@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/host/stack-config.js

@@ -41,11 +41,14 @@
  * `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`, with `OTEL_EXPORTER_OTLP_HEADERS`), what they say of
  * their source (`OTEL_SERVICE_NAME`, `OTEL_RESOURCE_ATTRIBUTES`) and which content they carry
  * (`NYLORUN_TRACE_CONTENT`, or all of it with `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true`).
+ * So is the Host tuning (`NYLORUN_TUNING`, `tuning.ts`), for every service: its timings,
+ * retries and internal sizes.
  */
 import { DEFAULT_SERVICE_NAME } from "../traces/otlp.js";
 import { TRACE_CONTENT_KINDS } from "../traces/map.js";
 import { isTenantId } from "@nylorun/core/compatibility";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
+import { HostTuningError, parseHostTuning } from "../tuning.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -254,8 +257,9 @@ function parseIdentityKeys(env) {
 /** Parse the stack configuration; throws `StackConfigError` naming the variable. */
 export function parseStackConfig(env, argv) {
     const { services, deprecatedRole } = parseServices(argv);
+    const tuning = parseTuning(env);
     if (services.has("harness"))
-        return { services, harness: parseHarnessService(env), endpoints: {} };
+        return { services, harness: parseHarnessService(env), endpoints: {}, ...(tuning ? { tuning } : {}) };
     // The image sets NYLORUN_LISTEN_*: only the API's processes read them.
     const servesApi = services.has("core") || services.has("loop");
     const listen = servesApi ? parseListen(env) : undefined;
@@ -345,8 +349,24 @@ export function parseStackConfig(env, argv) {
         ...(tenant ? { tenant } : {}),
         ...(objectStore ? { objectStore } : {}),
         ...(traces ? { traces } : {}),
+        ...(tuning ? { tuning } : {}),
     };
 }
+/** `StackConfig.tuning` from `NYLORUN_TUNING`, or undefined when it is unset. */
+function parseTuning(env) {
+    const raw = read(env, "NYLORUN_TUNING");
+    if (raw === undefined)
+        return undefined;
+    try {
+        const { tuning, overrides } = parseHostTuning(raw);
+        return { values: tuning, overrides: overrides ?? {} };
+    }
+    catch (error) {
+        if (error instanceof HostTuningError)
+            throw new StackConfigError(error.message);
+        throw error;
+    }
+}
 /**
  * `StackConfig.traces` (R7.2). The OTLP endpoint is the collector's base URL, to which
  * `/v1/traces` is added; `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` is the full URL and wins. Headers

package/dist/index.d.ts

@@ -5,7 +5,6 @@ export { createTrustedIssuers, type TrustedIssuers, type TrustedIssuersOptions,
 export type { TenantConfig, TenantHandle, TenantPaths, Logger, OpenTenantRuntime, } from "./tenant/types.js";
 export { scriptedModel, gatewayModel, type ModelProvider } from "./core/provider.js";
 export type { RuntimeAgent } from "./contracts.js";
-export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export type { RuntimeModelAdapter } from "./contracts.js";
 export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";
 export type { HostProcessPathInputs } from "./host/environment.js";

package/dist/index.js

@@ -3,5 +3,4 @@ export { startEphemeralRuntime, } from "./tenant/ephemeral.js";
 export { parseIdentityFile, IdentityFileError, } from "./tenant/identity-file.js";
 export { createTrustedIssuers, } from "./tenant/issuers.js";
 export { scriptedModel, gatewayModel } from "./core/provider.js";
-export { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "./media.js";
 export { baselineEnvironment, hostProcessEnvironment, } from "./host/environment.js";

package/dist/infra/index.js

@@ -2,6 +2,7 @@ import { createDatabase } from "./database.js";
 import { createExecution, executionKind } from "./execution.js";
 import { createReadiness, infraProbes } from "./readiness.js";
 import { createStreams, streamsKind } from "./streams.js";
+import { hostTuning } from "../tuning.js";
 export { createDatabase, probeDatabase } from "./database.js";
 export { createExecution, probeExecution, WORKER_LISTEN } from "./execution.js";
 export { createReadiness, infraProbes } from "./readiness.js";
@@ -30,7 +31,7 @@ export function createInfra(config, options = {}) {
         ...(streams ? { streams } : {}),
         ...(readiness ? { readiness } : {}),
         async close() {
-            await Promise.allSettled([database?.end({ timeout: 5 }), streams?.close()]);
+            await Promise.allSettled([database?.end({ timeout: hostTuning().postgres.closeTimeoutSeconds }), streams?.close()]);
         },
     };
 }

