@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/streams/memory.js

@@ -1,3 +1,4 @@
+import { parseBasin } from "./basin.js";
 /**
  * In-memory `DurableStreams` for unit tests and a local development Host.
  * Not durable: history does not survive a restart. Keeps the seam's
@@ -71,14 +72,19 @@ export class MemoryStreams {
         if (!this.tenants.has(tenantId))
             this.tenants.set(tenantId, new Map());
     }
-    async deleteTenant(tenantId) {
-        const streams = this.tenants.get(tenantId);
-        this.tenants.delete(tenantId);
-        for (const stream of streams?.keys() ?? [])
-            this.notify(tenantId, stream);
-        for (const key of this.waiters.keys())
-            if (key.startsWith(`${tenantId}\u0000`))
-                this.notifyKey(key);
+    async deleteTenant(tenantId, options = {}) {
+        const basins = options.allGenerations
+            ? [...this.tenants.keys()].filter((key) => parseBasin(key).tenantId === tenantId)
+            : [tenantId];
+        for (const basin of basins) {
+            const streams = this.tenants.get(basin);
+            this.tenants.delete(basin);
+            for (const stream of streams?.keys() ?? [])
+                this.notify(basin, stream);
+            for (const key of this.waiters.keys())
+                if (key.startsWith(`${basin}\u0000`))
+                    this.notifyKey(key);
+        }
     }
     async deleteStream(tenantId, stream) {
         this.tenants.get(tenantId)?.delete(stream);

package/dist/streams/relay/core.d.ts

@@ -0,0 +1,35 @@
+import { type DurableStreams } from "../types.js";
+import type { ChangeSource, RecordReader } from "./types.js";
+export interface StreamRelayOptions {
+    source: ChangeSource;
+    record: RecordReader;
+    streams: DurableStreams;
+    /** Relay events: lag, errors, reconciliations. */
+    log?: (message: string, fields?: Record<string, unknown>) => void;
+    /** Records per append (S2 allows 1000). */
+    maxBatchRecords?: number;
+    /** Bytes per append (S2 allows 1 MiB). */
+    maxBatchBytes?: number;
+    /** Sessions reconciled at once. */
+    reconcileConcurrency?: number;
+}
+export interface StreamRelayStatus {
+    /** This process holds the source (the replication slot). */
+    active: boolean;
+    /** Committed transactions not yet fully in S2. */
+    pendingTxs: number;
+    /** Rows queued for S2. */
+    pendingRows: number;
+    /** The last position acknowledged to the source. */
+    confirmed: string | null;
+    reconciliations: number;
+    lastError: string | null;
+}
+export interface StreamRelay {
+    start(): void;
+    stop(): Promise<void>;
+    status(): StreamRelayStatus;
+    /** Resolves once nothing is pending (tests and shutdown). */
+    idle(): Promise<void>;
+}
+export declare function createStreamRelay(options: StreamRelayOptions): StreamRelay;

package/dist/streams/relay/core.js

@@ -0,0 +1,366 @@
+/**
+ * The stream relay (Durable Streams §7): feeds S2 from the record, exactly once and in order
+ * per session.
+ *
+ * - **Input.** Committed transactions from a `ChangeSource`, in commit order. The source
+ *   keeps each one until it is acknowledged, so a crash replays what S2 may not have.
+ * - **Pumps.** Each session has a queue and one pump. The pump appends the contiguous rows
+ *   at the front of the queue as one batch to `sessions/<id>` in the row's basin generation,
+ *   with `matchSeq` = the first row's `seq`:
+ *   - `ok`: the rows are done;
+ *   - tail past the batch: S2 already has those rows (a replay); they are done;
+ *   - tail before the batch: S2 is missing rows (a lost stream, or rows the source never
+ *     delivered); they are read from the record and put in front;
+ *   - an error: the rows' generation is checked against the Tenant's (a reset or Tenant
+ *     deletion makes them obsolete: done), the basin is ensured, and the batch is retried
+ *     with backoff (50 ms to 2 s). The pump is per session, so order is kept.
+ * - **Acknowledgement.** A transaction is acknowledged once all its rows are done, in commit
+ *   order, never past one that is not.
+ * - **Reconciliation.** When the source starts fresh (a new or lost slot), every session's S2
+ *   tail is compared with its log head and the difference is re-sent from the record.
+ *   `matchSeq` makes overlap with the live input harmless.
+ *
+ * The relay never writes the record and never deletes from S2.
