@nylorun/runtime 0.21.1-beta → 0.23.0-beta

package/dist/execution/types.d.ts

@@ -1,12 +1,10 @@
 /**
  * The Durable Session Execution seam (architecture §12.3).
  *
- * Durable Session Execution decides when to look at a session again. It never
- * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
- * key, retries, timers, the sweep chain); the Session Store owns the record (the
- * checkpoint, the effect journal, the events) and the wake outbox that bridges the
- * two. Restate is the supported implementation
+ * Durable Session Execution decides when to look at a session again; `advance` is
+ * safe to repeat (§10.1). What it owns and what the Session Store owns is said once,
+ * under "Durable Session Execution" in `src/CONTEXT.md`. Restate is the supported
+ * implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -19,7 +17,7 @@
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
  *   are sent after the Session Store transaction that caused them commits, never
- *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   inside it: the transaction writes the wake to the outbox (`Tx.wake`), and the
  *   wake is sent after commit, or by the Tenant sweep when that send failed or a
  *   crash cut it off. A wake may therefore be sent more than once, always with the
  *   same `dedupeKey`.
@@ -75,9 +73,13 @@ export type AdvanceResult = {
 };
 /** A pod sandbox's timers. */
 export type SandboxTimer = "idle" | "ttl";
-/** What `DurableExecution.sandbox` asks for: a reconcile, or a timer. */
+/**
+ * What `DurableExecution.sandbox` asks for: a reconcile, or a timer. A reconcile's `key` merges
+ * repeated sends of one request (the outbox's `signal:<row id>`); without one, every send runs.
+ */
 export type SandboxSignal = {
     kind: "reconcile";
+    key?: string;
 } | {
     kind: "arm";
     timer: SandboxTimer;

package/dist/execution/types.js

@@ -1,12 +1,10 @@
 /**
  * The Durable Session Execution seam (architecture §12.3).
  *
- * Durable Session Execution decides when to look at a session again. It never
- * holds session state: every outcome lives in the Session Store, and `advance`
- * is safe to repeat (§10.1). It owns the schedule (wake delivery, one advance per
- * key, retries, timers, the sweep chain); the Session Store owns the record (the
- * checkpoint, the effect journal, the events) and the wake outbox that bridges the
- * two. Restate is the supported implementation
+ * Durable Session Execution decides when to look at a session again; `advance` is
+ * safe to repeat (§10.1). What it owns and what the Session Store owns is said once,
+ * under "Durable Session Execution" in `src/CONTEXT.md`. Restate is the supported
+ * implementation
  * (`adapters/execution/restate.ts`); `execution/memory.ts` is the in-process
  * implementation used by unit tests, `startEphemeralRuntime` and a Host
  * started without Restate endpoints.
@@ -19,7 +17,7 @@
  * - **At least once after a wake.** When `wake` resolves, an `advance` for the
  *   key will start after that point (possibly merged with other wakes). Wakes
  *   are sent after the Session Store transaction that caused them commits, never
- *   inside it: the transaction writes the wake to its outbox (`Tx.wake`), and the
+ *   inside it: the transaction writes the wake to the outbox (`Tx.wake`), and the
  *   wake is sent after commit, or by the Tenant sweep when that send failed or a
  *   crash cut it off. A wake may therefore be sent more than once, always with the
  *   same `dedupeKey`.

