@nylorun/runtime 0.13.0-beta → 0.14.0-beta

package/dist/vault/service.js

@@ -36,9 +36,6 @@
  * selectHostModel(body: SelectHostModelRequest): Promise<HostModelView>
  * readHostModel(): Promise<HostModelSecret | undefined>
  * updateHostCredential(credential): Promise<void>
- *
- * // Rejected caller audit: opens its own transaction.
- * reject(route: string): Promise<void>
  * ```
  *
  * ## Transactions and I/O
@@ -67,16 +64,21 @@ import { VaultError } from "./error.js";
 import { hostModelCatalog } from "../model/catalog.js";
 import { normalizeVaultUrl } from "./url.js";
 const REFRESH_SKEW_MS = 60_000;
+const REFRESH_TIMEOUT_MS = 30_000;
 const HOST_VAULT_ID = "host";
 const HOST_MODEL_ID = "host-model";
 export class VaultService {
     store;
     kek;
     fetchImpl;
+    refreshTimeoutMs;
+    /** Refreshes in progress by credential id: concurrent uses share one. */
+    refreshing = new Map();
     constructor(options) {
         this.store = options.store;
         this.kek = options.kek;
         this.fetchImpl = options.fetch;
+        this.refreshTimeoutMs = options.refreshTimeoutMs ?? REFRESH_TIMEOUT_MS;
     }
     // --- administration --------------------------------------------------------
     async createVault(body) {
@@ -338,7 +340,7 @@ export class VaultService {
             };
         }
         if (row.type === "oauth" && dueForRefresh(row.expiresAt)) {
-            const refreshed = await this.refresh(kek, row, payload, input.sessionId, url);
+            const refreshed = await this.refreshShared(kek, row, payload, input.sessionId, url);
             if (refreshed.status === "refused")
                 return refreshed;
             payload = refreshed.payload;
@@ -386,6 +388,7 @@ export class VaultService {
                     model: binding.model,
                     authType: binding.authType,
                     ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+                    ...(binding.settings ? { settings: binding.settings } : {}),
                     lastUpdated: row.rotatedAt ?? row.createdAt,
                     active: binding.provider === active,
                 };
@@ -412,6 +415,7 @@ export class VaultService {
                 provider: body.provider,
                 model: body.model,
                 baseUrl: body.baseUrl,
+                settings: body.settings,
                 authType: body.auth.type,
                 payload,
             });
@@ -442,6 +446,8 @@ export class VaultService {
                 provider: body.provider,
                 model: body.model,
                 baseUrl: body.baseUrl,
+                // Selecting a model keeps the endpoint's settings.
+                settings: binding.settings,
                 authType: binding.authType,
                 payload,
             });
@@ -474,6 +480,7 @@ export class VaultService {
             provider: binding.provider,
             model: binding.model,
             ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+            ...(binding.settings ? { settings: binding.settings } : {}),
             authType: binding.authType,
             credential,
         };
@@ -500,17 +507,47 @@ export class VaultService {
             });
         });
     }
-    // --- rejected callers ---------------------------------------------------------
-    async reject(route) {
-        await this.store.tx((t) => this.audit(t, {
-            actor: "executor",
-            action: "reject",
-            target: route,
-            outcome: "rejected",
-        }));
-    }
     // --- internals -----------------------------------------------------------------
     /** Calls the token endpoint outside any transaction, then stores the result. */
+    /**
+     * Refreshes an OAuth grant once for every concurrent use in this process. A rotating refresh
+     * token is valid once, so two refreshes with it would fail the second, or make the provider
+     * revoke the grant.