+ */
+import { basinOf } from "../basin.js";
+import { sessionStream } from "../types.js";
+const RETRY_MIN_MS = 50;
+const RETRY_MAX_MS = 2000;
+const HEADS_PAGE = 500;
+export function createStreamRelay(options) {
+    const { source, record, streams } = options;
+    const log = options.log ?? (() => { });
+    const maxRecords = options.maxBatchRecords ?? 500;
+    const maxBytes = options.maxBatchBytes ?? 768 * 1024;
+    const concurrency = options.reconcileConcurrency ?? 8;
+    /** Committed transactions not yet fully in S2, in commit order. */
+    const txs = [];
+    const sessions = new Map();
+    let confirmed = null;
+    let active = false;
+    let stopped = false;
+    let reconciliations = 0;
+    let lastError = null;
+    let idleWaiters = [];
+    /** Woken when queued rows settle or the activation ends (`reconcile` waits on its rows). */
+    let progressWaiters = [];
+    /** Moves on with every activation and every loss of the source. */
+    let activation = 0;
+    const stopping = new AbortController();
+    const keyOf = (tenantId, sessionId) => `${tenantId}\u0000${sessionId}`;
+    function queueOf(tenantId, sessionId) {
+        const key = keyOf(tenantId, sessionId);
+        let queue = sessions.get(key);
+        if (!queue)
+            sessions.set(key, (queue = { tenantId, sessionId, rows: [], running: false }));
+        return queue;
+    }
+    function queued(row, tx) {
+        const body = JSON.stringify(row.body) ?? "null";
+        return { ...row, seq: Number(row.seq), tx, bytes: Buffer.byteLength(body) };
+    }
+    function onTx(committed) {
+        if (stopped)
+            return;
+        const tx = { endLsn: committed.endLsn, remaining: committed.rows.length };
+        txs.push(tx);
+        // Queue every row before pumping, so a transaction's rows go out in as few batches as fit.
+        const touched = new Set();
+        for (const row of committed.rows) {
+            const queue = queueOf(row.tenantId, row.sessionId);
+            queue.rows.push(queued(row, tx));
+            touched.add(queue);
+        }
+        for (const queue of touched)
+            pumpSoon(queue);
+        advance();
+    }
+    function pumpSoon(queue) {
+        if (!queue.running)
+            void pump(queue);
+    }
+    function done(row) {
+        row.tx.remaining -= 1;
+    }
+    /** The contiguous rows at the front of the queue, within the batch limits. */
+    function takeBatch(rows) {
+        const batch = [rows[0]];
+        let bytes = rows[0].bytes;
+        for (let i = 1; i < rows.length && batch.length < maxRecords; i += 1) {
+            const row = rows[i];
+            const previous = batch[batch.length - 1];
+            if (row.seq !== previous.seq + 1 || row.generation !== previous.generation)
+                break;
+            if (bytes + row.bytes > maxBytes)
+                break;
+            bytes += row.bytes;
+            batch.push(row);
+        }
+        return batch;
+    }
+    async function pump(queue) {
+        queue.running = true;
+        let delay = RETRY_MIN_MS;
+        try {
+            while (queue.rows.length > 0 && !stopped) {
+                // Duplicates (a replay overlapping a refill) and stale rows sort out here.
+                queue.rows.sort((a, b) => a.generation - b.generation || a.seq - b.seq);
+                const batch = takeBatch(queue.rows);
+                const first = batch[0];
+                const basin = basinOf(first.tenantId, first.generation);
+                try {
+                    const result = await streams.append(basin, sessionStream(first.sessionId), batch.map((row) => row.body), { matchSeq: first.seq });
+                    if (result.status === "ok") {
+                        settle(queue, (row) => batch.includes(row));
+                    }
+                    else if (result.tail > first.seq) {
+                        // A replay: S2 already has every row below its tail.
+                        settle(queue, (row) => row.generation === first.generation && row.seq < result.tail);
+                    }
+                    else {
+                        // S2 is behind the record: re-send the gap first.
+                        await refill(queue, first.generation, result.tail, first.seq);
+                    }
+                    delay = RETRY_MIN_MS;
+                    lastError = null;
+                }
+                catch (error) {
+                    if (stopped)
+                        return;
+                    lastError = messageOf(error);
+                    if (await obsolete(first)) {
+                        settle(queue, (row) => row.generation <= first.generation);
+                        continue;
+                    }
+                    log("stream relay append failed; retrying", {
+                        tenantId: first.tenantId,
+                        sessionId: first.sessionId,
+                        seq: first.seq,
+                        retryInMs: delay,
+                        message: lastError,
+                    });
+                    // The basin may be missing (S2 lost it, or it was never created).
