@nylorun/runtime 0.21.1-beta → 0.23.0-beta

package/dist/infra/execution.d.ts

@@ -29,7 +29,24 @@ export declare function executionKind(config: Pick<StackConfig, "endpoints">): "
 export declare function validateExecutionConfig(config: Pick<StackConfig, "endpoints"> & {
     services?: RuntimeServices;
 }): void;
-export declare function createExecution(config: Pick<StackConfig, "endpoints"> & {
+/**
+ * The deployment a Worker registers with Restate (§14.6): `<NYLORUN_WORKER_URL>/nylorun/<version>`,
+ * the version being `NYLORUN_WORKER_VERSION` or the Runtime's. Restate sends new invocations to
+ * the latest deployment of a service and keeps each running invocation on the deployment it
+ * started on, so during a rolling upgrade the Workers of one version share that version's
+ * deployment (behind one load-balanced `NYLORUN_WORKER_URL`) and the old one finishes what it
+ * started; the endpoint answers on any path, so an older deployment's URL still reaches it.
+ * `force` replaces a deployment already registered at the URL with different code: only
+ * outside a container (a development Host, whose code changes under one version). Without
+ * it Restate keeps the deployment it already has at the URL, and a Worker whose services that
+ * deployment lacks refuses to start: a build whose code changed under the same version sets
+ * its own `NYLORUN_WORKER_VERSION`.
+ */
+export declare function workerDeployment(config: Pick<StackConfig, "endpoints" | "listen">): {
+    url: string;
+    force: boolean;
+} | undefined;
+export declare function createExecution(config: Pick<StackConfig, "endpoints" | "listen"> & {
     services?: RuntimeServices;
 }, options?: CreateExecutionOptions): DurableExecution;
 /**

package/dist/infra/execution.js

@@ -8,8 +8,8 @@
  * - wakes, timers and sweep arming go through the ingress, so every process can
  *   call them;
  * - a Worker (a process running the loop service) serves the Restate endpoint on
- *   `0.0.0.0:9080` and registers `NYLORUN_WORKER_URL` with the admin API when
- *   `infra/workers.ts` starts it;
+ *   `0.0.0.0:9080` and registers it with the admin API when `infra/workers.ts` starts it,
+ *   as a versioned deployment (`workerDeployment`);
  * - with `NYLORUN_RESTATE_IDENTITY_KEY` the endpoint accepts only requests
  *   signed by the Restate server holding the matching private key.
  *
@@ -17,6 +17,7 @@
  * only unit tests and a local development Host use.
  */
 import { createRestateExecution } from "../adapters/execution/restate.js";
+import { RUNTIME_VERSION } from "../version.js";
 import { MemoryExecution } from "../execution/memory.js";
 import { DEFAULT_SERVICES, describeServices, } from "../host/stack-config.js";
 /** Where a Worker serves the Restate endpoint (architecture §14.3). */
@@ -46,16 +47,39 @@ export function validateExecutionConfig(config) {
     if (services.has("loop") && !workerUrl)
         throw new Error(`NYLORUN_WORKER_URL is required for --service ${describeServices(services)}: the Worker endpoint URL Restate calls`);
 }
+/**
+ * The deployment a Worker registers with Restate (§14.6): `<NYLORUN_WORKER_URL>/nylorun/<version>`,
+ * the version being `NYLORUN_WORKER_VERSION` or the Runtime's. Restate sends new invocations to
+ * the latest deployment of a service and keeps each running invocation on the deployment it
+ * started on, so during a rolling upgrade the Workers of one version share that version's
+ * deployment (behind one load-balanced `NYLORUN_WORKER_URL`) and the old one finishes what it
+ * started; the endpoint answers on any path, so an older deployment's URL still reaches it.
+ * `force` replaces a deployment already registered at the URL with different code: only
+ * outside a container (a development Host, whose code changes under one version). Without
+ * it Restate keeps the deployment it already has at the URL, and a Worker whose services that
+ * deployment lacks refuses to start: a build whose code changed under the same version sets
+ * its own `NYLORUN_WORKER_VERSION`.
+ */
+export function workerDeployment(config) {
+    const { workerUrl, workerVersion } = config.endpoints;
+    if (!workerUrl)
+        return undefined;
+    const version = encodeURIComponent(workerVersion ?? RUNTIME_VERSION);
+    return { url: `${workerUrl.replace(/\/+$/, "")}/nylorun/${version}`, force: !config.listen };
+}
 export function createExecution(config, options = {}) {
     validateExecutionConfig(config);
-    const { restateIngressUrl, restateAdminUrl, workerUrl, restateIdentityKeys } = config.endpoints;
+    const { restateIngressUrl, restateAdminUrl, restateIdentityKeys } = config.endpoints;
     if (!restateIngressUrl || !restateAdminUrl)
         return new MemoryExecution();
+    const deployment = workerDeployment(config);
     return createRestateExecution({
         ingressUrl: restateIngressUrl,
         adminUrl: restateAdminUrl,
         workerListen: options.workerListen ?? { ...WORKER_LISTEN },
-        ...(workerUrl ? { workerAdvertisedUrl: workerUrl } : {}),
+        ...(deployment
+            ? { workerAdvertisedUrl: deployment.url, forceRegistration: deployment.force }
+            : {}),
         ...(restateIdentityKeys?.length ? { identityKeys: [...restateIdentityKeys] } : {}),
         ...(options.servicePrefix ? { servicePrefix: options.servicePrefix } : {}),
         ...(options.logger ? { logger: options.logger } : {}),

