@nylorun/runtime 0.12.0-beta → 0.14.0-beta

package/dist/store/postgres/store.js

@@ -19,7 +19,8 @@
  * ends. To stay deadlock-free:
  *
  * 1. A session-scoped transaction locks its session row before writing any
- *    other row of that session (effects, actions, checkpoints, outbox).
+ *    other row of that session (effects, actions, checkpoints, its record rows
+ *    and log head).
  * 2. A transaction that touches several sessions locks them in ascending id
  *    order, with `lockSessions` (`./locking.ts`), before writing any of them.
  *
@@ -29,7 +30,7 @@
  *
  * ## Values
  *
- * Document and outbox bodies are `json`, stored as the text `JSON.stringify`
+ * Document and event bodies are `json`, stored as the text `JSON.stringify`
  * wrote, so every string round-trips, including U+0000 and unpaired
  * surrogates that `jsonb` rejects (see `migrations/001_initial.ts`), and key
  * order is kept. Ids and ISO timestamps compared as text use `COLLATE "C"`.
@@ -37,10 +38,16 @@
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
+import { buildEvent } from "../event.js";
 import { encodeCursor } from "../cursor.js";
 import { OwnershipLostError } from "../ownership.js";
 import { POSTGRES_SCHEMA_VERSION, readSchemaVersion } from "./migrations/index.js";
 import { assertIdentifier, tenantSchemaName } from "./names.js";
+import { STREAMS_SCHEMA } from "./migrations/shared/index.js";
+import { createPostgresRecordReader } from "./record.js";
+/** The shared record (Durable Streams §6): every Tenant's events and log heads. */
+const SESSION_EVENTS = `${STREAMS_SCHEMA}.session_events`;
+const LOG_HEADS = `${STREAMS_SCHEMA}.session_log_heads`;
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
@@ -94,11 +101,10 @@ class PostgresSessionStore {
         finally {
             this.inflight.delete(run);
         }
-        if (t.events.length > 0 || t.workAvailable) {
+        if (t.events.length > 0) {
             const commit = {
                 events: t.events,
-                incarnations: t.incarnations,
-                workAvailable: t.workAvailable,
+                generations: t.generations,
             };
             for (const listener of [...this.listeners]) {
                 try {
@@ -123,6 +129,9 @@ class PostgresSessionStore {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
     }
+    record() {
+        return createPostgresRecordReader(this.sql, { tenantId: this.tenantId });
+    }
     async health() {
         const expectedSchemaVersion = this.schemaVersion;
         if (this.closed)
@@ -166,13 +175,23 @@ function toJson(value) {
 }
 const bytes = (value) => Buffer.from(value.buffer, value.byteOffset, value.byteLength);
 const fromBytes = (value) => new Uint8Array(value);
-function executorRow(row) {
+function endpointRow(row) {
+    const optional = (key, value) => value === null ? {} : { [key]: value };
     return {
         agentId: row.agent_id,
-        tokenHash: row.token_hash,
+        url: row.url,
         implementationVersion: row.implementation_version,
-        ...(row.manifest_hash !== null ? { manifestHash: row.manifest_hash } : {}),
-        ...(row.principal_id !== null ? { principalId: row.principal_id } : {}),
+        ...optional("manifestHash", row.manifest_hash),
+        timeoutMs: row.timeout_ms,
+        maxConcurrent: row.max_concurrent,
+        ...optional("principalId", row.principal_id),
+        ...optional("lastDeliveryAt", row.last_delivery_at),
+        ...optional("lastSuccessAt", row.last_success_at),
+        ...optional("lastErrorCode", row.last_error_code),
+        ...optional("lastErrorMessage", row.last_error_message),
+        consecutiveFailures: row.consecutive_failures,
+        ...optional("servedImplementationVersion", row.served_implementation_version),
+        ...optional("servedManifestHash", row.served_manifest_hash),
         createdAt: row.created_at,
         updatedAt: row.updated_at,
     };
