hammerkit 1.27.0-next.13 → 1.27.0-next.15

package/dist/server/server-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getSourceAccounts = exports.getSandboxRuntimes = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.sandboxGrantSchema = exports.sandboxBranchTypeSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.getMaxVolumeSize = exports.DEFAULT_MAX_VOLUME_SIZE = exports.DEFAULT_DENIED_EGRESS = exports.kubernetesPoolSchema = exports.accountSchema = exports.issuerSchema = exports.serverPlatformSchema = void 0;
+exports.detectPlatform = exports.getSecretCatalog = exports.readServerConfig = exports.getServerAccounts = exports.getSandboxRuntimes = exports.serverConfigSchema = exports.sourceSchema = exports.entitlementSchema = exports.endpointGrantSchema = exports.endpointLevelSchema = exports.sandboxGrantSchema = exports.sandboxBranchTypeSchema = exports.buildsLevelSchema = exports.accountLevelSchema = exports.getMaxVolumeSize = exports.DEFAULT_MAX_VOLUME_SIZE = exports.DEFAULT_DENIED_EGRESS = exports.kubernetesPoolSchema = exports.accountSchema = exports.issuerSchema = exports.serverPlatformSchema = void 0;
 const net_1 = require("net");
 const zod_1 = require("zod");
 const yaml_1 = require("yaml");
@@ -327,6 +327,11 @@ exports.sandboxGrantSchema = zod_1.z
         .refine((branches) => Object.keys(branches).length > 0, 'name the branches a sandbox may start from'),
 })
     .strict();
+// `open`: open the endpoints of the service runs of a repository, whoever started them, and
+// extend those runs; `publish`: also name endpoints in one's own service runs.
+exports.endpointLevelSchema = zod_1.z.enum(['open', 'publish']);
+// One repository (`host/path` pattern) whose endpoints an entitlement opens or publishes.
+exports.endpointGrantSchema = zod_1.z.object({ repo: repoPatternSchema, level: exports.endpointLevelSchema }).strict();
 exports.entitlementSchema = zod_1.z
     .object({
     ...whoShape,
@@ -339,16 +344,19 @@ exports.entitlementSchema = zod_1.z
     // the repositories the caller may keep sandboxes of, checkouts on the server that runs
     // work on: a list of its own, the `repos` above are for runs from a ref
     sandboxes: zod_1.z.array(exports.sandboxGrantSchema).optional(),
+    // the repositories whose service runs' endpoints the caller may open, or publish
+    endpoints: zod_1.z.array(exports.endpointGrantSchema).optional(),
 })
     .strict()
     .superRefine((entitlement, ctx) => {
     checkWho(entitlement, ctx);
     if (Object.keys(entitlement.accounts).length === 0 &&
         entitlement.builds === undefined &&
-        !entitlement.sandboxes?.length) {
+        !entitlement.sandboxes?.length &&
+        !entitlement.endpoints?.length) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
-            message: 'name accounts to use or request, a builds level or sandboxes',
+            message: 'name accounts to use or request, a builds level, sandboxes or endpoints',
         });
     }
 });
@@ -476,6 +484,31 @@ exports.serverConfigSchema = zod_1.z
         // which tasks take arguments: `any` but those that say `args: false`, or
         // `declared`, only those that say `args: true`
         args: zod_1.z.enum(['any', 'declared']).default('any'),
+        // runs of services (`services` in a run), kept up until their ttl ends
+        up: zod_1.z
+            .object({
+            // how long the services stay once ready, when the run names no ttl; then they are removed
+            ttl: duration.default('8h'),
+            // how long the services stay up without a request to an endpoint before they sleep,
+            // when the run names none: the next request wakes them. Unset, they never sleep.
+            sleepTtl: duration.optional(),
+            // the furthest a run, or an extend, sets the end from now
+            maxTtl: duration.default('72h'),
+            limits: zod_1.z
+                .object({
+                // service runs one caller has starting or up at a time; one more is 429
+                up: zod_1.z.number().int().min(1).default(3),
+            })
+                .strict()
+                .default({}),
+            // service runs starting or up on the whole server; one more is 503
+            total: zod_1.z.number().int().min(1).default(20),
+            // on a Kubernetes backend, the ResourceQuota of the namespace of each service
+            // run; backend.quota when left out
+            quota: zod_1.z.record(zod_1.z.union([zod_1.z.string().min(1), zod_1.z.number()]).transform(String)).optional(),
+        })
+            .strict()
+            .default({}),
     })
         .strict()
         .default({}),
@@ -513,6 +546,45 @@ exports.serverConfigSchema = zod_1.z
     })
         .strict()
         .default({}),
+    // ports of service runs published at hosts of their own below `domain`, behind the
+    // server's sign-in. Absent, a run naming endpoints is refused.
