@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/host/main.js

@@ -9,8 +9,8 @@
  * Execution and Durable Streams from the endpoints; `createHostExecution`
  * builds the process's execution; the Host serves the one Tenant its Postgres
  * database holds (`NYLORUN_DATABASE_URL`, required), and creates it there on
- * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`,
- * `NYLORUN_DERIVED_PRINCIPALS`; tenancy.md §4); with S2, a process running core
+ * first start (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`; tenancy.md §4), trusting the issuers of the identity file
+ * `NYLORUN_IDENTITY_FILE` names (Host feature `trusted-issuers`); with S2, a process running core
  * runs the stream relay, which feeds the Tenant's streams from the record over
  * logical replication (one process at a time holds the slot); `/ready` reports
  * the Tenant and the infrastructure checks. With an Object store
@@ -29,6 +29,8 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { hostPaths } from "../tenant/paths.js";
 import { createTenantModule } from "../tenant/module.js";
+import { parseIdentityFile } from "../tenant/identity-file.js";
+import { createTrustedIssuers } from "../tenant/issuers.js";
 import { hostPrincipals } from "../tenant/principals.js";
 import { createPostgresTenantOpener } from "../tenant/store-pg.js";
 import { openTenantRuntime } from "../tenant/runtime.js";
@@ -66,6 +68,35 @@ function coreVersion() {
 function loadJson(path) {
     return JSON.parse(readFileSync(path, "utf8"));
 }
+/**
+ * The trusted issuers of the identity file (`NYLORUN_IDENTITY_FILE`, Host feature
+ * `trusted-issuers`). A missing or malformed file stops the boot, naming the issuer and field;
+ * an issuer's JWKS is fetched only when a token needs it, so one that is down does not.
+ */
+function loadIssuers(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`NYLORUN_IDENTITY_FILE names ${path}, which cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return createTrustedIssuers(parseIdentityFile(text, path));
+}
+/** The bootstrap management key: 64 hex characters, surrounding whitespace ignored. */
+function loadManagementKey(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`NYLORUN_MANAGEMENT_KEY_FILE names ${path}, which cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const key = text.trim();
+    if (!/^[0-9a-f]{64}$/.test(key))
+        throw new Error(`NYLORUN_MANAGEMENT_KEY_FILE (${path}) must hold one key of 64 lowercase hex characters, such as \`openssl rand -hex 32\``);
+    return key;
+}
 function resolveHostRoot() {
     const fromEnv = process.env.NYLORUN_HOME;
     const root = fromEnv && fromEnv.length > 0 ? fromEnv : resolve(homedir(), ".nylorun");
@@ -105,11 +136,6 @@ async function ensureBucket(store, bucket, logger) {
         }
     }
 }
-/** The slot's lag in WAL bytes, when the source can tell. */
-async function lagOf(source) {
-    const lagBytes = await source.lag?.().catch(() => undefined);
-    return lagBytes === undefined ? {} : { lagBytes };
-}
 /**
  * The gateway's services: the Model Gate's listener (gates, keys) and egress-gate's (egress), over
  * the Postgres pool and the Host's tenant directory. Writes nothing to the Host root (the local
@@ -124,6 +150,8 @@ async function runGates(stack) {
         ...(stack.packing ? { packing: stack.packing } : {}),
         endpoints: describeEndpoints(stack.endpoints),
         objectStore: stack.objectStore ? "s3" : "none",
+        // Never the resolver's URL or token: only whether one is set (F9 C1).
+        resolver: stack.gates?.resolver ? "configured" : "none",
     });
     const database = createDatabase(stack);
     const servers = [];
@@ -195,7 +223,14 @@ export async function main() {
     }
     const config = loadJson(paths.config);
     const credentials = loadJson(paths.credentials);
+    const identityFile = stack.tenant?.identityFile;
+    const issuers = identityFile ? loadIssuers(identityFile) : undefined;
     const logger = createHostLogger();
+    if (issuers)
+        logger.info("trusted_issuers", {
+            file: identityFile,
+            issuers: issuers.issuers.map((issuer) => issuer.config.name),
+        });
     if (stack.deprecatedRole)
         logger.warn("deprecated_flag", {
             flag: "--role",
@@ -216,15 +251,14 @@ export async function main() {
     const database = infra.database;
     if (!database)
         throw new Error("NYLORUN_DATABASE_URL did not yield a Postgres pool");
-    const baseline = baselineEnvironment(process.env);
     // A Tenant that should answer with the fixture model carries the Tenant
     // setting (`tenant/model-setting.ts`); the Host has no fixture mode.
