@nylorun/runtime 0.22.0-beta → 0.24.0-beta

package/dist/host/stack-config.js

@@ -36,8 +36,14 @@
  * The Postgres, Restate and S2 endpoints are parsed and validated here;
  * `infra/*` builds the clients from them. So is the Object store (`NYLORUN_OBJECT_STORE_*`),
  * which every service may read; `host/main.ts` builds the `BlobStore` from it. So is who the Host's Tenant is when its database
- * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`).
+ * holds none yet (`NYLORUN_TENANT_ID`, `NYLORUN_TENANT_NAME`). So are traces (R7.2), for a
+ * process running core: where they go (`OTEL_EXPORTER_OTLP_ENDPOINT`, or
+ * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
+ * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
+ * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
  */
+import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
+import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
@@ -281,6 +287,12 @@ export function parseStackConfig(env, argv) {
     const workerUrl = parseUrl(env, "NYLORUN_WORKER_URL", http);
     if (workerUrl)
         endpoints.workerUrl = workerUrl;
+    const workerVersion = read(env, "NYLORUN_WORKER_VERSION");
+    if (workerVersion !== undefined) {
+        if (!/^[A-Za-z0-9._-]{1,64}$/.test(workerVersion))
+            throw new StackConfigError("NYLORUN_WORKER_VERSION must be 1 to 64 letters, digits, `.`, `_` or `-` (it is a URL path segment)");
+        endpoints.workerVersion = workerVersion;
+    }
     const s2Endpoint = parseUrl(env, "NYLORUN_S2_ENDPOINT", http);
     if (s2Endpoint)
         endpoints.s2Endpoint = s2Endpoint;
@@ -310,6 +322,7 @@ export function parseStackConfig(env, argv) {
     const delivery = parseDelivery(env);
     const tenant = servesApi ? parseTenant(env) : undefined;
     const objectStore = parseObjectStore(env);
+    const traces = services.has("core") ? parseTraces(env) : undefined;
     const removedResolverVariables = Object.keys(env)
         .filter((name) => name.startsWith(REMOVED_RESOLVER_PREFIX) && read(env, name) !== undefined)
         .sort();
@@ -331,8 +344,61 @@ export function parseStackConfig(env, argv) {
         ...(delivery ? { delivery } : {}),
         ...(tenant ? { tenant } : {}),
         ...(objectStore ? { objectStore } : {}),
+        ...(traces ? { traces } : {}),
     };
 }
+/**
+ * `StackConfig.traces` (R7.2). The OTLP endpoint is the collector's base URL, to which
+ * `/v1/traces` is added; `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` is the full URL and wins. Headers
+ * and resource attributes are `key=value` lists separated by commas, values percent-encoded (the
+ * OTel SDK environment specification).
+ */
+function parseTraces(env) {
+    const traces = parseUrl(env, "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", ["http:", "https:"]);
+    const base = parseUrl(env, "OTEL_EXPORTER_OTLP_ENDPOINT", ["http:", "https:"]);
+    const url = traces ?? (base === undefined ? undefined : `${base.replace(/\/+$/, "")}/v1/traces`);
+    const resource = keyValues(env, "OTEL_RESOURCE_ATTRIBUTES");
+    const all = read(env, "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT")?.toLowerCase() === "true";
+    const content = new Set(all ? TRACE_CONTENT_KINDS : []);
+    for (const kind of (read(env, "NYLORUN_TRACE_CONTENT") ?? "").split(",").map((part) => part.trim())) {
+        if (kind === "")
+            continue;
+        if (!TRACE_CONTENT_KINDS.includes(kind))
+            throw new StackConfigError(`NYLORUN_TRACE_CONTENT lists ${TRACE_CONTENT_KINDS.join(", ")}, not ${kind}`);
+        content.add(kind);
+    }
+    const serviceName = read(env, "OTEL_SERVICE_NAME") ?? resource["service.name"];
+    // Nothing set: the defaults (`service.name` nylorun, no content, no export).
+    if (url === undefined && serviceName === undefined && Object.keys(resource).length === 0 && content.size === 0)
+        return undefined;
+    return {
+        resource: {
+            serviceName: serviceName ?? DEFAULT_SERVICE_NAME,
+            attributes: resource,
+        },
+        content: TRACE_CONTENT_KINDS.filter((kind) => content.has(kind)),
+        ...(url ? { export: { url, headers: keyValues(env, "OTEL_EXPORTER_OTLP_HEADERS") } } : {}),
+    };
+}
+/** A `key=value,key=value` variable, values percent-decoded; a malformed one is refused. */
+function keyValues(env, name) {
+    const out = {};
+    for (const pair of (read(env, name) ?? "").split(",")) {
+        if (pair.trim() === "")
+            continue;
+        const at = pair.indexOf("=");
+        const key = at < 0 ? "" : pair.slice(0, at).trim();
+        if (key === "")
+            throw new StackConfigError(`${name} must be key=value pairs separated by commas`);
+        try {
+            out[key] = decodeURIComponent(pair.slice(at + 1).trim());
+        }
+        catch {
+            throw new StackConfigError(`${name} has a value that is not percent-encoded: ${key}`);
+        }
+    }
+    return out;
+}
 /** S3 bucket names: 3 to 63 lowercase letters, digits, dots and hyphens. */
 const BUCKET = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
 /** `StackConfig.objectStore` from `NYLORUN_OBJECT_STORE_*`, or `undefined` without an endpoint. */

