@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/store/postgres/store.js

@@ -1,16 +1,25 @@
 /**
- * The Postgres Session Store (architecture §12.2): one Tenant schema, one
- * `SessionStore`. See `store/types.ts` for the invariants it keeps.
+ * The Postgres Session Store (architecture §12.2, session-store.md §2–§3): the `SessionStore`
+ * of the one Tenant a database holds, its state in the schema `nylorun` and its record in
+ * `nylorun_streams`, queried through Drizzle (`schema.ts`). See `store/types.ts` for the
+ * invariants it keeps.
+ *
+ * ## Queries
+ *
+ * Plain reads and writes use Drizzle's query builder: `.set(patch)` and `and(...)` skip
+ * `undefined`, rows come back in the camelCase of `schema.ts`. Statements whose logic is SQL
+ * stay `sql` fragments inside it: the endpoint upsert's `CASE` arms, the log-head upsert,
+ * `orphanedSessions`' ordering, `counts()`, advisory locks and array updates.
  *
  * ## Transactions
  *
- * Every `tx` is one READ COMMITTED transaction on a pooled connection. Tables
- * are addressed by fully qualified, quoted names (`"tenant_<id>"."sessions"`),
- * never through `search_path`, so a statement cannot reach another schema.
- * Commit listeners and `afterCommit` callbacks run after `COMMIT` returns and
- * never reject the committed `tx`. Nested `tx` calls are detected with
- * `AsyncLocalStorage` and rejected, and a `Tx` rejects every call once its
- * callback settles.
+ * Every `tx` is one READ COMMITTED transaction on a pooled connection (Drizzle's
+ * `transaction` on postgres.js `begin`). Tables are addressed by schema-qualified names,
+ * never through `search_path`. Commit listeners and `afterCommit` callbacks run after `COMMIT`
+ * returns and never reject the committed `tx`. Nested `tx` calls are detected with
+ * `AsyncLocalStorage` and rejected, and a `Tx` rejects every call once its callback settles.
+ * A failed statement rejects `tx` with the driver's error (`driverError`), not Drizzle's
+ * wrapper, so its SQLSTATE is `code`.
  *
  * ## Lock ordering
  *
@@ -19,7 +28,8 @@
  * ends. To stay deadlock-free:
  *
  * 1. A session-scoped transaction locks its session row before writing any
- *    other row of that session (effects, actions, checkpoints, outbox).
+ *    other row of that session (effects, actions, its record rows and log
+ *    head).
  * 2. A transaction that touches several sessions locks them in ascending id
  *    order, with `lockSessions` (`./locking.ts`), before writing any of them.
  *
@@ -29,27 +39,45 @@
  *
  * ## Values
  *
- * Document and outbox bodies are `json`, stored as the text `JSON.stringify`
- * wrote, so every string round-trips, including U+0000 and unpaired
- * surrogates that `jsonb` rejects (see `migrations/001_initial.ts`), and key
- * order is kept. Ids and ISO timestamps compared as text use `COLLATE "C"`.
- * Lease times in action bodies are compared as `timestamptz`.
+ * Document and event bodies are `json`, stored as the text `JSON.stringify`
+ * wrote (`jsonText` in `schema.ts`), so every string round-trips, including U+0000 and
+ * unpaired surrogates that `jsonb` rejects, and key order is kept. Ids and ISO timestamps
+ * compared as text are `COLLATE "C"`. Delivery deadlines in action bodies are compared as
+ * `timestamptz`.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
-import { encodeCursor } from "../cursor.js";
+import { and, count, eq, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, ne, or, sql, } from "drizzle-orm";
+import { appendEvent } from "../../record/index.js";
 import { OwnershipLostError } from "../ownership.js";
-import { POSTGRES_SCHEMA_VERSION, readSchemaVersion } from "./migrations/index.js";
-import { assertIdentifier, tenantSchemaName } from "./names.js";
+import { database, driverError } from "./db.js";
+import { expectedSchemaVersion, readSchemaVersion } from "./migrate.js";
+import { createPostgresRecordReader } from "./record.js";
+import { postgresRecordWriter } from "./record-writer.js";
+import { actions, commands, definitions, effects, endpoints, links, modelBudgets, modelUsage, principals, publishableKeys, sandboxes, sessionEvents, sessionLogHeads, sessions, toolCrossings, signingKeys, subjectEpochs, subjectUsage, tenant, tenantSettings, vaultAudit, vaultCredentials, vaultIdempotency, vaults, } from "./schema.js";
 export function createPostgresSessionStore(options) {
     return new PostgresSessionStore(options);
 }
-const OWNERSHIP_KEYS = new Set(["owner", "epoch", "ownerExpiresAt"]);
 const OPEN_SESSION = ["running", "runnable"];
+const DOCUMENTS = {
+    definitions,
+    sessions: sessions,
+    commands,
+    effects: effects,
+    actions: actions,
+    sandboxes,
+    links: links,
+};
+/** A session row as `StoredSession` reads it: the body and the ownership columns. */
+const SESSION = {
+    body: sessions.body,
+    owner: sessions.owner,
+    epoch: sessions.epoch,
+    ownerExpiresAt: sessions.ownerExpiresAt,
+};
 class PostgresSessionStore {
     tenantId;
     sql;
-    schema;
+    db;
     schemaVersion;
     active = new AsyncLocalStorage();
     listeners = new Set();
@@ -60,9 +88,8 @@ class PostgresSessionStore {
     constructor(options) {
         this.tenantId = options.tenantId;
         this.sql = options.sql;
-        this.schema = options.schema ?? tenantSchemaName(options.tenantId);
-        assertIdentifier(this.schema);
-        this.schemaVersion = options.schemaVersion ?? POSTGRES_SCHEMA_VERSION;
+        this.db = database(options.sql);
+        this.schemaVersion = options.schemaVersion ?? expectedSchemaVersion();
         this.now = options.now ?? (() => new Date());
         this.onError =
             options.onError ??
@@ -77,28 +104,30 @@ class PostgresSessionStore {
             throw new Error("Nested SessionStore.tx is not allowed");
         let t;
         // Wrapped so `begin` does not treat an array result as queries to await.