package/dist/infra/readiness.d.ts

@@ -21,8 +21,6 @@ export interface ReadinessReport {
     errors: Record<string, string>;
 }
 export type Readiness = () => Promise<ReadinessReport>;
-/** Default bound on one readiness pass. Compose probes `/ready` every 2 s with a 5 s timeout. */
-export declare const READINESS_TIMEOUT_MS = 2000;
 export declare function createReadiness(probes: Readonly<Record<string, Probe>>, options?: {
     timeoutMs?: number;
 }): Readiness;

package/dist/infra/readiness.js

@@ -1,9 +1,10 @@
 import { probeDatabase } from "./database.js";
 import { probeExecution } from "./execution.js";
-/** Default bound on one readiness pass. Compose probes `/ready` every 2 s with a 5 s timeout. */
-export const READINESS_TIMEOUT_MS = 2000;
+import { hostTuning } from "../tuning.js";
 export function createReadiness(probes, options = {}) {
-    const timeoutMs = options.timeoutMs ?? READINESS_TIMEOUT_MS;
+    // The bound on one pass: `host.readinessTimeoutMs` (Host tuning). Compose probes `/ready` every
+    // 2 s with a 5 s timeout.
+    const timeoutMs = options.timeoutMs ?? hostTuning().host.readinessTimeoutMs;
     return async () => {
         const entries = Object.entries(probes);
         const results = await Promise.all(entries.map(async ([name, probe]) => [name, await runProbe(probe, timeoutMs)]));

package/dist/keys/client.d.ts

@@ -4,6 +4,7 @@ export interface HttpKeysOptions {
     readonly url: string;
     /** `NYLORUN_GATES_TOKEN`. */
     readonly token: string;
+    /** Default `keys.timeoutMs` (Host tuning): signing and vault writes are short. */
     readonly timeoutMs?: number;
 }
 export declare function httpKeys(options: HttpKeysOptions): Keys;

package/dist/keys/client.js

@@ -10,12 +10,11 @@ import { HttpError } from "../tenant/http.js";
 import { VaultError } from "../vault/error.js";
 import { KEYS_PATH } from "./contract.js";
 import { KEYS_OPERATIONS } from "./keys.js";
-/** Signing and vault writes are short; anything slower is a gateway in trouble. */
-const KEYS_TIMEOUT_MS = 30_000;
+import { hostTuning } from "../tuning.js";
 export function httpKeys(options) {
     const where = new URL(options.url).origin;
     function call(operation, args) {
-        const timeoutMs = options.timeoutMs ?? KEYS_TIMEOUT_MS;
+        const timeoutMs = options.timeoutMs ?? hostTuning().keys.timeoutMs;
         const url = new URL(`${KEYS_PATH}/${operation}`, options.url);
         const send = url.protocol === "https:" ? httpsRequest : httpRequest;
         const payload = Buffer.from(JSON.stringify({ args }), "utf8");

package/dist/keys/contract.d.ts

@@ -8,8 +8,6 @@
  * exactly what it answered when the operation ran in its own process.
  */
 export declare const KEYS_PATH = "/nylorun/v1/keys";
-/** Largest request body: a credential with its secret, or a token's claims. */
-export declare const MAX_KEYS_BODY_BYTES: number;
 export interface KeysError {
     readonly kind: "vault" | "http";
     readonly status: number;

package/dist/keys/contract.js

@@ -8,5 +8,3 @@
  * exactly what it answered when the operation ran in its own process.
  */
 export const KEYS_PATH = "/nylorun/v1/keys";
-/** Largest request body: a credential with its secret, or a token's claims. */
-export const MAX_KEYS_BODY_BYTES = 1024 * 1024;

package/dist/keys/egress-ca.d.ts

@@ -1,6 +1,4 @@
 import type { SessionStore } from "../store/types.js";
-/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
-export declare const EGRESS_LEAF_MINUTES = 60;
 export declare class EgressAuthority {
     private readonly store;
     private readonly kek;

