@nylorun/runtime 0.13.0-beta → 0.14.0-beta

package/dist/store/memory.js

@@ -1,5 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
+import { MemoryRecord } from "../streams/relay/memory.js";
+import { buildEvent } from "./event.js";
 import { encodeCursor } from "./cursor.js";
 import { OwnershipLostError } from "./ownership.js";
 import { DOC_TABLES, } from "./types.js";
@@ -9,14 +11,19 @@ function emptyState() {
     return {
         docs: Object.fromEntries(DOC_TABLES.map((table) => [table, new Map()])),
         sessionMeta: new Map(),
-        outbox: new Map(),
-        executors: new Map(),
+        heads: new Map(),
+        basin: { current: 0, retired: [] },
+        endpoints: new Map(),
         principals: new Map(),
         vaults: new Map(),
         credentials: new Map(),
         audit: [],
         idempotency: new Map(),
         settings: new Map(),
+        signingKeys: new Map(),
+        subjectEpochs: new Map(),
+        subjectUsage: new Map(),
+        publishableKeys: new Map(),
     };
 }
 const OWNERSHIP_KEYS = new Set(["owner", "epoch", "ownerExpiresAt"]);
@@ -32,13 +39,15 @@ const copy = (value) => structuredClone(value);
 export class MemoryStoreData {
     /** @internal */ state = emptyState();
     /** @internal */ queue = Promise.resolve();
+    /** The record of committed events, read back by the stream relay. */
+    record = new MemoryRecord();
 }
 /**
  * In-memory `SessionStore` for unit tests. Not a supported profile.
  *
  * Transactions are serialized (one at a time), each works on a copy of the
  * state and replaces it on commit, so a throw rolls back everything: documents,
- * sequences, outbox rows, `afterCommit` callbacks and `signalWork`. Commit listeners see
+ * sequences, record rows and `afterCommit` callbacks. Commit listeners see
  * only this store's commits, as with a Postgres connection.
  */
 export class MemorySessionStore {
@@ -79,11 +88,17 @@ export class MemorySessionStore {
                 t.closed = true;
             }
             this.data.state = working;
-            if (t.events.length > 0 || t.workAvailable) {
+            for (const change of t.recordChanges)
+                if (change.kind === "rows")
+                    this.data.record.commit(change.rows);
+                else {
+                    this.data.record.deleteRows(this.tenantId);
+                    this.data.record.setGeneration(this.tenantId, change.generation);
+                }
+            if (t.events.length > 0) {
                 const commit = {
                     events: t.events,
-                    incarnations: t.incarnations,
-                    workAvailable: t.workAvailable,
+                    generations: t.generations,
                 };
                 for (const listener of this.listeners) {
                     try {
@@ -112,6 +127,9 @@ export class MemorySessionStore {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
     }
+    record() {
+        return this.data.record;
+    }
     async health() {
         return {
             ok: !this.closed,
@@ -137,9 +155,9 @@ class MemoryTx {
     now;
     closed = false;
     events = [];
-    incarnations = [];
+    generations = [];
+    recordChanges = [];
     callbacks = [];
-    workAvailable = false;
     constructor(s, tenantId, now) {
         this.s = s;
         this.tenantId = tenantId;
@@ -167,7 +185,6 @@ class MemoryTx {
                     owner: null,
                     epoch: 0,
                     ownerExpiresAt: null,
-                    nextSeq: 0,
                 });
         }
         const json = JSON.stringify(value);
@@ -178,10 +195,9 @@ class MemoryTx {
     async delete(table, id) {
         this.check();
         this.s.docs[table].delete(id);
-        if (table === "sessions") {
+        // The session's log head stays: a session created again with this id continues its log.
+        if (table === "sessions")
             this.s.sessionMeta.delete(id);
-            this.s.outbox.delete(id);
-        }
     }
     session(id) {
         const raw = this.s.docs.sessions.get(id);
@@ -215,34 +231,32 @@ class MemoryTx {
         const meta = this.s.sessionMeta.get(sessionId);
         if (!meta)
             throw new Error(`Session ${sessionId} not found`);
-        const seq = meta.nextSeq++;
-        const event = JSON.parse(JSON.stringify({
-            eventId: randomUUID(),
-            sessionId,
+        let head = this.s.heads.get(sessionId);
+        if (!head)
+            this.s.heads.set(sessionId, (head = { head: 0, generation: this.s.basin.current }));
+        const event = buildEvent({
             tenantId: this.tenantId,
+            sessionId,
             turnId,
-            cursor: encodeCursor(sessionId, seq),
-            createdAt: this.now().toISOString(),
+            seq: head.head,
+            epoch: meta.epoch,
+            time: this.now(),
             type,
             payload,