package/dist/infra/execution.d.ts

@@ -29,7 +29,24 @@ export declare function executionKind(config: Pick<StackConfig, "endpoints">): "
 export declare function validateExecutionConfig(config: Pick<StackConfig, "endpoints"> & {
     services?: RuntimeServices;
 }): void;
-export declare function createExecution(config: Pick<StackConfig, "endpoints"> & {
+/**
+ * The deployment a Worker registers with Restate (§14.6): `<NYLORUN_WORKER_URL>/nylorun/<version>`,
+ * the version being `NYLORUN_WORKER_VERSION` or the Runtime's. Restate sends new invocations to
+ * the latest deployment of a service and keeps each running invocation on the deployment it
+ * started on, so during a rolling upgrade the Workers of one version share that version's
+ * deployment (behind one load-balanced `NYLORUN_WORKER_URL`) and the old one finishes what it
+ * started; the endpoint answers on any path, so an older deployment's URL still reaches it.
+ * `force` replaces a deployment already registered at the URL with different code: only
+ * outside a container (a development Host, whose code changes under one version). Without
+ * it Restate keeps the deployment it already has at the URL, and a Worker whose services that
+ * deployment lacks refuses to start: a build whose code changed under the same version sets
+ * its own `NYLORUN_WORKER_VERSION`.
+ */
+export declare function workerDeployment(config: Pick<StackConfig, "endpoints" | "listen">): {
+    url: string;
+    force: boolean;
+} | undefined;
+export declare function createExecution(config: Pick<StackConfig, "endpoints" | "listen"> & {
     services?: RuntimeServices;
 }, options?: CreateExecutionOptions): DurableExecution;
 /**