package/dist/infra/index.d.ts

@@ -36,7 +36,7 @@ export interface Infra {
  * Builds the configured clients. Throws naming the variable when endpoints are
  * incomplete (e.g. a Restate ingress without an admin URL).
  */
-export declare function createInfra(config: Pick<StackConfig, "services" | "endpoints">, options?: {
+export declare function createInfra(config: Pick<StackConfig, "services" | "endpoints" | "listen">, options?: {
     logger?: Logger;
     execution?: CreateExecutionOptions;
     streams?: CreateStreamsOptions;

package/dist/keys/egress-ca.d.ts

@@ -0,0 +1,15 @@
+import type { SessionStore } from "../store/types.js";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export declare const EGRESS_LEAF_MINUTES = 60;
+export declare class EgressAuthority {
+    private readonly store;
+    private readonly kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    private authority;
+    constructor(store: SessionStore, kek: () => Buffer);
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    certificate(): Promise<string>;
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    signLeaf(host: string, publicKey: string): Promise<string>;
+    private load;
+}

package/dist/keys/egress-ca.js

@@ -0,0 +1,66 @@
+/**
+ * The installation's egress CA (R2c, D50, E12): one long-lived certificate authority whose
+ * certificate every pod sandbox trusts, and whose key signs the short-lived leaf egress-gate
+ * presents when it terminates TLS for a host an `environment_secret` is bound to. Only keys holds
+ * the key: it lives in the Tenant setting `egress.ca`, sealed under the vault KEK like a signing
+ * key, beside the certificate in the clear. Created on first use under the signing keys' lock.
+ * No rotation yet (R8, with the KeyRoot seam).
+ */
+import { X509Certificate } from "node:crypto";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { createCertificateAuthority, issueLeafCertificate } from "./x509.js";
+const SETTING = "egress.ca";
+/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
+export const EGRESS_LEAF_MINUTES = 60;
+function aad(certificate) {
+    return Buffer.from(`nylorun.egress-ca:${new X509Certificate(certificate).fingerprint256}`);
+}
+export class EgressAuthority {
+    store;
+    kek;
+    /** The CA with its key, decrypted once per process, as signing keys are. */
+    authority;
+    constructor(store, kek) {
+        this.store = store;
+        this.kek = kek;
+    }
+    /** The CA certificate (PEM), creating the CA when the Tenant has none. */
+    async certificate() {
+        return (await this.load()).certificate;
+    }
+    /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
+    async signLeaf(host, publicKey) {
+        return issueLeafCertificate({ authority: await this.load(), host, publicKey, minutes: EGRESS_LEAF_MINUTES });
+    }
+    async load() {
+        if (this.authority)
+            return this.authority;
+        const kek = this.kek();
+        const stored = await this.store.tx(async (t) => (await read(t)) ?? (await create(t, kek)));
+        const privateKey = decryptSecret(kek, aad(stored.certificate), Buffer.from(stored.nonce, "base64"), Buffer.from(stored.ciphertext, "base64"), Buffer.from(stored.wrappedDek, "base64"), stored.kekId).toString("utf8");
+        this.authority = { certificate: stored.certificate, privateKey };
+        return this.authority;
+    }
+}
+async function read(t) {
+    const value = await t.getSetting(SETTING);
+    return value === undefined ? undefined : JSON.parse(value);
+}
