@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/streams.js

@@ -1,273 +1,202 @@
-/**
- * The Durable Streams seam of an open Tenant (architecture §12.4), wired by one
- * `wireStreams(ctx, …)` call in the composition root:
- *
- * - **Basin.** The Tenant's basin is created when the Tenant is created (`createTenantStreams`)
- *   and checked when it opens. A missing basin (S2 down at creation, a crash in between) is
- *   repaired on first use: a failed `ensureTenant` or relay append retries `ensureTenant` in the
- *   background with backoff, and `streamsStatus` reports the basin's state. Only Tenant deletion
- *   deletes the basin (`deleteTenantStreams`); a reset never does (s2-lite keeps a deleted basin's
- *   name for about a minute).
- * - **Relay.** The outbox relay (`streams/relay.ts`) subscribes to the Session Store's commits,
- *   appends committed events to the session's stream, and appends `work_available` to
- *   `tenant/work` after a commit that called `t.signalWork()`. It is the only writer of either;
- *   business code never publishes or notifies.
- * - **Readers.** History and session SSE read the session's stream (`tenant/live.ts`). This
- *   module runs one `tenant/work` reader per Tenant per process, which wakes connected
- *   executors, and one `tenant/control` reader, which calls `ctx.abortLocal` for each
- *   `session.cancel` and checks the session feeds for each `sessions.reset`.
- * - **Incarnations.** A session's stream is `sessions/<id>/<incarnation>`, with the incarnation
- *   stored on the session when it is created (`streams/types.ts`). A reset abandons the
- *   streams of the sessions it deletes instead of deleting and re-creating them, so a session
- *   created again with the same id (during or after the reset, on any node) starts a new stream
- *   at sequence 0. Abandoned streams are deleted best effort by `collectSessionStreams`: right
- *   after the reset, and by the Tenant sweep until a collection succeeds. The pending
- *   collection is a Tenant setting written before the reset, so it survives a crash.
- * - **Recovery.** `drainOutbox(ctx)` appends leftover outbox rows (after a crash or an S2
- *   outage). The Tenant sweep calls it.
- *
- * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
- * local development Host (not durable).
- */
-import { randomBytes } from "node:crypto";
-import { createRelay, signalCancel, signalSessionsReset, StreamGapError, } from "../streams/relay.js";
-import { CONTROL_STREAM, SESSION_STREAM_PREFIX, WORK_STREAM, parseSessionStream, streamOfSession, } from "../streams/types.js";
-import { announceWork, checkFeeds, sleep } from "./live.js";
+import { basinOf } from "../streams/basin.js";
+import { signalCancel, signalSessionsReset } from "../streams/control.js";
+import { createStreamRelay, } from "../streams/relay/core.js";
+import { CONTROL_STREAM, } from "../streams/types.js";
+import { checkSessionStreams, currentBasin, endSubjectStreams, sleep, } from "./session-streams.js";
 const RETRY_MIN_MS = 100;
 const RETRY_MAX_MS = 2000;
 /** The longest wait between two `ensureTenant` attempts while the basin is being repaired. */
 const BASIN_RETRY_MAX_MS = 5000;
 /** A repair started within this long after the last one succeeded waits for the next failure. */
 const BASIN_REPAIR_COOLDOWN_MS = 1000;
-/** Outbox rows per drain page at open. */
-const OPEN_DRAIN_PAGE = 1000;
-/** How often every session feed is checked against its session (backstop for lost signals). */
+/** How often every session stream is checked against its session (backstop for lost signals). */
 const FEED_CHECK_MS = 30_000;
-/** The Tenant setting that holds a pending collection's token ("" when none is pending). */
-export const COLLECT_SETTING = "streams.collect";
-/** Sessions looked up per transaction while collecting. */
-const COLLECT_LOOKUP_PAGE = 500;
-/** Stream deletions in flight at once while collecting. */
-const COLLECT_PARALLEL = 8;
+/** How long a retired basin stays for readers that have not moved yet. */
+const RETIRE_GRACE_MS = 60_000;
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
- * Wires the Tenant to Durable Streams: checks the basin, creates the relay (unless given),
- * starts the work and control readers, and records the handles on `ctx.live.wiring`. Call it
- * once, after `ctx` is built and before the Tenant serves requests.
+ * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
+ * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
+ * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
+ * `ctx` is built and before the Tenant serves requests.
  */
 export async function wireStreams(ctx, options) {
-    if (ctx.live.wiring)
+    if (ctx.sessionStreams.wiring)
         throw new Error("Streams are already wired");
     const { store, streams, tenantId } = options;
     const logger = ctx.config.logger;
     const stop = new AbortController();
+    const graceMs = options.retireGraceMs ?? RETIRE_GRACE_MS;
     // Nothing is reported once the wiring stops: the Tenant (and its log directory) may be gone,
     // and a throwing report in a detached loop would be an unhandled rejection.
     const report = (what) => (error) => {
         if (!stop.signal.aborted)
             logger.warn(what, { message: messageOf(error) });
     };
-    const basin = basinKeeper(streams, tenantId, stop.signal, report("stream basin unavailable; retrying"));
+    const generations = await store.tx((t) => t.basinGenerations());
+    ctx.sessionStreams.generation = generations.current;
+    const basin = basinKeeper(streams, () => currentBasin(ctx), stop.signal, report("stream basin unavailable; retrying"));
     // Wait for the first check so the first commits find the basin; a failure repairs it later.
     await basin.ensure().catch((error) => {
         report("stream basin unavailable; relaying later")(error);
         basin.repair();
     });
-    const relay = options.relay ??
-        createRelay({
-            store,
+    const relay = options.hostRelay
+        ? undefined
+        : createStreamRelay({
+            source: commitSource(store, tenantId),
+            record: store.record(),
             streams,
-            tenantId,
-            onError: (error) => {
-                report("event relay failed; events stay in the outbox")(error);
-                // The basin may be missing (never created, or deleted underneath); make sure of it.
-                if (!(error instanceof StreamGapError))
-                    basin.repair();
+            log: (message, fields) => {
+                if (!stop.signal.aborted)
+                    logger.info(message, fields);
             },
         });
-    const work = follow(streams, tenantId, WORK_STREAM, stop.signal, () => announceWork(ctx.live), report("work stream read failed; retrying"));
-    const control = follow(streams, tenantId, CONTROL_STREAM, stop.signal, (body) => {
+    relay?.start();
+    // One control reader, on the current basin; moving to a new generation restarts it there.
+    let control = new AbortController();
+    const startControl = () => follow(streams, currentBasin(ctx), CONTROL_STREAM, AbortSignal.any([stop.signal, control.signal]), (body) => {
         const signal = body;
         if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
-            ctx.abortLocal(signal.sessionId);
+            ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
         else if (signal?.type === "sessions.reset")
-            void checkFeeds(ctx).catch(report("session feed check failed"));
+            void checkSessionStreams(ctx).catch(report("session stream check failed"));
+        else if (signal?.type === "subject.revoked" &&
+            typeof signal.subject === "string" &&
+            typeof signal.epoch === "number")
+            endSubjectStreams(ctx.sessionStreams, signal.subject, signal.epoch);
     }, report("control stream read failed; retrying"));
     // Signals appended from here on reach this process.
-    await Promise.all([work, control]);
-    // Feeds whose session was reset end on the `sessions.reset` signal; this catches lost ones.
-    const feedCheck = setInterval(() => void checkFeeds(ctx).catch(report("session feed check failed")), FEED_CHECK_MS);
+    await startControl();
+    // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
+    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
     feedCheck.unref();
-    let collecting;
+    const retiring = new Set();
+    const timers = new Set();
     const wiring = {
         streams,
         relay,
         basin: () => basin.status(),
-        async drain(limit) {
-            await basin.ensure();
-            return relay.drain(limit);
+        moveTo(generation) {
+            if (stop.signal.aborted || generation === ctx.sessionStreams.generation)
+                return;
+            ctx.sessionStreams.generation = generation;
+            basin.repair();
+            control.abort();
+            control = new AbortController();
+            void startControl();
         },
-        collect() {
-            collecting ??= collectSessionStreams(ctx, streams).finally(() => {
-                collecting = undefined;
-            });
-            return collecting;
+        retire(retired) {
+            for (const generation of retired) {
+                if (generation === ctx.sessionStreams.generation || retiring.has(generation))
+                    continue;
+                retiring.add(generation);
+                const timer = setTimeout(() => {
+                    timers.delete(timer);
+                    void deleteRetired(generation).finally(() => retiring.delete(generation));
+                }, graceMs);
+                timer.unref();
+                timers.add(timer);
+            }
         },
         async close() {
             stop.abort();
             clearInterval(feedCheck);
-            unregisterSweep();
-            if (!options.relay)
-                await relay.close();
-            await collecting?.catch(() => undefined);
+            for (const timer of timers)
+                clearTimeout(timer);
+            await relay?.stop();
             if (options.ownsStreams)
                 await streams.close();
         },
     };
-    ctx.live.wiring = wiring;
-    // The sweep retries a collection a reset left pending (or one a crash interrupted).
