgres pool");
     const baseline = baselineEnvironment(process.env);
-    void hostProcessEnvironment(baseline, config, paths);
-    // Credential-free release/dev fixture (create-agent / CI smokes). Requires
-    // ephemeral mode so fixture models are allowed (Tenants D10).
-    const useFixture = process.env.NYLORUN_DEV_MODEL?.trim() === "fixture";
+    // A Tenant that should answer with the fixture model carries the Tenant
+    // setting (`tenant/model-setting.ts`); the Host has no fixture mode.
     const configFor = configForFactory({
         hostRoot,
         hostConfig: config,
         logger,
         baseline,
-        ...(useFixture
-            ? { mode: "ephemeral", model: { kind: "fixture" } }
-            : {}),
     });
-    const openRuntime = (tenantConfig) => openTenantRuntime(tenantConfig);
-    const store = createFsTenantStore({
+    // One Durable Session Execution for every Tenant this process opens: Restate
+    // when its endpoints are set, else the in-process memory execution. An
+    // invocation for a Tenant that is not open here opens it on demand.
+    const hostExecution = createHostExecution({
+        execution: infra.execution ?? createExecution(stack),
+        role: stack.role,
+        resolve: (tenantId) => module.worker(tenantId),
+        logger,
+    });
+    // Durable Streams: S2 when configured (always in container mode). Without
+    // them (a local Host only) each Tenant keeps in-process streams, whose history
+    // does not survive a restart.
+    const streams = infra.streams;
+    const store = createPostgresTenantStore({
         hostRoot,
-        openRuntime,
+        sql: database,
         configFor,
         logger,
-        writeBootstrap: (db, bootstrap) => {
-            migrateTenantDatabase(db);
-            bootstrapPrincipal(db, bootstrap);
-        },
+        openRuntime: (tenantConfig, opened) => openTenantRuntime(tenantConfig, {
+            execution: hostExecution.tenantExecution,
+            ...(streams ? { streams } : {}),
+            ...opened,
+        }),
     });
     const module = createTenantModule({
-        hostRoot,
         store,
-        openRuntime,
-        configFor,
         logger,
+        // A new Tenant's basin is created with it (opening it repairs a failure);
+        // a deleted Tenant's sweep stops re-arming and its basin goes.
+        ...(streams
+            ? { onCreated: (tenantId) => createTenantStreams(streams, tenantId) }
+            : {}),
+        onDeleted: async (tenantId) => {
+            const failed = (await Promise.allSettled([
+                hostExecution.disarm(tenantId),
+                ...(streams ? [deleteTenantStreams(streams, tenantId)] : []),
+            ])).flatMap((result) => (result.status === "rejected" ? [result.reason] : []));
+            if (failed.length > 0)
+                throw new AggregateError(failed, "Deleted Tenant cleanup failed");
+        },
     });
     const options = {
         hostRoot,
@@ -93,12 +138,32 @@ export async function main() {
         credentials,
         logger,
         coreVersion: coreVersion(),
+        ...(stack.listen ? { listen: stack.listen } : {}),
+        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
+        ...(infra.readiness ? { readiness: infra.readiness } : {}),
+        // SIGTERM and POST /v1/admin/host/shutdown both close the Host this way:
+        // stop the Worker, close the Tenants, then end the infrastructure clients.
+        shutdown: {
+            beforeTenants: () => hostExecution.stop(),
+            afterTenants: () => infra.close(),
+        },
     };
     const host = createHost(options);
+    // Startup order. The Worker starts first: opening a Tenant arms its sweep
+    // through Restate's ingress, which answers 404 until a Worker has registered
+    // the services, so no Tenant may open before `start` (the listener opens
+    // Tenants on demand). An api-role process serves no Worker endpoint, so it
+    // can open Tenants only once some Worker process has registered. Container
+    // mode runs one `--role all` process, which registers here. Then the
+    // listener starts (and marks discovery done), and every listed Tenant's
+    // sweep is re-armed, which recovers wakes lost with Restate's state (§14.8).