+     */
+    refreshShared(kek, row, payload, sessionId, url) {
+        let pending = this.refreshing.get(row.id);
+        if (!pending) {
+            pending = this.refreshLatest(kek, row, payload, sessionId, url).finally(() => this.refreshing.delete(row.id));
+            this.refreshing.set(row.id, pending);
+        }
+        return pending;
+    }
+    /** Uses a token another process refreshed instead of refreshing again, before and after. */
+    async refreshLatest(kek, row, payload, sessionId, url) {
+        const before = await this.rotatedSince(kek, row);
+        if (before)
+            return { status: "ok", payload: before };
+        const refreshed = await this.refresh(kek, row, payload, sessionId, url);
+        if (refreshed.status === "ok")
+            return refreshed;
+        // The loser of a race with another process fails with the spent refresh token.
+        const after = await this.rotatedSince(kek, row);
+        return after ? { status: "ok", payload: after } : refreshed;
+    }
+    /** The credential's payload when it was rotated after `row` was read and is not due. */
+    async rotatedSince(kek, row) {
+        const current = await this.store.tx((t) => t.getCredential(row.id));
+        if (!current || current.vaultId !== row.vaultId || !isUserCredential(current))
+            return undefined;
+        if (current.rotatedAt === row.rotatedAt || dueForRefresh(current.expiresAt))
+            return undefined;
+        try {
+            return readPayload(kek, current);
+        }
+        catch {
+            return undefined;
+        }
+    }
     async refresh(kek, row, payload, sessionId, url) {
         const failRefresh = async () => {
             await this.store.tx((t) => this.audit(t, {
@@ -557,6 +594,7 @@ export class VaultService {
                 headers,
                 body: body.toString(),
                 redirect: "error",
+                signal: AbortSignal.timeout(this.refreshTimeoutMs),
             });
             if (!response.ok)
                 return failRefresh();
@@ -640,6 +678,8 @@ export class VaultService {
         });
     }
     validateHostModel(body) {
+        if (body.settings && body.provider !== "custom")
+            throw new VaultError(400, "Model settings (context window, output limit, reasoning, compat) apply only to a custom provider.");
         if (body.provider === "custom") {
             if (!body.baseUrl)
                 throw new VaultError(400, "A base URL is required for a custom provider.");
@@ -673,6 +713,9 @@ export class VaultService {
                 provider: input.provider,
                 model: input.model,
                 ...(input.baseUrl ? { baseUrl: input.baseUrl } : {}),
+                ...(input.settings && Object.keys(input.settings).length
+                    ? { settings: input.settings }
+                    : {}),
                 authType: input.authType,
             }),
             expiresAt: null,
@@ -692,6 +735,7 @@ export class VaultService {
             model: binding.model,
             authType: binding.authType,
             ...(binding.baseUrl ? { baseUrl: binding.baseUrl } : {}),
+            ...(binding.settings ? { settings: binding.settings } : {}),
         };
     }
     async hostModelRows(t) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.13.0-beta";
+export declare const RUNTIME_VERSION = "0.14.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.13.0-beta";
+export const RUNTIME_VERSION = "0.14.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.13.0-beta",
+  "version": "0.14.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -30,6 +30,8 @@
       "types": "./dist/configuration.d.ts",
       "import": "./dist/configuration.js"
     },
+    "./openapi.json": "./dist/openapi.json",
+    "./admin-openapi.json": "./dist/admin-openapi.json",
     "./package.json": "./package.json"
   },
   "files": [
@@ -43,7 +45,7 @@
     "provenance": true
   },
   "scripts": {
-    "build": "npm run clean && node ../scripts/check-typescript-version.mjs && tsc -p tsconfig.json",
+    "build": "npm run clean && node ../scripts/check-typescript-version.mjs && tsc -p tsconfig.json && node scripts/build-openapi.mjs",