package/dist/keys/egress-ca.js

@@ -10,8 +10,6 @@ import { X509Certificate } from "node:crypto";
 import { decryptSecret, encryptSecret } from "../vault/crypto.js";
 import { createCertificateAuthority, issueLeafCertificate } from "./x509.js";
 const SETTING = "egress.ca";
-/** How long a leaf egress-gate presents is valid: one connection rarely lasts this long. */
-export const EGRESS_LEAF_MINUTES = 60;
 function aad(certificate) {
     return Buffer.from(`nylorun.egress-ca:${new X509Certificate(certificate).fingerprint256}`);
 }
@@ -30,7 +28,8 @@ export class EgressAuthority {
     }
     /** A leaf for `host` and the caller's P-256 public key (SPKI PEM); the caller keeps its key. */
     async signLeaf(host, publicKey) {
-        return issueLeafCertificate({ authority: await this.load(), host, publicKey, minutes: EGRESS_LEAF_MINUTES });
+        // Valid for `keys.leafLifetimeMs` (Host tuning): one connection rarely lasts this long.
+        return issueLeafCertificate({ authority: await this.load(), host, publicKey });
     }
     async load() {
         if (this.authority)

package/dist/keys/keys.d.ts

@@ -1,4 +1,4 @@
-import type { EnvironmentSecretView, HostModelView, McpPreview, McpPreviewRequest, PutEnvironmentSecretRequest, PutHostModelRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
+import type { AgentSecretView, HostModelView, McpPreview, McpPreviewRequest, PutAgentSecretRequest, PutHostModelRequest, SelectHostModelRequest, SigningKeyView } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import type { OutboundPolicy } from "../tenant/outbound.js";
 import { type SigningKeys } from "../tenant/signing-keys.js";
@@ -13,9 +13,10 @@ export interface Signed {
     /** The signing key's id, the token's `kid`. */
     readonly keyId: string;
 }
+import { type SealedWebhookSecret, type WebhookDelivery } from "./webhooks.js";
 export interface Keys {
-    /** `PUT /v1/environments/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
-    putEnvironmentSecret(environmentId: string, name: string, body: PutEnvironmentSecretRequest, actor: string): Promise<EnvironmentSecretView>;
+    /** `PUT /v1/agents/{id}/secrets/{name}` (`VaultService.putEnvironmentSecret`). */
+    putEnvironmentSecret(environmentId: string, name: string, body: PutAgentSecretRequest, actor: string): Promise<AgentSecretView>;
     putHostModel(body: PutHostModelRequest): Promise<HostModelView>;
     selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>;
     /**
@@ -46,9 +47,19 @@ export interface Keys {
      * egress CA (R2c). The leaf's private key never reaches keys; the CA's never leaves it.
      */
     signEgressLeaf(host: string, publicKey: string): Promise<string>;
+    /**
+     * A new Standard Webhooks secret for Agent `agentId`'s trigger `triggerId` (track T4, D75), and
+     * the same sealed with the vault key for the trigger's row. The secret leaves keys this once.
+     */
+    makeWebhookSecret(agentId: string, triggerId: string): Promise<{
+        secret: string;
+        sealed: SealedWebhookSecret;
+    }>;
+    /** Whether a delivery to that trigger carries a signature its sealed secret made. */
+    verifyWebhook(agentId: string, triggerId: string, sealed: SealedWebhookSecret, delivery: WebhookDelivery): Promise<boolean>;
 }
 /** The operations, by the name the HTTP route carries. */
-export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sealEnvironmentSecretCopies", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf"];
+export declare const KEYS_OPERATIONS: readonly ["putEnvironmentSecret", "putHostModel", "selectHostModel", "sealEnvironmentSecretCopies", "sign", "rotateSigningKeys", "ensureSigningKeys", "previewMcp", "egressCa", "signEgressLeaf", "makeWebhookSecret", "verifyWebhook"];
 export type KeysOperation = (typeof KEYS_OPERATIONS)[number];
 export interface InProcessKeysOptions {
     readonly store: SessionStore;

