@nylorun/runtime 0.21.0-beta → 0.22.0-beta

package/dist/harness/calls.d.ts

@@ -27,6 +27,8 @@ export interface ToolRouting {
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
     readonly sandboxId?: string;
+    /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+    readonly environment?: Readonly<Record<string, string>>;
     readonly activeTurnId: string | null;
     /** Who the sandbox call's events are claimed for: the run's id. */
     readonly claim?: string;

package/dist/harness/calls.js

@@ -127,6 +127,7 @@ export async function callSandboxTool(sandbox, routing, request, signal) {
         activeTurnId: routing.activeTurnId,
         manifest: routing.rootManifest,
         ...(routing.sandboxId === undefined ? {} : { sandboxId: routing.sandboxId }),
+        ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
     }, capability, request.toolName, request.input, signal);
 }

package/dist/harness/executors.js

@@ -95,6 +95,7 @@ export function routingOf(run) {
         ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
         ...(routing.sandbox?.sandboxId === undefined ? {} : { sandboxId: routing.sandbox.sandboxId }),
+        ...(routing.sandbox?.environment === undefined ? {} : { environment: routing.sandbox.environment }),
         activeTurnId: run.grant.turnId,
         claim: run.runId,
     };

package/dist/harness/main.js

@@ -44,7 +44,10 @@ export async function runHarness(stack, baseline) {
             log: (message, fields) => logger.info(message, fields),
         });
         logger.info("sandbox_network_policy_in_force", { sandboxId: config.pod.sandboxId, waitedMs });
-        pod = podHost(config.pod, logger, { volumeFile: join(config.root, "volume-id") });
+        pod = podHost(config.pod, logger, {
+            volumeFile: join(config.root, "volume-id"),
+            caBundleFile: join(config.root, "egress-ca-bundle.pem"),
+        });
     }
     const token = pod ? () => pod.token() : config.token;
     if (token === undefined)

package/dist/harness/pod.d.ts

@@ -18,4 +18,6 @@ export declare function podHost(config: PodHostConfig, logger: {
     renewMs?: number;
     /** Where the engine keeps the volume's id (on the volume): a new volume gets a new one. */
     volumeFile?: string;
+    /** Where the engine writes the trust bundle: the public roots and the egress CA (R2c). */
+    caBundleFile?: string;
 }): PodHost;

package/dist/harness/pod.js

@@ -5,17 +5,34 @@
  * read afresh each time: a reset writes a new one). The egress token minted with the host token
  * is the password of the proxy every command gets (`proxyEnv`); both are renewed every
  * `RENEW_MS`, well inside their 15-minute life.
+ *
+ * The join answer also carries the installation's egress CA (R2c, D50). The engine writes it,
+ * after the public roots, to a trust bundle on the pod (`caBundleFile`) and points every
+ * command's trust variables at it, so a CLI trusts the leaf egress-gate presents for a host an
+ * `environment_secret` is bound to. The bundle is rewritten only when the CA changes.
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
 /** How often the host and egress tokens are renewed. */
 export const RENEW_MS = 5 * 60_000;
+/** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
+const TRUST_VARIABLES = [
+    "SSL_CERT_FILE",
+    "NODE_EXTRA_CA_CERTS",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE",
+];
 class Refused extends Error {
 }
 export function podHost(config, logger, options = {}) {
     const call = options.fetch ?? fetch;
     let held;
+    /** The CA in the bundle on disk, once one is written. */
+    let bundled;
     const post = async (path, init) => {
         const response = await call(`${config.httpUrl}/nylorun/harness/v1/host/${path}`, {
             method: "POST",
@@ -32,13 +49,27 @@ export function podHost(config, logger, options = {}) {
         if (!response.ok)
             throw new Error(`host/${path} answered ${response.status}`);
         const body = JSON.parse(text);
+        if (typeof body.caCertificate === "string")
+            await writeBundle(body.caCertificate);
         return {
             hostToken: body.hostToken,
             egressToken: body.egressToken,
             epoch: body.epoch,
             expiresAt: Date.parse(body.expiresAt),
+            ...(typeof body.caCertificate === "string" ? { caCertificate: body.caCertificate } : {}),
         };
     };
+    const writeBundle = async (ca) => {
+        const file = options.caBundleFile;
+        if (!file || ca === bundled)
+            return;
+        await mkdir(dirname(file), { recursive: true });
+        // Written beside it and renamed, so a command never reads half a bundle.
+        const next = `${file}.${randomUUID()}`;
+        await writeFile(next, `${rootCertificates.join("\n")}\n${ca.trim()}\n`, { mode: 0o644 });
+        await rename(next, file);
+        bundled = ca;
+    };
     /** The volume's id, created on a volume that has none. */
     const volumeId = async () => {
         const file = options.volumeFile;
@@ -100,7 +131,11 @@ export function podHost(config, logger, options = {}) {
             url.username = "nylorun";
             url.password = held.egressToken;
             const proxy = url.toString().replace(/\/$/, "");
+            const trust = bundled !== undefined && options.caBundleFile
+                ? Object.fromEntries(TRUST_VARIABLES.map((name) => [name, options.caBundleFile]))
+                : {};
             return {
+                ...trust,
                 HTTPS_PROXY: proxy,
                 HTTP_PROXY: proxy,
                 https_proxy: proxy,