-        const run = this.sql.begin("isolation level read committed", async (sql) => {
-            t = new PostgresTx(sql, this.schema, this.tenantId, this.now);
+        const run = this.db.transaction(async (db) => {
+            t = new PostgresTx(db, this.tenantId, this.now);
             try {
                 return { value: await this.active.run(this, () => fn(t)) };
             }
             finally {
                 t.closed = true;
             }
-        });
+        }, { isolationLevel: "read committed" });
         this.inflight.add(run);
         let result;
         try {
-            result = (await run);
+            result = await run;
+        }
+        catch (error) {
+            throw driverError(error);
         }
         finally {
             this.inflight.delete(run);
         }
-        if (t.events.length > 0 || t.workAvailable) {
+        if (t.events.length > 0) {
             const commit = {
                 events: t.events,
-                incarnations: t.incarnations,
-                workAvailable: t.workAvailable,
+                generations: t.generations,
             };
             for (const listener of [...this.listeners]) {
                 try {
@@ -123,12 +152,15 @@ class PostgresSessionStore {
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
     }
+    record() {
+        return createPostgresRecordReader(this.sql, { tenantId: this.tenantId });
+    }
     async health() {
         const expectedSchemaVersion = this.schemaVersion;
         if (this.closed)
             return { ok: false, schemaVersion: 0, expectedSchemaVersion };
         try {
-            const schemaVersion = (await readSchemaVersion(this.sql, this.schema)) ?? 0;
+            const schemaVersion = (await readSchemaVersion(this.db)) ?? 0;
             return {
                 ok: schemaVersion === expectedSchemaVersion,
                 schemaVersion,
@@ -145,120 +177,43 @@ class PostgresSessionStore {
         await Promise.allSettled([...this.inflight]);
     }
 }
-// ---------------------------------------------------------------------------
 function storedSession(row) {
     return { ...row.body, ...ownership(row) };
 }
 function ownership(row) {
     return {
-        owner: row.owner ?? null,
-        epoch: Number(row.epoch),
-        ownerExpiresAt: row.owner_expires_at
-            ? new Date(row.owner_expires_at).toISOString()
-            : null,
+        owner: row.owner,
+        epoch: row.epoch,
+        ownerExpiresAt: row.ownerExpiresAt?.toISOString() ?? null,
     };
 }
-function toJson(value) {
-    const json = JSON.stringify(value);
-    if (json === undefined)
-        throw new Error("Document body must be JSON");
-    return json;
+/** An endpoint row with its unset (null) columns left out, as `EndpointRow` has them. */
+function endpointRow(row) {
+    return Object.fromEntries(Object.entries(row).filter(([, value]) => value !== null));
 }
-const bytes = (value) => Buffer.from(value.buffer, value.byteOffset, value.byteLength);
-const fromBytes = (value) => new Uint8Array(value);
-function executorRow(row) {
-    return {
-        agentId: row.agent_id,
-        tokenHash: row.token_hash,
-        implementationVersion: row.implementation_version,
-        ...(row.manifest_hash !== null ? { manifestHash: row.manifest_hash } : {}),
-        ...(row.principal_id !== null ? { principalId: row.principal_id } : {}),
-        createdAt: row.created_at,
-        updatedAt: row.updated_at,
-    };
-}
-function principalRow(row) {
-    return {
-        id: row.id,
-        role: row.role,
-        tokenHash: row.token_hash,
-        idempotencyKey: row.idempotency_key,
-        createdAt: row.created_at,
-    };
-}
-function vaultRow(row) {
-    return {
-        id: row.id,
-        name: row.name,
-        ownerUserId: row.owner_user_id,
-        metadataJson: row.metadata_json,
-        createdAt: row.created_at,
-        scope: row.scope,
-    };
-}
-function credentialRow(row) {
-    return {
-        id: row.id,
-        vaultId: row.vault_id,
-        name: row.name,
-        type: row.type,
-        bindingJson: row.binding_json,
-        expiresAt: row.expires_at,
-        createdAt: row.created_at,
-        rotatedAt: row.rotated_at,
-        kekId: row.kek_id,
-        nonce: fromBytes(row.nonce),
-        ciphertext: fromBytes(row.ciphertext),
-        wrappedDek: fromBytes(row.wrapped_dek),
-    };
-}
-function auditRow(row) {
-    return {
-        id: row.id,
-        at: row.at,
-        actor: row.actor,
-        action: row.action,
-        vaultId: row.vault_id,
-        credentialId: row.credential_id,
-        sessionId: row.session_id,
-        target: row.target,
-        outcome: row.outcome,
-    };
-}
-/** `VaultCredentialPatch` field → column. */
-const CREDENTIAL_COLUMNS = {
-    name: "name",
-    type: "type",
-    bindingJson: "binding_json",
-    expiresAt: "expires_at",
-    rotatedAt: "rotated_at",
-    kekId: "kek_id",
-    nonce: "nonce",
-    ciphertext: "ciphertext",
-    wrappedDek: "wrapped_dek",
+/** The time column a signing key's new state stamps. */
+const SIGNING_KEY_STAMP = {
+    current: "activatedAt",
+    previous: "retiredAt",
+    revoked: "revokedAt",
 };
-const SESSION_TABLES = [
-    "sessions",
-    "commands",
-    "checkpoints",
-    "effects",
-    "actions",
-    "links",
-    "outbox",
-];
+/** The audit columns a row has (`ord` only orders them). */
+const { ord: _ord, ...AUDIT } = getTableColumns(vaultAudit);
+const SESSION_TABLES = [sessions, commands, effects, actions, links];
+/** The inserted row's `column` (`ON CONFLICT … DO UPDATE`). */
+const excluded = (column) => sql.raw(`excluded.${column}`);
+/** Keeps an endpoint's health `column` when its URL stays; a new URL starts with `fresh`. */
+const sameUrl = (column, fresh = sql `NULL`) => sql `CASE WHEN ${endpoints.url} = excluded.url THEN ${column} ELSE ${fresh} END`;
 class PostgresTx {
-    sql;
-    schema;
+    db;
     tenantId;
     now;
     closed = false;
     events = [];
-    incarnations = [];
+    generations = [];
     callbacks = [];
-    workAvailable = false;
-    constructor(sql, schema, tenantId, now) {
-        this.sql = sql;
-        this.schema = schema;
+    constructor(db, tenantId, now) {
+        this.db = db;
         this.tenantId = tenantId;
         this.now = now;
     }
@@ -266,99 +221,79 @@ class PostgresTx {
         if (this.closed)
             throw new Error("Tx used after its transaction ended");
     }
-    /** The quoted, schema-qualified table. */
-    t(table) {
-        return this.sql(`${this.schema}.${table}`);
-    }
     // --- documents -----------------------------------------------------------
     async get(table, id) {
         this.check();
-        const sql = this.sql;
         if (table === "sessions") {
-            const [row] = await sql `
-        SELECT body, owner, epoch, owner_expires_at FROM ${this.t("sessions")}
-        WHERE id = ${id}`;
+            const [row] = await this.sessions().where(eq(sessions.id, id));
             return row && storedSession(row);
         }
-        const [row] = await sql `SELECT body FROM ${this.t(table)} WHERE id = ${id}`;
+        const t = DOCUMENTS[table];
+        const [row] = await this.db.select({ body: t.body }).from(t).where(eq(t.id, id));
         return row?.body;
     }
     async put(table, id, body) {
         this.check();
         let value = body;
-        if (table === "sessions" && body && typeof body === "object")
-            value = Object.fromEntries(Object.entries(body).filter(([key]) => !OWNERSHIP_KEYS.has(key)));
-        const json = toJson(value);
-        await this.sql `
-      INSERT INTO ${this.t(table)} (id, body) VALUES (${id}, ${json}::text::json)
-      ON CONFLICT (id) DO UPDATE SET body = excluded.body`;
+        if (table === "sessions" && body && typeof body === "object") {
+            // Ownership is store-managed: never in the body.