     const configFor = configForFactory({
         hostRoot,
-        hostConfig: config,
         logger,
-        baseline,
         ...(stack.delivery ? { delivery: stack.delivery } : {}),
+        ...(issuers ? { issuers } : {}),
+        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
     });
     // The process's Durable Session Execution: Restate when its endpoints are set, else the
     // in-process memory execution. An invocation that arrives while the Tenant opens waits for it.
@@ -242,7 +276,6 @@ export async function main() {
     // running core runs one, once the Tenant is open (the relay reads its id); the replication
     // slot lets exactly one be active. Without S2, the Tenant relays its own commits.
     let relay;
-    let relayLag;
     if (streams && stack.services.has("core"))
         await assertLogicalReplication(database);
     const startRelay = (tenantId) => {
@@ -259,14 +292,12 @@ export async function main() {
             streams,
             log: (message, fields) => logger.info(message, fields),
         });
-        const status = relay.status;
-        relayLag = async () => ({ ...status(), ...(await lagOf(source)) });
         relay.start();
     };
-    // With the gates service the Tenant's vault-backed model calls, remote MCP calls and Action
-    // deliveries cross it, and this process never reads a model or MCP credential.
-    // Their credentials (F5): each advance's run token for its session's model and MCP calls,
-    // core's credential (NYLORUN_GATES_TOKEN) for deliveries and MCP requests outside a run.
+    // With the gates service the Tenant's vault-backed model calls, remote MCP calls and HTTP
+    // tool calls cross it, and this process never reads a model or MCP credential.
+    // Their credentials (F5): each advance's run token for its session's model and tool calls,
+    // core's credential (NYLORUN_GATES_TOKEN) for MCP requests outside a run.
     const runGrants = stack.modelGate ? createRunGrants() : undefined;
     const modelGate = stack.modelGate && runGrants
         ? httpModelGate({ url: stack.modelGate.url, runTokens: runGrants })
@@ -290,7 +321,7 @@ export async function main() {
             harnessImage: stack.sandboxes.harnessImage,
         }
         : undefined;
-    const tenantSettings = stack.tenant ?? { name: "default", derivedPrincipals: ["project"] };
+    const tenantSettings = stack.tenant ?? { name: "default" };
     const module = createTenantModule({
         open: createPostgresTenantOpener({
             hostRoot,
@@ -300,7 +331,9 @@ export async function main() {
                 name: tenantSettings.name,
                 principals: hostPrincipals({
                     adminKey: credentials.adminKey,
-                    derived: tenantSettings.derivedPrincipals,
+                    ...(stack.tenant?.managementKeyFile
+                        ? { bootstrapKey: loadManagementKey(stack.tenant.managementKeyFile) }
+                        : {}),
                 }),
             },
             configFor,
@@ -320,34 +353,16 @@ export async function main() {
         }),
         logger,
         onOpen: (handle) => startRelay(handle.envelope.id),
-        relayStatus: async () => {
-            if (!relayLag)
-                throw new Error("no relay");
-            return relayLag();
-        },
     });
     const options = {
         hostRoot,
         module,
         config,
-        credentials,
         logger,
         coreVersion: coreVersion(),
         ...(stack.listen ? { listen: stack.listen } : {}),
-        ...(stack.publicUrl ? { publicUrl: stack.publicUrl } : {}),
-        // Container mode (the local stack) allows browsers unless told not to; a Host started
-        // from host.json only when it says so. Without publishable keys nothing is reachable.
-        browserAccess: stack.browserAccess ?? (stack.listen ? true : config.browserAccess === true),
-        // The Admin API on its own listener: from the container environment, or from host.json
-        // (loopback, on the same host) when the Host runs outside a container.
-        ...(stack.operator
-            ? { operator: stack.operator }
-            : !stack.listen && typeof config.adminPort === "number"
-                ? { operator: { host: config.host, port: config.adminPort } }
-                : {}),
         ...(infra.readiness ? { readiness: infra.readiness } : {}),
-        // SIGTERM and POST /v1/admin/host/shutdown both close the Host this way:
-        // stop the Worker and the relay, close the Tenant, then end the infrastructure clients.