+    endpoints: zod_1.z
+        .object({
+        // `run.example.com`: an endpoint is https://<label>.run.example.com, all of them
+        // pointing at this server with one wildcard DNS record
+        domain: zod_1.z
+            .string()
+            .regex(/^(?=.{1,200}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/, 'expected a domain name in lower case, such as run.example.com'),
+        // a wildcard certificate for *.<domain>, served for the hosts of endpoints; left out
+        // behind a TLS proxy, which holds it
+        tls: zod_1.z
+            .object({ cert: zod_1.z.string().min(1), key: zod_1.z.string().min(1) })
+            .strict()
+            .optional(),
+        // how a person signs in with a browser: the authorization code flow of an issuer of
+        // `issuers`, with a client of its own; without it only tokens open endpoints
+        login: zod_1.z
+            .object({
+            issuer: zod_1.z.string().min(1),
+            clientId: zod_1.z.string().min(1),
+            // for providers whose web clients need one (Google): read as an account no
+            // entitlement may name, as the secret of a source is
+            clientSecret: zod_1.z
+                .object({
+                from: zod_1.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]*:.+$/, 'expected provider:reference'),
+                account: accountNameSchema,
+            })
+                .strict()
+                .optional(),
+            scope: zod_1.z.string().min(1).default('openid'),
+        })
+            .strict()
+            .optional(),
+        // how long a sign-in at one endpoint lasts, at most until its run ends
+        session: duration.default('8h'),
+    })
+        .strict()
+        .optional(),
     backend: zod_1.z.discriminatedUnion('type', [hostBackendSchema, kubernetesBackendSchema]).default({ type: 'host' }),
 })
     .strict()
@@ -580,7 +652,7 @@ exports.serverConfigSchema = zod_1.z
             });
         }
     });
-    const readers = getSourceAccounts(config);
+    const readers = getServerAccounts(config);
     config.entitlements.forEach((entitlement, index) => {
         for (const account of Object.keys(entitlement.accounts)) {
             if (readers.includes(account)) {
@@ -663,7 +735,7 @@ exports.serverConfigSchema = zod_1.z
         });
         // the secrets of tasks are read in their Job, with the image of the provider; the
         // ones of the sources are read by the server, which checks the code out itself
-        const readers = getSourceAccounts(config);
+        const readers = getServerAccounts(config);
         for (const [name, account] of Object.entries(config.accounts)) {
             if (readers.includes(name)) {
                 continue;
@@ -749,6 +821,78 @@ exports.serverConfigSchema = zod_1.z
             message: 'the network of a local task can not be limited, allow only the docker runtime with runs.network',
         });
     }
+    if ((0, units_1.parseDuration)(config.runs.up.ttl) > (0, units_1.parseDuration)(config.runs.up.maxTtl)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['runs', 'up', 'ttl'],
+            message: `a ttl of ${config.runs.up.ttl} is more than maxTtl of ${config.runs.up.maxTtl}`,
+        });
+    }
+    const endpoints = config.endpoints;
+    if (endpoints) {
+        if (endpoints.tls && config.behindTlsProxy) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: 'behind a TLS proxy the proxy holds the certificate of the endpoints, leave out endpoints.tls',
+            });
+        }
+        if (endpoints.tls && !config.tls) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: 'the certificate of the endpoints is served next to the one of the server, set tls as well',
+            });
+        }
+        if (!endpoints.tls && !config.behindTlsProxy && (config.tls || !LOOPBACK_HOSTS.includes(config.listen.host))) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'tls'],
+                message: `name the certificate of *.${endpoints.domain} in endpoints.tls, or set behindTlsProxy: true when a proxy in front holds it`,
+            });
+        }
+        const login = endpoints.login;
+        if (login && !config.issuers.some((issuer) => issuer.issuer === login.issuer)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints', 'login', 'issuer'],
+                message: `issuer ${login.issuer} is not one of the accepted issuers`,