@@ -186,6 +205,38 @@ function principalRow(row) {
         createdAt: row.created_at,
     };
 }
+function signingKeyRow(row) {
+    return {
+        id: row.id,
+        state: row.state,
+        alg: row.alg,
+        publicJwk: row.public_jwk,
+        createdAt: row.created_at,
+        activatedAt: row.activated_at,
+        retiredAt: row.retired_at,
+        revokedAt: row.revoked_at,
+        kekId: row.kek_id,
+        nonce: fromBytes(row.nonce),
+        ciphertext: fromBytes(row.ciphertext),
+        wrappedDek: fromBytes(row.wrapped_dek),
+    };
+}
+function publishableKeyRow(row) {
+    return {
+        id: row.id,
+        key: row.key,
+        name: row.name,
+        originsJson: row.origins_json,
+        createdAt: row.created_at,
+        revokedAt: row.revoked_at,
+    };
+}
+/** The time column a signing key's new state stamps. */
+const SIGNING_KEY_STAMP = {
+    current: "activated_at",
+    previous: "retired_at",
+    revoked: "revoked_at",
+};
 function vaultRow(row) {
     return {
         id: row.id,
@@ -244,7 +295,6 @@ const SESSION_TABLES = [
     "effects",
     "actions",
     "links",
-    "outbox",
 ];
 class PostgresTx {
     sql;
@@ -253,9 +303,8 @@ class PostgresTx {
     now;
     closed = false;
     events = [];
-    incarnations = [];
+    generations = [];
     callbacks = [];
-    workAvailable = false;
     constructor(sql, schema, tenantId, now) {
         this.sql = sql;
         this.schema = schema;
@@ -295,10 +344,9 @@ class PostgresTx {
     }
     async delete(table, id) {
         this.check();
+        // A session's record rows and log head stay: a session created again with this id
+        // continues its log (per-session record deletion is deferred, Durable Streams §15).
         await this.sql `DELETE FROM ${this.t(table)} WHERE id = ${id}`;
-        // The session's stream is abandoned with it (a new incarnation starts at 0).
-        if (table === "sessions")
-            await this.sql `DELETE FROM ${this.t("outbox")} WHERE session_id = ${id}`;
     }
     async sessionRows(where, tail) {
         const sql = this.sql;
@@ -319,39 +367,43 @@ class PostgresTx {
     async event(sessionId, turnId, type, payload) {
         this.check();
         const sql = this.sql;
-        // The UPDATE takes the session row lock and allocates under it.
-        const [row] = await sql `
-      UPDATE ${this.t("sessions")} SET next_event_seq = next_event_seq + 1
-      WHERE id = ${sessionId}
-      RETURNING next_event_seq - 1 AS seq, stream_incarnation AS incarnation`;
-        if (!row)
+        // The session row lock orders the session's events; the log head allocates under it.
+        const [session] = await sql `
+      SELECT epoch FROM ${this.t("sessions")} WHERE id = ${sessionId} FOR UPDATE`;
+        if (!session)
             throw new Error(`Session ${sessionId} not found`);
+        const [row] = await sql `
+      INSERT INTO ${sql(LOG_HEADS)} (tenant_id, session_id, generation, head)
+      VALUES (
+        ${this.tenantId}, ${sessionId},
+        coalesce((SELECT basin_generation FROM ${this.t("tenant")}), 0), 1)
+      ON CONFLICT (tenant_id, session_id)
+        DO UPDATE SET head = ${sql(LOG_HEADS)}.head + 1
+      RETURNING head - 1 AS seq, generation`;
         const seq = Number(row.seq);
-        const event = JSON.parse(JSON.stringify({
-            eventId: randomUUID(),
-            sessionId,
+        const generation = Number(row.generation);
+        const event = buildEvent({
             tenantId: this.tenantId,
+            sessionId,
             turnId,
-            cursor: encodeCursor(sessionId, seq),
-            createdAt: this.now().toISOString(),
+            seq,
+            epoch: Number(session.epoch),
+            time: this.now(),
             type,
             payload,
-        }));
+        });
         await sql `
-      INSERT INTO ${this.t("outbox")} (session_id, seq, body)