-        }));
-        let rows = this.s.outbox.get(sessionId);
-        if (!rows)
-            this.s.outbox.set(sessionId, (rows = new Map()));
-        rows.set(seq, JSON.stringify(event));
+        });
+        const seq = head.head++;
+        this.recordChanges.push({
+            kind: "rows",
+            rows: [{ tenantId: this.tenantId, sessionId, seq, generation: head.generation, body: event }],
+        });
         this.events.push(event);
-        const doc = JSON.parse(this.s.docs.sessions.get(sessionId));
-        this.incarnations.push(doc.streamIncarnation ?? null);
+        this.generations.push(head.generation);
         return copy(event);
     }
     afterCommit(fn) {
         this.check();
         this.callbacks.push(fn);
     }
-    signalWork() {
-        this.check();
-        this.workAvailable = true;
-    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();
@@ -330,19 +344,29 @@ class MemoryTx {
     actions() {
         return this.docs("actions").map(([, doc]) => doc);
     }
-    async expiredClaims(now, limit) {
+    async pendingActions(agentId) {
+        this.check();
+        return this.actions().filter((a) => a.status === "pending" && a.agentId === agentId);
+    }
+    async deliveringCount(agentId) {
+        this.check();
+        return this.actions().filter((a) => a.status === "delivering" && a.agentId === agentId).length;
+    }
+    async pendingActionsWithEndpoint(limit) {
         this.check();
         return this.actions()
-            .filter((a) => a.status === "claimed" &&
-            a.leaseExpiresAt !== null &&
-            Date.parse(a.leaseExpiresAt) <= now.getTime())
-            .sort((a, b) => Date.parse(a.leaseExpiresAt) - Date.parse(b.leaseExpiresAt) ||
-            (a.actionId < b.actionId ? -1 : 1))
+            .filter((a) => a.status === "pending" && this.s.endpoints.has(a.agentId))
             .slice(0, limit);
     }
-    async pendingActions(agentId) {
+    async expiredDeliveries(now, limit) {
         this.check();
-        return this.actions().filter((a) => a.status === "pending" && a.agentId === agentId);
+        return this.actions()
+            .filter((a) => a.status === "delivering" &&
+            typeof a.deadlineAt === "string" &&
+            Date.parse(a.deadlineAt) <= now.getTime())
+            .sort((a, b) => Date.parse(a.deadlineAt) - Date.parse(b.deadlineAt) ||
+            (a.actionId < b.actionId ? -1 : 1))
+            .slice(0, limit);
     }
     async actionsForSession(sessionId, filter = {}) {
         this.check();
@@ -394,86 +418,51 @@ class MemoryTx {
             sessions: sessions.length,
             runningSessions: sessions.filter((s) => OPEN_SESSION.has(s.status))
                 .length,
-            pendingActions: this.actions().filter((a) => a.status === "pending" || a.status === "claimed").length,
+            pendingActions: this.actions().filter((a) => a.status === "pending" || a.status === "delivering").length,
             uncertainEffects: this.effects().filter((e) => e.status === "uncertain")
                 .length,
             sandboxes: this.s.docs.sandboxes.size,
             definitions: this.s.docs.definitions.size,
         };
     }
-    // --- outbox --------------------------------------------------------------
-    async outbox(limit, filter = {}) {
+    // --- basin generations --------------------------------------------------
+    async basinGenerations() {
         this.check();
-        const rows = [];
-        for (const [sessionId, bySeq] of byId(this.s.outbox)) {
-            if (filter.sessionId !== undefined && filter.sessionId !== sessionId)
-                continue;
-            for (const seq of [...bySeq.keys()].sort((a, b) => a - b)) {
-                if (rows.length >= limit)
-                    return rows;
-                rows.push({ sessionId, seq, event: JSON.parse(bySeq.get(seq)) });
-            }
-        }
-        return rows;
-    }
-    async deleteOutbox(sessionId, throughSeq, incarnation) {
-        this.check();
-        const rows = this.s.outbox.get(sessionId);
-        if (!rows)
-            return 0;
-        if (incarnation !== undefined) {
-            const doc = this.s.docs.sessions.get(sessionId);
-            if (doc === undefined ||
-                (JSON.parse(doc).streamIncarnation ?? null) !== incarnation)
-                return 0;
-        }
-        let n = 0;
-        for (const seq of [...rows.keys()])
-            if (seq <= throughSeq) {
-                rows.delete(seq);
-                n += 1;
-            }
-        if (rows.size === 0)
-            this.s.outbox.delete(sessionId);
-        return n;
-    }
-    async outboxStats() {
-        this.check();
-        let depth = 0;
-        let oldestCreatedAt = null;
-        for (const rows of this.s.outbox.values())
-            for (const body of rows.values()) {
-                depth += 1;
-                const createdAt = JSON.parse(body).createdAt;