+            });
+        }
+        if (login?.clientSecret) {
+            const { from, account } = login.clientSecret;
+            const kind = from.substring(0, from.indexOf(':'));
+            const where = ['endpoints', 'login', 'clientSecret'];
+            if (!config.accounts[account]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'account'],
+                    message: `unknown account ${account}`,
+                });
+            }
+            else if (!config.accounts[account].providers[kind]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'from'],
+                    message: `account ${account} has no credentials for the provider ${kind}`,
+                });
+            }
+            if (!config.secretProviders[kind]) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    path: [...where, 'from'],
+                    message: `secret provider ${kind} is not declared in secretProviders`,
+                });
+            }
+        }
+        if (backend.type === 'kubernetes' && backend.kubeconfig) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['endpoints'],
+                message: 'endpoints reach the services of runs at their Service in the cluster, run the server in the cluster rather than with a kubeconfig',
+            });
+        }
+    }
     if (!config.tls && !config.behindTlsProxy && !LOOPBACK_HOSTS.includes(config.listen.host)) {
         ctx.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -764,11 +908,18 @@ function getSandboxRuntimes(config) {
     return config.sandboxes.runtimes ?? config.runtimes.filter((runtime) => runtime === 'docker');
 }
 exports.getSandboxRuntimes = getSandboxRuntimes;
-// The accounts that read repositories: no caller uses them and no build file names them.
-function getSourceAccounts(config) {
-    return [...new Set(config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])))];
+// The accounts only the server reads secrets as: those that read the repositories of
+// `sources`, and the one of the client secret of `endpoints.login`. No caller uses them and
+// no build file names them.
+function getServerAccounts(config) {
+    return [
+        ...new Set([
+            ...config.sources.flatMap((source) => (source.secret ? [source.secret.account] : [])),
+            ...(config.endpoints?.login?.clientSecret ? [config.endpoints.login.clientSecret.account] : []),
+        ]),
+    ];
 }
-exports.getSourceAccounts = getSourceAccounts;
+exports.getServerAccounts = getServerAccounts;
 async function readServerConfig(environment, path) {
     if (!(await environment.file.exists(path))) {
         throw new Error(`unable to read ${path}: no such file`);

package/dist/server/server.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startServer = exports.getDiscoveryDocument = exports.SERVER_PROTOCOL = exports.DISCOVERY_PATH = void 0;
+exports.startServer = exports.refuseWake = exports.getDiscoveryDocument = exports.SERVER_PROTOCOL = exports.DISCOVERY_PATH = void 0;
 const http_1 = require("http");
 const https_1 = require("https");
+const tls_1 = require("tls");
 const version_1 = require("../version");
 const server_config_1 = require("./server-config");
 const discovery_1 = require("./discovery");
@@ -32,6 +33,8 @@ const sandbox_storage_1 = require("./sandbox-storage");
 const kubernetes_sandbox_storage_1 = require("./kubernetes-sandbox-storage");
 const sandbox_docker_1 = require("./sandbox-docker");
 const sandboxes_api_1 = require("./sandboxes-api");
+const endpoints_1 = require("./endpoints");
+const service_runs_1 = require("./service-runs");
 const units_1 = require("../utils/units");
 const run_logs_1 = require("./run-logs");
 const get_cache_directory_1 = require("../optimizer/get-cache-directory");
@@ -96,8 +99,8 @@ function streamEvents(registry, config, principal, id, req, res, url) {
         watch.stop();
     });
 }
-async function handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res, url) {
-    const match = /^\/v1\/runs(?:\/([^/]+)(?:\/(cancel|events|logs))?)?$/.exec(url.pathname);
+async function handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, endpointUrl, log, principal, req, res, url) {
+    const match = /^\/v1\/runs(?:\/([^/]+)(?:\/(cancel|events|logs|extend))?)?$/.exec(url.pathname);
     if (!match) {
         return false;
     }
@@ -115,7 +118,7 @@ async function handleRuns(config, registry, definitions, sources, sandboxes, pla