package/dist/harness-api/start.d.ts

@@ -14,6 +14,8 @@ export interface SegmentStart {
     readonly sandbox: {
         readonly ownerId: string;
         readonly sandboxId?: string;
+        /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+        readonly environment?: Readonly<Record<string, string>>;
     };
     /** The sandbox is a pod sandbox (F7.2): its engine runs the segment. Its lifecycle state. */
     readonly pod?: {

package/dist/harness-api/start.js

@@ -25,8 +25,10 @@ options = {}) {
         const fixtureModel = await usesFixtureModel(t);
         if (!options.harness)
             return { current, fixtureModel, outcomes: [], sandbox: { ownerId: id } };
-        const sandbox = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
-        const resource = sandbox.sandboxId === undefined ? undefined : await t.sandboxResource(sandbox.sandboxId);
+        const workspace = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
+        const resource = workspace.sandboxId === undefined ? undefined : await t.sandboxResource(workspace.sandboxId);
+        const { environment } = await ctx.vault.sessionEnvironment(t, current.vaultIds ?? []);
+        const sandbox = Object.keys(environment).length > 0 ? { ...workspace, environment } : workspace;
         return {
             current,
             fixtureModel,

package/dist/harness-api/ws-server.js

@@ -14,8 +14,8 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt }`; every refusal is the same 401. The
- * harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
+ * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";

package/dist/host/create-host.d.ts

@@ -1,7 +1,7 @@
 import type { ResourceServerConfig } from "../tenant/resource-server.js";
 import type { Logger, TenantModule } from "../tenant/types.js";
 import type { HostConfigFile } from "./config.js";
-import type { ContainerListen } from "./stack-config.js";
+import { type ContainerListen } from "./stack-config.js";
 export interface CreateHostOptions {
     hostRoot: string;
     module: TenantModule;

package/dist/host/create-host.js

@@ -1,7 +1,8 @@
 import { createServer, } from "node:http";
 import { getRequestListener, RequestError } from "@hono/node-server";
 import { createHostApp } from "./app.js";
-import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, isLoopbackHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
+import { isLoopbackHost } from "./stack-config.js";
+import { bindListener as bind, EXIT_NON_LOOPBACK, headerValue, HostListenError, isAllowedRequestHost, pathnameIsLogged, redactRoutePath, rejectedResponse, sendRejected, } from "./http.js";
 export function createHost(options) {
     const { module, config, logger, coreVersion } = options;
     const pid = options.pid ?? process.pid;

