@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/signing-keys.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { importJWK } from "jose";
+import type { PublicJwk, SigningKeyView } from "@nylorun/core/contracts";
+import type { SigningKeyRow, Tx } from "../store/types.js";
+type KeyLike = Awaited<ReturnType<typeof importJWK>>;
+export interface SigningKeysOptions {
+    tenantId: string;
+    /** The vault KEK, created on first use. Resolve it before opening a transaction. */
+    kek(): Buffer;
+}
+export interface CurrentKey {
+    readonly id: string;
+    readonly key: KeyLike;
+}
+export declare class SigningKeys {
+    private readonly options;
+    private readonly publicKeys;
+    private current;
+    constructor(options: SigningKeysOptions);
+    kek(): Buffer;
+    private aad;
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    private create;
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    ensure(t: Tx, kek: Buffer): Promise<SigningKeyRow>;
+    /** The private key of `row` (the current key), imported once per key id. */
+    privateKey(row: SigningKeyRow, kek: Buffer): Promise<CurrentKey>;
+    /** The public key of `row`, imported once per key id. */
+    publicKey(row: SigningKeyRow): Promise<KeyLike>;
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    revoke(t: Tx, id: string): Promise<SigningKeyRow>;
+}
+export declare function publicJwk(row: SigningKeyRow): PublicJwk;
+export declare function signingKeyView(row: SigningKeyRow): SigningKeyView;
+export {};

package/dist/tenant/signing-keys.js

@@ -0,0 +1,172 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
+import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
+import { DELIVERY_TOKEN_MAX_TTL_SECONDS } from "@nylorun/core/contracts";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { fail } from "./http.js";
+const ALG = "ES256";
+/** Grace added to the longest token lifetime before a previous key may be revoked. */
+const ROTATION_GRACE_MS = 60_000;
+export class SigningKeys {
+    options;
+    publicKeys = new Map();
+    current;
+    constructor(options) {
+        this.options = options;
+    }
+    kek() {
+        return this.options.kek();
+    }
+    aad(id) {
+        return Buffer.from(`nylorun.signing-key:${this.options.tenantId}:${id}`);
+    }
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    async create(kek, state, now) {
+        const id = newSigningKeyId();
+        const pair = await generateKeyPair(ALG, { extractable: true });
+        const jwk = await exportJWK(pair.publicKey);
+        const pkcs8 = await exportPKCS8(pair.privateKey);
+        const sealed = encryptSecret(kek, this.aad(id), Buffer.from(pkcs8, "utf8"));
+        return {
+            id,
+            state,
+            alg: ALG,
+            publicJwk: JSON.stringify({
+                kty: jwk.kty,
+                crv: jwk.crv,
+                x: jwk.x,
+                y: jwk.y,
+            }),
+            createdAt: now,
+            activatedAt: state === "current" ? now : null,
+            retiredAt: null,
+            revokedAt: null,
+            kekId: sealed.kekId,
+            nonce: sealed.nonce,
+            ciphertext: sealed.ciphertext,
+            wrappedDek: sealed.wrappedDek,
+        };
+    }
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    async ensure(t, kek) {
+        let live = await t.signingKeys(["standby", "current"]);
+        if (live.length < 2) {
+            // Concurrent first uses would both create keys: lock, then read what the winner made.
+            await t.lockSigningKeys();
+            live = await t.signingKeys(["standby", "current"]);
+        }
+        const now = new Date().toISOString();
+        let current = live.find((row) => row.state === "current");
+        if (!current) {
+            const standby = live.find((row) => row.state === "standby");
+            if (standby) {
+                await t.setSigningKeyState(standby.id, "standby", "current", now);
+                current = { ...standby, state: "current", activatedAt: now };
+            }
+            else {
+                current = await this.create(kek, "current", now);
+                await t.insertSigningKey(current);
+            }
+        }
+        if (!live.some((row) => row.state === "standby" && row.id !== current.id))
+            await t.insertSigningKey(await this.create(kek, "standby", now));
+        return current;
+    }
+    /** The private key of `row` (the current key), imported once per key id. */
+    async privateKey(row, kek) {
+        if (this.current?.id === row.id)
+            return this.current;
+        const pkcs8 = decryptSecret(kek, this.aad(row.id), Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrappedDek), row.kekId).toString("utf8");
+        const key = await importPKCS8(pkcs8, ALG);
+        this.current = { id: row.id, key };
+        return this.current;
+    }
+    /** The public key of `row`, imported once per key id. */
+    async publicKey(row) {
+        const cached = this.publicKeys.get(row.id);
+        if (cached)
+            return cached;
+        const key = await importJWK({ ...JSON.parse(row.publicJwk), alg: ALG }, ALG);
+        this.publicKeys.set(row.id, key);
+        return key;
+    }
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    async rotate(t, kek, maxTtlSeconds, force) {
+        await t.lockSigningKeys();
+        await this.ensure(t, kek);
+        const now = new Date();
+        const at = now.toISOString();
+        const [previous] = await t.signingKeys(["previous"]);
+        if (previous && !force) {
+            const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
+            // Delivery tokens may outlive the policy's subject tokens.
+            const longest = Math.max(maxTtlSeconds, DELIVERY_TOKEN_MAX_TTL_SECONDS);
+            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            if (until > now.getTime())
+                fail(409, "The previous key may still verify live tokens", {
+                    code: "request_rejected",
+                    details: { retryAfterSeconds: Math.ceil((until - now.getTime()) / 1000) },
+                });
+        }
+        if (previous)
+            await t.setSigningKeyState(previous.id, "previous", "revoked", at);
+        const [current] = await t.signingKeys(["current"]);
+        const [standby] = await t.signingKeys(["standby"]);
+        if (current)
+            await t.setSigningKeyState(current.id, "current", "previous", at);
+        if (standby)
+            await t.setSigningKeyState(standby.id, "standby", "current", at);
+        else
+            await t.insertSigningKey(await this.create(kek, "current", at));
+        await t.insertSigningKey(await this.create(kek, "standby", at));
+        return t.signingKeys();
+    }
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    async revoke(t, id) {
+        const row = SIGNING_KEY_ID_PATTERN.test(id)
+            ? await t.signingKey(id)
+            : undefined;
+        if (!row)
+            return fail(404, "Signing key not found");
+        if (row.state === "revoked")
+            return row;
+        if (row.state === "current")
+            return fail(409, "Rotate before revoking the current key");
+        const at = new Date().toISOString();
+        await t.setSigningKeyState(row.id, row.state, "revoked", at);
+        return { ...row, state: "revoked", revokedAt: at };
+    }
+}
+export function publicJwk(row) {
+    return { ...JSON.parse(row.publicJwk), kid: row.id, alg: ALG, use: "sig" };
+}
+export function signingKeyView(row) {
+    return {
+        id: row.id,
+        state: row.state,
+        alg: row.alg,
+        publicKey: publicJwk(row),
+        createdAt: row.createdAt,
+        activatedAt: row.activatedAt,
+        retiredAt: row.retiredAt,
+        revokedAt: row.revokedAt,
+    };
+}