package/dist/keys/keys.js

@@ -16,7 +16,10 @@
 import { EgressAuthority } from "./egress-ca.js";
 import { SignJWT } from "jose";
 import { previewMcpServer } from "../mcp/preview.js";
+import { readRuntimeLimits } from "../tenant/runtime-limits.js";
 import { signingKeyView } from "../tenant/signing-keys.js";
+import { makeWebhookSecret, verifyWebhook } from "./webhooks.js";
+import { VaultCryptoError } from "../vault/crypto.js";
 /** The operations, by the name the HTTP route carries. */
 export const KEYS_OPERATIONS = [
     "putEnvironmentSecret",
@@ -29,6 +32,8 @@ export const KEYS_OPERATIONS = [
     "previewMcp",
     "egressCa",
     "signEgressLeaf",
+    "makeWebhookSecret",
+    "verifyWebhook",
 ];
 export function inProcessKeys(options) {
     const { store, vault, signingKeys, kek } = options;
@@ -56,8 +61,24 @@ export function inProcessKeys(options) {
             const key = kek();
             await store.tx((t) => signingKeys.ensure(t, key));
         },
-        previewMcp: (body) => previewMcpServer(body, { vault, policy: options.policy ?? {} }),
+        previewMcp: async (body) => previewMcpServer(body, {
+            vault,
+            policy: options.policy ?? {},
+            limits: await store.tx((t) => readRuntimeLimits(t)),
+        }),
         egressCa: () => egress.certificate(),
         signEgressLeaf: (host, publicKey) => egress.signLeaf(host, publicKey),
+        makeWebhookSecret: async (agentId, triggerId) => makeWebhookSecret(kek(), agentId, triggerId),
+        verifyWebhook: async (agentId, triggerId, sealed, delivery) => {
+            try {
+                return verifyWebhook(kek(), agentId, triggerId, sealed, delivery);
+            }
+            catch (error) {
+                // A secret sealed with another vault key, or not one: it verifies nothing.
+                if (error instanceof VaultCryptoError)
+                    return false;
+                throw error;
+            }
+        },
     };
 }

package/dist/keys/webhooks.d.ts

@@ -0,0 +1,25 @@
+/** A secret sealed with the vault key, as the trigger's row keeps it. */
+export interface SealedWebhookSecret {
+    readonly nonce: string;
+    readonly ciphertext: string;
+    readonly wrappedDek: string;
+    readonly kekId: string;
+}
+/** What a delivery says, as it arrived: its headers, and its body in base64. */
+export interface WebhookDelivery {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly signature: string;
+    readonly body: string;
+}
+/** A new secret for Agent `agentId`'s trigger `triggerId`, and the same sealed for its row. */
+export declare function makeWebhookSecret(kek: Buffer, agentId: string, triggerId: string): {
+    secret: string;
+    sealed: SealedWebhookSecret;
+};
+/** The signature of `delivery`'s id, timestamp and body with `key` (base64). */
+export declare function signWebhook(key: Buffer, id: string, timestamp: string, body: Buffer): string;
+/** The key bytes of a `whsec_` secret. */
+export declare function webhookKeyOf(secret: string): Buffer;
+/** Whether `delivery` carries a signature the sealed secret made. */
+export declare function verifyWebhook(kek: Buffer, agentId: string, triggerId: string, sealed: SealedWebhookSecret, delivery: WebhookDelivery): boolean;