package/dist/gates/egress-credentials.d.ts

@@ -0,0 +1,48 @@
+import type { Duplex } from "node:stream";
+import type { Logger } from "../tenant/types.js";
+/** What the vault answers for one request to a host a credential may be bound to. */
+export type EgressCredentialRelease = {
+    readonly status: "none";
+} | {
+    readonly status: "released";
+    readonly header: string;
+    readonly value: string;
+    readonly credentialId: string;
+} | {
+    readonly status: "refused";
+    readonly reason: string;
+};
+export interface EgressCredentials {
+    /** Whether an `environment_secret` of a live session on the sandbox is bound to `host`. */
+    bound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header to set on one request, read from the vault each time. */
+    release(sandboxId: string, host: string): Promise<EgressCredentialRelease>;
+    /** A fresh leaf for `host`: its key, made here, and its certificate, signed by keys. */
+    leaf(host: string): Promise<{
+        readonly key: string;
+        readonly cert: string;
+    }>;
+    /** Tests: the CA upstream servers are verified against, instead of the public roots. */
+    readonly upstreamCa?: string;
+    /** Tests: the port requests are sent to, instead of 443. */
+    readonly upstreamPort?: number;
+}
+export interface CredentialTerminator {
+    /**
+     * Answers the CONNECT, terminates TLS for `host` and serves its requests, sending each to one
+     * of `addresses` (already checked) and nowhere else.
+     */
+    terminate(client: Duplex, target: {
+        readonly sandboxId: string;
+        readonly host: string;
+        readonly addresses: readonly {
+            address: string;
+            family: number;
+        }[];
+    }): Promise<void>;
+}
+export declare function credentialTerminator(options: {
+    readonly credentials: EgressCredentials;
+    readonly logger: Logger;
+    readonly idleMs: number;
+}): CredentialTerminator;

package/dist/gates/egress-credentials.js

@@ -0,0 +1,147 @@
+/**
+ * egress-gate's credential path (R2c, D50): how a skill's CLI authenticates while the secret
+ * stays out of the sandbox. A CONNECT to port 443 of a host that an `environment_secret` of a
+ * live session on the sandbox is bound to (`allowedHosts`) is not tunnelled: the gate answers
+ * 200, terminates TLS with a fresh leaf for that host signed by the installation's egress CA
+ * (keys holds its key; the pod trusts its certificate, `harness/pod.ts`), and reads HTTP/1.1
+ * requests. For each request it reads the vault (one Postgres query, no cache, so a rotation
+ * applies to the next request), sets the credential's header (replacing any of that name, such
+ * as the `nylorun-managed` sentinel the CLI sent), and forwards it over TLS to the address the
+ * gate already checked, verifying the host's certificate by name against the public roots.
+ *
+ * Nothing here knows a tool: the header name and its format are the credential's. A release the
+ * vault refuses (two secrets for one host, an unreadable value) answers 502 and is logged, never
+ * as an event; a value never is. Upgrades (WebSocket) and HTTP/2 are not served on this path.
+ */
+import { createServer } from "node:http";
+import { Agent, request } from "node:https";
+import { createSecureContext, TLSSocket } from "node:tls";
+/** Headers that describe one hop and are never forwarded. */
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "proxy-connection",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/** `rawHeaders` without hop-by-hop headers and `drop`, as lowercase names to values. */
+function forwardable(raw, drop) {
+    const headers = {};
+    for (let i = 0; i + 1 < raw.length; i += 2) {
+        const name = raw[i].toLowerCase();
+        if (HOP_BY_HOP.has(name) || name === drop)
+            continue;
+        (headers[name] ??= []).push(raw[i + 1]);
+    }
+    return headers;
+}
+function reply(res, status, message) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    const body = `egress-gate: ${message}\n`;
+    res.writeHead(status, { "content-type": "text/plain; charset=utf-8", "content-length": Buffer.byteLength(body) });