package/dist/host/gates.js

@@ -27,6 +27,7 @@ import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
 import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
+import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export const GATES_REQUEST_TIMEOUT_MS = 660_000;
 export async function startGates(options) {
@@ -172,6 +173,16 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        credentials: {
+            bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
+            release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),
+            // A fresh key per connection, made here: keys signs its public half and never sees it.
+            async leaf(host) {
+                const pair = leafKeyPair();
+                const cert = await (await tenant.open()).keys().signEgressLeaf(host, pair.publicKey);
+                return { key: pair.privateKey, cert };
+            },
+        },
         ...options.gate,
     });
 }

package/dist/host/http.d.ts

@@ -54,4 +54,3 @@ export declare function adminKeyMatches(presented: string | undefined, adminKey:
 export declare function headerValue(incoming: IncomingMessage, name: string): string | undefined;
 /** A JSON request body, capped at `limit` bytes (413); `undefined` when there is none. */
 export declare function readJsonBody(request: Request, limit?: number): Promise<unknown>;
-export declare function isLoopbackHost(host: string): boolean;

package/dist/host/http.js

@@ -191,9 +191,3 @@ export async function readJsonBody(request, limit = 1024 * 1024) {
         throw Object.assign(new Error("Invalid JSON"), { status: 400 });
     }
 }
-export function isLoopbackHost(host) {
-    const normalized = host.trim().toLowerCase();
-    return (normalized === "127.0.0.1" ||
-        normalized === "::1" ||
-        normalized === "localhost");
-}

package/dist/host/stack-config.d.ts

@@ -237,6 +237,8 @@ export declare function parseServices(argv: readonly string[]): ServiceSelection
  * IPv6 literals must be bracketed (`[::1]:4000`).
  */
 export declare function normalizeAllowedHost(name: string, entry: string): string;
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export declare function isLoopbackHost(host: string): boolean;
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export declare function parseStackConfig(env: EnvSnapshot, argv: readonly string[]): StackConfig;
 /** Endpoint summary for logs: which endpoints are set, never their values. */