+            const { owner: _owner, epoch: _epoch, ownerExpiresAt: _expires, ...rest } = body;
+            value = rest;
+        }
+        const t = DOCUMENTS[table];
+        await this.db
+            .insert(t)
+            .values({ id, body: value })
+            .onConflictDoUpdate({ target: t.id, set: { body: excluded("body") } });
     }
     async delete(table, id) {
         this.check();
-        await this.sql `DELETE FROM ${this.t(table)} WHERE id = ${id}`;
-        // The session's stream is abandoned with it (a new incarnation starts at 0).
-        if (table === "sessions")
-            await this.sql `DELETE FROM ${this.t("outbox")} WHERE session_id = ${id}`;
-    }
-    async sessionRows(where, tail) {
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT body, owner, epoch, owner_expires_at FROM ${this.t("sessions")}
-      ${where ? sql `WHERE ${where}` : sql ``}
-      ${tail ?? sql `ORDER BY id`}`;
-        return rows.map((row) => storedSession(row));
+        // A session's record rows and log head stay: a session created again with this id
+        // continues its log (per-session record deletion is deferred, Durable Streams §15).
+        const t = DOCUMENTS[table];
+        await this.db.delete(t).where(eq(t.id, id));
+    }
+    sessions() {
+        return this.db.select(SESSION).from(sessions).$dynamic();
     }
     // --- ordering ------------------------------------------------------------
     async lockSession(id) {
         this.check();
-        const [row] = await this.sql `
-      SELECT body, owner, epoch, owner_expires_at FROM ${this.t("sessions")}
-      WHERE id = ${id} FOR UPDATE`;
+        const [row] = await this.sessions().where(eq(sessions.id, id)).for("update");
         return row && storedSession(row);
     }
     async event(sessionId, turnId, type, payload) {
         this.check();
-        const sql = this.sql;
-        // The UPDATE takes the session row lock and allocates under it.
-        const [row] = await sql `
-      UPDATE ${this.t("sessions")} SET next_event_seq = next_event_seq + 1
-      WHERE id = ${sessionId}
-      RETURNING next_event_seq - 1 AS seq, stream_incarnation AS incarnation`;
-        if (!row)
+        const db = this.db;
+        // The session row lock orders the session's events; the log head allocates under it.
+        const [session] = await db
+            .select({ epoch: sessions.epoch })
+            .from(sessions)
+            .where(eq(sessions.id, sessionId))
+            .for("update");
+        if (!session)
             throw new Error(`Session ${sessionId} not found`);
-        const seq = Number(row.seq);
-        const event = JSON.parse(JSON.stringify({
-            eventId: randomUUID(),
-            sessionId,
+        const { event, generation } = await appendEvent(postgresRecordWriter(db), {
             tenantId: this.tenantId,
+            sessionId,
             turnId,
-            cursor: encodeCursor(sessionId, seq),
-            createdAt: this.now().toISOString(),
+            epoch: session.epoch,
+            time: this.now(),
             type,
             payload,
-        }));
-        await sql `
-      INSERT INTO ${this.t("outbox")} (session_id, seq, body)
-      VALUES (${sessionId}, ${seq}, ${JSON.stringify(event)}::text::json)`;
+        });
         this.events.push(event);
-        this.incarnations.push(row.incarnation ?? null);
+        this.generations.push(generation);
         return structuredClone(event);
     }
     afterCommit(fn) {
         this.check();
         this.callbacks.push(fn);
     }
-    signalWork() {
-        this.check();
-        this.workAvailable = true;
-    }
     // --- ownership -----------------------------------------------------------
     async takeOwnership(sessionId, claim) {
         this.check();
-        const sql = this.sql;
-        const [row] = await sql `
-      SELECT owner, epoch, owner_expires_at FROM ${this.t("sessions")}
-      WHERE id = ${sessionId} FOR UPDATE`;
+        const [row] = await this.sessions().where(eq(sessions.id, sessionId)).for("update");
         if (!row)
             return { status: "missing" };
         const previous = ownership(row);
@@ -370,30 +305,36 @@ class PostgresTx {
                 owner: previous.owner,
                 ownerExpiresAt: previous.ownerExpiresAt,
             };
-        const expires = new Date(claim.now.getTime() + claim.leaseMs);
-        const [updated] = await sql `
-      UPDATE ${this.t("sessions")}
-      SET owner = ${claim.owner}, epoch = epoch + 1, owner_expires_at = ${expires}
-      WHERE id = ${sessionId} RETURNING epoch`;
+        const [updated] = await this.db
+            .update(sessions)
+            .set({
+            owner: claim.owner,
+            epoch: sql `${sessions.epoch} + 1`,
+            ownerExpiresAt: new Date(claim.now.getTime() + claim.leaseMs),
+        })
+            .where(eq(sessions.id, sessionId))
+            .returning({ epoch: sessions.epoch });
         return {
             status: "owned",
-            epoch: Number(updated.epoch),
+            epoch: updated.epoch,
             takeover: previous.owner !== null,
             previous,
         };
     }
     async renewOwnership(sessionId, owner, epoch, until) {
         this.check();
-        const result = await this.sql `
-      UPDATE ${this.t("sessions")} SET owner_expires_at = ${until}
-      WHERE id = ${sessionId} AND owner = ${owner} AND epoch = ${epoch}`;
+        const result = await this.db
+            .update(sessions)
+            .set({ ownerExpiresAt: until })
+            .where(and(eq(sessions.id, sessionId), eq(sessions.owner, owner), eq(sessions.epoch, epoch)));
         return result.count > 0;
     }
     async releaseOwnership(sessionId, owner, epoch) {
         this.check();
-        const result = await this.sql `
-      UPDATE ${this.t("sessions")} SET owner = NULL, owner_expires_at = NULL
-      WHERE id = ${sessionId} AND owner = ${owner} AND epoch = ${epoch}`;
+        const result = await this.db
+            .update(sessions)
+            .set({ owner: null, ownerExpiresAt: null })
+            .where(and(eq(sessions.id, sessionId), eq(sessions.owner, owner), eq(sessions.epoch, epoch)));
         return result.count > 0;
     }
     async assertEpoch(sessionId, epoch) {
@@ -407,79 +348,97 @@ class PostgresTx {
     // --- typed queries -------------------------------------------------------
     async sessionsWithStatus(statuses) {
         this.check();
-        return this.sessionRows(this.sql `status = ANY(${[...statuses]})`);
+        const rows = await this.sessions()
+            .where(inArray(sessions.status, statuses))
+            .orderBy(sessions.id);
+        return rows.map((row) => storedSession(row));
     }
     async orphanedSessions(now, limit) {
         this.check();
-        const sql = this.sql;
-        return this.sessionRows(sql `status = ANY(${OPEN_SESSION})
-        AND (owner IS NULL OR owner_expires_at IS NULL OR owner_expires_at <= ${now})`, sql `ORDER BY
-        CASE WHEN owner IS NULL THEN NULL ELSE owner_expires_at END ASC NULLS FIRST,
-        id
-        LIMIT ${limit}`);
+        const rows = await this.sessions()
+            .where(and(inArray(sessions.status, OPEN_SESSION), or(isNull(sessions.owner), isNull(sessions.ownerExpiresAt), lte(sessions.ownerExpiresAt, now))))
+            // Never-owned sessions first, then the longest expired.