             });
         }
         else if (method === 'POST') {
-            await submitRun(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res);
+            await submitRun(config, registry, definitions, sources, sandboxes, planning, repos, endpointUrl, log, principal, req, res);
         }
         else {
             (0, http_2.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET, POST' });
@@ -134,6 +137,13 @@ async function handleRuns(config, registry, definitions, sources, sandboxes, pla
         log(`cancel iss=${principal.iss} sub=${principal.sub} run=${id} found=${Boolean(run)}`);
         run ? (0, http_2.send)(res, 200, toRunResponse(run)) : (0, http_2.send)(res, 404, { error: 'not found' });
     }
+    else if (action === 'extend') {
+        if (method !== 'POST') {
+            (0, http_2.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+            return true;
+        }
+        await extendRun(config, registry, log, principal, id, req, res);
+    }
     else if (method !== 'GET') {
         (0, http_2.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
     }
@@ -181,12 +191,75 @@ function accountsOf(config, principal) {
     const grant = (0, policy_1.getGrant)(config.entitlements, principal);
     return (account) => (0, policy_1.canUse)(grant, account);
 }
+async function extendRun(config, registry, log, principal, id, req, res) {
+    const body = (await (0, http_2.readJson)(req));
+    let ttl;
+    try {
+        if (typeof body !== 'object' || body === null || typeof body.ttl !== 'string') {
+            throw new Error();
+        }
+        ttl = (0, units_1.parseDuration)(body.ttl);
+        if (!(ttl > 0)) {
+            throw new Error();
+        }
+    }
+    catch {
+        (0, http_2.send)(res, 400, { error: 'ttl: expected a duration like 30m, 8h or 1d' });
+        return;
+    }
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    const result = registry.extend(principal, id, ttl, (run) => (0, service_runs_1.mayOpenEndpoints)(grant, run));
+    log(`extend iss=${principal.iss} sub=${principal.sub} run=${id} result=${result.status}`);
+    if (result.status === 'not-found') {
+        (0, http_2.send)(res, 404, { error: 'not found' });
+    }
+    else if (result.status === 'not-up') {
+        (0, http_2.send)(res, 409, { error: `the run is ${result.state}, only a service run that is up can be extended` });
+    }
+    else {
+        (0, http_2.send)(res, 200, toRunResponse(result.run));
+    }
+}
+// Why the owner of a service run that sleeps may no longer run it, with the entitlements of
+// the moment: a wake is started by who opens an endpoint, but runs as the owner, as a new
+// run of theirs would.
+function refuseWake(config, repos, run) {
+    if (run.source.type !== 'ref') {
+        return 'a run from a sandbox does not wake';
+    }
+    const grant = (0, policy_1.getGrant)(config.entitlements, {
+        iss: run.owner.iss,
+        sub: run.owner.sub,
+        groups: run.owner.groups ?? [],
+        claims: run.owner.claims ?? {},
+    });
+    const decision = (0, policy_1.decideRun)({
+        grant,
+        accounts: run.accounts,
+        catalog: config.accounts,
+        source: { type: 'ref', repo: run.source.repo, ref: run.source.ref },
+        // an account it may only request is refused, the wake has nobody to approve it
+        approvable: () => true,
+        readable: (repo) => repos.readable(repo),
+    });
+    if (decision.type === 'refuse') {
+        return `its owner ${run.owner.sub} may no longer run it: ${decision.error.replace(/^you /, 'they ')}`;
+    }
+    if (decision.type === 'approval') {
+        return `its owner ${run.owner.sub} may only request ${decision.accounts.join(', ')} now, start it again`;
+    }
+    if (run.up?.endpoints.length && (0, policy_1.endpointLevel)(grant, run.source.repo) !== 'publish') {
+        return `its owner ${run.owner.sub} may no longer publish endpoints of ${run.source.repo}`;
+    }
+    return undefined;
+}
+exports.refuseWake = refuseWake;
 function toRunResponse(run) {
     const { owner, ...visible } = run;
     void owner;
     return { ...visible, results: run.results ?? {} };
 }
-async function submitRun(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res) {
+async function submitRun(config, registry, definitions, sources, sandboxes, planning, repos, endpointUrl, log, principal, req, res) {