+        // SIGTERM closes the Host this way: stop the Worker and the relay, close the Tenant, then end the infrastructure clients.
         shutdown: {
             beforeTenants: async () => {
                 await hostExecution.stop();
@@ -370,8 +385,8 @@ export async function main() {
     // listener starts and opens the Tenant (migrating its database, creating it on
     // first start); opening arms its sweep, which recovers wakes lost with
     // Restate's state (§14.8), and starts the stream relay. A Tenant that cannot
-    // be opened leaves the Host listening but not ready, with the cause in
-    // `/v1/admin/status`.
+    // be opened leaves the Host listening but not ready; `nylorun-operate status` names the
+    // cause.
     // The Harness API listener (NYLORUN_HARNESS=remote): only harnesses connect here, with the
     // harness credential, and only while the Tenant is open.
     let harnessListener;

package/dist/host/operate.d.ts

@@ -0,0 +1,29 @@
+import type { TenantCause } from "@nylorun/core/contracts";
+export declare const EXIT_REFUSED = 1;
+export declare const EXIT_TENANT = 2;
+export declare const EXIT_USAGE = 64;
+export interface OperateIo {
+    env: Readonly<Record<string, string | undefined>>;
+    out(line: string): void;
+    err(line: string): void;
+    /** For the Host's `/ready`. Default: the global `fetch`. */
+    fetch?: typeof fetch;
+}
+/** `nylorun-operate status --json`. */
+export interface OperateStatus {
+    version: string;
+    protocol: {
+        min: number;
+        max: number;
+        features: string[];
+    };
+    tenant: {
+        id: string | null;
+        name: string | null;
+        state: "open" | "unavailable";
+        cause?: TenantCause["code"];
+        message?: string;
+    };
+}
+/** Runs one command; resolves to the exit code. */
+export declare function runOperate(argv: readonly string[], io: OperateIo): Promise<number>;

package/dist/host/operate.js

@@ -0,0 +1,223 @@
+/**
+ * `nylorun-operate`: the Host's one-shot operator command, run inside the runtime container
+ * (`docker compose exec runtime nylorun-operate …`, `kubectl exec … -- nylorun-operate …`). It
+ * reads the Tenant's database from `NYLORUN_DATABASE_URL`, as the Host does, does one job and
+ * exits. Being able to run it is the authorization: whoever can exec into the container holds
+ * the installation. It never migrates or creates the Tenant: the Host does that.
+ *
+ *   nylorun-operate status [--json]
+ *   nylorun-operate keys list [--json]
+ *   nylorun-operate keys put <id> [--role application|management] [--json]
+ *   nylorun-operate keys rm <id> [--json]
+ *
+ * `status` says whether the Tenant is open and, when it is not, why: from the database (no
+ * Tenant yet, an old layout, a schema newer or older than this Runtime) and from the running
+ * Host's `/ready` on this container's listen port. It needs no key, so it works when the Tenant
+ * cannot open. `keys put` prints the new key once on stdout (with `--json`, the whole
+ * response). Exit codes: 0 done (`status`: the Tenant is open), 1 refused (an id, a role),
+ * 2 the Tenant cannot be opened (`status` still prints it), 64 usage.