     try {
+        await hostExecution.start();
         await host.listen();
     }
     catch (error) {
+        await hostExecution.stop().catch(() => undefined);
+        await infra.close();
         if (error instanceof HostListenError) {
             logger.error("listen_failed", {
                 message: error.message,
@@ -109,26 +174,20 @@ export async function main() {
         }
         throw error;
     }
-    const state = {
-        pid: process.pid,
-        startedAt: new Date().toISOString(),
-        version: RUNTIME_VERSION,
-        entry,
+    const tenants = await module.list();
+    await hostExecution
+        .armAll(tenants.filter((t) => t.state === "open").map((t) => t.id))
+        .catch((error) => logger.warn("tenant_sweeps_not_armed", {
+        message: error instanceof Error ? error.message : String(error),
+    }));
+    logger.info("host_ready", {
         url: host.url,
-    };
-    writeFileSync(paths.state, `${JSON.stringify(state, null, 2)}\n`, {
-        mode: 0o600,
+        hostId: config.hostId,
+        tenants: tenants.length,
     });
-    logger.info("host_ready", { url: host.url, hostId: config.hostId });
-    process.send?.({ type: "ready", url: host.url });
-    let closing;
-    const shutdown = () => {
-        closing ??= host.close().then(() => {
-            process.exit(0);
-        });
-    };
+    void host.closed.then(() => process.exit(0));
     for (const signal of ["SIGINT", "SIGTERM"]) {
-        process.on(signal, shutdown);
+        process.on(signal, () => void host.close());
     }
 }
 void main().catch((error) => {

package/dist/host/stack-config.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Stack configuration for the Runtime process, parsed from an environment
+ * snapshot and argv. Pure: `host/main.ts` passes the process environment and
+ * arguments; nothing here reads ambient state.
+ *
+ * Two listen modes:
+ * - **local** (no `NYLORUN_LISTEN_*` / `NYLORUN_ALLOWED_HOSTS`): the Host binds
+ *   what `host.json` names, loopback only unless `allowNonLoopback`.
+ * - **container**: the Host binds `NYLORUN_LISTEN_HOST:NYLORUN_LISTEN_PORT`
+ *   (default `0.0.0.0:4000`) and accepts only the `Host` headers in
+ *   `NYLORUN_ALLOWED_HOSTS`, plus the loopback forms of the listen port for
+ *   probes from inside the container.
+ *
+ * The Postgres, Restate and S2 endpoints are parsed and validated here;
+ * `infra/*` builds the clients from them.
+ */
+export type RuntimeRole = "api" | "worker" | "all";
+export declare const RUNTIME_ROLES: readonly RuntimeRole[];
+export declare const DEFAULT_CONTAINER_LISTEN_HOST = "0.0.0.0";
+export declare const DEFAULT_CONTAINER_LISTEN_PORT = 4000;
+export interface ContainerListen {
+    /** Bind address, e.g. `0.0.0.0`. */
+    host: string;
+    port: number;
+    /**
+     * Exact `Host` header values accepted (lowercase `name:port`). Replaces the
+     * loopback-only rule.
+     */
+    allowedHosts: readonly string[];
+}
+export interface StackEndpoints {
+    databaseUrl?: string;
+    restateIngressUrl?: string;
+    restateAdminUrl?: string;
+    workerUrl?: string;
+    s2Endpoint?: string;
+    s2Token?: string;
+    workspaceStoreUrl?: string;
+    /**
+     * Restate request-identity public keys (`publickeyv1_...`) the Worker
+     * endpoint accepts, from `NYLORUN_RESTATE_IDENTITY_KEY` (comma-separated
+     * during a rotation). Unset means the endpoint accepts unsigned requests.
+     */
+    restateIdentityKeys?: string[];
+}
+export interface StackConfig {
+    role: RuntimeRole;
+    /** Present in container mode; absent means bind what host.json names. */
+    listen?: ContainerListen;
+    endpoints: StackEndpoints;
+    /**
+     * The URL clients use to reach this Host (`NYLORUN_PUBLIC_URL`), reported by
+     * `/v1/admin/status`. In container mode the bind address (`0.0.0.0:4000`)
+     * means nothing outside the container.
+     */
+    publicUrl?: string;
+}
+export declare class StackConfigError extends Error {
+    constructor(message: string);
+}
+type EnvSnapshot = Readonly<Record<string, string | undefined>>;
+export declare function parseRole(argv: readonly string[]): RuntimeRole;
+/**
+ * Normalize one `Host` header allowlist entry to lowercase `name:port`.
+ * IPv6 literals must be bracketed (`[::1]:4000`).
+ */
+export declare function normalizeAllowedHost(name: string, entry: string): string;
+/** Parse the stack configuration; throws `StackConfigError` naming the variable. */
+export declare function parseStackConfig(env: EnvSnapshot, argv: readonly string[]): StackConfig;
+/** Endpoint summary for logs: which endpoints are set, never their values. */
+export declare function describeEndpoints(endpoints: StackEndpoints): string[];
+export {};