-    const unregisterSweep = ctx.onSweep(async () => {
-        await wiring.collect();
-    });
-    // Rows a previous process committed but did not relay; the sweep picks up what this misses.
-    void (async () => {
-        while ((await wiring.drain(OPEN_DRAIN_PAGE)) >= OPEN_DRAIN_PAGE)
-            ;
-    })().catch(report("outbox drain at open failed"));
+    /** Deletes a retired generation's basin, then forgets it. A failure retries on next open. */
+    async function deleteRetired(generation) {
+        try {
+            await withRetries(() => streams.deleteTenant(basinOf(tenantId, generation)), 5);
+            await store.tx((t) => t.forgetRetiredGeneration(generation));
+            logger.info("retired stream basin deleted", { generation });
+        }
+        catch (error) {
+            report("retired stream basin not deleted; retrying when the Tenant opens")(error);
+        }
+    }
+    ctx.sessionStreams.wiring = wiring;
+    wiring.retire(generations.retired);
     return wiring;
 }
-/** The Tenant sweep's outbox recovery: appends leftover rows, at most `limit`. */
-export function drainOutbox(ctx, limit) {
-    const wiring = ctx.live.wiring;
-    return wiring ? wiring.drain(limit) : Promise.resolve(0);
+/**
+ * The Tenant's own commits as a change source, for a Tenant without the Host's relay. It
+ * starts fresh every time (the relay reconciles the record first) and keeps nothing: a commit
+ * this process did not see is found by the next reconciliation.
+ */
+function commitSource(store, tenantId) {
+    let unsubscribe;
+    let n = 0;
+    return {
+        start(handlers) {
+            handlers.onActive({ fresh: true });
+            unsubscribe = store.onCommit((commit) => {
+                n += 1;
+                handlers.onTx({
+                    endLsn: `0/${n}`,
+                    rows: commit.events.map((event, i) => ({
+                        tenantId,
+                        sessionId: event.sessionId,
+                        seq: event.seq,
+                        generation: commit.generations[i],
+                        body: event,
+                    })),
+                });
+            });
+        },
+        acknowledge() { },
+        async reconciled() { },
+        async stop() {
+            unsubscribe?.();
+        },
+    };
 }
 /**
- * Appends `session.cancel` for `sessionId` to `tenant/control`, so the process running its
- * advance aborts it. Call it from `t.afterCommit` after a cancel commits. A lost signal costs
- * latency only (the advance checks the Session Store before every effect), so failures are
- * logged, never thrown.
+ * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
+ * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
+ * commits. A lost signal costs latency only (the advance checks the Session Store before every
+ * effect), so failures are logged, never thrown.
  */
-export function signalSessionCancel(ctx, sessionId) {
-    const streams = ctx.live.wiring?.streams;
+export function signalSessionCancel(ctx, sessionId, turnId) {
+    const streams = ctx.sessionStreams.wiring?.streams;
     if (!streams)
         return;
-    void signalCancel(streams, ctx.config.tenantId, sessionId).catch((error) => ctx.config.logger.warn("cancel signal failed", {
+    void signalCancel(streams, currentBasin(ctx), sessionId, turnId ?? undefined).catch((error) => ctx.config.logger.warn("cancel signal failed", {
         sessionId,
         message: messageOf(error),
     }));
 }
 /**
- * Before a reset that deletes sessions: records a pending collection of their streams in the
- * Tenant settings, so it is retried by the sweep even if this process stops before it runs.