+ */
+import { pathToFileURL } from "node:url";
+import { HOST_PROTOCOL } from "@nylorun/core/compatibility";
+import { createPostgresClient } from "../store/postgres/connect.js";
+import { database } from "../store/postgres/db.js";
+import { assertCurrentLayout, expectedSchemaVersion, readSchemaVersion, } from "../store/postgres/migrate.js";
+import { createPostgresSessionStore } from "../store/postgres/store.js";
+import { readTenantEnvelope } from "../store/postgres/tenant.js";
+import { openError, TenantOpenError } from "../tenant/cause.js";
+import { operatorKeys } from "../tenant/operator-keys.js";
+import { RUNTIME_VERSION } from "../version.js";
+import { DEFAULT_CONTAINER_LISTEN_PORT } from "./stack-config.js";
+export const EXIT_REFUSED = 1;
+export const EXIT_TENANT = 2;
+export const EXIT_USAGE = 64;
+const USAGE = `Usage:
+  nylorun-operate status [--json]
+  nylorun-operate keys list [--json]
+  nylorun-operate keys put <id> [--role application|management] [--json]
+  nylorun-operate keys rm <id> [--json]`;
+class Exit extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** Runs one command; resolves to the exit code. */
+export async function runOperate(argv, io) {
+    try {
+        if (argv[0] === "status") {
+            const json = argv[1] === "--json";
+            if (argv.length > (json ? 2 : 1))
+                throw new Exit(EXIT_USAGE, USAGE);
+            return await status(io, json);
+        }
+        const command = parse(argv);
+        const url = io.env.NYLORUN_DATABASE_URL;
+        if (!url)
+            throw new Exit(EXIT_TENANT, "NYLORUN_DATABASE_URL is not set: run this inside the runtime container");
+        const sql = createPostgresClient(url, { max: 1 });
+        try {
+            const keys = operatorKeys(await openStore(sql));
+            return await command(keys, io);
+        }
+        finally {
+            await sql.end({ timeout: 5 });
+        }
+    }
+    catch (error) {
+        if (error instanceof Exit) {
+            io.err(error.message);
+            return error.code;
+        }
+        io.err(`nylorun-operate failed: ${error instanceof Error ? error.message : String(error)}`);
+        return EXIT_TENANT;
+    }
+}
+function parse(argv) {
+    const [group, verb, ...rest] = argv;
+    if (group !== "keys")
+        throw new Exit(EXIT_USAGE, USAGE);
+    const json = rest.includes("--json");
+    const args = rest.filter((arg) => arg !== "--json");
+    switch (verb) {
+        case "list":
+            if (args.length > 0)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (keys, io) => {
+                const list = await keys.list();
+                if (json)
+                    io.out(JSON.stringify({ keys: list }));
+                else
+                    for (const key of list)
+                        io.out(`${key.id}\t${key.role}\t${key.createdAt}`);
+                return 0;
+            };
+        case "put": {
+            const [id, ...flags] = args;
+            if (!id || id.startsWith("-"))
+                throw new Exit(EXIT_USAGE, USAGE);
+            let role = "application";
+            if (flags.length > 0) {
+                const value = flags[0] === "--role" ? flags[1] : undefined;
+                if (flags.length !== 2 || (value !== "application" && value !== "management"))
+                    throw new Exit(EXIT_USAGE, USAGE);
+                role = value;
+            }
+            return async (keys, io) => {
+                const put = await keys.put(id, role);
+                if ("reason" in put)
+                    throw new Exit(EXIT_REFUSED, put.message);
+                if (json)
+                    io.out(JSON.stringify(put));
+                else {
+                    io.out(put.key);
+                    io.err(`${put.rotated ? "Rotated" : "Created"} ${put.role} key ${put.id}. It is shown this once.`);
+                }
+                return 0;
+            };
+        }
+        case "rm": {
+            const [id] = args;
+            if (!id || args.length !== 1)
+                throw new Exit(EXIT_USAGE, USAGE);
+            return async (keys, io) => {
+                const deleted = await keys.delete(id);
+                if (typeof deleted !== "boolean")
+                    throw new Exit(EXIT_REFUSED, deleted.message);
+                if (json)
+                    io.out(JSON.stringify({ id, deleted }));
+                else
+                    io.err(deleted ? `Deleted key ${id}.` : `There is no key ${id}.`);
+                return 0;
+            };
+        }
+        default:
+            throw new Exit(EXIT_USAGE, USAGE);
+    }
+}
+async function status(io, json) {
+    const tenant = await tenantStatus(io);