package/dist/infra/execution.js

@@ -8,8 +8,8 @@
  * - wakes, timers and sweep arming go through the ingress, so every process can
  *   call them;
  * - a Worker (a process running the loop service) serves the Restate endpoint on
- *   `0.0.0.0:9080` and registers `NYLORUN_WORKER_URL` with the admin API when
- *   `infra/workers.ts` starts it;
+ *   `0.0.0.0:9080` and registers it with the admin API when `infra/workers.ts` starts it,
+ *   as a versioned deployment (`workerDeployment`);
  * - with `NYLORUN_RESTATE_IDENTITY_KEY` the endpoint accepts only requests
  *   signed by the Restate server holding the matching private key.
  *
@@ -17,6 +17,7 @@
  * only unit tests and a local development Host use.
  */
 import { createRestateExecution } from "../adapters/execution/restate.js";
+import { RUNTIME_VERSION } from "../version.js";
 import { MemoryExecution } from "../execution/memory.js";
 import { DEFAULT_SERVICES, describeServices, } from "../host/stack-config.js";
 /** Where a Worker serves the Restate endpoint (architecture §14.3). */
@@ -46,16 +47,39 @@ export function validateExecutionConfig(config) {
     if (services.has("loop") && !workerUrl)
         throw new Error(`NYLORUN_WORKER_URL is required for --service ${describeServices(services)}: the Worker endpoint URL Restate calls`);
 }
+/**
+ * The deployment a Worker registers with Restate (§14.6): `<NYLORUN_WORKER_URL>/nylorun/<version>`,
+ * the version being `NYLORUN_WORKER_VERSION` or the Runtime's. Restate sends new invocations to
+ * the latest deployment of a service and keeps each running invocation on the deployment it
+ * started on, so during a rolling upgrade the Workers of one version share that version's
+ * deployment (behind one load-balanced `NYLORUN_WORKER_URL`) and the old one finishes what it
+ * started; the endpoint answers on any path, so an older deployment's URL still reaches it.
+ * `force` replaces a deployment already registered at the URL with different code: only
+ * outside a container (a development Host, whose code changes under one version). Without
+ * it Restate keeps the deployment it already has at the URL, and a Worker whose services that
+ * deployment lacks refuses to start: a build whose code changed under the same version sets
+ * its own `NYLORUN_WORKER_VERSION`.
+ */
+export function workerDeployment(config) {
+    const { workerUrl, workerVersion } = config.endpoints;
+    if (!workerUrl)
+        return undefined;
+    const version = encodeURIComponent(workerVersion ?? RUNTIME_VERSION);
+    return { url: `${workerUrl.replace(/\/+$/, "")}/nylorun/${version}`, force: !config.listen };
+}
 export function createExecution(config, options = {}) {
     validateExecutionConfig(config);
-    const { restateIngressUrl, restateAdminUrl, workerUrl, restateIdentityKeys } = config.endpoints;
+    const { restateIngressUrl, restateAdminUrl, restateIdentityKeys } = config.endpoints;
     if (!restateIngressUrl || !restateAdminUrl)
         return new MemoryExecution();
+    const deployment = workerDeployment(config);
     return createRestateExecution({
         ingressUrl: restateIngressUrl,
         adminUrl: restateAdminUrl,
         workerListen: options.workerListen ?? { ...WORKER_LISTEN },
-        ...(workerUrl ? { workerAdvertisedUrl: workerUrl } : {}),
+        ...(deployment
+            ? { workerAdvertisedUrl: deployment.url, forceRegistration: deployment.force }
+            : {}),
         ...(restateIdentityKeys?.length ? { identityKeys: [...restateIdentityKeys] } : {}),
         ...(options.servicePrefix ? { servicePrefix: options.servicePrefix } : {}),
         ...(options.logger ? { logger: options.logger } : {}),

package/dist/infra/index.d.ts

@@ -36,7 +36,7 @@ export interface Infra {
  * Builds the configured clients. Throws naming the variable when endpoints are
  * incomplete (e.g. a Restate ingress without an admin URL).
  */
-export declare function createInfra(config: Pick<StackConfig, "services" | "endpoints">, options?: {
+export declare function createInfra(config: Pick<StackConfig, "services" | "endpoints" | "listen">, options?: {
     logger?: Logger;
     execution?: CreateExecutionOptions;
     streams?: CreateStreamsOptions;