+            .orderBy(sql `CASE WHEN ${sessions.owner} IS NULL THEN NULL ELSE ${sessions.ownerExpiresAt} END ASC NULLS FIRST`, sessions.id)
+            .limit(limit);
+        return rows.map((row) => storedSession(row));
     }
     async listSessions(filter = {}) {
         this.check();
-        const sql = this.sql;
-        const conditions = [
-            ...(filter.agentId === undefined ? [] : [sql `agent_id = ${filter.agentId}`]),
-            ...(filter.ownerUserId === undefined
-                ? []
-                : [sql `owner_user_id = ${filter.ownerUserId}`]),
-        ];
-        return this.sessionRows(conditions.length === 0
+        const rows = await this.sessions()
+            .where(and(filter.agentId === undefined ? undefined : eq(sessions.agentId, filter.agentId), filter.ownerUserId === undefined
             ? undefined
-            : conditions.reduce((all, next) => sql `${all} AND ${next}`));
+            : eq(sessions.ownerUserId, filter.ownerUserId)))
+            .orderBy(sessions.id);
+        return rows.map((row) => storedSession(row));
     }
     async bodies(table) {
-        const rows = await this.sql `SELECT body FROM ${this.t(table)} ORDER BY id`;
+        const rows = await this.db.select({ body: table.body }).from(table).orderBy(table.id);
         return rows.map((row) => row.body);
     }
     async listDefinitions() {
         this.check();
-        return this.bodies("definitions");
+        return this.bodies(definitions);
     }
     async listSandboxes() {
         this.check();
-        return this.bodies("sandboxes");
+        return this.bodies(sandboxes);
     }
-    async expiredClaims(now, limit) {
-        this.check();
-        const rows = await this.sql `
-      SELECT body FROM ${this.t("actions")}
-      WHERE status = 'claimed' AND lease_expires_at IS NOT NULL
-        AND lease_expires_at::timestamptz <= ${now}
-      ORDER BY lease_expires_at::timestamptz, id
-      LIMIT ${limit}`;
+    async actionBodies(where) {
+        const rows = await this.db
+            .select({ body: actions.body })
+            .from(actions)
+            .where(where)
+            .orderBy(actions.id);
         return rows.map((row) => row.body);
     }
     async pendingActions(agentId) {
         this.check();
-        const rows = await this.sql `
-      SELECT body FROM ${this.t("actions")}
-      WHERE agent_id = ${agentId} AND status = 'pending'
-      ORDER BY id`;
+        return this.actionBodies(and(eq(actions.agentId, agentId), eq(actions.status, "pending")));
+    }
+    async deliveringCount(agentId) {
+        this.check();
+        const [row] = await this.db
+            .select({ n: count() })
+            .from(actions)
+            .where(and(eq(actions.agentId, agentId), eq(actions.status, "delivering")));
+        return row.n;
+    }
+    async pendingActionsWithEndpoint(limit) {
+        this.check();
+        const rows = await this.db
+            .select({ body: actions.body })
+            .from(actions)
+            .innerJoin(endpoints, eq(endpoints.agentId, actions.agentId))
+            .where(eq(actions.status, "pending"))
+            .orderBy(actions.id)
+            .limit(limit);
         return rows.map((row) => row.body);
     }
-    async actionsForSession(sessionId, filter = {}) {
+    async expiredDeliveries(now, limit) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT body FROM ${this.t("actions")}
-      WHERE session_id = ${sessionId}
-      ${filter.turnId === undefined ? sql `` : sql `AND turn_id = ${filter.turnId}`}
-      ${filter.statuses === undefined ? sql `` : sql `AND status = ANY(${[...filter.statuses]})`}
-      ORDER BY id`;
+        const deadline = sql `${actions.deadlineAt}::timestamptz`;
+        const rows = await this.db
+            .select({ body: actions.body })
+            .from(actions)
+            .where(and(eq(actions.status, "delivering"), isNotNull(actions.deadlineAt), sql `${deadline} <= ${now.toISOString()}::timestamptz`))
+            .orderBy(deadline, actions.id)
+            .limit(limit);
         return rows.map((row) => row.body);
     }
+    async actionsForSession(sessionId, filter = {}) {
+        this.check();
+        return this.actionBodies(and(eq(actions.sessionId, sessionId), filter.turnId === undefined ? undefined : eq(actions.turnId, filter.turnId), filter.statuses === undefined ? undefined : inArray(actions.status, filter.statuses)));
+    }
     async actionsWithStatus(statuses, filter = {}) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT body FROM ${this.t("actions")}
-      WHERE status = ANY(${[...statuses]})
-      ${filter.kinds === undefined ? sql `` : sql `AND kind = ANY(${[...filter.kinds]})`}
-      ORDER BY id`;
+        return this.actionBodies(and(inArray(actions.status, statuses), filter.kinds === undefined ? undefined : inArray(actions.kind, filter.kinds)));
+    }
+    async effectBodies(where) {
+        const rows = await this.db
+            .select({ body: effects.body })
+            .from(effects)
+            .where(where)
+            .orderBy(effects.id);
         return rows.map((row) => row.body);
     }
     async invokingEffects(sessionId) {
@@ -487,35 +446,23 @@ class PostgresTx {
     }
     async effectsForSession(sessionId, filter = {}) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT body FROM ${this.t("effects")}
-      WHERE session_id = ${sessionId}
-      ${filter.turnId === undefined ? sql `` : sql `AND turn_id = ${filter.turnId}`}
-      ${filter.statuses === undefined ? sql `` : sql `AND status = ANY(${[...filter.statuses]})`}
-      ORDER BY id`;
-        return rows.map((row) => row.body);
+        return this.effectBodies(and(eq(effects.sessionId, sessionId), filter.turnId === undefined ? undefined : eq(effects.turnId, filter.turnId), filter.statuses === undefined ? undefined : inArray(effects.status, filter.statuses)));
     }
     async effectsForTurn(sessionId, turnId, statuses) {