-                if (oldestCreatedAt === null || createdAt < oldestCreatedAt)
-                    oldestCreatedAt = createdAt;
-            }
-        return { depth, oldestCreatedAt };
+        return copy(this.s.basin);
+    }
+    async forgetRetiredGeneration(generation) {
+        this.check();
+        this.s.basin.retired = this.s.basin.retired.filter((g) => g !== generation);
     }
-    // --- executors -----------------------------------------------------------
-    async listExecutors() {
+    // --- Action endpoints -----------------------------------------------------
+    async listEndpoints() {
         this.check();
-        return byId(this.s.executors).map(([, row]) => copy(row));
+        return byId(this.s.endpoints).map(([, row]) => copy(row));
     }
-    async getExecutor(agentId) {
+    async getEndpoint(agentId) {
         this.check();
-        const row = this.s.executors.get(agentId);
+        const row = this.s.endpoints.get(agentId);
         return row && copy(row);
     }
-    async putExecutor(row) {
+    async putEndpoint(row) {
         this.check();
-        for (const other of this.s.executors.values())
-            if (other.tokenHash === row.tokenHash && other.agentId !== row.agentId)
-                throw new Error("executors.token_hash must be unique");
-        const existing = this.s.executors.get(row.agentId);
-        this.s.executors.set(row.agentId, {
+        const existing = this.s.endpoints.get(row.agentId);
+        const health = existing && existing.url === row.url ? healthOf(existing) : { consecutiveFailures: 0 };
+        this.s.endpoints.set(row.agentId, {
             ...copy(row),
+            ...health,
             createdAt: existing?.createdAt ?? row.updatedAt,
         });
     }
-    async deleteExecutor(agentId) {
+    async deleteEndpoint(agentId) {
         this.check();
-        this.s.executors.delete(agentId);
+        this.s.endpoints.delete(agentId);
+    }
+    async recordEndpointHealth(agentId, update) {
+        this.check();
+        const row = this.s.endpoints.get(agentId);
+        if (row)
+            this.s.endpoints.set(agentId, withHealth(row, update));
     }
     // --- principals ----------------------------------------------------------
     async insertPrincipal(row) {
@@ -602,6 +591,119 @@ class MemoryTx {
             throw new Error("vault_idempotency.id must be unique");
         this.s.idempotency.set(row.id, copy(row));
     }
+    // --- subject tokens ------------------------------------------------------
+    /** Transactions are serialized already. */
+    async lockSigningKeys() {
+        this.check();
+    }
+    async insertSigningKey(row) {
+        this.check();
+        if (this.s.signingKeys.has(row.id))
+            throw new Error("signing_keys.id must be unique");
+        if (row.state !== "revoked")
+            for (const other of this.s.signingKeys.values())
+                if (other.state === row.state)
+                    throw new Error(`signing_keys allows one ${row.state} key`);
+        this.s.signingKeys.set(row.id, copy(row));
+    }
+    async signingKey(id) {
+        this.check();
+        const row = this.s.signingKeys.get(id);
+        return row && copy(row);
+    }
+    async signingKeys(states) {
+        this.check();
+        return [...this.s.signingKeys.values()]
+            .filter((row) => states === undefined || states.includes(row.state))
+            .sort(byCreated)
+            .map(copy);
+    }
+    async setSigningKeyState(id, from, to, at) {
+        this.check();
+        const row = this.s.signingKeys.get(id);
+        if (!row || row.state !== from)
+            return false;
+        if (to !== "revoked")
+            for (const other of this.s.signingKeys.values())
+                if (other.id !== id && other.state === to)
+                    throw new Error(`signing_keys allows one ${to} key`);
+        this.s.signingKeys.set(id, { ...row, ...signingKeyStamp(to, at), state: to });
+        return true;
+    }
+    async countSigningKeys() {
+        this.check();
+        return this.s.signingKeys.size;
+    }
+    async subjectEpoch(subject) {
+        this.check();
+        return this.s.subjectEpochs.get(subject) ?? 0;
+    }
+    async subjectEpochs(subjects) {
+        this.check();
+        const out = new Map();
+        for (const subject of subjects) {
+            const epoch = this.s.subjectEpochs.get(subject);
+            if (epoch !== undefined)
+                out.set(subject, epoch);
+        }
+        return out;
+    }
+    async bumpSubjectEpoch(subject, _at) {
+        this.check();
+        const epoch = (this.s.subjectEpochs.get(subject) ?? 0) + 1;
+        this.s.subjectEpochs.set(subject, epoch);
+        return epoch;
+    }
+    async lockSubjectUsage(initial) {
+        this.check();
+        // Transactions are serialized, so the row is as good as locked.