package/dist/keys/client.js

@@ -51,7 +51,10 @@ export function httpKeys(options) {
                         return resolve(answer.result);
                     const error = answer.error;
                     reject(error.kind === "vault"
-                        ? new VaultError(error.status, error.message)
+                        ? new VaultError(error.status, error.message, {
+                            ...(error.code === undefined ? {} : { code: error.code }),
+                            ...(error.details === undefined ? {} : { details: error.details }),
+                        })
                         : new HttpError(error.status, error.message, {
                             ...(error.code === undefined ? {} : { code: error.code }),
                             ...(error.details === undefined ? {} : { details: error.details }),

package/dist/keys/keys.d.ts

@@ -1,4 +1,4 @@
-import type { CreateCredentialRequest, CredentialInfo, HostModelView, McpPreview, McpPreviewRequest, PutHostModelRequest, RotateCredentialRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
+import type { EnvironmentSecretView, HostModelView, McpPreview, McpPreviewRequest, PutEnvironmentSecretRequest, PutHostModelRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
@@ -14,8 +14,8 @@ export interface Signed {
     readonly keyId: string;
 }
 export interface Keys {
-    createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>;
-    rotateCredential(vaultId: string, id: string, body: RotateCredentialRequest): Promise<CredentialInfo>;
+    /** `PUT /v1/environments/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
     /** Signs with the current key, creating the Tenant's keys if it has none. */
@@ -28,7 +28,7 @@ export interface Keys {
     /** Creates the current and standby keys when the Tenant has none. */
     ensureSigningKeys(): Promise<void>;
     /**
-     * Lists a remote MCP server's tools with the installation vault's credential for its URL
+     * Lists a remote MCP server's tools with the Environment's credential for its URL
      * (R2b C12, `mcp/preview.ts`); never calls a tool.
      */
     previewMcp(body: McpPreviewRequest): Promise<McpPreview>;
@@ -41,7 +41,7 @@ export interface Keys {
     signEgressLeaf(host: string, publicKey: string): Promise<string>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["createCredential", "rotateCredential", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
+export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -1,12 +1,12 @@
 /**
  * The keys seam (blueprint §14, F4.2): everything that needs the vault key. Vault writes that
- * touch a secret (creating and rotating a credential, setting and selecting the host model;
+ * touch a secret (writing an Environment's secret, setting and selecting the host model;
  * rotation and selection decrypt the old secret first) and all token signing (capability
  * links, run and host tokens, signing-key rotation) run here, whole, so the process that calls them never
  * holds the key or a private signing key.
  *
- * A tool preview (R2b C12, `previewMcp`) runs here too: it sends an installation vault's
- * credential to the server it lists, so the process that reads the plaintext makes the request.
+ * A tool preview (R2b C12, `previewMcp`) runs here too: it sends an Environment's credential to
+ * the server it lists, so the process that reads the plaintext makes the request.
  *
  * Two implementations: `inProcessKeys` (embedding, the ephemeral Runtime, tests, and the gates
  * service itself, which serves the HTTP routes with it), and `httpKeys` (`client.ts`), the
@@ -18,8 +18,7 @@ import { previewMcpServer } from "../mcp/preview.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
 /** The operations, by the name the HTTP route carries. */
 export const KEYS_OPERATIONS = [
-    "createCredential",
-    "rotateCredential",
+    "putEnvironmentSecret",
     "putHostModel",
     "selectHostModel",
     "sign",
@@ -33,8 +32,7 @@ export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
     const egress = new EgressAuthority(store, kek);
     return {
-        createCredential: (vaultId, body) => vault.createCredential(vaultId, body),
-        rotateCredential: (vaultId, id, body) => vault.rotateCredential(vaultId, id, body),
+        putEnvironmentSecret: (environmentId, name, body, actor) => vault.putEnvironmentSecret(environmentId, name, body, actor),
         putHostModel: (body) => vault.putHostModel(body),
         selectHostModel: (body) => vault.selectHostModel(body),
         async sign(request) {