     "check": "npm run build && npm test && node scripts/check-package.mjs",
     "typecheck": "node ../scripts/check-typescript-version.mjs && tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
@@ -55,21 +57,31 @@
     "start": "node dist/host/main.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@earendil-works/pi-ai": "0.87.0",
+    "@ag-ui/core": "~1.0.0",
+    "@asteasolutions/zod-to-openapi": "^9.1.0",
+    "@earendil-works/pi-ai": "0.99.1",
     "@hono/node-server": "^2.1.1",
-    "@nylorun/harness": "0.20.0-beta",
-    "@nylorun/core": "0.8.0-beta",
+    "@hono/zod-openapi": "^1.6.3",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@nylorun/core": "0.9.0-beta",
+    "@nylorun/harness": "0.21.0-beta",
     "@restatedev/restate-sdk": "1.16.9",
     "@s2-dev/streamstore": "0.27.0",
+    "hono": "^4.13.12",
+    "jose": "^6.2.12",
     "just-bash": "3.4.2",
-    "postgres": "^3.4.9"
+    "pg": "8.23.1",
+    "pg-logical-replication": "2.5.0",
+    "postgres": "^3.4.9",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
+    "@a2a-js/sdk": "~1.3.0",
     "@ag-ui/client": "1.0.0",
+    "@scalar/openapi-parser": "^0.29.9",
     "@types/node": "^26.5.0",
+    "@types/pg": "^8.23.1",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "hono": "^4.13.8",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "vitest": "^5.0.1"
   }

package/dist/core/executors.d.ts

@@ -1,44 +0,0 @@
-import type { ExecutorScope } from "@nylorun/core/contracts";
-import type { SessionStore } from "../store/types.js";
-/**
- * Executor bearer tokens are 256-bit CSPRNG values minted by the CLI and the wire schema
- * requires at least 16 characters, so an unsalted digest is adequate to keep them out of
- * the Session Store at rest. This is not a password KDF and must not be used for one.
- */
-export declare const hashToken: (token: string) => string;
-export interface ExecutorRecord extends ExecutorScope {
-    readonly tokenHash: string;
-    /** Always true under Runtime Tenants; startup env executors are removed (D8). */
-    readonly persisted: boolean;
-    readonly updatedAt: string;
-    /** Application principal that last registered this executor, when known. */
-    readonly principalId?: string;
-}
-/**
- * Rejects tokens that are weak, empty of agent identity, or whose hash equals any
- * application principal hash (A5). Replaces the old `serverToken` equality check.
- */
-export declare function assertExecutorCredential(executor: {
-    agentId: string;
-    implementationVersion: string;
-    token: string;
-}, applicationHashes: readonly string[]): void;
-/** Mint a 32-byte hex application/executor key for tests and CLI bootstrap. */
-export declare function mintBearerToken(): string;
-export declare class ExecutorRegistry {
-    private readonly byHash;
-    private readonly byAgent;
-    seed(records: readonly ExecutorRecord[]): void;
-    find(tokenHash: string): ExecutorRecord | undefined;
-    get(agentId: string): ExecutorRecord | undefined;
-    list(): readonly ExecutorRecord[];
-    upsert(record: ExecutorRecord): {
-        rotated: boolean;
-        previousHash?: string;
-        previousPrincipalId?: string;
-    };
-    remove(agentId: string): ExecutorRecord | undefined;
-    private write;
-}
-/** A registry seeded from the executors the store persisted (at Tenant open). */
-export declare function loadExecutorRegistry(store: SessionStore): Promise<ExecutorRegistry>;

package/dist/core/executors.js

@@ -1,95 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-const equals = (a, b) => {
-    const aa = Buffer.from(a), bb = Buffer.from(b);
-    return aa.length === bb.length && timingSafeEqual(aa, bb);
-};
-/**
- * Executor bearer tokens are 256-bit CSPRNG values minted by the CLI and the wire schema
- * requires at least 16 characters, so an unsalted digest is adequate to keep them out of
- * the Session Store at rest. This is not a password KDF and must not be used for one.
- */
-export const hashToken = (token) => createHash("sha256").update(token, "utf8").digest("hex");
-/**
- * Rejects tokens that are weak, empty of agent identity, or whose hash equals any
- * application principal hash (A5). Replaces the old `serverToken` equality check.