+    const report = {
+        version: RUNTIME_VERSION,
+        protocol: { min: HOST_PROTOCOL.min, max: HOST_PROTOCOL.max, features: [...HOST_PROTOCOL.features] },
+        tenant,
+    };
+    if (json)
+        io.out(JSON.stringify(report));
+    else {
+        io.out(`Runtime ${report.version}, protocol ${report.protocol.min}–${report.protocol.max}`);
+        const named = tenant.name ? `${tenant.name} (${tenant.id})` : "none";
+        io.out(`Tenant  ${named}: ${tenant.state}${tenant.cause ? ` (${tenant.cause})` : ""}`);
+        if (tenant.message)
+            io.out(tenant.message);
+    }
+    return tenant.state === "open" ? 0 : EXIT_TENANT;
+}
+/** The Tenant from its database, then from the running Host's `/ready`. */
+async function tenantStatus(io) {
+    const url = io.env.NYLORUN_DATABASE_URL;
+    if (!url)
+        return unavailable(null, "NYLORUN_DATABASE_URL is not set: run this inside the runtime container");
+    const sql = createPostgresClient(url, { max: 1 });
+    let envelope;
+    try {
+        const db = database(sql);
+        await assertCurrentLayout(db);
+        envelope = await readTenantEnvelope(db);
+        if (!envelope)
+            return unavailable(null, "The database holds no Tenant yet: the Runtime creates it when it starts");
+        const version = (await readSchemaVersion(db)) ?? 0;
+        const expected = expectedSchemaVersion();
+        if (version > expected)
+            throw openError("schema-too-new", `The Tenant's schema is at version ${version}, this Runtime's is ${expected}: it was migrated by a newer Runtime`);
+        if (version < expected)
+            return unavailable(envelope, `The Tenant's schema is at version ${version}, this Runtime's is ${expected}: the Runtime migrates it when it starts; if it is running, its log says why it did not`);
+    }
+    catch (error) {
+        if (error instanceof TenantOpenError)
+            return { ...unavailable(envelope ?? null, `${error.message}. Repair: ${error.repair}`), cause: error.code };
+        return unavailable(envelope ?? null, `The database cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        await sql.end({ timeout: 5 });
+    }
+    const port = io.env.NYLORUN_LISTEN_PORT ?? String(DEFAULT_CONTAINER_LISTEN_PORT);
+    const ready = `http://127.0.0.1:${port}/ready`;
+    let answer;
+    try {
+        const response = await (io.fetch ?? fetch)(ready, { signal: AbortSignal.timeout(5000) });
+        answer = (await response.json());
+    }
+    catch {
+        return unavailable(envelope, `The Runtime is not answering at ${ready}: it is stopped or still starting`);
+    }
+    if (answer.checks?.tenant !== true)
+        return unavailable(envelope, "The Runtime is running but has not opened the Tenant: its log names the cause");
+    return { id: envelope.id, name: envelope.name, state: "open" };
+}
+function unavailable(envelope, message) {
+    return { id: envelope?.id ?? null, name: envelope?.name ?? null, state: "unavailable", message };
+}
+/** The Tenant's store, when the Host has created and migrated it to this Runtime's schema. */
+async function openStore(sql) {
+    const db = database(sql);
+    const envelope = await readTenantEnvelope(db).catch((error) => {
+        throw new Exit(EXIT_TENANT, `The Tenant's database cannot be read: ${error instanceof Error ? error.message : String(error)}`);
+    });
+    if (!envelope)
+        throw new Exit(EXIT_TENANT, "The database holds no Tenant yet: start the Runtime first");
+    const version = await readSchemaVersion(db);
+    const expected = expectedSchemaVersion();
+    if (version !== expected)
+        throw new Exit(EXIT_TENANT, `The Tenant's schema is at version ${version ?? "none"}, this Runtime's is ${expected}: start the Runtime to migrate it, or run the Runtime's own image`);
+    return createPostgresSessionStore({ sql, tenantId: envelope.id, schemaVersion: expected });
+}
+if (import.meta.url === pathToFileURL(process.argv[1] ?? "").href) {
+    const code = await runOperate(process.argv.slice(2), {
+        env: process.env,
+        out: (line) => process.stdout.write(`${line}\n`),
+        err: (line) => process.stderr.write(`${line}\n`),
+    });
+    process.exitCode = code;
+}

package/dist/host/stack-config.d.ts

@@ -54,6 +54,14 @@ export interface GatesConfig {
     listen: ContainerListen;
     /** `NYLORUN_GATES_TOKEN`: the bearer the loop presents; at least 32 bytes as hex. */
     token: string;
+    /**
+     * The operator's credential resolver (`NYLORUN_RESOLVER_URL`, `NYLORUN_RESOLVER_TOKEN`), asked
+     * for a person's MCP credential when the session's vaults hold none (F9 C1). Absent: vaults only.