package/dist/tenant/slim.d.ts

@@ -0,0 +1,8 @@
+import type { Tx } from "../store/types.js";
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export declare function slimModelEffects(t: Tx, sessionId: string, turnId: string | null): Promise<void>;

package/dist/tenant/slim.js

@@ -0,0 +1,21 @@
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export async function slimModelEffects(t, sessionId, turnId) {
+    if (!turnId)
+        return;
+    for (const effect of await t.effectsForTurn(sessionId, turnId, ["completed"])) {
+        if (effect.request?.kind !== "model" || effect.slimmed)
+            continue;
+        const { input: _input, ...request } = effect.request;
+        await t.put("effects", request.effectId, {
+            ...effect,
+            request,
+            outcome: {},
+            slimmed: true,
+        });
+    }
+}

package/dist/tenant/status.d.ts

@@ -1,22 +1,20 @@
 import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
-import type { ExecutorRegistry } from "../core/executors.js";
 import type { VaultService } from "../vault/service.js";
 import type { SandboxManager } from "../sandbox/manager.js";
 import type { TenantConfig } from "./types.js";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import type { StuckInvocation } from "../execution/types.js";
 import type { StreamsStatus } from "./streams.js";
+import type { Keys } from "../keys/keys.js";
 export interface TenantStatusContext {
     envelope: TenantEnvelope;
     config: TenantConfig;
     store: SessionStore;
-    registry: ExecutorRegistry;
     vault: VaultService;
     sandbox: SandboxManager;
     closing: boolean;
     modelConfigured: boolean;
-    executorStreams: Map<string, Set<unknown>>;
     /**
      * This Tenant's execution invocations that need an operator (`TenantExecution`). Absent
      * when the execution cannot report them.
@@ -34,4 +32,6 @@ export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<Ten
 export declare function seedTenantConfig(ctx: {
     store: SessionStore;
     vault: VaultService;
+    /** Seals the seeded model credential (F4.2). */
+    keys: Pick<Keys, "putHostModel">;
 }, body: SeedTenantConfigRequest): Promise<SeedTenantConfigResponse>;