+        const row = this.s.subjectUsage.get(initial.subject);
+        if (row)
+            return copy(row);
+        this.s.subjectUsage.set(initial.subject, copy(initial));
+        return copy(initial);
+    }
+    async putSubjectUsage(row) {
+        this.check();
+        this.s.subjectUsage.set(row.subject, copy(row));
+    }
+    async countOwnerSessions(ownerUserId, statuses) {
+        this.check();
+        return this.sessions().filter((s) => s.ownerUserId === ownerUserId &&
+            statuses.includes(s.status ?? "")).length;
+    }
+    // --- publishable keys ----------------------------------------------------
+    async insertPublishableKey(row) {
+        this.check();
+        for (const other of this.s.publishableKeys.values())
+            if (other.id === row.id || other.key === row.key || other.name === row.name)
+                throw new Error("publishable_keys id, key and name must be unique");
+        this.s.publishableKeys.set(row.id, copy(row));
+    }
+    async publishableKeyByKey(key) {
+        this.check();
+        for (const row of this.s.publishableKeys.values())
+            if (row.key === key)
+                return copy(row);
+        return undefined;
+    }
+    async publishableKey(id) {
+        this.check();
+        const row = this.s.publishableKeys.get(id);
+        return row && copy(row);
+    }
+    async publishableKeys() {
+        this.check();
+        return [...this.s.publishableKeys.values()].sort(byCreated).map(copy);
+    }
+    async updatePublishableKey(id, patch) {
+        this.check();
+        const row = this.s.publishableKeys.get(id);
+        if (!row)
+            return false;
+        this.s.publishableKeys.set(id, { ...row, ...copy(patch) });
+        return true;
+    }
     // --- settings ------------------------------------------------------------
     async getSetting(key) {
         this.check();
@@ -625,21 +727,84 @@ class MemoryTx {
             ])
                 this.s.docs[table].clear();
             this.s.sessionMeta.clear();
-            this.s.outbox.clear();
+            this.s.heads.clear();
+            this.s.subjectUsage.clear();
+            this.s.basin = {
+                current: this.s.basin.current + 1,
+                retired: [...this.s.basin.retired, this.s.basin.current],
+            };
+            this.recordChanges.push({ kind: "reset", generation: this.s.basin.current });
         }
         if (scope === "sandboxes" || scope === "all")
             this.s.docs.sandboxes.clear();
         if (scope === "all") {
             this.s.docs.definitions.clear();
-            this.s.executors.clear();
+            this.s.endpoints.clear();
             for (const vault of [...this.s.vaults.values()])
                 if (vault.scope !== "host")
                     await this.deleteVault(vault.id);
         }
     }
 }
+/** The time column a signing key's new state stamps. */
+export function signingKeyStamp(state, at) {
+    if (state === "current")
+        return { activatedAt: at };
+    if (state === "previous")
+        return { retiredAt: at };
+    if (state === "revoked")
+        return { revokedAt: at };
+    return {};
+}
 function byCreated(a, b) {
     if (a.createdAt !== b.createdAt)
         return a.createdAt < b.createdAt ? -1 : 1;
     return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
 }
+const HEALTH_KEYS = [
+    "lastDeliveryAt",
+    "lastSuccessAt",
+    "lastErrorCode",
+    "lastErrorMessage",
+    "consecutiveFailures",
+    "servedImplementationVersion",
+    "servedManifestHash",
+];
+/** The health fields of an endpoint row. */
+function healthOf(row) {
+    const health = {};
+    for (const key of HEALTH_KEYS)
+        if (row[key] !== undefined)
+            health[key] = row[key];
+    return { ...health, consecutiveFailures: row.consecutiveFailures };
+}
+/** `row` after one health observation (the same rules as the Postgres store). */
+function withHealth(row, update) {
+    switch (update.kind) {
+        case "success": {
+            const { lastErrorCode: _c, lastErrorMessage: _m, ...rest } = row;
+            return {
+                ...rest,
+                lastDeliveryAt: update.at,
+                lastSuccessAt: update.at,
+                consecutiveFailures: 0,
+            };
+        }
+        case "failure":
+            return {
+                ...row,
+                lastDeliveryAt: update.at,
+                lastErrorCode: update.code,
+                lastErrorMessage: update.message,
+                consecutiveFailures: row.consecutiveFailures + 1,
+            };
+        case "served": {
+            const { servedManifestHash: _h, ...rest } = row;
+            return {
+                ...rest,
+                servedImplementationVersion: update.implementationVersion,
+                ...(update.manifestHash === undefined ? {} : { servedManifestHash: update.manifestHash }),
+            };
+        }
+    }
+}