-      VALUES (${sessionId}, ${seq}, ${JSON.stringify(event)}::text::json)`;
+      INSERT INTO ${sql(SESSION_EVENTS)} (tenant_id, session_id, seq, generation, type, body)
+      VALUES (${this.tenantId}, ${sessionId}, ${seq}, ${generation}, ${type},
+              ${JSON.stringify(event)}::text::json)`;
         this.events.push(event);
-        this.incarnations.push(row.incarnation ?? null);
+        this.generations.push(generation);
         return structuredClone(event);
     }
     afterCommit(fn) {
         this.check();
         this.callbacks.push(fn);
     }
-    signalWork() {
-        this.check();
-        this.workAvailable = true;
-    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();
@@ -443,22 +495,39 @@ class PostgresTx {
         this.check();
         return this.bodies("sandboxes");
     }
-    async expiredClaims(now, limit) {
+    async pendingActions(agentId) {
         this.check();
         const rows = await this.sql `
       SELECT body FROM ${this.t("actions")}
-      WHERE status = 'claimed' AND lease_expires_at IS NOT NULL
-        AND lease_expires_at::timestamptz <= ${now}
-      ORDER BY lease_expires_at::timestamptz, id
+      WHERE agent_id = ${agentId} AND status = 'pending'
+      ORDER BY id`;
+        return rows.map((row) => row.body);
+    }
+    async deliveringCount(agentId) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT count(*)::int AS n FROM ${this.t("actions")}
+      WHERE agent_id = ${agentId} AND status = 'delivering'`;
+        return row.n;
+    }
+    async pendingActionsWithEndpoint(limit) {
+        this.check();
+        const rows = await this.sql `
+      SELECT a.body FROM ${this.t("actions")} a
+      JOIN ${this.t("endpoints")} e ON e.agent_id = a.agent_id
+      WHERE a.status = 'pending'
+      ORDER BY a.id
       LIMIT ${limit}`;
         return rows.map((row) => row.body);
     }
-    async pendingActions(agentId) {
+    async expiredDeliveries(now, limit) {
         this.check();
         const rows = await this.sql `
       SELECT body FROM ${this.t("actions")}
-      WHERE agent_id = ${agentId} AND status = 'pending'
-      ORDER BY id`;
+      WHERE status = 'delivering' AND deadline_at IS NOT NULL
+        AND deadline_at::timestamptz <= ${now}
+      ORDER BY deadline_at::timestamptz, id
+      LIMIT ${limit}`;
         return rows.map((row) => row.body);
     }
     async actionsForSession(sessionId, filter = {}) {
@@ -529,7 +598,7 @@ class PostgresTx {
       SELECT
         (SELECT count(*) FROM ${this.t("sessions")})::int AS sessions,
         (SELECT count(*) FROM ${this.t("sessions")} WHERE status = ANY(${OPEN_SESSION}))::int AS running,
-        (SELECT count(*) FROM ${this.t("actions")} WHERE status IN ('pending', 'claimed'))::int AS actions,
+        (SELECT count(*) FROM ${this.t("actions")} WHERE status IN ('pending', 'delivering'))::int AS actions,
         (SELECT count(*) FROM ${this.t("effects")} WHERE status = 'uncertain')::int AS uncertain,
         (SELECT count(*) FROM ${this.t("sandboxes")})::int AS sandboxes,
         (SELECT count(*) FROM ${this.t("definitions")})::int AS definitions`;
@@ -542,78 +611,96 @@ class PostgresTx {
             definitions: row.definitions,
         };
     }
-    // --- outbox --------------------------------------------------------------
-    async outbox(limit, filter = {}) {
-        this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT session_id, seq, body FROM ${this.t("outbox")}
-      ${filter.sessionId === undefined ? sql `` : sql `WHERE session_id = ${filter.sessionId}`}
-      ORDER BY session_id, seq
-      LIMIT ${limit}`;
-        return rows.map((row) => ({
-            sessionId: row.session_id,
-            seq: Number(row.seq),
-            event: row.body,
-        }));
-    }
-    async deleteOutbox(sessionId, throughSeq, incarnation) {
-        this.check();
-        const sql = this.sql;
-        // One statement: the session and the rows are read from the same snapshot.