+    res.end(body);
+}
+export function credentialTerminator(options) {
+    const { credentials, logger } = options;
+    const terminated = new WeakMap();
+    const http = createServer((req, res) => {
+        forward(req, res).catch((error) => {
+            logger.error("egress_forward_failed", { error: error instanceof Error ? error.message : String(error) });
+            reply(res, 502, "the request failed");
+        });
+    });
+    http.keepAliveTimeout = options.idleMs;
+    http.headersTimeout = 60_000;
+    // Uploads may be long; the client socket's idle timeout still applies.
+    http.requestTimeout = 0;
+    http.on("upgrade", (req, socket) => {
+        const at = terminated.get(req.socket);
+        logger.warn("egress_refused", { status: 501, reason: "upgrade_refused", sandboxId: at?.sandboxId, host: at?.host });
+        socket.destroy();
+    });
+    http.on("clientError", (_error, socket) => socket.destroy());
+    async function forward(req, res) {
+        const at = terminated.get(req.socket);
+        if (!at) {
+            res.destroy();
+            return;
+        }
+        const { sandboxId, host } = at;
+        const release = await credentials.release(sandboxId, host);
+        if (release.status === "refused") {
+            logger.warn("egress_credential_refused", { status: 502, reason: release.reason, sandboxId, host });
+            req.resume();
+            return reply(res, 502, `the credential for ${host} could not be used`);
+        }
+        const header = release.status === "released" ? release.header.toLowerCase() : undefined;
+        const headers = forwardable(req.rawHeaders, header);
+        if (release.status === "released")
+            headers[header] = [release.value];
+        const upstream = request({
+            host,
+            port: credentials.upstreamPort ?? 443,
+            servername: host,
+            method: req.method,
+            path: req.url,
+            headers,
+            agent: at.agent,
+        });
+        upstream.on("response", (response) => {
+            res.writeHead(response.statusCode ?? 502, response.statusMessage, forwardable(response.rawHeaders));
+            response.pipe(res);
+            response.on("error", () => res.destroy());
+        });
+        upstream.on("error", (error) => {
+            logger.warn("egress_upstream_failed", { status: 502, sandboxId, host, code: error.code });
+            reply(res, 502, `could not reach ${host}`);
+        });
+        req.on("error", () => upstream.destroy());
+        res.on("close", () => {
+            if (!res.writableFinished)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    }
+    return {
+        async terminate(client, target) {
+            const { sandboxId, host, addresses } = target;
+            const leaf = await credentials.leaf(host);
+            if (client.destroyed)
+                return;
+            // Requests go to the addresses the gate checked, never to the name resolved again.
+            const lookup = (_name, lookupOptions, callback) => {
+                if (lookupOptions.all)
+                    callback(null, addresses);
+                else
+                    callback(null, addresses[0].address, addresses[0].family);
+            };
+            const agent = new Agent({
+                keepAlive: true,
+                maxSockets: 8,
+                lookup,
+                ...(credentials.upstreamCa ? { ca: credentials.upstreamCa } : {}),
+            });
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            const tls = new TLSSocket(client, {
+                isServer: true,
+                secureContext: createSecureContext({ key: leaf.key, cert: leaf.cert }),
+                ALPNProtocols: ["http/1.1"],
+            });
+            terminated.set(tls, { sandboxId, host, agent });
+            tls.on("error", () => tls.destroy());
+            tls.on("close", () => {
+                agent.destroy();
+                client.destroy();
+            });
+            logger.info("egress_terminated", { sandboxId, host });
+            http.emit("connection", tls);
+        },
+    };
+}