package/dist/keys/webhooks.js

@@ -0,0 +1,62 @@
+/**
+ * Webhook signing secrets (track T4, D75): the keys service makes a trigger's Standard Webhooks
+ * secret, seals it with the Tenant's vault key for the trigger's row, and is the only place that
+ * opens it, to verify a delivery. The secret leaves keys once, when it is made, for its owner.
+ *
+ * Standard Webhooks (https://www.standardwebhooks.com): the secret is `whsec_` and the base64 of
+ * its key bytes; a delivery's `webhook-signature` is space-separated `v1,<base64>` entries, each an
+ * HMAC-SHA256 with the key over `<webhook-id>.<webhook-timestamp>.<body>`. One that matches, in
+ * constant time, verifies it. The timestamp's tolerance is the route's to check.
+ */
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+/** The Standard Webhooks secret format: the prefix, and 32 random bytes of key. */
+const SECRET_PREFIX = "whsec_";
+const SECRET_BYTES = 32;
+const aadOf = (agentId, triggerId) => Buffer.from(`nylorun-webhook:${agentId}:${triggerId}`, "utf8");
+/** A new secret for Agent `agentId`'s trigger `triggerId`, and the same sealed for its row. */
+export function makeWebhookSecret(kek, agentId, triggerId) {
+    const key = randomBytes(SECRET_BYTES);
+    try {
+        const sealed = encryptSecret(kek, aadOf(agentId, triggerId), key);
+        return {
+            secret: `${SECRET_PREFIX}${key.toString("base64")}`,
+            sealed: {
+                nonce: sealed.nonce.toString("base64"),
+                ciphertext: sealed.ciphertext.toString("base64"),
+                wrappedDek: sealed.wrappedDek.toString("base64"),
+                kekId: sealed.kekId,
+            },
+        };
+    }
+    finally {
+        key.fill(0);
+    }
+}
+/** The signature of `delivery`'s id, timestamp and body with `key` (base64). */
+export function signWebhook(key, id, timestamp, body) {
+    return createHmac("sha256", key).update(`${id}.${timestamp}.`).update(body).digest("base64");
+}
+/** The key bytes of a `whsec_` secret. */
+export function webhookKeyOf(secret) {
+    return Buffer.from(secret.startsWith(SECRET_PREFIX) ? secret.slice(SECRET_PREFIX.length) : secret, "base64");
+}
+/** Whether `delivery` carries a signature the sealed secret made. */
+export function verifyWebhook(kek, agentId, triggerId, sealed, delivery) {
+    const key = decryptSecret(kek, aadOf(agentId, triggerId), Buffer.from(sealed.nonce, "base64"), Buffer.from(sealed.ciphertext, "base64"), Buffer.from(sealed.wrappedDek, "base64"), sealed.kekId);
+    try {
+        const expected = Buffer.from(signWebhook(key, delivery.id, delivery.timestamp, Buffer.from(delivery.body, "base64")), "base64");
+        for (const entry of delivery.signature.split(" ")) {
+            const [version, value] = entry.split(",", 2);
+            if (version !== "v1" || !value)
+                continue;
+            const given = Buffer.from(value, "base64");
+            if (given.length === expected.length && timingSafeEqual(given, expected))
+                return true;
+        }
+        return false;
+    }
+    finally {
+        key.fill(0);
+    }
+}

package/dist/keys/x509.d.ts

@@ -4,22 +4,26 @@ export interface CertificateAuthority {
     /** PKCS#8 PEM of the CA key: sealed in the vault, used only by keys. */
     readonly privateKey: string;
 }
-/** A new P-256 CA, valid from an hour ago for `days` days. */
+/**
+ * A new P-256 CA, valid from `keys.caBackdateMs` ago (Host tuning, an hour) for `days` days
+ * (default `keys.caLifetimeDays`).
+ */
 export declare function createCertificateAuthority(options: {
     readonly commonName: string;
     readonly days?: number;
     readonly now?: Date;
 }): CertificateAuthority;
 /**
- * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
- * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from
+ * `keys.leafBackdateMs` ago (Host tuning, five minutes) for `lifetimeMs` (default
+ * `keys.leafLifetimeMs`, an hour: one connection rarely lasts this long). The caller keeps the leaf's private key: only the
  * certificate comes back, so no private key leaves whoever holds it.
  */
 export declare function issueLeafCertificate(options: {
     readonly authority: CertificateAuthority;
     readonly host: string;
     readonly publicKey: string;
-    readonly minutes?: number;
+    readonly lifetimeMs?: number;
     readonly now?: Date;
 }): string;
 /** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */

package/dist/keys/x509.js

@@ -10,6 +10,7 @@
  * CA's key identifier. Go (`gh`), OpenSSL (`curl`, `git`), Node and Python accept that shape.
  */
 import { isIP } from "node:net";
+import { hostTuning } from "../tuning.js";
 import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
 const OID = {
     ecdsaWithSha256: "1.2.840.10045.4.3.2",
@@ -96,21 +97,28 @@ function pem(der) {
     const body = der.toString("base64").replace(/(.{64})/g, "$1\n").replace(/\n$/, "");
     return `-----BEGIN CERTIFICATE-----\n${body}\n-----END CERTIFICATE-----\n`;
 }
-/** A new P-256 CA, valid from an hour ago for `days` days. */
+/** Milliseconds in a day: a unit, not a setting. */
+const DAY_MS = 86_400_000;
+/**
+ * A new P-256 CA, valid from `keys.caBackdateMs` ago (Host tuning, an hour) for `days` days
+ * (default `keys.caLifetimeDays`).
+ */
 export function createCertificateAuthority(options) {
     const { publicKey, privateKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
     const now = options.now ?? new Date();
+    const tuning = hostTuning().keys;
     const subject = name({ commonName: options.commonName, organization: "Nylorun" });
     const ski = keyIdentifier(publicKey);
-    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subject, seq(time(new Date(now.getTime() - 3_600_000)), time(new Date(now.getTime() + (options.days ?? 3650) * 86_400_000))), subject, spki(publicKey), explicit(3, seq(extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))), extension(OID.keyUsage, true, bits(Buffer.from([0x06]), 1)), extension(OID.subjectKeyIdentifier, false, octets(ski)))));
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subject, seq(time(new Date(now.getTime() - tuning.caBackdateMs)), time(new Date(now.getTime() + (options.days ?? tuning.caLifetimeDays) * DAY_MS))), subject, spki(publicKey), explicit(3, seq(extension(OID.basicConstraints, true, seq(bool(true), integer(Buffer.from([0])))), extension(OID.keyUsage, true, bits(Buffer.from([0x06]), 1)), extension(OID.subjectKeyIdentifier, false, octets(ski)))));
     return {
         certificate: pem(certificate(tbs, privateKey)),
         privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
     };
 }
 /**
- * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from five
- * minutes ago for `minutes` minutes. The caller keeps the leaf's private key: only the
+ * A leaf for `host` and the caller's `publicKey` (SPKI PEM), signed by the CA, valid from
+ * `keys.leafBackdateMs` ago (Host tuning, five minutes) for `lifetimeMs` (default
+ * `keys.leafLifetimeMs`, an hour: one connection rarely lasts this long). The caller keeps the leaf's private key: only the
  * certificate comes back, so no private key leaves whoever holds it.
  */
 export function issueLeafCertificate(options) {
@@ -122,8 +130,9 @@ export function issueLeafCertificate(options) {
     if (publicKey.asymmetricKeyType !== "ec" || publicKey.asymmetricKeyDetails?.namedCurve !== "prime256v1")
         throw new Error("A leaf key must be ECDSA P-256");
     const now = options.now ?? new Date();
+    const tuning = hostTuning().keys;
     const issuer = Buffer.from(ca.raw);
-    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subjectOf(issuer), seq(time(new Date(now.getTime() - 300_000)), time(new Date(now.getTime() + (options.minutes ?? 60) * 60_000))), name({ commonName: options.host }), spki(publicKey), explicit(3, seq(extension(OID.keyUsage, true, bits(Buffer.from([0x80]), 7)), extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))), extension(OID.subjectAltName, false, seq(tlv(0x82, Buffer.from(options.host, "ascii")))), extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(ca.publicKey)))))));
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), serial(), seq(oid(OID.ecdsaWithSha256)), subjectOf(issuer), seq(time(new Date(now.getTime() - tuning.leafBackdateMs)), time(new Date(now.getTime() + (options.lifetimeMs ?? tuning.leafLifetimeMs)))), name({ commonName: options.host }), spki(publicKey), explicit(3, seq(extension(OID.keyUsage, true, bits(Buffer.from([0x80]), 7)), extension(OID.extKeyUsage, false, seq(oid(OID.serverAuth))), extension(OID.subjectAltName, false, seq(tlv(0x82, Buffer.from(options.host, "ascii")))), extension(OID.authorityKeyIdentifier, false, seq(tlv(0x80, keyIdentifier(ca.publicKey)))))));
     return pem(certificate(tbs, caKey));
 }
 /** A P-256 key pair for a leaf, as PEM: SPKI for the public key, PKCS#8 for the private key. */