-        const result = await sql `
-      DELETE FROM ${this.t("outbox")}
-      WHERE session_id = ${sessionId} AND seq <= ${throughSeq}
-      ${incarnation === undefined
-            ? sql ``
-            : sql `AND EXISTS (
-              SELECT 1 FROM ${this.t("sessions")} WHERE id = ${sessionId}
-                AND stream_incarnation IS NOT DISTINCT FROM ${incarnation})`}`;
-        return result.count;
-    }
-    async outboxStats() {
+    // --- basin generations --------------------------------------------------
+    async basinGenerations() {
         this.check();
         const [row] = await this.sql `
-      SELECT count(*)::int AS depth, min(created_at) AS oldest
-      FROM ${this.t("outbox")}`;
+      SELECT basin_generation, retired_generations FROM ${this.t("tenant")}`;
+        // A schema without its Tenant row (store tests) is at generation 0.
+        if (!row)
+            return { current: 0, retired: [] };
         return {
-            depth: row.depth,
-            oldestCreatedAt: row.oldest ?? null,
+            current: Number(row.basin_generation),
+            retired: row.retired_generations.map(Number),
         };
     }
-    // --- executors -----------------------------------------------------------
-    async listExecutors() {
+    async forgetRetiredGeneration(generation) {
+        this.check();
+        await this.sql `
+      UPDATE ${this.t("tenant")}
+      SET retired_generations = array_remove(retired_generations, ${generation}::int)`;
+    }
+    // --- Action endpoints -----------------------------------------------------
+    async listEndpoints() {
         this.check();
-        const rows = await this.sql `SELECT * FROM ${this.t("executors")} ORDER BY agent_id`;
-        return rows.map(executorRow);
+        const rows = await this.sql `SELECT * FROM ${this.t("endpoints")} ORDER BY agent_id`;
+        return rows.map(endpointRow);
     }
-    async getExecutor(agentId) {
+    async getEndpoint(agentId) {
         this.check();
         const [row] = await this.sql `
-      SELECT * FROM ${this.t("executors")} WHERE agent_id = ${agentId}`;
-        return row && executorRow(row);
+      SELECT * FROM ${this.t("endpoints")} WHERE agent_id = ${agentId}`;
+        return row && endpointRow(row);
     }
-    async putExecutor(row) {
+    async putEndpoint(row) {
         this.check();
+        // Health belongs to a URL: a new URL starts with none.
         await this.sql `
-      INSERT INTO ${this.t("executors")} (
-        agent_id, token_hash, implementation_version, manifest_hash,
-        principal_id, created_at, updated_at
+      INSERT INTO ${this.t("endpoints")} AS e (
+        agent_id, url, implementation_version, manifest_hash, timeout_ms,
+        max_concurrent, principal_id, consecutive_failures, created_at, updated_at
       ) VALUES (
-        ${row.agentId}, ${row.tokenHash}, ${row.implementationVersion},
-        ${row.manifestHash ?? null}, ${row.principalId ?? null},
+        ${row.agentId}, ${row.url}, ${row.implementationVersion}, ${row.manifestHash ?? null},
+        ${row.timeoutMs}, ${row.maxConcurrent}, ${row.principalId ?? null}, 0,
         ${row.updatedAt}, ${row.updatedAt}
       )
       ON CONFLICT (agent_id) DO UPDATE SET
-        token_hash = excluded.token_hash,
+        url = excluded.url,
         implementation_version = excluded.implementation_version,
         manifest_hash = excluded.manifest_hash,
+        timeout_ms = excluded.timeout_ms,
+        max_concurrent = excluded.max_concurrent,
         principal_id = excluded.principal_id,
-        updated_at = excluded.updated_at`;
+        updated_at = excluded.updated_at,
+        last_delivery_at = CASE WHEN e.url = excluded.url THEN e.last_delivery_at END,
+        last_success_at = CASE WHEN e.url = excluded.url THEN e.last_success_at END,
+        last_error_code = CASE WHEN e.url = excluded.url THEN e.last_error_code END,
+        last_error_message = CASE WHEN e.url = excluded.url THEN e.last_error_message END,
+        consecutive_failures =
+          CASE WHEN e.url = excluded.url THEN e.consecutive_failures ELSE 0 END,
+        served_implementation_version =