package/dist/gates/egress.d.ts

@@ -3,6 +3,7 @@ import { type Socket } from "node:net";
 import type { EgressTokenVerdict } from "../sandbox/egress-token.js";
 import type { SessionStore } from "../store/types.js";
 import type { Logger } from "../tenant/types.js";
+import { type EgressCredentials } from "./egress-credentials.js";
 /**
  * What egress-gate reads of a sandbox: its current host epoch, the pod that joined at it, and
  * its spec's `network.allow`; `undefined` when it is gone, deleted, lost, expired or not a pod.
@@ -46,6 +47,8 @@ export interface StartEgressGateOptions {
     readonly blocked?: (address: string) => boolean;
     /** Tests replace how the checked address is dialled. */
     readonly dial?: (address: string, port: number) => Socket;
+    /** The vault and keys, for hosts an `environment_secret` is bound to (R2c). None: tunnels only. */
+    readonly credentials?: EgressCredentials;
 }
 export interface EgressGate {
     /** Where the gate listens, e.g. `http://0.0.0.0:4200`. */

package/dist/gates/egress.js

@@ -17,7 +17,10 @@
  *    (cloud metadata included), multicast or reserved, else 502 or 403;
  * 6. the gate connects to that checked address (never to the name again) and pipes.
  *
- * No TLS interception and no credential injection: a tunnel is opaque bytes. Any other request
+ * A tunnel is opaque bytes, with one exception (R2c, D50): port 443 of a host that an
+ * `environment_secret` of a live session on the sandbox is bound to. There the gate terminates
+ * TLS and sets the credential's header on every request (`egress-credentials.ts`), still sending
+ * only to the checked address. Every other host gets the tunnel. Any other request
  * (an absolute-form plain HTTP request included) is answered 405. Refusals are logged, never as
  * events; the token never is. Tunnels close after `idleMs` without traffic in either direction.
  */
@@ -27,6 +30,7 @@ import { BlockList, connect, isIP } from "node:net";
 import { isSandboxHostPattern } from "@nylorun/core/define";
 import { isPrivateAddress } from "../tenant/outbound.js";
 import { bindListener } from "../host/http.js";
+import { credentialTerminator } from "./egress-credentials.js";
 /** Ports a tunnel may open. */
 export const EGRESS_PORTS = [443, 80];
 /** Tunnels one sandbox may hold open at once. */
@@ -151,6 +155,9 @@ export async function startEgressGate(options) {
             cache.delete(cache.keys().next().value);
         return value;
     }
+    const terminator = options.credentials
+        ? credentialTerminator({ credentials: options.credentials, logger, idleMs })
+        : undefined;
     const open = new Map();
     const tunnels = new Set();
     async function onConnect(req, client, head) {
@@ -209,6 +216,12 @@ export async function startEgressGate(options) {
             return refuse(403, "address_refused", { sandboxId }, `${host} resolves only to addresses tunnels may not reach`);
         if (client.destroyed)
             return;
+        if (terminator && port === 443 && (await options.credentials.bound(sandboxId, host))) {
+            // A client that spoke before the 200 is not one this path serves.
+            if (head.length > 0)
+                return refuse(403, "early_data", { sandboxId }, "wait for the CONNECT answer before sending");
+            return terminator.terminate(client, { sandboxId, host, addresses: allowed });
+        }
         const upstream = await dialFirst(allowed.map((entry) => entry.address), port);
         if (!upstream)
             return refuse(502, "connect_failed", { sandboxId }, `could not connect to ${host}:${port}`);

package/dist/gates/tenant-vaults.d.ts

@@ -34,6 +34,10 @@ export interface TenantVault {
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
+    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** The header an `environment_secret` sets on one request to `host` (R2c). */
+    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**

package/dist/gates/tenant-vaults.js

@@ -52,6 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
+            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
+            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */

package/dist/harness/calls.d.ts

@@ -27,6 +27,8 @@ export interface ToolRouting {
     /** The session that owns the tree's sandbox, and the sandbox resource it is attached to. */
     readonly sandboxOwnerId: string;
     readonly sandboxId?: string;
+    /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+    readonly environment?: Readonly<Record<string, string>>;
     readonly activeTurnId: string | null;
     /** Who the sandbox call's events are claimed for: the run's id. */
     readonly claim?: string;

package/dist/harness/calls.js

@@ -127,6 +127,7 @@ export async function callSandboxTool(sandbox, routing, request, signal) {
         activeTurnId: routing.activeTurnId,
         manifest: routing.rootManifest,
         ...(routing.sandboxId === undefined ? {} : { sandboxId: routing.sandboxId }),
+        ...(routing.environment === undefined ? {} : { environment: routing.environment }),
         ...(routing.claim === undefined ? {} : { claim: routing.claim }),
     }, capability, request.toolName, request.input, signal);
 }

package/dist/harness/executors.js

@@ -95,6 +95,7 @@ export function routingOf(run) {
         ...(routing.mcpSnapshot ? { mcpSnapshot: routing.mcpSnapshot } : {}),
         sandboxOwnerId: routing.sandbox?.ownerId ?? run.grant.sessionId,
         ...(routing.sandbox?.sandboxId === undefined ? {} : { sandboxId: routing.sandbox.sandboxId }),
+        ...(routing.sandbox?.environment === undefined ? {} : { environment: routing.sandbox.environment }),
         activeTurnId: run.grant.turnId,
         claim: run.runId,
     };

