@nylorun/runtime 0.53.1-beta → 0.53.2-beta

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.53.2-beta
+
+### Patch Changes
+
+- d423ecf: Computers on Kubernetes, the rest of the plan: the Helm chart signs Restate's requests to the
+  worker with an identity key it keeps (the runtime reads it from `NYLORUN_RESTATE_IDENTITY_KEY_FILE`,
+  a PEM it derives `publickeyv1_…` from), writes Restate's partition snapshots to the object store,
+  and can run the keys provider beside Substrate's egress (`keysProvider.enabled`) with the decide
+  route on the gateway. A computer resumed elsewhere by a drain records `agent.suspended` (reason
+  `drain`) on its next use, not only on its next reconcile.
+
 ## 0.53.1-beta
 
 ### Patch Changes

package/dist/host/restate-identity.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Restate's request identity key in its own format (`publickeyv1_` and the base58btc encoding of
+ * the raw 32-byte Ed25519 public key), from a PEM: Restate's PKCS#8 private key, as the Helm chart
+ * mounts it, or the SPKI public key. `nylorun start` computes the same string
+ * (cli/nylorun/src/stack/restate-identity.ts) and passes it as NYLORUN_RESTATE_IDENTITY_KEY.
+ */
+export declare function restateIdentityKeyOf(pem: string): string;
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes "1". */
+export declare function base58btc(bytes: Uint8Array): string;

package/dist/host/restate-identity.js

@@ -0,0 +1,41 @@
+import { createPrivateKey, createPublicKey } from "node:crypto";
+/**
+ * Restate's request identity key in its own format (`publickeyv1_` and the base58btc encoding of
+ * the raw 32-byte Ed25519 public key), from a PEM: Restate's PKCS#8 private key, as the Helm chart
+ * mounts it, or the SPKI public key. `nylorun start` computes the same string
+ * (cli/nylorun/src/stack/restate-identity.ts) and passes it as NYLORUN_RESTATE_IDENTITY_KEY.
+ */
+export function restateIdentityKeyOf(pem) {
+    const text = pem.trim();
+    const key = text.includes("PRIVATE KEY") ? createPublicKey(createPrivateKey(text)) : createPublicKey(text);
+    if (key.asymmetricKeyType !== "ed25519")
+        throw new Error("not an Ed25519 key");
+    const raw = Buffer.from(key.export({ format: "jwk" }).x ?? "", "base64url");
+    if (raw.length !== 32)
+        throw new Error("the public key is not 32 bytes");
+    return `publickeyv1_${base58btc(raw)}`;
+}
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+/** Base58 with the Bitcoin alphabet; each leading zero byte becomes "1". */
+export function base58btc(bytes) {
+    let zeros = 0;
+    while (zeros < bytes.length && bytes[zeros] === 0)
+        zeros += 1;
+    const digits = [];
+    for (let index = zeros; index < bytes.length; index += 1) {
+        let carry = bytes[index];
+        for (let digit = 0; digit < digits.length; digit += 1) {
+            carry += digits[digit] * 256;
+            digits[digit] = carry % 58;
+            carry = Math.floor(carry / 58);
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = Math.floor(carry / 58);
+        }
+    }
+    let out = "1".repeat(zeros);
+    for (let digit = digits.length - 1; digit >= 0; digit -= 1)
+        out += BASE58_ALPHABET[digits[digit]];
+    return out;
+}

package/dist/host/stack-config.js

@@ -53,6 +53,8 @@ import { LOOPBACK_HOSTS } from "@nylorun/core/contracts";
 import { blockedAddresses } from "../sandbox/pods/network-gate.js";
 import { HostTuningError, parseHostTuning } from "../tuning.js";
 import { HOST_IDENTITY_PROVIDERS } from "../vault/host-identity.js";
+import { readFileSync } from "node:fs";
+import { restateIdentityKeyOf } from "./restate-identity.js";
 export const RUNTIME_SERVICES = ["core", "loop", "gates", "keys", "egress", "harness", "computer"];
 /**
  * Services that may share a process (D12): they hold the same secrets and parse the same
@@ -246,14 +248,28 @@ function parseListen(env) {
     });
 }
 const IDENTITY_KEY = /^publickeyv1_[1-9A-HJ-NP-Za-km-z]{32,64}$/;
+/**
+ * The keys Restate signs with: NYLORUN_RESTATE_IDENTITY_KEY (`publickeyv1_…`, comma-separated),
+ * and NYLORUN_RESTATE_IDENTITY_KEY_FILE, a PEM of the key (Restate's private key as the Helm chart
+ * mounts it, or the public key) whose `publickeyv1_…` the Runtime computes.
+ */
 function parseIdentityKeys(env) {
     const raw = read(env, "NYLORUN_RESTATE_IDENTITY_KEY");
-    if (raw === undefined)
+    const file = read(env, "NYLORUN_RESTATE_IDENTITY_KEY_FILE");
+    if (raw === undefined && file === undefined)
         return undefined;
-    const keys = raw
+    const keys = (raw ?? "")
         .split(",")
         .map((key) => key.trim())
         .filter((key) => key !== "");
+    if (file !== undefined) {
+        try {
+            keys.push(restateIdentityKeyOf(readFileSync(file, "utf8")));
+        }
+        catch (error) {
+            throw new StackConfigError(`NYLORUN_RESTATE_IDENTITY_KEY_FILE ${file} is not an Ed25519 PEM: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     for (const key of keys)
         if (!IDENTITY_KEY.test(key))
             throw new StackConfigError("NYLORUN_RESTATE_IDENTITY_KEY must be publickeyv1_<base58 Ed25519 public key>, comma-separated");

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.53.1-beta",
+    "version": "0.53.2-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.53.1-beta",
+    "version": "0.53.2-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,

package/dist/sandbox/computer.js

@@ -68,6 +68,10 @@ export async function computerAccess(ctx, id, signal) {
             return fail(409, `Agent ${id}'s computer failed: ${pod.reason ?? "it did not start"}.`, { code: "agent_unavailable" });
         const status = await pods.client.status(pod.k8sName, { wait: "ready", timeoutMs: 20_000 }).catch(() => undefined);
         if (status?.ready && status.podUID) {
+            // A drain the reconcile hasn't recorded yet (suspend before drain resumed it elsewhere,
+            // ready at once): the reconcile records it, once.
+            if (status.drainedAt !== undefined && status.drainedAt !== pod.drainedAt)
+                await ctx.sandboxSignal(id, { kind: "reconcile" }).catch(() => undefined);
             await firstContact(ctx, id, status.podUID);
             const expiresAt = Date.now() + computers.ttlMs;
             return {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.53.1-beta";
+export declare const RUNTIME_VERSION = "0.53.2-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.53.1-beta";
+export const RUNTIME_VERSION = "0.53.2-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.53.1-beta",
+  "version": "0.53.2-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",