+          CASE WHEN e.url = excluded.url THEN e.served_implementation_version END,
+        served_manifest_hash =
+          CASE WHEN e.url = excluded.url THEN e.served_manifest_hash END`;
+    }
+    async deleteEndpoint(agentId) {
+        this.check();
+        await this.sql `DELETE FROM ${this.t("endpoints")} WHERE agent_id = ${agentId}`;
     }
-    async deleteExecutor(agentId) {
+    async recordEndpointHealth(agentId, update) {
         this.check();
-        await this.sql `DELETE FROM ${this.t("executors")} WHERE agent_id = ${agentId}`;
+        const table = this.t("endpoints");
+        switch (update.kind) {
+            case "success":
+                await this.sql `
+          UPDATE ${table} SET last_delivery_at = ${update.at}, last_success_at = ${update.at},
+            consecutive_failures = 0, last_error_code = NULL, last_error_message = NULL
+          WHERE agent_id = ${agentId}`;
+                return;
+            case "failure":
+                await this.sql `
+          UPDATE ${table} SET last_delivery_at = ${update.at}, last_error_code = ${update.code},
+            last_error_message = ${update.message},
+            consecutive_failures = consecutive_failures + 1
+          WHERE agent_id = ${agentId}`;
+                return;
+            case "served":
+                await this.sql `
+          UPDATE ${table} SET served_implementation_version = ${update.implementationVersion},
+            served_manifest_hash = ${update.manifestHash ?? null}
+          WHERE agent_id = ${agentId}`;
+                return;
+        }
     }
     // --- principals ----------------------------------------------------------
     async insertPrincipal(row) {
@@ -766,6 +853,151 @@ class PostgresTx {
       INSERT INTO ${this.t("vault_idempotency")} (id, body_hash, response)
       VALUES (${row.id}, ${row.bodyHash}, ${row.response})`;
     }
+    // --- subject tokens ------------------------------------------------------
+    async lockSigningKeys() {
+        this.check();
+        const key = `${this.schema}.signing_keys`;
+        await this.sql `SELECT pg_advisory_xact_lock(hashtext(${key}))`;
+    }
+    async insertSigningKey(row) {
+        this.check();
+        await this.sql `
+      INSERT INTO ${this.t("signing_keys")} (
+        id, state, alg, public_jwk, kek_id, nonce, ciphertext, wrapped_dek,
+        created_at, activated_at, retired_at, revoked_at
+      ) VALUES (
+        ${row.id}, ${row.state}, ${row.alg}, ${row.publicJwk}, ${row.kekId},
+        ${bytes(row.nonce)}, ${bytes(row.ciphertext)}, ${bytes(row.wrappedDek)},
+        ${row.createdAt}, ${row.activatedAt}, ${row.retiredAt}, ${row.revokedAt}
+      )`;
+    }
+    async signingKey(id) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT * FROM ${this.t("signing_keys")} WHERE id = ${id}`;
+        return row && signingKeyRow(row);
+    }
+    async signingKeys(states) {
+        this.check();
+        const sql = this.sql;
+        const rows = await sql `
+      SELECT * FROM ${this.t("signing_keys")}
+      ${states === undefined ? sql `` : sql `WHERE state = ANY(${states})`}
+      ORDER BY created_at, id`;
+        return rows.map(signingKeyRow);
+    }
+    async setSigningKeyState(id, from, to, at) {
+        this.check();
+        const sql = this.sql;
+        const column = SIGNING_KEY_STAMP[to];
+        const rows = await sql `
+      UPDATE ${this.t("signing_keys")}
+      SET state = ${to}${column ? sql `, ${sql(column)} = ${at}` : sql ``}
+      WHERE id = ${id} AND state = ${from}
+      RETURNING id`;
+        return rows.length === 1;
+    }
+    async countSigningKeys() {
+        this.check();
+        const [row] = await this.sql `
+      SELECT count(*)::int AS n FROM ${this.t("signing_keys")}`;
+        return row.n;
+    }
+    async subjectEpoch(subject) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT epoch FROM ${this.t("subject_epochs")} WHERE subject = ${subject}`;
+        return row ? Number(row.epoch) : 0;
+    }
+    async subjectEpochs(subjects) {
+        this.check();
+        if (subjects.length === 0)
+            return new Map();
+        const rows = await this.sql `
+      SELECT subject, epoch FROM ${this.t("subject_epochs")}