package/dist/host/stack-config.js

@@ -179,9 +179,10 @@ export function normalizeAllowedHost(name, entry) {
 function loopbackForms(port) {
     return [`localhost:${port}`, `127.0.0.1:${port}`, `[::1]:${port}`];
 }
-function isLoopbackAddress(host) {
-    const value = host.toLowerCase();
-    return value === "127.0.0.1" || value === "::1" || value === "localhost";
+/** A loopback bind address: `127.0.0.1`, `::1` or `localhost`. */
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
 function parseUrl(env, name, protocols) {
     const raw = read(env, name);
@@ -198,32 +199,37 @@ function parseUrl(env, name, protocols) {
         throw new StackConfigError(`${name} must use ${protocols.map((p) => p.replace(/:$/, "")).join(" or ")}; got ${url.protocol.replace(/:$/, "")}`);
     return raw;
 }
-function parseListen(env) {
-    const rawHost = read(env, "NYLORUN_LISTEN_HOST");
-    const rawPort = read(env, "NYLORUN_LISTEN_PORT");
-    const rawAllowed = read(env, "NYLORUN_ALLOWED_HOSTS");
-    if (rawHost === undefined && rawPort === undefined && rawAllowed === undefined)
-        return undefined;
-    const host = rawHost ?? DEFAULT_CONTAINER_LISTEN_HOST;
+function parseListener(env, prefix, defaultPort, hosts) {
+    const hostName = `${prefix}LISTEN_HOST`;
+    const host = read(env, hostName) ?? DEFAULT_CONTAINER_LISTEN_HOST;
     if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_LISTEN_HOST is not an address: ${host}`);
-    const port = rawPort === undefined
-        ? DEFAULT_CONTAINER_LISTEN_PORT
-        : parsePort("NYLORUN_LISTEN_PORT", rawPort);
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_ALLOWED_HOSTS is required when NYLORUN_LISTEN_HOST is ${host}: list the Host headers clients send, e.g. runtime:${port},localhost:<published port>`);
+        throw new StackConfigError(`${hostName} is not an address: ${host}`);
+    const portName = `${prefix}LISTEN_PORT`;
+    const rawPort = read(env, portName);
+    const port = rawPort === undefined ? defaultPort : parsePort(portName, rawPort);
+    if (!hosts)
+        return { host, port };
+    const allowedName = `${prefix}ALLOWED_HOSTS`;
+    const explicit = (read(env, allowedName) ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+        .map((entry) => normalizeAllowedHost(allowedName, entry));
+    if (explicit.length === 0 && !isLoopbackHost(host))
+        throw new StackConfigError(`${allowedName} is required when ${hostName} is ${host}: list the Host headers ${hosts.senders}, e.g. ${hosts.example(port)}`);
     // Loopback forms of the listen port serve probes from inside the container
     // (health checks). A browser on the Docker host never sends them: it sends
     // the published port.
-    const allowedHosts = [...new Set([...explicit, ...loopbackForms(port)])];
-    return { host, port, allowedHosts };
+    return { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] };
+}
+/** The API's listener (`NYLORUN_LISTEN_*`, `NYLORUN_ALLOWED_HOSTS`): none when none is set. */
+function parseListen(env) {
+    if (["NYLORUN_LISTEN_HOST", "NYLORUN_LISTEN_PORT", "NYLORUN_ALLOWED_HOSTS"].every((name) => read(env, name) === undefined))
+        return undefined;
+    return parseListener(env, "NYLORUN_", DEFAULT_CONTAINER_LISTEN_PORT, {
+        senders: "clients send",
+        example: (port) => `runtime:${port},localhost:<published port>`,
+    });
 }
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
 function parseIdentityKeys(env) {
@@ -398,30 +404,14 @@ function parseSandboxes(env) {
  * (required with `NYLORUN_HARNESS=remote`; optional when only sandbox pods connect).
  */
 function parseHarnessListener(env, tokenRequired = true) {
-    const host = read(env, "NYLORUN_HARNESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_HARNESS_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_HARNESS_LISTEN_PORT
