fix(envoy-client): add tls

[MasterPtato]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[MasterPtato]

• fix(envoy-client): add tls #4595 : 2 dependent PRs (#4597 , #4599 ) 👈 (View in Graphite)
• chore: fix driver test suite #4591
• chore: tunnel auth #4588
• chore: remove udb as a dependency of envoy-client #4587
• chore: revert actor v2 hack #4586
• fix: fix pool metadata protocol version refresh, rivetkit native ws #4585
• feat: US-001 - Define SqliteKv trait in rivetkit-sqlite-native #4584
• feat(rust/engine-runner): minimal rust engine runner #4289
• chore: delete kv channel #4583
• feat(engine): rust runner #4582
• chore: remove non-engine drivers #4574 : 1 other dependent PR (#4581 )
• feat: dynamic actors #4397
• fix: driver test suite & sqlite reliability #4559
• fix: remove serverless token #4572
• fix: misc token fixes #4569
• fix(pb): clean up actor stop decision handling #4566
• fix(envoy): use global instance, add signal handlers #4565
• chore: misc fixes, add pb snapshot test #4561
• fix(cache): make in memory cache global #4560
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: fix(envoy-client): add tls

Summary

This PR adds TLS support to the envoy-client SDK via rustls-tls-native-roots and includes two separate bug fixes in the pegboard key encoding and namespace subspace logic.

---

Issues

Bug: Build will break after removing rivet-util-serde workspace dependency

The workspace-level [workspace.dependencies.rivet-util-serde] declaration is removed from the root Cargo.toml, but engine/sdks/rust/envoy-client/Cargo.toml still has rivet-util-serde.workspace = true.

The package actively uses it in multiple source files (connection.rs, actor.rs, stringify.rs, tunnel.rs) via rivet_util_serde::HashableMap. Removing the workspace declaration while keeping the workspace = true reference will cause a compile error. Either keep the workspace dependency or also update envoy-client/Cargo.toml and its usages to inline the dependency or use an alternative.

Concern: install_default() called on every connection

In engine/sdks/rust/envoy-client/src/connection.rs (line 85), install_default() is a process-global one-time operation. Calling it inside single_connection() on every reconnect works (the second call returns Err, which is silently ignored), but it creates an unnecessary allocation every time. A std::sync::OnceLock or a one-time init at process startup would be cleaner.

Note: Key format change in ProtocolVersionKey is a breaking storage change

engine/packages/pegboard/src/keys/runner_config.rs: The tuple order change (moving PROTOCOL_VERSION constant after namespace_id and name) is semantically correct. Placing variable components before the discriminant constant allows namespace-based range scans. However, this is a breaking change to the persisted key format. Any existing database rows written with the old layout (DATA, PROTOCOL_VERSION, namespace_id, name) will be unreadable after this change. If this is deployed against a live store, a migration or coordinated flush is needed. If the store is ephemeral or not yet populated, this is fine as-is, just worth confirming.

---

Looks Good

• Moving tokio-tungstenite from a simple string to a feature table with rustls-tls-native-roots is the right approach.
• The tx.with_subspace(namespace::keys::subspace()) fix in conn.rs is correct. Writing to the raw tx instead of the namespace subspace was a key-path bug.
• Formatting-only change in resolve_actor_query.rs is fine.

Please write a Python or Node.js script to make this API call if the shell heredoc approach fails, or find any method that works to update the comment body. Return the HTTP response status and any error messages.

[MasterPtato]

Merge activity

• Apr 13, 12:21 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Apr 13, 12:24 AM UTC: Graphite rebased this pull request as part of a merge.
• Apr 13, 12:25 AM UTC: @MasterPtato merged this pull request with Graphite.