package/dist/tenant/status.js

@@ -1,4 +1,5 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
+import { SANDBOX_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
 /** How long status waits for the execution to list stuck invocations. */
 const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
@@ -54,17 +55,13 @@ export async function buildTenantStatus(ctx) {
     const definitionIds = new Set(definitions
         .map((d) => d.manifest?.id)
         .filter((id) => typeof id === "string"));
-    const executorIds = new Set(ctx.registry.list().map((e) => e.agentId));
-    const agentIds = new Set([...definitionIds, ...executorIds]);
-    const agents = [...agentIds].sort().map((agentId) => {
-        const record = ctx.registry.get(agentId);
-        return {
-            agentId,
-            registered: definitionIds.has(agentId),
-            connected: !!record &&
-                (ctx.executorStreams.get(record.tokenHash)?.size ?? 0) > 0,
-        };
-    });
+    const endpointIds = new Set((await ctx.store.tx((t) => t.listEndpoints())).map((e) => e.agentId));
+    const agentIds = new Set([...definitionIds, ...endpointIds]);
+    const agents = [...agentIds].sort().map((agentId) => ({
+        agentId,
+        registered: definitionIds.has(agentId),
+        endpoint: endpointIds.has(agentId),
+    }));
     return {
         tenant: ctx.envelope,
         path: ctx.config.paths.root,
@@ -72,7 +69,7 @@ export async function buildTenantStatus(ctx) {
             store: health.schemaVersion > 0,
             scheduler: !ctx.closing,
             model: ctx.modelConfigured || modelView.configured,
-            executors: true,
+            endpoints: true,
             schema: health.ok,
         },
         model: modelView,
@@ -108,6 +105,16 @@ export async function seedTenantConfig(ctx, body) {
         });
         (inserted ? applied : kept).push("sandbox.backend");
     }
+    const sandboxConfig = body.sandbox?.config;
+    if (sandboxConfig) {
+        const inserted = await ctx.store.tx(async (t) => {
+            if ((await t.getSetting(SANDBOX_CONFIG_SETTING)) !== undefined)
+                return false;
+            await writeSandboxConfig(t, sandboxConfig);
+            return true;
+        });
+        (inserted ? applied : kept).push(SANDBOX_CONFIG_SETTING);
+    }
     if (body.fixtureModel) {
         const inserted = await ctx.store.tx((t) => seedFixtureModel(t));
         (inserted ? applied : kept).push(FIXTURE_MODEL_SETTING);
@@ -118,7 +125,7 @@ export async function seedTenantConfig(ctx, body) {
             kept.push("model");
         }
         else {
-            await ctx.vault.putHostModel({
+            await ctx.keys.putHostModel({
                 requestId: body.requestId,
                 idempotencyKey: `seed-model:${body.requestId}`,
                 ...body.model,

package/dist/tenant/store-pg.d.ts

@@ -1,15 +1,18 @@
 import type { PostgresClient } from "../store/postgres/connect.js";
-import type { Migration } from "../store/postgres/migrations/index.js";
-import { type Logger, type OpenTenantRuntime, type TenantConfig, type TenantStore } from "./types.js";
-export interface PostgresTenantStoreOptions {
+import type { Migration } from "../store/postgres/migrate.js";
+import { type TenantCreation } from "../store/postgres/tenant.js";
+import { type Logger, type OpenTenantRuntime, type TenantConfig, type TenantOpener } from "./types.js";
+export interface PostgresTenantOptions {
     hostRoot: string;
-    /** The Host's pool. The store never ends it. */
+    /** The pool on the Tenant's database. The Tenant never ends it. */
     sql: PostgresClient;
-    /** Opens the Tenant Runtime on a store the catalog opened; the Runtime then owns it. */
+    /** Who the Tenant is when the database holds none yet. */
+    create: TenantCreation;
+    /** Opens the Tenant Runtime on the opened store; the Runtime then owns it. */
     openRuntime: OpenTenantRuntime;
     configFor: (tenantId: string) => TenantConfig;
     logger?: Logger;
     /** Tests only: the migrations this Runtime knows. */
     migrations?: readonly Migration[];
 }
-export declare function createPostgresTenantStore(options: PostgresTenantStoreOptions): TenantStore;
+export declare function createPostgresTenantOpener(options: PostgresTenantOptions): TenantOpener;