package/dist/harness/main.js

@@ -44,7 +44,10 @@ export async function runHarness(stack, baseline) {
             log: (message, fields) => logger.info(message, fields),
         });
         logger.info("sandbox_network_policy_in_force", { sandboxId: config.pod.sandboxId, waitedMs });
-        pod = podHost(config.pod, logger, { volumeFile: join(config.root, "volume-id") });
+        pod = podHost(config.pod, logger, {
+            volumeFile: join(config.root, "volume-id"),
+            caBundleFile: join(config.root, "egress-ca-bundle.pem"),
+        });
     }
     const token = pod ? () => pod.token() : config.token;
     if (token === undefined)

package/dist/harness/pod.d.ts

@@ -18,4 +18,6 @@ export declare function podHost(config: PodHostConfig, logger: {
     renewMs?: number;
     /** Where the engine keeps the volume's id (on the volume): a new volume gets a new one. */
     volumeFile?: string;
+    /** Where the engine writes the trust bundle: the public roots and the egress CA (R2c). */
+    caBundleFile?: string;
 }): PodHost;

package/dist/harness/pod.js

@@ -5,17 +5,34 @@
  * read afresh each time: a reset writes a new one). The egress token minted with the host token
  * is the password of the proxy every command gets (`proxyEnv`); both are renewed every
  * `RENEW_MS`, well inside their 15-minute life.
+ *
+ * The join answer also carries the installation's egress CA (R2c, D50). The engine writes it,
+ * after the public roots, to a trust bundle on the pod (`caBundleFile`) and points every
+ * command's trust variables at it, so a CLI trusts the leaf egress-gate presents for a host an
+ * `environment_secret` is bound to. The bundle is rewritten only when the CA changes.
  */
 import { randomUUID } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { rootCertificates } from "node:tls";
 import { dirname } from "node:path";
 /** How often the host and egress tokens are renewed. */
 export const RENEW_MS = 5 * 60_000;
+/** The variables CLIs read their trust bundle from: OpenSSL, Node, Python, curl, git, AWS. */
+const TRUST_VARIABLES = [
+    "SSL_CERT_FILE",
+    "NODE_EXTRA_CA_CERTS",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "GIT_SSL_CAINFO",
+    "AWS_CA_BUNDLE",
+];
 class Refused extends Error {
 }
 export function podHost(config, logger, options = {}) {
     const call = options.fetch ?? fetch;
     let held;
+    /** The CA in the bundle on disk, once one is written. */
+    let bundled;
     const post = async (path, init) => {
         const response = await call(`${config.httpUrl}/nylorun/harness/v1/host/${path}`, {
             method: "POST",
@@ -32,13 +49,27 @@ export function podHost(config, logger, options = {}) {
         if (!response.ok)
             throw new Error(`host/${path} answered ${response.status}`);
         const body = JSON.parse(text);
+        if (typeof body.caCertificate === "string")
+            await writeBundle(body.caCertificate);
         return {
             hostToken: body.hostToken,
             egressToken: body.egressToken,
             epoch: body.epoch,
             expiresAt: Date.parse(body.expiresAt),
+            ...(typeof body.caCertificate === "string" ? { caCertificate: body.caCertificate } : {}),
         };
     };
+    const writeBundle = async (ca) => {
+        const file = options.caBundleFile;
+        if (!file || ca === bundled)
+            return;
+        await mkdir(dirname(file), { recursive: true });
+        // Written beside it and renamed, so a command never reads half a bundle.
+        const next = `${file}.${randomUUID()}`;
+        await writeFile(next, `${rootCertificates.join("\n")}\n${ca.trim()}\n`, { mode: 0o644 });
+        await rename(next, file);
+        bundled = ca;
+    };
     /** The volume's id, created on a volume that has none. */
     const volumeId = async () => {
         const file = options.volumeFile;
@@ -100,7 +131,11 @@ export function podHost(config, logger, options = {}) {
             url.username = "nylorun";
             url.password = held.egressToken;
             const proxy = url.toString().replace(/\/$/, "");
+            const trust = bundled !== undefined && options.caBundleFile
+                ? Object.fromEntries(TRUST_VARIABLES.map((name) => [name, options.caBundleFile]))
+                : {};
             return {
+                ...trust,
                 HTTPS_PROXY: proxy,
                 HTTP_PROXY: proxy,
                 https_proxy: proxy,