     const parsed = run_request_1.runRequestSchema.safeParse(await (0, http_2.readJson)(req));
     if (!parsed.success) {
         const issue = parsed.error.issues[0];
@@ -218,6 +291,27 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
         (0, http_2.send)(res, 400, { error: `${version.hash} has no task ${unknown.map(oauth_1.quote).join(', ')}` });
         return;
     }
+    const notServices = request.services.filter((service) => !version.services.includes(service));
+    if (notServices.length > 0) {
+        (0, http_2.send)(res, 400, { error: `${version.hash} has no service ${notServices.map(oauth_1.quote).join(', ')}` });
+        return;
+    }
+    if (request.endpoints.length > 0 && !config.endpoints) {
+        (0, http_2.send)(res, 400, { error: 'this server publishes no endpoints (endpoints is not configured)' });
+        return;
+    }
+    const ttl = request.services.length > 0 ? (0, units_1.parseDuration)(request.ttl ?? config.runs.up.ttl) : 0;
+    if (ttl > (0, units_1.parseDuration)(config.runs.up.maxTtl)) {
+        (0, http_2.send)(res, 400, { error: `ttl: at most ${config.runs.up.maxTtl} on this server (runs.up.maxTtl)` });
+        return;
+    }
+    // the files of a sandbox change under a run that sleeps, it would wake to others
+    if (request.sleepTtl !== undefined && request.source.type === 'sandbox') {
+        (0, http_2.send)(res, 400, { error: 'sleepTtl: a service run from a sandbox does not sleep, start it from a branch' });
+        return;
+    }
+    const sleepTtlText = request.source.type === 'ref' ? request.sleepTtl ?? config.runs.up.sleepTtl : undefined;
+    const sleepTtl = request.services.length > 0 && sleepTtlText ? (0, units_1.parseDuration)(sleepTtlText) : undefined;
     const argued = (request.options.args ?? []).length > 0 ? request.tasks[0] : undefined;
     if (argued !== undefined && version.services.includes(argued)) {
         (0, http_2.send)(res, 400, { error: `${argued} is a service, arguments go to a task` });
@@ -239,6 +333,12 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
             return;
         }
     }
+    if (request.services.length > 0 && request.source.type === 'sandbox' && config.backend.type === 'kubernetes') {
+        (0, http_2.send)(res, 400, {
+            error: 'on a cluster a service run starts from a branch, push the sandbox and start it from there',
+        });
+        return;
+    }
     const sandbox = request.source.type === 'sandbox' ? sandboxes.registry.get(principal, request.source.id) : undefined;
     if (request.source.type === 'sandbox') {
         if (!sandbox) {
@@ -275,12 +375,20 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
         (0, http_2.send)(res, 400, { error: `the run does not load: ${e instanceof Error ? e.message : String(e)}` });
         return;
     }
-    const refused = (0, run_plan_1.refuseArguments)(request, planned.plan, sandbox ? sandboxes.policy : planning.policy);
+    const refused = (0, run_plan_1.refuseArguments)(request, planned.plan, sandbox ? sandboxes.policy : planning.policy) ??
+        (0, service_runs_1.refuseEndpoints)(request, planned.plan, config.runs.secretNetwork === 'open');
     if (refused) {
         log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${refused}`);
         (0, http_2.send)(res, 400, { error: refused });
         return;
     }
+    const runRepo = request.source.type === 'ref' ? request.source.repo : sandbox?.repo;
+    if (request.endpoints.length > 0 && (!runRepo || (0, policy_1.endpointLevel)(grant, runRepo) !== 'publish')) {
+        const error = `you may not publish endpoints of ${runRepo ?? 'this source'}, an entitlement needs endpoints with level publish for it`;
+        log(`refuse run iss=${principal.iss} sub=${principal.sub}: ${error}`);
+        (0, http_2.send)(res, 403, { error });
+        return;
+    }
     const decision = (0, policy_1.decideRun)({
         grant,
         accounts: planned.accounts,
@@ -324,13 +432,34 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
     else if (request.source.type === 'upload') {
         source = request.source;
     }
-    const submit = (runSource) => registry.submit(principal, {
+    // a service run is named after its branch unless it says, and its endpoints after that
+    const serviceName = request.services.length > 0
+        ? request.name ??