package/dist/store/postgres/connect.d.ts

@@ -9,6 +9,16 @@ export interface PostgresClientOptions {
     connectTimeoutSeconds?: number;
     /** `application_name` on every connection. Default `nylorun-runtime`. */
     applicationName?: string;
+    /**
+     * `statement_timeout`: a statement running or waiting for a lock longer fails. Default
+     * 60 s; 0 turns it off. Schema migrations lift it (`lockSchema`).
+     */
+    statementTimeoutMs?: number;
+    /**
+     * `idle_in_transaction_session_timeout`: a transaction left idle this long is ended and its
+     * connection closed, releasing its locks. Default 60 s; 0 turns it off.
+     */
+    idleInTransactionTimeoutMs?: number;
 }
 /**
  * Opens a connection pool for Session Stores and the Tenant catalog. One pool
@@ -21,5 +31,8 @@ export interface PostgresClientOptions {
  * named prepared statements would pile up on every pooled connection with the
  * number of Tenants a Host serves. Unnamed statements still go in one round
  * trip; the queries are simple enough that re-planning them costs little.
+ *
+ * The pool is shared by every Tenant, so a statement or transaction that hangs must not hold
+ * a connection forever: both are bounded by default.
  */
 export declare function createPostgresClient(url: string, options?: PostgresClientOptions): PostgresClient;

package/dist/store/postgres/connect.js

@@ -10,6 +10,9 @@ import postgres, {} from "postgres";
  * named prepared statements would pile up on every pooled connection with the
  * number of Tenants a Host serves. Unnamed statements still go in one round
  * trip; the queries are simple enough that re-planning them costs little.
+ *
+ * The pool is shared by every Tenant, so a statement or transaction that hangs must not hold
+ * a connection forever: both are bounded by default.
  */
 export function createPostgresClient(url, options = {}) {
     return postgres(url, {
@@ -20,6 +23,8 @@ export function createPostgresClient(url, options = {}) {
         onnotice: () => { },
         connection: {
             application_name: options.applicationName ?? "nylorun-runtime",
+            statement_timeout: options.statementTimeoutMs ?? 60_000,
+            idle_in_transaction_session_timeout: options.idleInTransactionTimeoutMs ?? 60_000,
         },
     });
 }

package/dist/store/postgres/migrations/003_subject_tokens.d.ts

@@ -0,0 +1,8 @@
+import type { Migration } from "./index.js";
+/**
+ * Subject tokens (Host feature `subject-tokens`): the Tenant's signing keys (private halves
+ * sealed with the vault KEK, like credentials), each subject's revocation epoch, each
+ * subject's turn bucket. Counting a subject's sessions by status uses the owner index of
+ * migration 2; a second index on status would be written on every session transition.
+ */
+export declare const subjectTokens: Migration;