package/dist/harness-api/start.d.ts

@@ -14,6 +14,8 @@ export interface SegmentStart {
     readonly sandbox: {
         readonly ownerId: string;
         readonly sandboxId?: string;
+        /** Variables every sandbox command gets (R2c): secret names set to the sentinel, plain values. */
+        readonly environment?: Readonly<Record<string, string>>;
     };
     /** The sandbox is a pod sandbox (F7.2): its engine runs the segment. Its lifecycle state. */
     readonly pod?: {

package/dist/harness-api/start.js

@@ -25,8 +25,10 @@ options = {}) {
         const fixtureModel = await usesFixtureModel(t);
         if (!options.harness)
             return { current, fixtureModel, outcomes: [], sandbox: { ownerId: id } };
-        const sandbox = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
-        const resource = sandbox.sandboxId === undefined ? undefined : await t.sandboxResource(sandbox.sandboxId);
+        const workspace = sandboxWorkspaceOf(current, await sandboxLookup(t, current.id));
+        const resource = workspace.sandboxId === undefined ? undefined : await t.sandboxResource(workspace.sandboxId);
+        const { environment } = await ctx.vault.sessionEnvironment(t, current.vaultIds ?? []);
+        const sandbox = Object.keys(environment).length > 0 ? { ...workspace, environment } : workspace;
         return {
             current,
             fixtureModel,

package/dist/harness-api/ws-server.js

@@ -14,8 +14,8 @@
  * /nylorun/harness/v1/host/join` (`{ sandboxId, podUid, joinToken }`), renews it with `POST
  * .../host/renew` (`Authorization: Bearer <host token>`), and upgrades with the host token as
  * its bearer: that connection hosts its sandbox alone (`HarnessPeer.host`). Both answer
- * `{ hostToken, egressToken, sandboxId, epoch, expiresAt }`; every refusal is the same 401. The
- * harness token is never accepted as a host token, nor a host token anywhere but here.
+ * `{ hostToken, egressToken, sandboxId, epoch, expiresAt, caCertificate }` (the egress CA, R2c);
+ * every refusal is the same 401. The harness token is never accepted as a host token, nor a host token anywhere but here.
  */
 import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";

package/dist/host/execution.d.ts

@@ -19,12 +19,14 @@
  * services, so the open would fail. A core-only process relies on a Worker having registered
  * them first.
  *
- * **One Worker URL.** `start` registers the Worker endpoint (`NYLORUN_WORKER_URL`) with
- * Restate once. Restate sends new invocations to the latest registered deployment, so
- * several Workers that each register their own URL do not share load: the last one to start
- * takes every new invocation. The local stack runs a single `runtime` container with
- * `--service core,loop`. A deployment with several Worker processes (Helm, Cloud) must advertise one
- * load-balanced `NYLORUN_WORKER_URL` shared by all of them.
+ * **One Worker URL per version.** `start` registers the Worker endpoint with Restate once, as
+ * `<NYLORUN_WORKER_URL>/nylorun/<version>` (`workerDeployment` in `infra/execution.ts`).
+ * Restate sends new invocations to the latest registered deployment, so several Workers that
+ * each register their own URL do not share load: the last one to start takes every new
+ * invocation. The local stack runs a single `runtime` container with `--service core,loop`. A
+ * deployment with several Worker processes (Helm, Cloud) must advertise one load-balanced
+ * `NYLORUN_WORKER_URL` shared by all of them; a rolling upgrade registers the new version's
+ * path next to the old one, which keeps the invocations it started.
  */
 import type { DurableExecution } from "../execution/types.js";
 import type { Logger } from "../tenant/types.js";