+            (0, service_runs_1.getServiceRunName)(request.source.type === 'ref' ? request.source.ref : sandbox?.ref)
+        : '';
+    const up = request.services.length > 0
+        ? {
+            services: request.services,
+            ttl,
+            ...(sleepTtl ? { sleepTtl } : {}),
+            name: serviceName,
+            endpoints: (0, service_runs_1.toRunEndpoints)(request.endpoints, (0, service_runs_1.getEndpointHosts)(serviceName, principal, request.endpoints), endpointUrl),
+        }
+        : undefined;
+    // a run that may sleep keeps what its owner is entitled by, for the check of a wake
+    const claimNames = new Set(config.entitlements.flatMap((entitlement) => Object.keys(entitlement.claims?.match ?? {})));
+    const owner = {
+        ...principal,
+        claims: Object.fromEntries(Object.entries(principal.claims).filter(([name]) => claimNames.has(name))),
+    };
+    const submit = (runSource) => registry.submit(owner, {
         definition: version.hash,
         tasks: request.tasks,
         accounts: planned.accounts,
         plan: planned.plan,
         source: runSource,
         options: request.options,
+        ...(up ? { up } : {}),
     }, approvals);
     try {
         // a sandbox is read and the run submitted while nothing else changes it: the run
@@ -348,7 +477,9 @@ async function submitRun(config, registry, definitions, sources, sandboxes, plan
                     clean: state.clean,
                 });
             });
-        log(`run ${run.id} iss=${principal.iss} sub=${principal.sub} accounts=[${planned.accounts.join(',')}] source=${run.source.type}${run.source.type === 'sandbox' ? ` sandbox=${run.source.id}` : ''} tasks=${run.tasks.length}${approvals.length > 0 ? ` approval=[${approvals.join(',')}]` : ''}`);
+        log(`run ${run.id} iss=${principal.iss} sub=${principal.sub} accounts=[${planned.accounts.join(',')}] source=${run.source.type}${run.source.type === 'sandbox' ? ` sandbox=${run.source.id}` : ''} tasks=${run.tasks.length}${run.up
+            ? ` services=[${run.up.services.join(',')}] name=${run.up.name} endpoints=${run.up.endpoints.length}`
+            : ''}${approvals.length > 0 ? ` approval=[${approvals.join(',')}]` : ''}`);
         (0, http_2.send)(res, 202, toRunResponse(run));
     }
     catch (e) {
@@ -385,7 +516,13 @@ async function authenticate(verifier, log, req, res) {
         return null;
     }
 }
-async function handle(config, registry, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res) {
+async function handle(config, registry, gateway, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res) {
+    // the hosts of endpoints are the apps of service runs, not the API
+    const label = gateway?.hostOf(req);
+    if (gateway && label) {
+        await gateway.handle(label, req, res);
+        return;
+    }
     const url = new URL(req.url ?? '/', 'http://localhost');
     const path = url.pathname;
     if (path === discovery_1.DISCOVERY_PATH || path === '/healthz') {
@@ -412,7 +549,7 @@ async function handle(config, registry, definitions, proposals, sources, sandbox
     if (await (0, sandboxes_api_1.handleSandboxes)(config, sandboxes.registry, repos, log, principal, req, res, url)) {
         return;
     }
-    if (await handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, log, principal, req, res, url)) {
+    if (await handleRuns(config, registry, definitions, sources, sandboxes, planning, repos, (host) => gateway?.url(host) ?? host, log, principal, req, res, url)) {
         return;
     }
     if (await (0, approvals_api_1.handleApprovals)(config, registry, log, principal, req, res, url)) {
@@ -447,7 +584,7 @@ async function startServer(config, environment, options = {}) {
         },
         policy: {
             envs: config.runs.env.allow,
-            reserved: (0, server_config_1.getSourceAccounts)(config),
+            reserved: (0, server_config_1.getServerAccounts)(config),
             runtimes: config.runtimes,
             backend: config.backend.type,
             network: (0, work_network_1.parseWorkNetwork)(config.runs.network),
@@ -529,10 +666,34 @@ async function startServer(config, environment, options = {}) {
         limits: config.runs.limits,
         maxDuration: (0, units_1.parseDuration)(config.runs.maxDuration),
         maxLogBytes: config.runs.maxLogBytes,
+        up: {
+            maxTtl: (0, units_1.parseDuration)(config.runs.up.maxTtl),
+            perCaller: config.runs.up.limits.up,
+            total: config.runs.up.total,
+        },
         store: new run_store_1.FileRunStore((0, path_1.join)(storage, 'records')),
         log,
     });
     await registry.restore();
+    if (executor instanceof kubernetes_backend_1.KubernetesExecutor) {