- */
-export async function requestStreamCollection(ctx) {
-    const token = `${Date.now()}-${randomBytes(6).toString("hex")}`;
-    await ctx.store.tx((t) => t.putSetting(COLLECT_SETTING, token));
-}
-/**
- * After a reset deleted sessions: tells every process with the Tenant open to check its
- * session feeds (`sessions.reset`), and deletes the abandoned streams now, best effort.
- * Failures are logged; the sweep retries the collection.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
+ * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
+ * moves this process's readers, and deletes the old basin after the grace period. Failures
+ * are logged; the periodic check and the next open finish the job.
  */
-export function sessionStreamsAbandoned(ctx) {
-    const wiring = ctx.live.wiring;
+export async function tenantReset(ctx) {
+    const wiring = ctx.sessionStreams.wiring;
     if (!wiring)
         return;
-    const warn = (what) => (error) => ctx.config.logger.warn(what, { message: messageOf(error) });
-    void signalSessionsReset(wiring.streams, ctx.config.tenantId).catch(warn("sessions.reset signal failed"));
-    void wiring.collect().catch(warn("session stream collection failed; the sweep retries"));
+    const previous = currentBasin(ctx);
+    const generations = await ctx.store.tx((t) => t.basinGenerations());
+    await signalSessionsReset(wiring.streams, previous, generations.current).catch((error) => ctx.config.logger.warn("sessions.reset signal failed", { message: messageOf(error) }));
+    wiring.moveTo(generations.current);
+    wiring.retire(generations.retired);
 }
-/**
- * Deletes the Tenant's session streams that no session uses any more: streams of deleted
- * sessions and of earlier incarnations. Runs only while a collection is pending
- * (`requestStreamCollection`), and clears it once every deletion succeeded, unless another
- * reset requested a new one meanwhile.
- *
- * Streams are listed before their sessions are read, so a session created meanwhile keeps
- * its stream: its row committed before the relay created the stream.
- */
-export async function collectSessionStreams(ctx, streams) {
-    const { store } = ctx;
-    const tenantId = ctx.config.tenantId;
-    const token = await store.tx((t) => t.getSetting(COLLECT_SETTING));
-    if (!token)
-        return undefined;
-    const bySession = new Map();
-    for (const name of await streams.listStreams(tenantId, SESSION_STREAM_PREFIX)) {
-        const parsed = parseSessionStream(name);
-        if (!parsed)
-            continue;
-        let names = bySession.get(parsed.sessionId);
-        if (!names)
-            bySession.set(parsed.sessionId, (names = []));
-        names.push(name);
-    }
-    const ids = [...bySession.keys()];
-    const current = new Map();
-    for (let i = 0; i < ids.length; i += COLLECT_LOOKUP_PAGE) {
-        const page = ids.slice(i, i + COLLECT_LOOKUP_PAGE);
-        await store.tx(async (t) => {
-            for (const id of page) {
-                const session = await t.get("sessions", id);
-                if (session)
-                    current.set(id, streamOfSession(session));
-            }
-        });
-    }
-    const abandoned = [...bySession].flatMap(([id, names]) => names.filter((name) => current.get(id) !== name));
-    const result = {
-        deleted: 0,
-        kept: [...bySession.values()].flat().length - abandoned.length,
-        failed: 0,
-    };
-    let next = 0;
-    await Promise.all(Array.from({ length: Math.min(COLLECT_PARALLEL, abandoned.length) }, async () => {
-        while (next < abandoned.length) {
-            const name = abandoned[next++];
-            try {
-                await streams.deleteStream(tenantId, name);
-                result.deleted += 1;
-            }
-            catch (error) {
-                result.failed += 1;
-                ctx.config.logger.warn("session stream delete failed; the sweep retries", {
-                    stream: name,
-                    message: messageOf(error),
-                });
-            }
-        }
-    }));
-    if (result.failed === 0)
-        await store.tx(async (t) => {
-            if ((await t.getSetting(COLLECT_SETTING)) === token)
-                await t.putSetting(COLLECT_SETTING, "");
-        });
-    return result;
-}
-/**
- * The streams seam's status for an open Tenant: S2 reachability, the basin, outbox depth and
- * relay lag. Reads the Session Store and probes the streams (at most `probeTimeoutMs`).