package/dist/tenant/store-pg.js

@@ -1,140 +1,75 @@
 /**
- * The Tenant store over the Postgres Tenant catalog (architecture §8.1, §8.2).
+ * Opens the Host's Tenant on its Postgres database (tenancy.md §4–§5, plan P9).
  *
- * A Tenant exists when its schema `tenant_<id>` exists (`store/postgres/tenants.ts`); the
- * envelope is a row in it, so this store keeps no registry. What stays on the Host root is
- * the Tenant directory `tenants/<id>/`: the vault key (`vault-kek`), `plugin-data/`, `logs/`,
- * and the private `home/`, `tmp/` and `sandboxes/`. It is created with the Tenant and removed
- * with it; nothing in it says whether the Tenant exists.
+ * The database holds one Tenant (`store/postgres/tenant.ts`): opening migrates it, creates
+ * the Tenant on first start (from the Host's configuration: id, name, Studio and derived
+ * principals), and opens the Tenant Runtime on its Session Store. What stays on the Host root
+ * is the Tenant directory `tenant/`: the vault key (`vault-kek`), `plugin-data/`, `logs/`,
+ * and the private `home/`, `tmp/` and `sandboxes/`.
  *
- * - `create` makes the directory, then creates, migrates and bootstraps the schema in one
- *   transaction. A schema that already exists is `exists`; the module compares its bootstrap.
- * - `open` migrates an older schema forward and opens the Tenant Runtime on the schema's
- *   Session Store. A missing schema is `TenantNotFoundError`; a schema newer than this
- *   Runtime, a failed migration, an unreadable envelope or vault ciphertext without its key
- *   throws that quarantine. A failure outside the Tenant (Postgres unreachable, its sweep
- *   not armed) is `TenantUnavailableError`, which the module does not cache.
- * - `trash` drops the schema and removes the directory. There is no `trash/` copy: the key
- *   is useless without the schema.
+ * - A failure in the Tenant (an old layout, a database newer than this Runtime, a failed
+ *   migration, an unreadable Tenant row, vault ciphertext without its key) rejects with that
+ *   `TenantOpenError`; the Host reports it and fails readiness.
+ * - A failure outside the Tenant (Postgres unreachable, its sweep not armed in Restate) is
+ *   `TenantUnavailableError`; the Tenant module retries.
  */
-import { mkdirSync, rmSync } from "node:fs";
-import { tenantSchemaName } from "../store/postgres/names.js";
-import { createPostgresTenantCatalog } from "../store/postgres/tenants.js";
+import { mkdirSync } from "node:fs";
+import { openTenantDatabase, } from "../store/postgres/tenant.js";
+import { TenantOpenError } from "./cause.js";
 import { tenantPaths } from "./paths.js";
-import { QuarantineError, TenantConflictError } from "./quarantine.js";
-import { TenantNotFoundError, TenantUnavailableError, } from "./types.js";
-/** Repair instructions for a Postgres Tenant, naming its schema. */
-function repairFor(code, tenantId) {
-    const status = `nylo tenant status ${tenantId}`;
-    const schema = tenantSchemaName(tenantId);
-    switch (code) {
-        case "schema-too-new":
-            return `${status} — schema ${schema} was migrated by a newer Runtime; run that version or newer`;
-        case "migration-failed":
-            return `${status} — inspect the Runtime log for the failed migration of ${schema}, fix it, then restart the Runtime`;
-        case "envelope-invalid":
-            return `${status} — the tenant table of schema ${schema} is missing or invalid; restore the schema from a Postgres backup`;
-        case "kek-missing":
-            return `${status} — restore vault-kek under the Tenant directory (ciphertext cannot be opened without it)`;
-        default:
-            return `${status} — inspect the Runtime log and Postgres, then restart the Runtime`;
-    }
-}
-function unavailable(tenantId, cause) {
+import { TenantUnavailableError, } from "./types.js";
+function unavailable(cause) {
     return cause instanceof TenantUnavailableError
         ? cause
-        : new TenantUnavailableError(tenantId, { cause });
-}
-function quarantined(reason, tenantId) {
-    return new QuarantineError({ ...reason, repair: repairFor(reason.code, tenantId) });
+        : new TenantUnavailableError({ cause });
 }
-export function createPostgresTenantStore(options) {
-    const catalog = createPostgresTenantCatalog({
-        sql: options.sql,
-        ...(options.migrations ? { migrations: options.migrations } : {}),
-        onError: (error) => options.logger?.error("post-commit step failed", {
-            message: error instanceof Error ? error.message : String(error),
-        }),
-    });
-    const paths = (id) => tenantPaths(options.hostRoot, id);
-    function makeDirectory(id) {
-        const p = paths(id);
-        mkdirSync(p.root, { recursive: true, mode: 0o700 });
-        for (const dir of [p.home, p.tmp, p.sandboxes, p.pluginData, p.logs])
-            mkdirSync(dir, { recursive: true });
-    }
-    async function readEnvelope(id) {
+export function createPostgresTenantOpener(options) {
+    const { logger } = options;
+    return async () => {
+        const opened = await openTenantDatabase({