         return this.effectsForSession(sessionId, { turnId, statuses });
     }
     async effectsWithStatus(statuses, filter = {}) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT body FROM ${this.t("effects")}
-      WHERE status = ANY(${[...statuses]})
-      ${filter.kinds === undefined ? sql `` : sql `AND kind = ANY(${[...filter.kinds]})`}
-      ORDER BY id`;
-        return rows.map((row) => row.body);
+        return this.effectBodies(and(inArray(effects.status, statuses), filter.kinds === undefined ? undefined : inArray(effects.kind, filter.kinds)));
     }
     async linkedSessions(workflowSessionId) {
         this.check();
-        const rows = await this.sql `
-      SELECT l.id, l.body AS link, s.body, s.owner, s.epoch, s.owner_expires_at
-      FROM ${this.t("links")} l JOIN ${this.t("sessions")} s ON s.id = l.id
-      WHERE l.workflow_session_id = ${workflowSessionId}
-      ORDER BY l.id`;
+        const rows = await this.db
+            .select({ id: links.id, link: links.body, ...SESSION })
+            .from(links)
+            .innerJoin(sessions, eq(sessions.id, links.id))
+            .where(eq(links.workflowSessionId, workflowSessionId))
+            .orderBy(links.id);
         return rows.map((row) => ({
             agentSessionId: row.id,
             link: row.link,
@@ -524,15 +471,16 @@ class PostgresTx {
     }
     async counts() {
         this.check();
-        const sql = this.sql;
-        const [row] = await sql `
+        const [row] = await this.db.execute(sql `
       SELECT
-        (SELECT count(*) FROM ${this.t("sessions")})::int AS sessions,
-        (SELECT count(*) FROM ${this.t("sessions")} WHERE status = ANY(${OPEN_SESSION}))::int AS running,
-        (SELECT count(*) FROM ${this.t("actions")} WHERE status IN ('pending', 'claimed'))::int AS actions,
-        (SELECT count(*) FROM ${this.t("effects")} WHERE status = 'uncertain')::int AS uncertain,
-        (SELECT count(*) FROM ${this.t("sandboxes")})::int AS sandboxes,
-        (SELECT count(*) FROM ${this.t("definitions")})::int AS definitions`;
+        (SELECT count(*) FROM ${sessions})::int AS sessions,
+        (SELECT count(*) FROM ${sessions}
+          WHERE ${sessions.status} IN ('running', 'runnable'))::int AS running,
+        (SELECT count(*) FROM ${actions}
+          WHERE ${actions.status} IN ('pending', 'delivering'))::int AS actions,
+        (SELECT count(*) FROM ${effects} WHERE ${effects.status} = 'uncertain')::int AS uncertain,
+        (SELECT count(*) FROM ${sandboxes})::int AS sandboxes,
+        (SELECT count(*) FROM ${definitions})::int AS definitions`);
         return {
             sessions: row.sessions,
             runningSessions: row.running,
@@ -542,256 +490,464 @@ class PostgresTx {
             definitions: row.definitions,
         };
     }
-    // --- outbox --------------------------------------------------------------
-    async outbox(limit, filter = {}) {
+    // --- basin generations --------------------------------------------------
+    async basinGenerations() {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT session_id, seq, body FROM ${this.t("outbox")}
-      ${filter.sessionId === undefined ? sql `` : sql `WHERE session_id = ${filter.sessionId}`}
-      ORDER BY session_id, seq
-      LIMIT ${limit}`;
-        return rows.map((row) => ({
-            sessionId: row.session_id,
-            seq: Number(row.seq),
-            event: row.body,
-        }));
+        const [row] = await this.db
+            .select({ current: tenant.basinGeneration, retired: tenant.retiredGenerations })
+            .from(tenant);
+        // A database whose Tenant row is not written yet is at generation 0.
+        return row ?? { current: 0, retired: [] };
     }
-    async deleteOutbox(sessionId, throughSeq, incarnation) {
-        this.check();
-        const sql = this.sql;
-        // One statement: the session and the rows are read from the same snapshot.
-        const result = await sql `
-      DELETE FROM ${this.t("outbox")}
-      WHERE session_id = ${sessionId} AND seq <= ${throughSeq}
-      ${incarnation === undefined
-            ? sql ``
-            : sql `AND EXISTS (
-              SELECT 1 FROM ${this.t("sessions")} WHERE id = ${sessionId}
-                AND stream_incarnation IS NOT DISTINCT FROM ${incarnation})`}`;
-        return result.count;
-    }
-    async outboxStats() {
-        this.check();
-        const [row] = await this.sql `
-      SELECT count(*)::int AS depth, min(created_at) AS oldest
-      FROM ${this.t("outbox")}`;
-        return {
-            depth: row.depth,
-            oldestCreatedAt: row.oldest ?? null,
-        };
-    }
-    // --- executors -----------------------------------------------------------
-    async listExecutors() {
+    async forgetRetiredGeneration(generation) {
         this.check();
-        const rows = await this.sql `SELECT * FROM ${this.t("executors")} ORDER BY agent_id`;
-        return rows.map(executorRow);
+        await this.db.update(tenant).set({
+            retiredGenerations: sql `array_remove(${tenant.retiredGenerations}, ${generation}::int)`,
+        });
     }
-    async getExecutor(agentId) {
-        this.check();
-        const [row] = await this.sql `
-      SELECT * FROM ${this.t("executors")} WHERE agent_id = ${agentId}`;
-        return row && executorRow(row);
+    // --- Action endpoints -----------------------------------------------------
+    async listEndpoints() {
+        this.check();
+        const rows = await this.db.select().from(endpoints).orderBy(endpoints.agentId);
+        return rows.map(endpointRow);
+    }
+    async getEndpoint(agentId) {
+        this.check();
+        const [row] = await this.db.select().from(endpoints).where(eq(endpoints.agentId, agentId));
+        return row && endpointRow(row);
+    }
+    async putEndpoint(row) {
+        this.check();
+        // Health belongs to a URL: a new URL starts with none.