- */
-export function assertExecutorCredential(executor, applicationHashes) {
-    const tokenHash = hashToken(executor.token);
-    const matchesApplication = applicationHashes.some((hash) => equals(hash, tokenHash));
-    if (executor.token.length < 16 ||
-        matchesApplication ||
-        !executor.agentId ||
-        !executor.implementationVersion)
-        throw new Error("Executor tokens require independent credentials and an agent id");
-}
-/** Mint a 32-byte hex application/executor key for tests and CLI bootstrap. */
-export function mintBearerToken() {
-    return randomBytes(32).toString("hex");
-}
-export class ExecutorRegistry {
-    byHash = new Map();
-    byAgent = new Map();
-    seed(records) {
-        for (const record of records)
-            this.write(record);
-    }
-    find(tokenHash) {
-        return this.byHash.get(tokenHash);
-    }
-    get(agentId) {
-        return this.byAgent.get(agentId);
-    }
-    list() {
-        return [...this.byAgent.values()];
-    }
-    upsert(record) {
-        const previous = this.byAgent.get(record.agentId);
-        const collision = this.byHash.get(record.tokenHash);
-        if (collision && collision.agentId !== record.agentId)
-            throw new Error("Executor tokens must be unique");
-        this.write(record);
-        if (!previous || previous.tokenHash === record.tokenHash)
-            return { rotated: false };
-        return {
-            rotated: true,
-            previousHash: previous.tokenHash,
-            ...(previous.principalId === undefined
-                ? {}
-                : { previousPrincipalId: previous.principalId }),
-        };
-    }
-    remove(agentId) {
-        const record = this.byAgent.get(agentId);
-        if (!record)
-            return undefined;
-        this.byAgent.delete(agentId);
-        this.byHash.delete(record.tokenHash);
-        return record;
-    }
-    write(record) {
-        const previous = this.byAgent.get(record.agentId);
-        if (previous)
-            this.byHash.delete(previous.tokenHash);
-        this.byAgent.set(record.agentId, record);
-        this.byHash.set(record.tokenHash, record);
-    }
-}
-/** A registry seeded from the executors the store persisted (at Tenant open). */
-export async function loadExecutorRegistry(store) {
-    const registry = new ExecutorRegistry();
-    const rows = await store.tx((t) => t.listExecutors());
-    registry.seed(rows.map((row) => ({
-        agentId: row.agentId,
-        implementationVersion: row.implementationVersion,
-        ...(row.manifestHash === undefined
-            ? {}
-            : { manifestHash: row.manifestHash }),
-        tokenHash: row.tokenHash,
-        persisted: true,
-        updatedAt: row.updatedAt,
-        ...(row.principalId === undefined
-            ? {}
-            : { principalId: row.principalId }),
-    })));
-    return registry;
-}

package/dist/streams/relay.d.ts

@@ -1,37 +0,0 @@
-import type { SessionStore } from "../store/types.js";
-import { type DurableStreams } from "./types.js";
-/** A session's outbox starts past the end of its stream: events are missing from the stream. */
-export declare class StreamGapError extends Error {
-    constructor(sessionId: string, first: number, tail: number);
-}
-export interface RelayOptions {
-    store: SessionStore;
-    streams: DurableStreams;
-    /** The Tenant whose basin receives the events; must match `store.tenantId`. */
-    tenantId: string;
-    /** Receives append and delete failures. The rows they concern stay in the outbox. */
-    onError?: (error: unknown) => void;
-}
-export interface Relay {
-    /**
-     * Appends leftover outbox rows (at most `limit`, default 1000) per session in
-     * sequence order: the Tenant sweep's recovery after a crash or an S2 outage.
-     * Resolves with the number of rows now in S2 and removed from the outbox.
-     * Per-session failures go to `onError`; those rows stay.