+        // the services of the runs of a server that stopped are gone with it
+        executor.sweepServiceRuns();
+    }
+    const login = config.endpoints?.login;
+    const gateway = config.endpoints
+        ? new endpoints_1.EndpointGateway(config, registry, {
+            keyFile: (0, path_1.join)(storage, 'endpoints', 'session.key'),
+            verifier,
+            ...(login?.clientSecret
+                ? { clientSecret: () => repos.serverSecret(login.clientSecret) }
+                : {}),
+            log,
+            ...(options.fetch ? { fetch: options.fetch } : {}),
+            ...(options.now ? { now: options.now } : {}),
+            mayWake: (run) => refuseWake(config, repos, run),
+        })
+        : undefined;
+    await gateway?.load();
     sandboxes.registry.useRuns({
         holder: (id) => registry.holder(id),
         stop: (id) => registry.stopSandbox(id, 'the sandbox was deleted'),
@@ -543,7 +704,7 @@ async function startServer(config, environment, options = {}) {
         cooldown: (0, units_1.parseDuration)(config.approvals.cooldown),
     });
     const listener = (req, res) => {
-        handle(config, registry, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res).catch((e) => {
+        handle(config, registry, gateway, definitions, proposals, sources, sandboxes, planning, repos, verifier, log, req, res).catch((e) => {
             if (e instanceof http_2.HttpError) {
                 (0, http_2.send)(res, e.status, { error: e.message });
                 return;
@@ -563,11 +724,44 @@ async function startServer(config, environment, options = {}) {
             environment.file.read(config.tls.cert),
             environment.file.read(config.tls.key),
         ]);
-        server = (0, https_1.createServer)({ cert, key }, listener);
+        // the hosts of endpoints have a wildcard certificate of their own
+        const endpointsTls = config.endpoints?.tls;
+        const endpointContext = endpointsTls
+            ? (0, tls_1.createSecureContext)({
+                cert: await environment.file.read(endpointsTls.cert),
+                key: await environment.file.read(endpointsTls.key),
+            })
+            : undefined;
+        const domain = config.endpoints?.domain;
+        server = (0, https_1.createServer)({
+            cert,
+            key,
+            ...(endpointContext && domain
+                ? {
+                    SNICallback: (servername, done) => done(null, servername.toLowerCase().endsWith(`.${domain}`) ? endpointContext : undefined),
+                }
+                : {}),
+        }, listener);
     }
     else {
         server = (0, http_1.createServer)(listener);
     }
+    // WebSockets of the apps behind endpoints; the API has none. An upgraded connection is
+    // no longer the HTTP server's, it goes when the server closes.
+    const upgraded = new Set();
+    server.on('upgrade', (req, socket, head) => {
+        upgraded.add(socket);
+        socket.once('close', () => upgraded.delete(socket));
+        const label = gateway?.hostOf(req);
+        if (!gateway || !label) {
+            socket.end('HTTP/1.1 404 Not Found\r\nconnection: close\r\ncontent-length: 0\r\n\r\n');
+            return;
+        }
+        gateway.upgrade(label, req, socket, head).catch((e) => {
+            log(`error upgrade ${label}: ${e instanceof Error ? e.message : String(e)}`);
+            socket.destroy();
+        });
+    });
     await new Promise((resolve, reject) => {
         server.once('error', reject);
         server.listen(config.listen.port, config.listen.host, () => {
@@ -576,11 +770,12 @@ async function startServer(config, environment, options = {}) {
         });
     });
     const address = server.address();
+    gateway?.listening(address.port, Boolean(config.tls));
     const host = address.family === 'IPv6' ? `[${address.address}]` : address.address;
     return {
         url: `${config.tls ? 'https' : 'http'}://${host}:${address.port}`,
         reload: (next) => {
-            const readers = (0, server_config_1.getSourceAccounts)(config);
+            const readers = (0, server_config_1.getServerAccounts)(config);
             next.entitlements.forEach((entitlement, index) => {
                 const iss = (entitlement.subject ?? entitlement.group ?? entitlement.claims)?.iss;
                 if (iss && !config.issuers.some((issuer) => issuer.issuer === iss)) {
@@ -605,6 +800,7 @@ async function startServer(config, environment, options = {}) {
             await new Promise((resolve, reject) => {
                 server.close((err) => (err ? reject(err) : resolve()));
                 server.closeAllConnections();
+                upgraded.forEach((socket) => socket.destroy());
             });
         },
     };