+      WHERE subject = ANY(${subjects})`;
+        return new Map(rows.map((row) => [row.subject, Number(row.epoch)]));
+    }
+    async bumpSubjectEpoch(subject, at) {
+        this.check();
+        const [row] = await this.sql `
+      INSERT INTO ${this.t("subject_epochs")} (subject, epoch, revoked_at)
+      VALUES (${subject}, 1, ${at})
+      ON CONFLICT (subject) DO UPDATE
+        SET epoch = ${this.t("subject_epochs")}.epoch + 1, revoked_at = excluded.revoked_at
+      RETURNING epoch`;
+        return Number(row.epoch);
+    }
+    async lockSubjectUsage(initial) {
+        this.check();
+        await this.sql `
+      INSERT INTO ${this.t("subject_usage")} (subject, turn_tokens, refilled_at)
+      VALUES (${initial.subject}, ${initial.turnTokens}, ${initial.refilledAt})
+      ON CONFLICT (subject) DO NOTHING`;
+        const [row] = await this.sql `
+      SELECT subject, turn_tokens, refilled_at FROM ${this.t("subject_usage")}
+      WHERE subject = ${initial.subject} FOR UPDATE`;
+        return {
+            subject: row.subject,
+            turnTokens: Number(row.turn_tokens),
+            refilledAt: row.refilled_at,
+        };
+    }
+    async putSubjectUsage(row) {
+        this.check();
+        await this.sql `
+      INSERT INTO ${this.t("subject_usage")} (subject, turn_tokens, refilled_at)
+      VALUES (${row.subject}, ${row.turnTokens}, ${row.refilledAt})
+      ON CONFLICT (subject) DO UPDATE
+        SET turn_tokens = excluded.turn_tokens, refilled_at = excluded.refilled_at`;
+    }
+    async countOwnerSessions(ownerUserId, statuses) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT count(*)::int AS n FROM ${this.t("sessions")}
+      WHERE owner_user_id = ${ownerUserId} AND status = ANY(${statuses})`;
+        return row.n;
+    }
+    // --- publishable keys ----------------------------------------------------
+    async insertPublishableKey(row) {
+        this.check();
+        await this.sql `
+      INSERT INTO ${this.t("publishable_keys")} (id, key, name, origins_json, created_at, revoked_at)
+      VALUES (${row.id}, ${row.key}, ${row.name}, ${row.originsJson}, ${row.createdAt}, ${row.revokedAt})`;
+    }
+    async publishableKeyByKey(key) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT * FROM ${this.t("publishable_keys")} WHERE key = ${key}`;
+        return row && publishableKeyRow(row);
+    }
+    async publishableKey(id) {
+        this.check();
+        const [row] = await this.sql `
+      SELECT * FROM ${this.t("publishable_keys")} WHERE id = ${id}`;
+        return row && publishableKeyRow(row);
+    }
+    async publishableKeys() {
+        this.check();
+        const rows = await this.sql `
+      SELECT * FROM ${this.t("publishable_keys")} ORDER BY created_at, id`;
+        return rows.map(publishableKeyRow);
+    }
+    async updatePublishableKey(id, patch) {
+        this.check();
+        const sql = this.sql;
+        const sets = [
+            ...(patch.originsJson === undefined ? [] : [sql `origins_json = ${patch.originsJson}`]),
+            ...(patch.revokedAt === undefined ? [] : [sql `revoked_at = ${patch.revokedAt}`]),
+        ];
+        if (sets.length === 0)
+            return (await this.publishableKey(id)) !== undefined;
+        const rows = await sql `
+      UPDATE ${this.t("publishable_keys")}
+      SET ${sets.reduce((all, next) => sql `${all}, ${next}`)}
+      WHERE id = ${id} RETURNING id`;
+        return rows.length === 1;
+    }
     // --- settings ------------------------------------------------------------
     async getSetting(key) {
         this.check();
@@ -783,14 +1015,24 @@ class PostgresTx {
     async reset(scope) {
         this.check();
         const sql = this.sql;
-        if (scope === "sessions" || scope === "all")
+        if (scope === "sessions" || scope === "all") {
             for (const table of SESSION_TABLES)
                 await sql `DELETE FROM ${this.t(table)}`;
+            await sql `DELETE FROM ${this.t("subject_usage")}`;
+            // The record goes with the sessions, and the Tenant moves to a new basin: the ids it
+            // frees start again in an empty one (Durable Streams §8.1).