-     */
-    drain(limit?: number): Promise<number>;
-    /** Resolves when every relay started so far has settled. */
-    idle(): Promise<void>;
-    /** Stops listening to commits and waits for in-flight relays. */
-    close(): Promise<void>;
-}
-export declare function createRelay(options: RelayOptions): Relay;
-/** Appends a `work_available` signal to `tenant/work`. Not relayed through the outbox. */
-export declare function signalWork(streams: DurableStreams, tenantId: string): Promise<void>;
-/** Appends a `session.cancel` signal to `tenant/control`. Not relayed through the outbox. */
-export declare function signalCancel(streams: DurableStreams, tenantId: string, sessionId: string): Promise<void>;
-/**
- * Appends a `sessions.reset` signal to `tenant/control`: every process with the Tenant open
- * checks its session feeds against the Session Store.
- */
-export declare function signalSessionsReset(streams: DurableStreams, tenantId: string): Promise<void>;

package/dist/streams/relay.js

@@ -1,254 +0,0 @@
-/**
- * The outbox relay (architecture §12.4, "Writing: outbox and relay").
- *
- * The Session Store writes every event to its outbox in the same transaction
- * as the state change. After the commit the relay appends the events to the
- * stream of their session's incarnation (`sessions/<id>/<incarnation>`) with
- * `matchSeq` set to each batch's first sequence, and deletes the rows S2 has:
- *
- * - **The right incarnation.** A committed event comes with the incarnation
- *   its session had when the event was allocated (`Commit.incarnations`).
- *   Leftover rows (`drain`, and a commit that finds earlier rows still
- *   waiting) are read with the session's incarnation in one transaction that
- *   locks the session; deleting a session deletes its outbox rows in the same
- *   transaction, so those rows belong to the incarnation read. Either way a
- *   session deleted and created again with the same id never gets the old
- *   incarnation's events, or the reverse.
- * - **ok**: the rows are deleted through the last appended sequence, only
- *   while the session still has the incarnation appended to (one statement,
- *   `deleteOutbox` with `incarnation`).
- * - **`seq_mismatch` with the tail past the batch start**: an earlier attempt
- *   (this process or another) already appended those events. The rows below
- *   the tail are deleted, and whatever is left of the batch is appended from
- *   the tail.
- * - **`seq_mismatch` with the tail before the batch start**: earlier events of
- *   the session are still in the outbox (an earlier append failed), and the
- *   session's outbox is relayed in sequence order, which includes this batch.
- *   If the outbox's first row is past the tail, events are missing from the
- *   stream: the rows stay and the error goes to `onError`.
- * - **append throws** (S2 unreachable, basin missing): the rows stay in the
- *   outbox and the error goes to `onError`. The next commit of the session, or
- *   the Tenant sweep's `drain`, appends them in order.
- *
- * Conditional appends make this exactly-once and in order per session however
- * many processes relay the same rows. Within one process the relay also runs
- * one relay at a time per session.
- *
- * `work_available`, `session.cancel` and `sessions.reset` are signals, not
- * canonical events: they skip the outbox (`signalWork`, `signalCancel`,
- * `signalSessionsReset`). A commit that called `t.signalWork()` is signalled
- * by the relay after its events.