+                    await streams.ensureTenant(basin).catch(() => undefined);
+                    await sleep(delay, stopping.signal);
+                    delay = Math.min(delay * 2, RETRY_MAX_MS);
+                }
+            }
+        }
+        finally {
+            queue.running = false;
+            if (queue.rows.length === 0)
+                sessions.delete(keyOf(queue.tenantId, queue.sessionId));
+            else if (!stopped)
+                pumpSoon(queue);
+            advance();
+        }
+    }
+    /** Marks the queue's rows matching `match` done and drops them. */
+    function settle(queue, match) {
+        const keep = [];
+        for (const row of queue.rows) {
+            if (match(row))
+                done(row);
+            else
+                keep.push(row);
+        }
+        queue.rows = keep;
+        progressed();
+    }
+    function progressed() {
+        const waiters = progressWaiters;
+        progressWaiters = [];
+        for (const wake of waiters)
+            wake();
+    }
+    /** The rows' generation is no longer the Tenant's (a reset), or the Tenant is gone. */
+    async function obsolete(row) {
+        try {
+            const current = await record.generation(row.tenantId);
+            return current === undefined || current > row.generation;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Puts record rows `[from, to)` in front of the queue (not part of the ack order). Returns
+     * their pending count, which reaches 0 once they are all in S2.
+     */
+    async function refill(queue, generation, from, to) {
+        const rows = await record.readRange(queue.tenantId, queue.sessionId, from, to);
+        const own = rows.filter((row) => row.generation === generation);
+        if (own.length < to - from) {
+            // The record no longer has them (a reset deleted the session): nothing to re-send.
+            if (await obsolete({ ...queue, seq: from, generation, body: null })) {
+                settle(queue, (row) => row.generation <= generation);
+                return undefined;
+            }
+            throw new Error(`The record is missing rows ${from}..${to - 1} of session ${queue.sessionId}`);
+        }
+        const tx = { endLsn: undefined, remaining: own.length };
+        log("stream relay refilling a session from the record", {
+            tenantId: queue.tenantId,
+            sessionId: queue.sessionId,
+            from,
+            to,
+        });
+        queue.rows.unshift(...own.map((row) => queued(row, tx)));
+        return tx;
+    }
+    /** Acknowledges the newest transaction whose rows, and all before it, are in S2. */
+    function advance() {
+        let lsn;
+        while (txs.length > 0 && txs[0].remaining <= 0)
+            lsn = txs.shift().endLsn ?? lsn;
+        if (lsn)
+            acknowledge(lsn);
+        if (txs.length === 0 && sessions.size === 0) {
+            const waiters = idleWaiters;
+            idleWaiters = [];
+            for (const wake of waiters)
+                wake();
+        }
+    }
+    function acknowledge(lsn) {
+        confirmed = lsn;
+        source.acknowledge(lsn);
+    }
+    /**
+     * Re-sends, for every session, what the record has beyond its S2 tail, and resolves true
+     * once all of it is in S2. False when activation `of` ended first (the source was lost, so
+     * the queued rows were dropped) or the relay stopped: the slot must stay unreconciled.
+     */
+    async function reconcile(of) {
+        reconciliations += 1;
+        const started = Date.now();
+        const current = () => !stopped && activation === of;
+        let sessionsChecked = 0;
+        let resent = 0;
+        const refilled = [];
+        let after;
+        for (;;) {
+            if (!current())
+                return false;
+            const page = await record.heads(after, HEADS_PAGE);
+            if (page.length === 0)
+                break;
+            let next = 0;
+            await Promise.all(Array.from({ length: Math.min(concurrency, page.length) }, async () => {
+                while (next < page.length && current()) {
+                    const head = page[next++];
+                    sessionsChecked += 1;
+                    const tx = await reconcileOne(head);
+                    if (tx) {
+                        refilled.push(tx);
+                        resent += tx.remaining;
+                    }
+                }
+            }));
+            const last = page[page.length - 1];
+            after = { tenantId: last.tenantId, sessionId: last.sessionId };
+        }
+        // Queued is not delivered: wait until S2 has every re-sent row.