+     */
+    resolver?: {
+        url: string;
+        token: string;
+    };
 }
 /** egress-gate's listener (`NYLORUN_EGRESS_LISTEN_HOST`, `NYLORUN_EGRESS_LISTEN_PORT`). */
 export interface EgressConfig {
@@ -115,7 +123,7 @@ export interface HarnessServiceConfig {
     pod?: PodHostConfig;
     /** `NYLORUN_GATES_URL`: the gates service its model and MCP calls cross, with run tokens. */
     gatesUrl: string;
-    /** `NYLORUN_HARNESS_ROOT`: its sandboxes, plugin data, home and tmp. Default `/harness`. */
+    /** `NYLORUN_HARNESS_ROOT`: its sandboxes. Default `/harness`. */
     root: string;
     /** `/health` on `127.0.0.1:<NYLORUN_HARNESS_HEALTH_PORT>` (default 4300). */
     healthPort: number;
@@ -141,7 +149,7 @@ export interface StackConfig {
     sandboxes?: SandboxesConfig;
     /**
      * Present when the process runs core or loop and `NYLORUN_GATES_URL` is set: its model calls,
-     * remote MCP calls and Action deliveries cross the gates service. Required for loop in
+     * remote MCP calls and HTTP tool calls cross the gates service. Required for loop in
      * container mode; outside a container (a development Host, tests) the loop may make them in
      * its own process.
      */
@@ -164,24 +172,13 @@ export interface StackConfig {
     listen?: ContainerListen;
     endpoints: StackEndpoints;
     /**
-     * The URL clients use to reach this Host (`NYLORUN_PUBLIC_URL`), reported by
-     * `/v1/admin/status`. In container mode the bind address (`0.0.0.0:4000`)
-     * means nothing outside the container.
+     * The URL clients use to reach this Host (`NYLORUN_PUBLIC_URL`). In container mode the bind
+     * address (`0.0.0.0:4000`) means nothing outside the container.
      */
     publicUrl?: string;
     /**
-     * `NYLORUN_BROWSER_ACCESS` (`on` or `off`): whether browser requests may reach Tenant
-     * routes. Absent means the Host's default (on in container mode).
-     */
-    browserAccess?: boolean;
-    /**
-     * The operator listener in container mode (`NYLORUN_ADMIN_LISTEN_PORT`, `…_HOST`,
-     * `…_ALLOWED_HOSTS`). Absent: one listener serves the Admin API and the Tenant API.
-     */
-    operator?: ContainerListen;
-    /**
-     * How the Runtime may call Action endpoints: `NYLORUN_ENDPOINT_LOOPBACK=docker-host` (the local
-     * stack: `localhost` means the machine that runs Docker), `NYLORUN_ENDPOINT_PRIVATE`
+     * How the Runtime may call MCP servers and HTTP tools: `NYLORUN_ENDPOINT_LOOPBACK=docker-host`
+     * (the local stack: `localhost` means the machine that runs Docker), `NYLORUN_ENDPOINT_PRIVATE`
      * (`allow` or `refuse`) and `NYLORUN_ENDPOINT_HTTP` (`allow` or `refuse`).
      */
     delivery?: {
@@ -221,10 +218,16 @@ export interface TenantSettings {
     /** `NYLORUN_TENANT_NAME`. Default `default`. */
     name: string;
     /**
-     * `NYLORUN_DERIVED_PRINCIPALS`: comma-separated application principals whose keys the admin
-     * key derives (`deriveTenantKey`). Default `project`.
+     * `NYLORUN_IDENTITY_FILE`: the identity file listing the trusted issuers (Host feature
+     * `trusted-issuers`), read once at boot (`host/main.ts`). Absent: no issuer is trusted.
+     */
+    identityFile?: string;
+    /**
+     * `NYLORUN_MANAGEMENT_KEY_FILE`: a file holding a management key (64 hex characters), which
+     * the Host registers as the principal `bootstrap` at every start, replacing its key when the
+     * file changed (protocol 8). For installations where no one can run `nylorun-operate`.
      */
-    derivedPrincipals: readonly string[];
+    managementKeyFile?: string;
 }
 export declare class StackConfigError extends Error {
     constructor(message: string);