+        await this.db
+            .insert(endpoints)
+            .values({
+            agentId: row.agentId,
+            url: row.url,
+            implementationVersion: row.implementationVersion,
+            manifestHash: row.manifestHash ?? null,
+            timeoutMs: row.timeoutMs,
+            maxConcurrent: row.maxConcurrent,
+            principalId: row.principalId ?? null,
+            consecutiveFailures: 0,
+            createdAt: row.updatedAt,
+            updatedAt: row.updatedAt,
+        })
+            .onConflictDoUpdate({
+            target: endpoints.agentId,
+            set: {
+                url: excluded("url"),
+                implementationVersion: excluded("implementation_version"),
+                manifestHash: excluded("manifest_hash"),
+                timeoutMs: excluded("timeout_ms"),
+                maxConcurrent: excluded("max_concurrent"),
+                principalId: excluded("principal_id"),
+                updatedAt: excluded("updated_at"),
+                lastDeliveryAt: sameUrl(sql `${endpoints.lastDeliveryAt}`),
+                lastSuccessAt: sameUrl(sql `${endpoints.lastSuccessAt}`),
+                lastErrorCode: sameUrl(sql `${endpoints.lastErrorCode}`),
+                lastErrorMessage: sameUrl(sql `${endpoints.lastErrorMessage}`),
+                consecutiveFailures: sameUrl(sql `${endpoints.consecutiveFailures}`, sql `0`),
+                servedImplementationVersion: sameUrl(sql `${endpoints.servedImplementationVersion}`),
+                servedManifestHash: sameUrl(sql `${endpoints.servedManifestHash}`),
+            },
+        });
     }
-    async putExecutor(row) {
+    async deleteEndpoint(agentId) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("executors")} (
-        agent_id, token_hash, implementation_version, manifest_hash,
-        principal_id, created_at, updated_at
-      ) VALUES (
-        ${row.agentId}, ${row.tokenHash}, ${row.implementationVersion},
-        ${row.manifestHash ?? null}, ${row.principalId ?? null},
-        ${row.updatedAt}, ${row.updatedAt}
-      )
-      ON CONFLICT (agent_id) DO UPDATE SET
-        token_hash = excluded.token_hash,
-        implementation_version = excluded.implementation_version,
-        manifest_hash = excluded.manifest_hash,
-        principal_id = excluded.principal_id,
-        updated_at = excluded.updated_at`;
+        await this.db.delete(endpoints).where(eq(endpoints.agentId, agentId));
     }
-    async deleteExecutor(agentId) {
+    async recordEndpointHealth(agentId, update) {
         this.check();
-        await this.sql `DELETE FROM ${this.t("executors")} WHERE agent_id = ${agentId}`;
+        const set = update.kind === "success"
+            ? {
+                lastDeliveryAt: update.at,
+                lastSuccessAt: update.at,
+                consecutiveFailures: 0,
+                lastErrorCode: null,
+                lastErrorMessage: null,
+            }
+            : update.kind === "failure"
+                ? {
+                    lastDeliveryAt: update.at,
+                    lastErrorCode: update.code,
+                    lastErrorMessage: update.message,
+                    consecutiveFailures: sql `${endpoints.consecutiveFailures} + 1`,
+                }
+                : {
+                    servedImplementationVersion: update.implementationVersion,
+                    servedManifestHash: update.manifestHash ?? null,
+                };
+        await this.db.update(endpoints).set(set).where(eq(endpoints.agentId, agentId));
     }
     // --- principals ----------------------------------------------------------
     async insertPrincipal(row) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("principals")} (id, role, token_hash, idempotency_key, created_at)
-      VALUES (${row.id}, ${row.role}, ${row.tokenHash}, ${row.idempotencyKey}, ${row.createdAt})`;
+        await this.db.insert(principals).values(row);
     }
     async principalByTokenHash(tokenHash) {
         this.check();
-        const [row] = await this.sql `
-      SELECT * FROM ${this.t("principals")} WHERE token_hash = ${tokenHash}`;
-        return row && principalRow(row);
+        const [row] = await this.db
+            .select()
+            .from(principals)
+            .where(eq(principals.tokenHash, tokenHash));
+        return row;
     }
     async principalById(id) {
         this.check();
-        const [row] = await this.sql `
-      SELECT * FROM ${this.t("principals")} WHERE id = ${id}`;
-        return row && principalRow(row);
+        const [row] = await this.db.select().from(principals).where(eq(principals.id, id));
+        return row;
     }
     async applicationTokenHashes() {
         this.check();
-        const rows = await this.sql `
-      SELECT token_hash FROM ${this.t("principals")}
-      WHERE role = 'application' ORDER BY id`;
-        return rows.map((row) => row.token_hash);
+        const rows = await this.db
+            .select({ tokenHash: principals.tokenHash })
+            .from(principals)
+            .where(eq(principals.role, "application"))
+            .orderBy(principals.id);
+        return rows.map((row) => row.tokenHash);
     }
     // --- vault ---------------------------------------------------------------
     async insertVault(row) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("vaults")} (id, name, owner_user_id, metadata_json, created_at, scope)
-      VALUES (${row.id}, ${row.name}, ${row.ownerUserId}, ${row.metadataJson},
-              ${row.createdAt}, ${row.scope})`;
+        await this.db.insert(vaults).values(row);
     }
     async getVault(id) {
         this.check();
-        const [row] = await this.sql `SELECT * FROM ${this.t("vaults")} WHERE id = ${id}`;
-        return row && vaultRow(row);
+        const [row] = await this.db.select().from(vaults).where(eq(vaults.id, id));
+        return row;
     }
     async vaultsByOwner(ownerUserId) {
         this.check();
-        const rows = await this.sql `
-      SELECT * FROM ${this.t("vaults")}
-      WHERE owner_user_id = ${ownerUserId} AND scope = 'user'
-      ORDER BY created_at, id`;
-        return rows.map(vaultRow);
+        return this.db
+            .select()
+            .from(vaults)
+            .where(and(eq(vaults.ownerUserId, ownerUserId), eq(vaults.scope, "user")))
+            .orderBy(vaults.createdAt, vaults.id);
     }
     async updateVaultMetadata(id, metadataJson) {
         this.check();
-        await this.sql `
-      UPDATE ${this.t("vaults")} SET metadata_json = ${metadataJson} WHERE id = ${id}`;
+        await this.db.update(vaults).set({ metadataJson }).where(eq(vaults.id, id));
     }
     async deleteVault(id) {
         this.check();
         // Credentials go with it (ON DELETE CASCADE).