+        while (current() && refilled.some((tx) => tx.remaining > 0))
+            await new Promise((resolve) => progressWaiters.push(resolve));
+        if (!current())
+            return false;
+        log("stream relay reconciled the record with S2", {
+            sessions: sessionsChecked,
+            resent,
+            durationMs: Date.now() - started,
+        });
+        return true;
+    }
+    async function reconcileOne(head) {
+        const current = await record.generation(head.tenantId);
+        if (current === undefined || current !== head.generation)
+            return undefined;
+        const basin = basinOf(head.tenantId, head.generation);
+        await streams.ensureTenant(basin);
+        const tail = await streams.tail(basin, sessionStream(head.sessionId));
+        if (tail >= head.head)
+            return undefined;
+        const queue = queueOf(head.tenantId, head.sessionId);
+        const tx = await refill(queue, head.generation, tail, head.head);
+        pumpSoon(queue);
+        return tx;
+    }
+    return {
+        start() {
+            source.start({
+                onActive({ fresh }) {
+                    active = true;
+                    const of = (activation += 1);
+                    log("stream relay active", { fresh });
+                    if (fresh)
+                        void reconcile(of)
+                            .then((complete) => (complete ? source.reconciled() : undefined))
+                            .catch((error) => {
+                            lastError = messageOf(error);
+                            log("stream relay reconciliation failed", { message: lastError });
+                        });
+                },
+                onTx,
+                onKeepalive(lsn) {
+                    // Caught up: let the source move past WAL that holds none of our rows.
+                    if (txs.length === 0) {
+                        confirmed = lsn;
+                        return lsn;
+                    }
+                    return undefined;
+                },
+                onInactive(error) {
+                    active = false;
+                    activation += 1;
+                    // The source replays everything not acknowledged; what is queued is dropped.
+                    txs.length = 0;
+                    for (const queue of sessions.values())
+                        queue.rows = [];
+                    progressed();
+                    if (error) {
+                        lastError = messageOf(error);
+                        log("stream relay lost its source; retrying", { message: lastError });
+                    }
+                },
+            });
+        },
+        async stop() {
+            stopped = true;
+            stopping.abort();
+            progressed();
+            await source.stop();
+            const waiters = idleWaiters;
+            idleWaiters = [];
+            for (const wake of waiters)
+                wake();
+        },
+        status: () => ({
+            active,
+            pendingTxs: txs.length,
+            pendingRows: [...sessions.values()].reduce((n, queue) => n + queue.rows.length, 0),
+            confirmed,
+            reconciliations,
+            lastError,
+        }),
+        idle() {
+            if (txs.length === 0 && sessions.size === 0)
+                return Promise.resolve();
+            return new Promise((resolve) => idleWaiters.push(resolve));
+        },
+    };
+}
+const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            return resolve();
+        const done = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", done);
+            resolve();
+        };
+        const timer = setTimeout(done, ms);
+        signal.addEventListener("abort", done, { once: true });
+    });
+}

package/dist/streams/relay/types.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Contracts of the stream relay (Durable Streams §7): what it reads committed events from,
+ * and how it reads the record back to refill and reconcile. Postgres implements both with
+ * logical replication (`adapters/replication/pgoutput.ts`) and the record tables
+ * (`store/postgres/record.ts`); the relay core's unit tests use an in-memory pair
+ * (`test/support/relay-record.ts`).
+ */
+/** One committed row of the record: a session event and the basin generation it goes to. */
+export interface RecordRow {
+    tenantId: string;
+    sessionId: string;
+    seq: number;
+    generation: number;
+    /** The event, as stored. */
+    body: unknown;
+}
+/** One committed transaction's record rows, in commit order. */
+export interface CommittedTx {
+    /** Where the source resumes after this transaction once it is acknowledged. */
+    readonly endLsn: string;
+    readonly rows: readonly RecordRow[];
+}
+export interface ChangeHandlers {
+    /**
+     * This process now reads the source (the slot is ours). `fresh` while the source has no
+     * history to replay for rows committed before it existed (a new or lost slot): the record
+     * must be reconciled with S2, then `reconciled()` called.
+     */
+    onActive(state: {
+        fresh: boolean;
+    }): void;
+    /** A committed transaction, in commit order. Replayed after a restart until acknowledged. */
+    onTx(tx: CommittedTx): void;
+    /**
+     * The source asks how far it may move on: return the position to acknowledge (the
+     * server's `lsn` when nothing is pending), or undefined to acknowledge nothing new.