+async function create(t, kek) {
+    // Concurrent first uses would both create a CA: lock, then read what the winner made.
+    await t.lockSigningKeys();
+    const existing = await read(t);
+    if (existing)
+        return existing;
+    const authority = createCertificateAuthority({ commonName: "Nylorun egress CA" });
+    const sealed = encryptSecret(kek, aad(authority.certificate), Buffer.from(authority.privateKey, "utf8"));
+    const stored = {
+        certificate: authority.certificate,
+        kekId: sealed.kekId,
+        nonce: sealed.nonce.toString("base64"),
+        ciphertext: sealed.ciphertext.toString("base64"),
+        wrappedDek: sealed.wrappedDek.toString("base64"),
+    };
+    await t.putSetting(SETTING, JSON.stringify(stored));
+    return stored;
+}

package/dist/keys/keys.d.ts

@@ -32,9 +32,16 @@ export interface Keys {
      * (R2b C12, `mcp/preview.ts`); never calls a tool.
      */
     previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
+    /** The egress CA's certificate (PEM), creating the CA when the Tenant has none (R2c, D50). */
+    egressCa(): Promise<string>;
+    /**
+     * A short-lived leaf for `host` and the caller's P-256 public key (SPKI PEM), signed by the
+     * egress CA (R2c). The leaf's private key never reaches keys; the CA's never leaves it.
+     */
+    signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp"];
+export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -12,6 +12,7 @@
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
  * runtime container's client of the `keys` service in the gateway.
  */
+import { EgressAuthority } from "./egress-ca.js";
 import { SignJWT } from "jose";
 import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
@@ -25,9 +26,12 @@ export const KEYS_OPERATIONS = [
     "rotateSigningKeys",
     "ensureSigningKeys",
     "previewMcp",
+    "egressCa",
+    "signEgressLeaf",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
+    const egress = new EgressAuthority(store, kek);
     return {
         createCredential: (vaultId, body) => vault.createCredential(vaultId, body),
         rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
@@ -52,5 +56,7 @@ export function inProcessKeys(options) {
             await store.tx((t) => signingKeys.ensure(t, key));
         },
         previewMcp: (body) => previewMcpServer(body, { vault, policy: options.policy ?? {} }),
+        egressCa: () => egress.certificate(),
+        signEgressLeaf: (host, publicKey) => egress.signLeaf(host, publicKey),
     };
 }

package/dist/keys/x509.d.ts

@@ -0,0 +1,29 @@
+export interface CertificateAuthority {
+    /** PEM of the CA certificate: the only part a sandbox ever receives. */
+    readonly certificate: string;
+    /** PKCS#8 PEM of the CA key: sealed in the vault, used only by keys. */
+    readonly privateKey: string;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export declare function createCertificateAuthority(options: {
+    readonly commonName: string;
+    readonly days?: number;
+    readonly now?: Date;
+}): CertificateAuthority;
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export declare function issueLeafCertificate(options: {
+    readonly authority: CertificateAuthority;
+    readonly host: string;
+    readonly publicKey: string;
+    readonly minutes?: number;
+    readonly now?: Date;
+}): string;
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export declare function leafKeyPair(): {
+    readonly publicKey: string;
+    readonly privateKey: string;
+};