package/dist/host/gates.js

@@ -27,6 +27,7 @@ import { probeDatabase } from "../infra/database.js";
 import { bindListener, headerValue, isAllowedRequestHost, sendRejected } from "./http.js";
 import { startEgressGate, storeEgressSandboxes } from "../gates/egress.js";
 import { verifyEgressToken } from "../sandbox/egress-token.js";
+import { leafKeyPair } from "../keys/x509.js";
 /** Above the gate's 600 s provider request timeout and the loop's 630 s client timeout. */
 export const GATES_REQUEST_TIMEOUT_MS = 660_000;
 export async function startGates(options) {
@@ -172,6 +173,16 @@ export async function startEgress(options) {
             return verifyEgressToken(vault.store, vault.tenantId, raw, publicKeys);
         },
         sandboxes: { live: async (sandboxId) => storeEgressSandboxes((await tenant.open()).store).live(sandboxId) },
+        credentials: {
+            bound: async (sandboxId, host) => (await tenant.open()).environmentSecretBound(sandboxId, host),
+            release: async (sandboxId, host) => (await tenant.open()).releaseEnvironmentSecret(sandboxId, host),
+            // A fresh key per connection, made here: keys signs its public half and never sees it.
+            async leaf(host) {
+                const pair = leafKeyPair();
+                const cert = await (await tenant.open()).keys().signEgressLeaf(host, pair.publicKey);
+                return { key: pair.privateKey, cert };
+            },
+        },
         ...options.gate,
     });
 }

package/dist/host/main.js

@@ -56,6 +56,7 @@ import { createRunGrants } from "../tenant/run-grants.js";
 import { runHarness } from "../harness/main.js";
 import { startHarnessListener } from "../harness-api/ws-server.js";
 import { httpSandboxesClient } from "../sandbox/pods/client.js";
+import { retry } from "../retry.js";
 const nodeRequire = createRequire(import.meta.url);
 function coreVersion() {
     try {
@@ -121,22 +122,15 @@ function objectStore(config) {
  * uploads and downloads fail meanwhile) and does not hold up the Host.
  */
 async function ensureBucket(store, bucket, logger) {
-    for (let attempt = 1;; attempt += 1) {
-        try {
-            await store.ensureBucket();
-            logger.info("object_store_ready", { bucket });
-            return;
-        }
-        catch (error) {
-            if (attempt >= 10) {
-                logger.error("object_store_unavailable", {
-                    bucket,
-                    message: error instanceof Error ? error.message : String(error),
-                });
-                return;
-            }
-            await new Promise((resolve) => setTimeout(resolve, Math.min(1000 * attempt, 5000)));
-        }
+    try {
+        await retry(() => store.ensureBucket(), { minMs: 1000, maxMs: 5000, attempts: 10 });
+        logger.info("object_store_ready", { bucket });
+    }
+    catch (error) {
+        logger.error("object_store_unavailable", {
+            bucket,
+            message: error instanceof Error ? error.message : String(error),
+        });
     }
 }
 /**

package/dist/host/stack-config.d.ts

@@ -39,6 +39,12 @@ export interface StackEndpoints {
     restateIngressUrl?: string;
     restateAdminUrl?: string;
     workerUrl?: string;
+    /**
+     * The Worker deployment's version, from `NYLORUN_WORKER_VERSION` (default: the Runtime's
+     * version): the Worker registers `<NYLORUN_WORKER_URL>/nylorun/<version>` with Restate
+     * (`infra/execution.ts`, `workerDeployment`).
+     */
+    workerVersion?: string;
     s2Endpoint?: string;
     s2Token?: string;
     workspaceStoreUrl?: string;

package/dist/host/stack-config.js

@@ -281,6 +281,12 @@ export function parseStackConfig(env, argv) {
     const workerUrl = parseUrl(env, "NYLORUN_WORKER_URL", http);
     if (workerUrl)
         endpoints.workerUrl = workerUrl;
+    const workerVersion = read(env, "NYLORUN_WORKER_VERSION");
+    if (workerVersion !== undefined) {
+        if (!/^[A-Za-z0-9._-]{1,64}$/.test(workerVersion))
+            throw new StackConfigError("NYLORUN_WORKER_VERSION must be 1 to 64 letters, digits, `.`, `_` or `-` (it is a URL path segment)");
+        endpoints.workerVersion = workerVersion;
+    }
     const s2Endpoint = parseUrl(env, "NYLORUN_S2_ENDPOINT", http);
     if (s2Endpoint)
         endpoints.s2Endpoint = s2Endpoint;