-        await this.sql `DELETE FROM ${this.t("vaults")} WHERE id = ${id}`;
+        await this.db.delete(vaults).where(eq(vaults.id, id));
     }
     async insertCredential(row) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("vault_credentials")} (
-        id, vault_id, name, type, binding_json, expires_at, created_at,
-        rotated_at, kek_id, nonce, ciphertext, wrapped_dek
-      ) VALUES (
-        ${row.id}, ${row.vaultId}, ${row.name}, ${row.type}, ${row.bindingJson},
-        ${row.expiresAt}, ${row.createdAt}, ${row.rotatedAt}, ${row.kekId},
-        ${bytes(row.nonce)}, ${bytes(row.ciphertext)}, ${bytes(row.wrappedDek)}
-      )`;
+        await this.db.insert(vaultCredentials).values(row);
     }
     async getCredential(id) {
         this.check();
-        const [row] = await this.sql `
-      SELECT * FROM ${this.t("vault_credentials")} WHERE id = ${id}`;
-        return row && credentialRow(row);
+        const [row] = await this.db
+            .select()
+            .from(vaultCredentials)
+            .where(eq(vaultCredentials.id, id));
+        return row;
     }
     async credentialsForVault(vaultId, filter = {}) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT * FROM ${this.t("vault_credentials")}
-      WHERE vault_id = ${vaultId}
-      ${filter.type === undefined ? sql `` : sql `AND type = ${filter.type}`}
-      ORDER BY created_at, id`;
-        return rows.map(credentialRow);
+        return this.db
+            .select()
+            .from(vaultCredentials)
+            .where(and(eq(vaultCredentials.vaultId, vaultId), filter.type === undefined ? undefined : eq(vaultCredentials.type, filter.type)))
+            .orderBy(vaultCredentials.createdAt, vaultCredentials.id);
     }
     async updateCredential(vaultId, id, patch) {
         this.check();
-        const sql = this.sql;
-        const columns = {};
-        for (const [field, column] of Object.entries(CREDENTIAL_COLUMNS)) {
-            const value = patch[field];
-            if (value === undefined)
-                continue;
-            columns[column] = value instanceof Uint8Array ? bytes(value) : value;
-        }
-        if (Object.keys(columns).length === 0) {
-            const rows = await sql `
-        SELECT 1 FROM ${this.t("vault_credentials")}
-        WHERE vault_id = ${vaultId} AND id = ${id}`;
+        const where = and(eq(vaultCredentials.vaultId, vaultId), eq(vaultCredentials.id, id));
+        if (Object.values(patch).every((value) => value === undefined)) {
+            const rows = await this.db
+                .select({ id: vaultCredentials.id })
+                .from(vaultCredentials)
+                .where(where);
             return rows.length > 0;
         }
-        const result = await sql `
-      UPDATE ${this.t("vault_credentials")} SET ${sql(columns)}
-      WHERE vault_id = ${vaultId} AND id = ${id}`;
+        const result = await this.db.update(vaultCredentials).set(patch).where(where);
         return result.count > 0;
     }
     async deleteCredential(vaultId, id) {
         this.check();
-        const result = await this.sql `
-      DELETE FROM ${this.t("vault_credentials")}
-      WHERE vault_id = ${vaultId} AND id = ${id}`;
+        const result = await this.db
+            .delete(vaultCredentials)
+            .where(and(eq(vaultCredentials.vaultId, vaultId), eq(vaultCredentials.id, id)));
         return result.count > 0;
     }
     async countCredentials() {
         this.check();
-        const [row] = await this.sql `
-      SELECT count(*)::int AS n FROM ${this.t("vault_credentials")}`;
+        const [row] = await this.db.select({ n: count() }).from(vaultCredentials);
         return row.n;
     }
     async insertVaultAudit(row) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("vault_audit")} (
-        id, at, actor, action, vault_id, credential_id, session_id, target, outcome
-      ) VALUES (
-        ${row.id}, ${row.at}, ${row.actor}, ${row.action}, ${row.vaultId},
-        ${row.credentialId}, ${row.sessionId}, ${row.target}, ${row.outcome}
-      )`;
+        await this.db.insert(vaultAudit).values(row);
     }
     async vaultAudit(filter = {}) {
         this.check();
-        const sql = this.sql;
-        const rows = await sql `
-      SELECT * FROM ${this.t("vault_audit")}
-      ${filter.vaultId === undefined ? sql `` : sql `WHERE vault_id = ${filter.vaultId}`}
-      ORDER BY ord
-      ${filter.limit === undefined ? sql `` : sql `LIMIT ${filter.limit}`}`;
-        return rows.map(auditRow);
+        const query = this.db
+            .select(AUDIT)
+            .from(vaultAudit)
+            .where(filter.vaultId === undefined ? undefined : eq(vaultAudit.vaultId, filter.vaultId))
+            .orderBy(vaultAudit.ord)
+            .$dynamic();
+        return filter.limit === undefined ? query : query.limit(filter.limit);
     }
     async getVaultIdempotency(id) {
         this.check();
-        const [row] = await this.sql `
-      SELECT id, body_hash, response FROM ${this.t("vault_idempotency")} WHERE id = ${id}`;
-        return row && { id: row.id, bodyHash: row.body_hash, response: row.response };
+        const [row] = await this.db
+            .select()
+            .from(vaultIdempotency)
+            .where(eq(vaultIdempotency.id, id));
+        return row;
     }
     async insertVaultIdempotency(row) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("vault_idempotency")} (id, body_hash, response)
-      VALUES (${row.id}, ${row.bodyHash}, ${row.response})`;
+        await this.db.insert(vaultIdempotency).values(row);
+    }
+    // --- subject tokens ------------------------------------------------------
+    async lockSigningKeys() {
+        this.check();
+        await this.db.execute(sql `SELECT pg_advisory_xact_lock(hashtext('nylorun.signing_keys'))`);
+    }
+    async insertSigningKey(row) {
+        this.check();
+        await this.db.insert(signingKeys).values(row);
+    }
+    async signingKey(id) {
+        this.check();
+        const [row] = await this.db.select().from(signingKeys).where(eq(signingKeys.id, id));
+        return row;
+    }
+    async signingKeys(states) {
+        this.check();
+        return this.db
+            .select()
+            .from(signingKeys)
+            .where(states === undefined ? undefined : inArray(signingKeys.state, states))
+            .orderBy(signingKeys.createdAt, signingKeys.id);
+    }
+    async setSigningKeyState(id, from, to, at) {
+        this.check();
+        const stamp = SIGNING_KEY_STAMP[to];
+        const rows = await this.db
+            .update(signingKeys)
+            .set({ state: to, ...(stamp ? { [stamp]: at } : {}) })
+            .where(and(eq(signingKeys.id, id), eq(signingKeys.state, from)))
+            .returning({ id: signingKeys.id });
+        return rows.length === 1;
+    }
+    async countSigningKeys() {
+        this.check();
+        const [row] = await this.db.select({ n: count() }).from(signingKeys);
+        return row.n;
+    }
+    async subjectEpoch(subject) {
+        this.check();
+        const [row] = await this.db
+            .select({ epoch: subjectEpochs.epoch })
+            .from(subjectEpochs)
+            .where(eq(subjectEpochs.subject, subject));
+        return row?.epoch ?? 0;
+    }
+    async subjectEpochs(subjects) {
+        this.check();
+        if (subjects.length === 0)
+            return new Map();
+        const rows = await this.db
+            .select({ subject: subjectEpochs.subject, epoch: subjectEpochs.epoch })
+            .from(subjectEpochs)
+            .where(inArray(subjectEpochs.subject, subjects));
+        return new Map(rows.map((row) => [row.subject, row.epoch]));
+    }
+    async bumpSubjectEpoch(subject, at) {
+        this.check();
+        const [row] = await this.db
+            .insert(subjectEpochs)
+            .values({ subject, epoch: 1, revokedAt: at })
+            .onConflictDoUpdate({