+            sql: options.sql,
+            create: options.create,
+            ...(options.migrations ? { migrations: options.migrations } : {}),
+            onError: (error) => logger?.error("post-commit step failed", {
+                message: error instanceof Error ? error.message : String(error),
+            }),
+        }).catch((error) => {
+            if (error instanceof TenantOpenError)
+                throw error;
+            throw unavailable(error);
+        });
+        const { store, envelope } = opened;
+        const tenantId = envelope.id;
+        if (opened.created)
+            logger?.info("tenant created", { tenantId, name: envelope.name });
+        else if (options.create.tenantId !== undefined && options.create.tenantId !== tenantId)
+            logger?.warn("tenant id configured differs", {
+                tenantId,
+                configured: options.create.tenantId,
+                message: "The database already holds a Tenant; the configured id applies only to a new database",
+            });
+        if (opened.migrated.from !== opened.migrated.to)
+            logger?.info("tenant schema migrated", {
+                tenantId,
+                from: opened.migrated.from,
+                to: opened.migrated.to,
+            });
         try {
-            return await catalog.readEnvelope(id);
+            const config = options.configFor(tenantId);
+            const paths = tenantPaths(options.hostRoot);
+            mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+            return await options.openRuntime({ ...config, tenantId }, { store, envelope });
         }
         catch (error) {
-            if (!(error instanceof QuarantineError))
-                throw unavailable(id, error);
-            // Dropped since it was listed (deleted by another process).
-            if (!(await catalog.tenantExists(id).catch(() => true)))
-                throw new TenantNotFoundError(id);
-            throw quarantined(error.toQuarantine(), id);
-        }
-    }
-    return {
-        enumerate: () => catalog.listTenantIds(),
-        readEnvelope,
-        async create(envelope, bootstrap) {
-            makeDirectory(envelope.id);
-            try {
-                const result = await catalog.createTenant({ envelope, principals: bootstrap });
-                return result.status;
-            }
-            catch (error) {
-                // An existing Tenant with other bootstrap material; the module reports the conflict.
-                if (error instanceof TenantConflictError)
-                    return "exists";
+            await store.close().catch(() => undefined);
+            if (error instanceof TenantOpenError) {
+                // The Tenant's own failure (`kek-missing`): report which Tenant it is.
+                error.envelope ??= envelope;
                 throw error;
             }
-        },
-        bootstrapMatches: (id, bootstrap) => catalog.bootstrapMatches(id, bootstrap),
-        async open(id) {
-            const result = await catalog
-                .openTenant(id)
-                .catch((error) => {
-                throw unavailable(id, error);
-            });
-            if (result.status === "not-found")
-                throw new TenantNotFoundError(id);
-            if (result.status === "quarantined")
-                throw quarantined(result.reason, id);
-            if (result.migrated.from !== result.migrated.to)
-                options.logger?.info("tenant schema migrated", {
-                    tenantId: id,
-                    from: result.migrated.from,
-                    to: result.migrated.to,
-                });
-            try {
-                makeDirectory(id);
-                const config = options.configFor(id);
-                return await options.openRuntime({ ...config, tenantId: id }, { store: result.store, envelope: result.envelope });
-            }
-            catch (error) {
-                await result.store.close().catch(() => undefined);
-                // The Runtime's own quarantines (`kek-missing`) get this store's repair wording.
-                const reason = error?.quarantine;
-                if (reason)
-                    throw quarantined(reason, id);
-                if (error instanceof QuarantineError)
-                    throw error;
-                // Anything else failed outside the Tenant (Postgres, arming its sweep in Restate):
-                // the next use tries again rather than quarantining it.
-                throw unavailable(id, error);
-            }
-        },
-        async trash(id) {
-            await catalog.deleteTenant(id);
-            rmSync(paths(id).root, { recursive: true, force: true });
-        },
-        async removePartial(id) {
-            if (await catalog.tenantExists(id))
-                return;
-            rmSync(paths(id).root, { recursive: true, force: true });
-        },
+            // Anything else failed outside the Tenant (Postgres, arming its sweep in Restate): the
+            // next use tries again.
+            throw unavailable(error);
+        }
     };
 }