+            await sql `DELETE FROM ${sql(SESSION_EVENTS)} WHERE tenant_id = ${this.tenantId}`;
+            await sql `DELETE FROM ${sql(LOG_HEADS)} WHERE tenant_id = ${this.tenantId}`;
+            await sql `
+        UPDATE ${this.t("tenant")}
+        SET retired_generations = array_append(retired_generations, basin_generation),
+            basin_generation = basin_generation + 1`;
+        }
         if (scope === "sandboxes" || scope === "all")
             await sql `DELETE FROM ${this.t("sandboxes")}`;
         if (scope === "all") {
             await sql `DELETE FROM ${this.t("definitions")}`;
-            await sql `DELETE FROM ${this.t("executors")}`;
+            await sql `DELETE FROM ${this.t("endpoints")}`;
             await sql `DELETE FROM ${this.t("vaults")} WHERE scope <> 'host'`;
         }
     }

package/dist/store/postgres/tenants.js

@@ -5,6 +5,7 @@ import { TenantConflictError, asQuarantine, quarantine, } from "../../tenant/qua
 import { MIGRATIONS, lockSchema, migrateSchemaInTx, readSchemaVersion, schemaExists, } from "./migrations/index.js";
 import { TENANT_SCHEMA_PREFIX, tenantIdFromSchema, tenantSchemaName } from "./names.js";
 import { createPostgresSessionStore } from "./store.js";
+import { STREAMS_SCHEMA, migrateStreamsSchema } from "./migrations/shared/index.js";
 /**
  * Whether Postgres rejected a statement (a SQLSTATE), rather than the connection or the
  * server failing (classes 08, 53, 57, and the driver's own connection errors). Only the
@@ -19,6 +20,12 @@ function isStatementError(error) {
 export function createPostgresTenantCatalog(options) {
     const { sql } = options;
     const now = options.now ?? (() => new Date());
+    // The shared record (`nylorun_streams`) exists before any Tenant is created or opened.
+    let streamsReady;
+    const ensureStreams = () => (streamsReady ??= migrateStreamsSchema(sql).catch((error) => {
+        streamsReady = undefined;
+        throw error;
+    }));
     const migrations = options.migrations ?? MIGRATIONS;
     const latest = migrations.length;
     async function readEnvelopeWith(q, id) {
@@ -104,6 +111,7 @@ export function createPostgresTenantCatalog(options) {
             return readEnvelopeWith(sql, id);
         },
         async createTenant({ envelope, principals }) {
+            await ensureStreams();
             const input = TenantEnvelopeSchema.parse(envelope);
             const schema = tenantSchemaName(input.id);
             const outcome = await sql.begin(async (tx) => {
@@ -145,6 +153,7 @@ export function createPostgresTenantCatalog(options) {
         async openTenant(id, storeOptions = {}) {
             if (!isTenantId(id))
                 return { status: "not-found" };
+            await ensureStreams();
             const schema = tenantSchemaName(id);
             const version = await readSchemaVersion(sql, schema);
             if (version === undefined)
@@ -206,6 +215,11 @@ export function createPostgresTenantCatalog(options) {
                 if (!(await schemaExists(tx, schema)))
                     return false;
                 await tx `DROP SCHEMA ${tx(schema)} CASCADE`;
+                // The Tenant's share of the record goes with it (Durable Streams §15).
+                if ((await schemaExists(tx, STREAMS_SCHEMA))) {
+                    await tx `DELETE FROM ${tx(`${STREAMS_SCHEMA}.session_events`)} WHERE tenant_id = ${id}`;
+                    await tx `DELETE FROM ${tx(`${STREAMS_SCHEMA}.session_log_heads`)} WHERE tenant_id = ${id}`;
+                }
                 return true;
             });
         },