- */
-import { decodeCursor } from "../store/cursor.js";
-import { CONTROL_STREAM, WORK_AVAILABLE, WORK_STREAM, streamOfSession, } from "./types.js";
-/** A session's outbox starts past the end of its stream: events are missing from the stream. */
-export class StreamGapError extends Error {
-    constructor(sessionId, first, tail) {
-        super(`Outbox of session ${sessionId} starts at ${first}, past the end of its stream at ${tail}; events before it are missing`);
-        this.name = "StreamGapError";
-    }
-}
-/** At most this many records per append (S2 allows 1000). */
-const MAX_BATCH_RECORDS = 500;
-/** At most this many bytes of JSON per append (S2 allows 1 MiB metered). */
-const MAX_BATCH_BYTES = 768 * 1024;
-/** Outbox rows read per page while relaying one session. */
-const DRAIN_PAGE = 1000;
-export function createRelay(options) {
-    const { store, streams, tenantId } = options;
-    if (store.tenantId !== tenantId)
-        throw new Error(`Relay tenant ${tenantId} does not match store tenant ${store.tenantId}`);
-    const onError = options.onError ?? (() => { });
-    /** sessionId → tail of that session's relay chain. */
-    const chains = new Map();
-    const pending = new Set();
-    let closed = false;
-    /** Runs `task` after every earlier task of the same session. */
-    function serialize(sessionId, task) {
-        const previous = chains.get(sessionId) ?? Promise.resolve();
-        const run = previous.then(task, task);
-        const settled = run.then(() => undefined, () => undefined);
-        chains.set(sessionId, settled);
-        pending.add(settled);
-        void settled.then(() => {
-            pending.delete(settled);
-            if (chains.get(sessionId) === settled)
-                chains.delete(sessionId);
-        });
-        return run;
-    }
-    /**
-     * Appends `rows` (one session, ascending, contiguous) to the stream of `incarnation`
-     * with `matchSeq`, and deletes what S2 has while the session still has that incarnation.
-     * Throws a `StreamGapError` when the stream's tail is before the first row still to append.
-     */
-    async function appendRows(sessionId, incarnation, rows) {
-        const stream = streamOfSession({
-            id: sessionId,
-            ...(incarnation === null ? {} : { streamIncarnation: incarnation }),
-        });
-        const deleteThrough = (seq) => store.tx((t) => t.deleteOutbox(sessionId, seq, incarnation));
-        let rest = rows;
-        while (rest.length > 0) {
-            const batch = takeBatch(rest);
-            const first = batch[0].seq;
-            const last = batch[batch.length - 1].seq;
-            const result = await streams.append(tenantId, stream, batch.map((row) => row.event), { matchSeq: first });
-            if (result.status === "ok") {
-                await deleteThrough(last);
-                rest = rest.slice(batch.length);
-            }
-            else if (result.tail > first) {
-                // Already appended by an earlier attempt: S2 has everything below the tail.
-                await deleteThrough(result.tail - 1);
-                rest = rest.filter((row) => row.seq >= result.tail);
-            }
-            else {
-                throw new StreamGapError(sessionId, first, result.tail);
-            }
-        }
-    }
-    /**
-     * Appends the session's outbox rows in sequence order, at most `limit`, reading them with
-     * the session's incarnation under its lock. Resolves with the number relayed.
-     */
-    async function relaySession(sessionId, limit = Infinity) {
-        let relayed = 0;
-        while (relayed < limit) {
-            const page = Math.min(DRAIN_PAGE, limit - relayed);
-            const read = await store.tx(async (t) => {
-                const session = await t.lockSession(sessionId);
-                // A deleted session took its outbox rows with it.
-                if (!session)
-                    return undefined;
-                return {
-                    incarnation: session.streamIncarnation ?? null,
-                    rows: await t.outbox(page, { sessionId }),
-                };
-            });
-            if (!read || read.rows.length === 0)
-                return relayed;
-            const run = contiguous(read.rows);
-            await appendRows(sessionId, read.incarnation, run);
-            relayed += run.length;
-            // A gap inside the outbox: the next page starts at it and reports it.
-            if (read.rows.length < page && run.length === read.rows.length)
-                return relayed;
-        }
-        return relayed;
-    }
-    /**
-     * Appends one commit's rows of a session to the stream of the incarnation they were
-     * written under. When earlier rows are still in the outbox, relays the whole outbox.