+     */
+    onKeepalive(lsn: string): string | undefined;
+    /** This process stopped reading the source (connection lost); it tries again. */
+    onInactive(error?: unknown): void;
+}
+/**
+ * Committed record rows in commit order, kept by the source until acknowledged: a
+ * transaction not acknowledged before a crash is delivered again.
+ */
+export interface ChangeSource {
+    /** Starts reading; keeps trying (another process may hold the source) until `stop`. */
+    start(handlers: ChangeHandlers): void;
+    /** Everything up to `lsn` is delivered; the source may forget it. */
+    acknowledge(lsn: string): void;
+    /**
+     * The relay reconciled the record after a fresh start. Until this is called, every process
+     * that becomes active is told `fresh` again (the reconciliation may have been cut short).
+     */
+    reconciled(): Promise<void>;
+    stop(): Promise<void>;
+    /** How far the source is behind, in bytes, when known. */
+    lag?(): Promise<number | undefined>;
+}
+/** A session's log head: the next `seq` to allocate. */
+export interface LogHead {
+    tenantId: string;
+    sessionId: string;
+    generation: number;
+    head: number;
+}
+/** Reads the record back (refill and reconciliation). */
+export interface RecordReader {
+    /** Rows `[from, to)` of a session, in `seq` order. */
+    readRange(tenantId: string, sessionId: string, from: number, to: number): Promise<RecordRow[]>;
+    /** Log heads with `head > 0`, in (Tenant, session) order, after `after`, at most `limit`. */
+    heads(after: {
+        tenantId: string;
+        sessionId: string;
+    } | undefined, limit: number): Promise<LogHead[]>;
+    /** The Tenant's current basin generation; undefined when the Tenant is gone. */
+    generation(tenantId: string): Promise<number | undefined>;
+}

package/dist/streams/relay/types.js

@@ -0,0 +1,8 @@
+/**
+ * Contracts of the stream relay (Durable Streams §7): what it reads committed events from,
+ * and how it reads the record back to refill and reconcile. Postgres implements both with
+ * logical replication (`adapters/replication/pgoutput.ts`) and the record tables
+ * (`store/postgres/record.ts`); the relay core's unit tests use an in-memory pair
+ * (`test/support/relay-record.ts`).
+ */
+export {};

package/dist/streams/types.d.ts

@@ -1,3 +1,43 @@
+/**
+ * The Durable Streams seam (Durable Streams §8).
+ *
+ * Durable Streams deliver what the record holds. Each Tenant has one S2 basin per basin
+ * generation (`streams/basin.ts`); inside it:
+ *
+ * | Stream | Contents | Written by | Read by |
+ * | --- | --- | --- | --- |
+ * | `sessions/<sessionId>` | every event of the session, in sequence | the stream relay, from the record | history and session SSE |
+ * | `tenant/control` | `session.cancel`, `sessions.reset` and `subject.revoked` signals | API nodes | every process with the Tenant open |
+ *
+ * **Basin generations.** A session id is unique within its Tenant's basin generation. A
+ * Tenant reset, the only path that frees ids, moves the Tenant to the next generation, so
+ * a session created again with the same id starts in an empty basin at sequence 0; the old
+ * basin is deleted afterwards. The cursor is `base64url("<sessionId>:<seq>")`.
+ *
+ * S2 is the supported implementation (`adapters/streams/s2.ts`, the only file
+ * importing the S2 SDK); `streams/memory.ts` is the in-memory fake.
+ *
+ * ## Guarantees every implementation keeps
+ *
+ * - **Sequence numbers.** Each stream numbers its records from 0 without gaps.
+ *   The tail is the sequence the next appended record gets (0 for a stream
+ *   that does not exist yet).
+ * - **Conditional appends.** With `matchSeq`, a batch is appended only when the
+ *   tail equals `matchSeq`; otherwise nothing is written and the result is a
+ *   `SeqMismatch` carrying the current tail. The relay appends a session
+ *   stream with `matchSeq` set to the record row's sequence, so a retried
+ *   append after an unacknowledged success is detected and never duplicated.
+ * - **Batches are atomic.** A batch is appended entirely or not at all.
+ * - **Reads resume.** `read` from `fromSeq` yields every record with
+ *   `seq >= fromSeq` in order, with no gap between history and the live tail.
+ * - **Tenant scope.** Methods take a Tenant id, or a basin key from `basinOf`
+ *   for a later generation. `ensureTenant` creates the basin (idempotent) and
+ *   must run before appends; streams are created on first append or read.