package/dist/store/postgres/migrations/003_subject_tokens.js

@@ -0,0 +1,42 @@
+/**
+ * Subject tokens (Host feature `subject-tokens`): the Tenant's signing keys (private halves
+ * sealed with the vault KEK, like credentials), each subject's revocation epoch, each
+ * subject's turn bucket. Counting a subject's sessions by status uses the owner index of
+ * migration 2; a second index on status would be written on every session transition.
+ */
+export const subjectTokens = {
+    version: 3,
+    name: "subject_tokens",
+    up: (s) => `
+    CREATE TABLE ${s}.signing_keys (
+      id text COLLATE "C" PRIMARY KEY,
+      state text NOT NULL CHECK (state IN ('standby', 'current', 'previous', 'revoked')),
+      alg text NOT NULL CHECK (alg = 'ES256'),
+      public_jwk text NOT NULL,
+      kek_id text NOT NULL,
+      nonce bytea NOT NULL,
+      ciphertext bytea NOT NULL,
+      wrapped_dek bytea NOT NULL,
+      created_at text NOT NULL,
+      activated_at text,
+      retired_at text,
+      revoked_at text
+    );
+    CREATE UNIQUE INDEX signing_keys_one_standby ON ${s}.signing_keys (state) WHERE state = 'standby';
+    CREATE UNIQUE INDEX signing_keys_one_current ON ${s}.signing_keys (state) WHERE state = 'current';
+    CREATE UNIQUE INDEX signing_keys_one_previous ON ${s}.signing_keys (state) WHERE state = 'previous';
+
+    CREATE TABLE ${s}.subject_epochs (
+      subject text COLLATE "C" PRIMARY KEY,
+      epoch bigint NOT NULL,
+      revoked_at text NOT NULL
+    );
+
+    CREATE TABLE ${s}.subject_usage (
+      subject text COLLATE "C" PRIMARY KEY,
+      turn_tokens double precision NOT NULL,
+      refilled_at text NOT NULL
+    );
+
+  `,
+};

package/dist/store/postgres/migrations/004_publishable_keys.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "./index.js";
+/**
+ * Publishable keys (Host feature `browser-access`): public by design, so stored as they are,
+ * with the origins a browser may use each from.
+ */
+export declare const publishableKeys: Migration;

package/dist/store/postgres/migrations/004_publishable_keys.js

@@ -0,0 +1,18 @@
+/**
+ * Publishable keys (Host feature `browser-access`): public by design, so stored as they are,
+ * with the origins a browser may use each from.
+ */
+export const publishableKeys = {
+    version: 4,
+    name: "publishable_keys",
+    up: (s) => `
+    CREATE TABLE ${s}.publishable_keys (
+      id text COLLATE "C" PRIMARY KEY,
+      key text COLLATE "C" NOT NULL UNIQUE,
+      name text NOT NULL UNIQUE,
+      origins_json text NOT NULL,
+      created_at text NOT NULL,
+      revoked_at text
+    );
+  `,
+};

package/dist/store/postgres/migrations/005_action_endpoints.d.ts

@@ -0,0 +1,6 @@
+import type { Migration } from "./index.js";
+/**
+ * Action endpoints: where the Runtime delivers each agent's Actions over HTTP, with the health
+ * recent deliveries report, and the deadline of an Action being delivered.
+ */
+export declare const actionEndpoints: Migration;

package/dist/store/postgres/migrations/005_action_endpoints.js

@@ -0,0 +1,32 @@
+/**
+ * Action endpoints: where the Runtime delivers each agent's Actions over HTTP, with the health
+ * recent deliveries report, and the deadline of an Action being delivered.
+ */
+export const actionEndpoints = {
+    version: 5,
+    name: "action_endpoints",
+    up: (s) => `
+    CREATE TABLE ${s}.endpoints (
+      agent_id text COLLATE "C" PRIMARY KEY,
+      url text NOT NULL,
+      implementation_version text NOT NULL,
+      manifest_hash text,
+      timeout_ms integer NOT NULL,
+      max_concurrent integer NOT NULL,
+      principal_id text,
+      last_delivery_at text,
+      last_success_at text,
+      last_error_code text,
+      last_error_message text,
+      consecutive_failures integer NOT NULL DEFAULT 0,
+      served_implementation_version text,
+      served_manifest_hash text,
+      created_at text NOT NULL,
+      updated_at text NOT NULL
+    );
+
+    ALTER TABLE ${s}.actions
+      ADD COLUMN deadline_at text GENERATED ALWAYS AS (${s}.doc(body)->>'deadlineAt') STORED;
+    CREATE INDEX actions_deadline ON ${s}.actions (status, deadline_at);
+  `,
+};