-     */
-    async function relayCommitted(sessionId, incarnation, rows) {
-        try {
-            await appendRows(sessionId, incarnation, contiguous(rows));
-        }
-        catch (error) {
-            if (!(error instanceof StreamGapError))
-                throw error;
-            await relaySession(sessionId);
-        }
-    }
-    function onCommit(commit) {
-        if (closed)
-            return;
-        /** `sessionId\0incarnation` → the commit's rows of that incarnation. */
-        const groups = new Map();
-        commit.events.forEach((event, i) => {
-            let seq;
-            try {
-                seq = decodeCursor(event.sessionId, event.cursor);
-            }
-            catch {
-                onError(new Error(`Event ${event.eventId} has an invalid cursor; left for the sweep`));
-                return;
-            }
-            const incarnation = commit.incarnations[i] ?? null;
-            const key = `${event.sessionId}\u0000${incarnation ?? ""}`;
-            let group = groups.get(key);
-            if (!group)
-                groups.set(key, (group = { sessionId: event.sessionId, incarnation, rows: [] }));
-            group.rows.push({ sessionId: event.sessionId, seq, event });
-        });
-        const relays = [...groups.values()].map(({ sessionId, incarnation, rows }) => {
-            rows.sort((a, b) => a.seq - b.seq);
-            return serialize(sessionId, () => relayCommitted(sessionId, incarnation, rows)).catch(onError);
-        });
-        if (commit.workAvailable) {
-            const signalled = Promise.all(relays)
-                .then(() => signalWork(streams, tenantId))
-                .catch(onError);
-            pending.add(signalled);
-            void signalled.then(() => pending.delete(signalled));
-        }
-    }
-    const unsubscribe = store.onCommit(onCommit);
-    async function idle() {
-        while (pending.size > 0)
-            await Promise.all([...pending]);
-    }
-    return {
-        async drain(limit = 1000) {
-            const rows = await store.tx((t) => t.outbox(limit));
-            const bySession = new Map();
-            for (const row of rows)
-                bySession.set(row.sessionId, (bySession.get(row.sessionId) ?? 0) + 1);
-            const counts = await Promise.all([...bySession].map(([sessionId, count]) => 
-            // Rows may have been relayed since they were read; the conditional
-            // appends skip those.
-            serialize(sessionId, () => relaySession(sessionId, count)).catch((error) => {
-                onError(error);
-                return 0;
-            })));
-            return counts.reduce((sum, n) => sum + n, 0);
-        },
-        idle,
-        async close() {
-            closed = true;
-            unsubscribe();
-            await idle();
-        },
-    };
-}
-/** Appends a `work_available` signal to `tenant/work`. Not relayed through the outbox. */
-export async function signalWork(streams, tenantId) {
-    await streams.append(tenantId, WORK_STREAM, [WORK_AVAILABLE]);
-}
-/** Appends a `session.cancel` signal to `tenant/control`. Not relayed through the outbox. */
-export async function signalCancel(streams, tenantId, sessionId) {
-    if (!sessionId)
-        throw new Error("sessionId is required");
-    const signal = { type: "session.cancel", sessionId };
-    await streams.append(tenantId, CONTROL_STREAM, [signal]);
-}
-/**
- * Appends a `sessions.reset` signal to `tenant/control`: every process with the Tenant open
- * checks its session feeds against the Session Store.
- */
-export async function signalSessionsReset(streams, tenantId) {
-    const signal = { type: "sessions.reset" };
-    await streams.append(tenantId, CONTROL_STREAM, [signal]);
-}
-// ---------------------------------------------------------------------------
-/** The leading run of `rows` (ascending) without a sequence gap. */
-function contiguous(rows) {
-    let n = 1;
-    while (n < rows.length && rows[n].seq === rows[n - 1].seq + 1)
-        n += 1;
-    return rows.slice(0, n);
-}
-/** The leading rows that fit one append. Always at least one row. */
-function takeBatch(rows) {
-    let bytes = 0;
-    let n = 0;
-    while (n < rows.length && n < MAX_BATCH_RECORDS) {
-        const size = JSON.stringify(rows[n].event).length + 8;
-        if (n > 0 && bytes + size > MAX_BATCH_BYTES)
-            break;
-        bytes += size;
-        n += 1;
-    }
-    return rows.slice(0, n);
-}