+            target: subjectEpochs.subject,
+            set: { epoch: sql `${subjectEpochs.epoch} + 1`, revokedAt: excluded("revoked_at") },
+        })
+            .returning({ epoch: subjectEpochs.epoch });
+        return row.epoch;
+    }
+    async lockSubjectUsage(initial) {
+        this.check();
+        await this.db.insert(subjectUsage).values(initial).onConflictDoNothing();
+        const [row] = await this.db
+            .select()
+            .from(subjectUsage)
+            .where(eq(subjectUsage.subject, initial.subject))
+            .for("update");
+        return row;
+    }
+    async putSubjectUsage(row) {
+        this.check();
+        await this.db
+            .insert(subjectUsage)
+            .values(row)
+            .onConflictDoUpdate({
+            target: subjectUsage.subject,
+            set: { turnTokens: excluded("turn_tokens"), refilledAt: excluded("refilled_at") },
+        });
+    }
+    async countOwnerSessions(ownerUserId, statuses) {
+        this.check();
+        const [row] = await this.db
+            .select({ n: count() })
+            .from(sessions)
+            .where(and(eq(sessions.ownerUserId, ownerUserId), inArray(sessions.status, statuses)));
+        return row.n;
+    }
+    // --- publishable keys ----------------------------------------------------
+    async insertPublishableKey(row) {
+        this.check();
+        await this.db.insert(publishableKeys).values(row);
+    }
+    async publishableKeyByKey(key) {
+        this.check();
+        const [row] = await this.db
+            .select()
+            .from(publishableKeys)
+            .where(eq(publishableKeys.key, key));
+        return row;
+    }
+    async publishableKey(id) {
+        this.check();
+        const [row] = await this.db
+            .select()
+            .from(publishableKeys)
+            .where(eq(publishableKeys.id, id));
+        return row;
+    }
+    async publishableKeys() {
+        this.check();
+        return this.db
+            .select()
+            .from(publishableKeys)
+            .orderBy(publishableKeys.createdAt, publishableKeys.id);
+    }
+    async updatePublishableKey(id, patch) {
+        this.check();
+        if (patch.originsJson === undefined && patch.revokedAt === undefined)
+            return (await this.publishableKey(id)) !== undefined;
+        const rows = await this.db
+            .update(publishableKeys)
+            .set(patch)
+            .where(eq(publishableKeys.id, id))
+            .returning({ id: publishableKeys.id });
+        return rows.length === 1;
+    }
+    // --- model usage ---------------------------------------------------------
+    async recordModelUsage(row) {
+        this.check();
+        const [inserted] = await this.db
+            .insert(modelUsage)
+            .values({
+            ...row,
+            duplicate: sql `EXISTS (SELECT 1 FROM ${modelUsage} WHERE ${modelUsage.effectKey} = ${row.effectKey})`,
+        })
+            .returning({ duplicate: modelUsage.duplicate });
+        return { ...row, duplicate: inserted.duplicate };
+    }
+    async modelUsageTotals(query) {
+        this.check();
+        const [row] = await this.db
+            .select({
+            calls: count(),
+            tokens: sql `coalesce(sum(${modelUsage.totalTokens}), 0)::bigint`.mapWith(Number),
+            costUsd: sql `coalesce(sum(${modelUsage.costUsd}), 0)::double precision`.mapWith(Number),
+        })
+            .from(modelUsage)
+            .where(and(query.scope === "agent" ? eq(modelUsage.agentId, query.id ?? "") : undefined, query.scope === "turn" ? eq(modelUsage.turnId, query.id ?? "") : undefined, query.since !== undefined ? gte(modelUsage.createdAt, query.since) : undefined));
+        return row;
+    }
+    async listModelBudgets() {
+        this.check();
+        return this.db
+            .select()
+            .from(modelBudgets)
+            .orderBy(sql `${modelBudgets.scope} COLLATE "C"`, modelBudgets.scopeId);
+    }
+    async putModelBudgets(rows) {
+        this.check();
+        await this.db.delete(modelBudgets);
+        if (rows.length > 0)
+            await this.db.insert(modelBudgets).values([...rows]);
+    }
+    // --- tool crossings --------------------------------------------------------
+    async toolCrossing(key) {
+        this.check();
+        const [row] = await this.db.select().from(toolCrossings).where(eq(toolCrossings.key, key));
+        return row;
+    }
+    async startToolCrossing(row) {
+        this.check();
+        const inserted = await this.db
+            .insert(toolCrossings)
+            .values({ ...row, settledAt: null, answer: null })
+            .onConflictDoNothing()
+            .returning({ key: toolCrossings.key });
+        return inserted.length === 1;
+    }
+    async settleToolCrossing(key, answer, settledAt) {
+        this.check();
+        await this.db
+            .update(toolCrossings)
+            .set({ answer, settledAt })
+            .where(eq(toolCrossings.key, key));
+    }
+    async pruneToolCrossings(before) {
+        this.check();
+        const deleted = await this.db
+            .delete(toolCrossings)
+            .where(lt(toolCrossings.settledAt, before))
+            .returning({ key: toolCrossings.key });
+        return deleted.length;
     }
     // --- settings ------------------------------------------------------------
     async getSetting(key) {
         this.check();
-        const [row] = await this.sql `
-      SELECT value FROM ${this.t("tenant_settings")} WHERE key = ${key}`;
+        const [row] = await this.db
+            .select({ value: tenantSettings.value })
+            .from(tenantSettings)
+            .where(eq(tenantSettings.key, key));
         return row?.value;
     }
     async putSetting(key, value) {
         this.check();
-        await this.sql `
-      INSERT INTO ${this.t("tenant_settings")} (key, value) VALUES (${key}, ${value})
-      ON CONFLICT (key) DO UPDATE SET value = excluded.value`;
+        await this.db
+            .insert(tenantSettings)
+            .values({ key, value })
+            .onConflictDoUpdate({ target: tenantSettings.key, set: { value: excluded("value") } });
     }
     // --- reset ---------------------------------------------------------------
     async reset(scope) {
         this.check();
-        const sql = this.sql;
-        if (scope === "sessions" || scope === "all")
+        const db = this.db;
+        if (scope === "sessions" || scope === "all") {
             for (const table of SESSION_TABLES)
-                await sql `DELETE FROM ${this.t(table)}`;
+                await db.delete(table);
+            await db.delete(subjectUsage);
+            await db.delete(toolCrossings);
+            // The record goes with the sessions, and the Tenant moves to a new basin: the ids it
+            // frees start again in an empty one (Durable Streams §8.1).
+            await db.delete(sessionEvents);
+            await db.delete(sessionLogHeads);
+            await db.update(tenant).set({
+                retiredGenerations: sql `array_append(${tenant.retiredGenerations}, ${tenant.basinGeneration})`,
+                basinGeneration: sql `${tenant.basinGeneration} + 1`,
+            });
+        }
         if (scope === "sandboxes" || scope === "all")
-            await sql `DELETE FROM ${this.t("sandboxes")}`;
+            await db.delete(sandboxes);
         if (scope === "all") {
-            await sql `DELETE FROM ${this.t("definitions")}`;
-            await sql `DELETE FROM ${this.t("executors")}`;
-            await sql `DELETE FROM ${this.t("vaults")} WHERE scope <> 'host'`;
+            await db.delete(definitions);
+            await db.delete(endpoints);
+            await db.delete(modelUsage);
+            await db.delete(modelBudgets);
+            await db.delete(vaults).where(ne(vaults.scope, "host"));
         }
     }
 }