-        : parsePort("NYLORUN_HARNESS_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_HARNESS_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_HARNESS_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_HARNESS_ALLOWED_HOSTS is required when NYLORUN_HARNESS_LISTEN_HOST is ${host}: list the Host headers harnesses send, e.g. runtime:${port}`);
+    const listen = parseListener(env, "NYLORUN_HARNESS_", DEFAULT_HARNESS_LISTEN_PORT, {
+        senders: "harnesses send",
+        example: (port) => `runtime:${port}`,
+    });
     const token = tokenRequired || read(env, "NYLORUN_HARNESS_TOKEN") !== undefined
         ? parseHarnessToken(env, "with NYLORUN_HARNESS=remote: the credential harnesses present")
         : undefined;
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        ...(token ? { token } : {}),
-    };
+    return { listen, ...(token ? { token } : {}) };
 }
 /** What a harness process must not hold: it runs next to agent code. */
 const HARNESS_REFUSED = ["NYLORUN_DATABASE_URL", "NYLORUN_GATES_TOKEN", "NYLORUN_KEYS_URL"];
@@ -491,43 +481,22 @@ function parsePodHost(env, url) {
 }
 /** `StackConfig.gates` from `NYLORUN_GATES_*`. */
 function parseGates(env) {
-    const host = read(env, "NYLORUN_GATES_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_GATES_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_GATES_LISTEN_PORT");
-    const port = rawPort === undefined
-        ? DEFAULT_GATES_LISTEN_PORT
-        : parsePort("NYLORUN_GATES_LISTEN_PORT", rawPort);
-    const rawAllowed = read(env, "NYLORUN_GATES_ALLOWED_HOSTS");
-    const explicit = rawAllowed === undefined
-        ? []
-        : rawAllowed
-            .split(",")
-            .map((entry) => entry.trim())
-            .filter((entry) => entry !== "")
-            .map((entry) => normalizeAllowedHost("NYLORUN_GATES_ALLOWED_HOSTS", entry));
-    if (explicit.length === 0 && !isLoopbackAddress(host))
-        throw new StackConfigError(`NYLORUN_GATES_ALLOWED_HOSTS is required when NYLORUN_GATES_LISTEN_HOST is ${host}: list the Host headers the loop sends, e.g. gateway:${port}`);
+    const listen = parseListener(env, "NYLORUN_GATES_", DEFAULT_GATES_LISTEN_PORT, {
+        senders: "the loop sends",
+        example: (port) => `gateway:${port}`,
+    });
     const token = read(env, "NYLORUN_GATES_TOKEN");
     if (token === undefined)
         throw new StackConfigError("NYLORUN_GATES_TOKEN is required for --service gates: the token the loop presents (`nylorun start` sets it)");
     if (!GATES_TOKEN.test(token))
         throw new StackConfigError("NYLORUN_GATES_TOKEN must be at least 32 bytes as hex");
-    return {
-        listen: { host, port, allowedHosts: [...new Set([...explicit, ...loopbackForms(port)])] },
-        token,
-    };
+    return { listen, token };
 }
 /** The prefix of the credential resolver's variables (removed in protocol 10). */
 const REMOVED_RESOLVER_PREFIX = "NYLORUN_RESOLVER_";
 /** `StackConfig.egress` from `NYLORUN_EGRESS_LISTEN_*`. CONNECT has no Host header to check. */
 function parseEgress(env) {
-    const host = read(env, "NYLORUN_EGRESS_LISTEN_HOST") ?? DEFAULT_CONTAINER_LISTEN_HOST;
-    if (/\s|\//.test(host))
-        throw new StackConfigError(`NYLORUN_EGRESS_LISTEN_HOST is not an address: ${host}`);
-    const rawPort = read(env, "NYLORUN_EGRESS_LISTEN_PORT");
-    const port = rawPort === undefined ? DEFAULT_EGRESS_LISTEN_PORT : parsePort("NYLORUN_EGRESS_LISTEN_PORT", rawPort);
-    return { listen: { host, port } };
+    return { listen: parseListener(env, "NYLORUN_EGRESS_", DEFAULT_EGRESS_LISTEN_PORT) };
 }
 /** `StackConfig.modelGate` from `NYLORUN_GATES_URL` and `NYLORUN_GATES_TOKEN`. */
 function parseModelGate(env) {