package/dist/keys/x509.js

@@ -0,0 +1,160 @@
+/**
+ * The two certificates R2c needs (D50), built without a dependency: the installation's egress
+ * CA, and a short-lived leaf for one host name that egress-gate presents when it terminates TLS
+ * for a host an `environment_secret` is bound to. Node can parse X.509 but not build it, so this
+ * writes the DER by hand. Both use ECDSA P-256 with SHA-256.
+ *
+ * Only what clients check is written: a CA with basicConstraints CA:TRUE (critical), keyUsage
+ * keyCertSign and cRLSign (critical) and a subject key identifier; a leaf with the host as its
+ * only subjectAltName, keyUsage digitalSignature (critical), extKeyUsage serverAuth, and the
+ * CA's key identifier. Go (`gh`), OpenSSL (`curl`, `git`), Node and Python accept that shape.
+ */
+import { isIP } from "node:net";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
+const OID = {
+    ecdsaWithSha256: "1.2.840.10045.4.3.2",
+    commonName: "2.5.4.3",
+    organization: "2.5.4.10",
+    basicConstraints: "2.5.29.19",
+    keyUsage: "2.5.29.15",
+    extKeyUsage: "2.5.29.37",
+    serverAuth: "1.3.6.1.5.5.7.3.1",
+    subjectAltName: "2.5.29.17",
+    subjectKeyIdentifier: "2.5.29.14",
+    authorityKeyIdentifier: "2.5.29.35",
+};
+function length(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let v = n; v > 0; v = Math.floor(v / 256))
+        bytes.unshift(v & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function tlv(tag, content) {
+    return Buffer.concat([Buffer.from([tag]), length(content.length), content]);
+}
+const seq = (...items) => tlv(0x30, Buffer.concat(items));
+const set = (...items) => tlv(0x31, Buffer.concat(items));
+const octets = (content) => tlv(0x04, content);
+const bits = (content, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), content]));
+const bool = (value) => tlv(0x01, Buffer.from([value ? 0xff : 0x00]));
+const explicit = (n, content) => tlv(0xa0 + n, content);
+function integer(value) {
+    let v = value;
+    while (v.length > 1 && v[0] === 0 && (v[1] & 0x80) === 0)
+        v = v.subarray(1);
+    if (v[0] & 0x80)
+        v = Buffer.concat([Buffer.from([0]), v]);
+    return tlv(0x02, v);
+}
+function oid(dotted) {
+    const parts = dotted.split(".").map(Number);
+    const out = [40 * parts[0] + parts[1]];
+    for (const part of parts.slice(2)) {
+        const chunk = [part & 0x7f];
+        for (let v = Math.floor(part / 128); v > 0; v = Math.floor(v / 128))
+            chunk.unshift((v & 0x7f) | 0x80);
+        out.push(...chunk);
+    }
+    return tlv(0x06, Buffer.from(out));
+}
+function name(fields) {
+    const rdns = [set(seq(oid(OID.commonName), tlv(0x0c, Buffer.from(fields.commonName, "utf8"))))];
+    if (fields.organization)
+        rdns.unshift(set(seq(oid(OID.organization), tlv(0x0c, Buffer.from(fields.organization, "utf8")))));
+    return seq(...rdns);
+}
+/** UTCTime before 2050, GeneralizedTime from then on (RFC 5280 §4.1.2.5). */
+function time(at) {
+    const iso = at.toISOString().replace(/[-:T]/g, "").slice(0, 14) + "Z";
+    return at.getUTCFullYear() < 2050 ? tlv(0x17, Buffer.from(iso.slice(2), "ascii")) : tlv(0x18, Buffer.from(iso, "ascii"));
+}
+function extension(id, critical, value) {
+    return critical ? seq(oid(id), bool(true), octets(value)) : seq(oid(id), octets(value));
+}
+function spki(key) {
+    return key.export({ type: "spki", format: "der" });
+}
+/** SHA-1 of the subjectPublicKey bits (RFC 5280 §4.2.1.2, method 1). */
+function keyIdentifier(publicKey) {
+    const der = spki(publicKey);
+    // The SPKI is SEQUENCE { AlgorithmIdentifier, BIT STRING }; for P-256 the key is its last 65 bytes.
+    return createHash("sha1").update(der.subarray(der.length - 65)).digest();
+}
+function serial() {
+    const value = randomBytes(16);
+    value[0] = value[0] & 0x7f;
+    return integer(value);
+}
+function certificate(tbs, issuerKey) {