+ *   `deleteTenant` removes the basin and every stream in it (with
+ *   `allGenerations`, every generation's basin of the Tenant).
+ * - **Records are JSON.** Bodies are JSON-serializable values; implementations
+ *   encode them as they need.
+ */
 /** A record as read from a stream. */
 export interface StreamRecord<T = unknown> {
     seq: number;
@@ -48,9 +88,14 @@ export interface DurableStreams {
     tail(tenantId: string, stream: string): Promise<number>;
     /** Creates the Tenant's basin. Idempotent. */
     ensureTenant(tenantId: string): Promise<void>;
-    /** Deletes the Tenant's basin and all its streams. Idempotent. */
-    deleteTenant(tenantId: string): Promise<void>;
-    /** Deletes one stream (an abandoned session incarnation). Idempotent. */
+    /**
+     * Deletes the basin and all its streams. Idempotent. With `allGenerations`, given a Tenant
+     * id, also every later generation's basin (Tenant deletion).
+     */
+    deleteTenant(tenantId: string, options?: {
+        allGenerations?: boolean;
+    }): Promise<void>;
+    /** Deletes one stream. Idempotent. */
     deleteStream(tenantId: string, stream: string): Promise<void>;
     /**
      * Names of the Tenant's streams starting with `prefix`, in name order,
@@ -66,50 +111,40 @@ export interface DurableStreams {
     probe?(signal: AbortSignal): Promise<void>;
 }
 export declare const SESSION_STREAM_PREFIX = "sessions/";
-/** `work_available` signals for executor connections. */
-export declare const WORK_STREAM = "tenant/work";
 /** `session.cancel` and `sessions.reset` signals for every process with the Tenant open. */
 export declare const CONTROL_STREAM = "tenant/control";
+/** The stream of a session: `sessions/<sessionId>`. */
+export declare function sessionStream(sessionId: string): string;
 /**
- * The incarnation of a session document written before incarnations existed.
- * Random incarnations are 12 characters, so never this.
- */
-export declare const LEGACY_INCARNATION = "0";
-/** A new session incarnation: 12 random base64url characters. */
-export declare function newStreamIncarnation(): string;
-/** The stream of one incarnation of a session: `sessions/<sessionId>/<incarnation>`. */
-export declare function sessionStream(sessionId: string, incarnation: string): string;
-/** The fields of a session document that name its stream. */
-export interface SessionStreamRef {
-    id: string;
-    /** Set when the session is created (`newStreamIncarnation`); never changed. */
-    streamIncarnation?: string;
-}
-/** The stream of a session as stored now. */
-export declare function streamOfSession(session: SessionStreamRef): string;
-/** The session id and incarnation of a session stream, or undefined for other streams. */
-export declare function parseSessionStream(stream: string): {
-    sessionId: string;
-    incarnation: string;
-} | undefined;
-/**
- * Signals are not canonical events: they are appended without the outbox, and
- * a lost signal costs latency, not correctness.
+ * Signals are not events: they are appended directly, never recorded, and a
+ * lost signal costs latency, not correctness.
  */
-export interface WorkSignal {
-    type: "work_available";
-}
 /** Ends the advance of `sessionId` on the process running it. */
 export interface SessionCancelSignal {
     type: "session.cancel";
     sessionId: string;
+    /**
+     * The cancelled turn. Only an advance of this turn stops, so a signal delivered late (an
+     * append retried after S2 returns) never stops a later turn. Absent: any advance stops.
+     */
+    turnId?: string;
 }
 /**
- * Session streams were abandoned (a Tenant reset): each process checks its
- * session feeds and ends those whose session is gone or has a new incarnation.
+ * The Tenant was reset and moved to basin generation `generation`. Appended to the old
+ * generation's `tenant/control`: each process switches its readers to the new basin and
+ * ends the streams of sessions the reset deleted.
  */
 export interface SessionsResetSignal {
     type: "sessions.reset";
+    generation?: number;
+}
+/**
+ * A subject's tokens older than `epoch` were revoked: each process ends that subject's
+ * streams opened with them.
+ */
+export interface SubjectRevokedSignal {
+    type: "subject.revoked";
+    subject: string;
+    epoch: number;
 }
-export type ControlSignal = SessionCancelSignal | SessionsResetSignal;
-export declare const WORK_AVAILABLE: Readonly<WorkSignal>;
+export type ControlSignal = SessionCancelSignal | SessionsResetSignal | SubjectRevokedSignal;