package/dist/keys/egress-ca.d.ts

@@ -0,0 +1,15 @@
+import type { SessionStore } from "../store/types.js";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export declare const EGRESS_LEAF_MINUTES = 60;
+export declare class EgressAuthority {
+    private readonly store;
+    private readonly kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    private authority;
+    constructor(store: SessionStore, kek: () => Buffer);
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    certificate(): Promise<string>;
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    signLeaf(host: string, publicKey: string): Promise<string>;
+    private load;
+}

package/dist/keys/egress-ca.js

@@ -0,0 +1,66 @@
+/**
+ * The installation's egress CA (R2c, D50, E12): one long-lived certificate authority whose
+ * certificate every pod sandbox trusts, and whose key signs the short-lived leaf egress-gate
+ * presents when it terminates TLS for a host an `environment_secret` is bound to. Only keys holds
+ * the key: it lives in the Tenant setting `egress.ca`, sealed under the vault KEK like a signing
+ * key, beside the certificate in the clear. Created on first use under the signing keys' lock.
+ * No rotation yet (R8, with the KeyRoot seam).
+ */
+import { X509Certificate } from "node:crypto";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { createCertificateAuthority, issueLeafCertificate } from "./x509.js";
+const SETTING = "egress.ca";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export const EGRESS_LEAF_MINUTES = 60;
+function aad(certificate) {
+    return Buffer.from(`nylorun.egress-ca:${new X509Certificate(certificate).fingerprint256}`);
+}
+export class EgressAuthority {
+    store;
+    kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    authority;
+    constructor(store, kek) {
+        this.store = store;
+        this.kek = kek;
+    }
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    async certificate() {
+        return (await this.load()).certificate;
+    }
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    async signLeaf(host, publicKey) {
+        return issueLeafCertificate({ authority: await this.load(), host, publicKey, minutes: EGRESS_LEAF_MINUTES });
+    }
+    async load() {
+        if (this.authority)
+            return this.authority;
+        const kek = this.kek();
+        const stored = await this.store.tx(async (t) => (await read(t)) ?? (await create(t, kek)));
+        const privateKey = decryptSecret(kek, aad(stored.certificate), Buffer.from(stored.nonce, "base64"), Buffer.from(stored.ciphertext, "base64"), Buffer.from(stored.wrappedDek, "base64"), stored.kekId).toString("utf8");
+        this.authority = { certificate: stored.certificate, privateKey };
+        return this.authority;
+    }
+}
+async function read(t) {
+    const value = await t.getSetting(SETTING);
+    return value === undefined ? undefined : JSON.parse(value);
+}
+async function create(t, kek) {
+    // Concurrent first uses would both create a CA: lock, then read what the winner made.
+    await t.lockSigningKeys();
+    const existing = await read(t);
+    if (existing)
+        return existing;
+    const authority = createCertificateAuthority({ commonName: "Nylorun egress CA" });
+    const sealed = encryptSecret(kek, aad(authority.certificate), Buffer.from(authority.privateKey, "utf8"));
+    const stored = {
+        certificate: authority.certificate,
+        kekId: sealed.kekId,
+        nonce: sealed.nonce.toString("base64"),
+        ciphertext: sealed.ciphertext.toString("base64"),
+        wrappedDek: sealed.wrappedDek.toString("base64"),
+    };
+    await t.putSetting(SETTING, JSON.stringify(stored));
+    return stored;
+}

package/dist/keys/keys.d.ts

@@ -32,9 +32,16 @@ export interface Keys {
      * (R2b C12, `mcp/preview.ts`); never calls a tool.
      */
     previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
+    /** The egress CA's certificate (PEM), creating the CA when the Tenant has none (R2c, D50). */
+    egressCa(): Promise<string>;
+    /**
+     * A short-lived leaf for `host` and the caller's P-256 public key (SPKI PEM), signed by the
+     * egress CA (R2c). The leaf's private key never reaches keys; the CA's never leaves it.
+     */
+    signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -12,6 +12,7 @@
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
  */
+import { EgressAuthority } from "./egress-ca.js";
 import { SignJWT } from "jose";
 import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
@@ -25,9 +26,12 @@ export const KEYS_OPERATIONS = [
     "rotateSigningKeys",
     "ensureSigningKeys",
     "previewMcp",
+    "egressCa",
+    "signEgressLeaf",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
+    const egress = new EgressAuthority(store, kek);
     return {
         createCredential: (vaultId, body) => vault.createCredential(vaultId, body),
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
@@ -52,5 +56,7 @@ export function inProcessKeys(options) {
             await store.tx((t) => signingKeys.ensure(t, key));
         },
         previewMcp: (body) => previewMcpServer(body, { vault, policy: options.policy ?? {} }),
+        egressCa: () => egress.certificate(),
+        signEgressLeaf: (host, publicKey) => egress.signLeaf(host, publicKey),
     };
 }

package/dist/keys/x509.d.ts

@@ -0,0 +1,29 @@
+export interface CertificateAuthority {
+    /** PEM of the CA certificate: the only part a sandbox ever receives. */
+    readonly certificate: string;
+    /** PKCS#8 PEM of the CA key: sealed in the vault, used only by keys. */
+    readonly privateKey: string;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export declare function createCertificateAuthority(options: {
+    readonly commonName: string;
+    readonly days?: number;
+    readonly now?: Date;
+}): CertificateAuthority;
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export declare function issueLeafCertificate(options: {
+    readonly authority: CertificateAuthority;
+    readonly host: string;
+    readonly publicKey: string;
+    readonly minutes?: number;
+    readonly now?: Date;
+}): string;
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export declare function leafKeyPair(): {
+    readonly publicKey: string;
+    readonly privateKey: string;
+};