+    const algorithm = seq(oid(OID.ecdsaWithSha256));
+    const signature = sign("sha256", tbs, issuerKey);
+    return seq(tbs, algorithm, bits(signature));
+}
+function pem(der) {
+    const body = der.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
+    return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----\n`;
+}
+/** A new P-256 CA, valid from an hour ago for `days` days. */
+export function createCertificateAuthority(options) {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const now = options.now ?? new Date();
+    const subject = name({ commonName: options.commonName, organization: "Nylorun" });
+    const ski = keyIdentifier(publicKey);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subject, seq(time(new Date(now.getTime() - 3_600_000)), time(new Date(now.getTime() + (options.days ?? 3650) * 86_400_000))), subject, spki(publicKey), explicit(3, seq(extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))), extension(OID.keyUsage, true, bits(Buffer.from([0x06]), 1)), extension(OID.subjectKeyIdentifier, false, octets(ski)))));
+    return {
+        certificate: pem(certificate(tbs, privateKey)),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/**
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
+ * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * certificate comes back, so no private key leaves whoever holds it.
+ */
+export function issueLeafCertificate(options) {
+    if (isIP(options.host) !== 0 || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(options.host))
+        throw new Error(`Not a host name: ${options.host}`);
+    const caKey = createPrivateKey(options.authority.privateKey);
+    const ca = new X509Certificate(options.authority.certificate);
+    const publicKey = createPublicKey(options.publicKey);
+    if (publicKey.asymmetricKeyType !== "ec" || publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1")
+        throw new Error("A leaf key must be ECDSA P-256");
+    const now = options.now ?? new Date();
+    const issuer = Buffer.from(ca.raw);
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subjectOf(issuer), seq(time(new Date(now.getTime() - 300_000)), time(new Date(now.getTime() + (options.minutes ?? 60) * 60_000))), name({ commonName: options.host }), spki(publicKey), explicit(3, seq(extension(OID.keyUsage, true, bits(Buffer.from([0x80]), 7)), extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))), extension(OID.subjectAltName, false, seq(tlv(0x82, Buffer.from(options.host, "ascii")))), extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(ca.publicKey)))))));
+    return pem(certificate(tbs, caKey));
+}
+/** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */
+export function leafKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    return {
+        publicKey: publicKey.export({ type: "spki", format: "pem" }).toString(),
+        privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/** The subject Name of a DER certificate, byte for byte, to use as a leaf's issuer. */
+function subjectOf(der) {
+    // Certificate ::= SEQUENCE { tbs SEQUENCE { [0] version, serial, sigAlg, issuer, validity, subject, … } }
+    const read = (buf, at) => {
+        let len = buf[at + 1];
+        let header = 2;
+        if (len & 0x80) {
+            const n = len & 0x7f;
+            len = 0;
+            for (let i = 0; i < n; i++)
+                len = len * 256 + buf[at + 2 + i];
+            header += n;
+        }
+        return { start: at, header, end: at + header + len };
+    };
+    const cert = read(der, 0);
+    const tbs = read(der, cert.start + cert.header);
+    // TBSCertificate fields: [0] version, serial, signature, issuer, validity, subject.
+    let at = tbs.start + tbs.header;
+    for (let field = 0; field < 5; field++)
+        at = read(der, at).end;
+    const subject = read(der, at);
+    return der.subarray(subject.start, subject.end);
+}