- */
+/** The streams seam's status for an open Tenant: S2 reachability, the basin and the relay. */
 export async function streamsStatus(ctx, options = {}) {
-    const wiring = ctx.live.wiring;
-    const now = options.now ?? Date.now;
-    const [reachable, stored] = await Promise.all([
-        wiring
-            ? probe(wiring.streams, options.probeTimeoutMs ?? 2000)
-            : Promise.resolve(false),
-        ctx.store.tx(async (t) => ({
-            outbox: await t.outboxStats(),
-            collect: await t.getSetting(COLLECT_SETTING),
-        })),
-    ]);
-    const oldest = stored.outbox.oldestCreatedAt;
-    const oldestAgeMs = oldest === null ? null : Math.max(0, now() - Date.parse(oldest));
+    const wiring = ctx.sessionStreams.wiring;
     return {
-        reachable,
+        reachable: wiring
+            ? await probe(wiring.streams, options.probeTimeoutMs ?? 2000)
+            : false,
         basin: wiring?.basin() ?? { ready: false, failures: 0, lastError: null },
-        outbox: { depth: stored.outbox.depth, oldestAgeMs },
-        relayLagMs: oldestAgeMs ?? 0,
-        collectionPending: !!stored.collect,
+        generation: ctx.sessionStreams.generation,
+        relay: wiring?.relay?.status() ?? null,
     };
 }
 /** Resolves true when the streams answer a probe within `timeoutMs` (in-process ones always do). */
@@ -280,24 +209,9 @@ async function probe(streams, timeoutMs) {
         return false;
     }
 }
-/**
- * Creates a new Tenant's basin. Call it when the Tenant is created, after its schema commits;
- * retries transient failures, then throws. A failure need not fail the creation: opening the
- * Tenant repairs a missing basin.
- */
-export async function createTenantStreams(streams, tenantId, options = {}) {
-    await withRetries(() => streams.ensureTenant(tenantId), options.attempts ?? 3);
-}
-/**
- * Deletes a Tenant's basin and every stream in it. Call it when the Tenant is deleted (never
- * on reset). Idempotent; retries transient failures, then throws.
- */
-export async function deleteTenantStreams(streams, tenantId, options = {}) {
-    await withRetries(() => streams.deleteTenant(tenantId), options.attempts ?? 5);
-}
 /** Close: stops the readers and relay; the observers were ended by `endAllStreams`. */
 export async function closeStreams(ctx) {
-    await ctx.live.wiring?.close();
+    await ctx.sessionStreams.wiring?.close();
 }
 // ---------------------------------------------------------------------------
 async function withRetries(task, attempts) {
@@ -314,20 +228,23 @@ async function withRetries(task, attempts) {
         }
     }
 }
-function basinKeeper(streams, tenantId, signal, onError) {
+function basinKeeper(streams, basinKey, signal, onError) {
     let ready = false;
+    let readyFor;
     let failures = 0;
     let lastError = null;
     let attempt;
     let repairing = false;
     let repairedAt = 0;
     const ensure = () => {
-        if (ready)
+        const key = basinKey();
+        if (ready && readyFor === key)
             return Promise.resolve();
         attempt ??= streams
-            .ensureTenant(tenantId)
+            .ensureTenant(key)
             .then(() => {
             ready = true;
+            readyFor = key;
             failures = 0;
             lastError = null;
         }, (error) => {
@@ -345,7 +262,7 @@ function basinKeeper(streams, tenantId, signal, onError) {
         repair() {
             if (repairing || signal.aborted)
                 return;
-            if (ready && Date.now() - repairedAt < BASIN_REPAIR_COOLDOWN_MS)
+            if (ready && readyFor === basinKey() && Date.now() - repairedAt < BASIN_REPAIR_COOLDOWN_MS)
                 return;
             repairing = true;
             ready = false;
@@ -375,7 +292,7 @@ function basinKeeper(streams, tenantId, signal, onError) {
  * `signal` aborts. Failed reads retry with backoff; a read that ends by itself (the basin was
  * deleted) starts again from the new tail. Resolves once the first tail is known (or failed).
  */
-function follow(streams, tenantId, stream, signal, onRecord, onError) {
+function follow(streams, basin, stream, signal, onRecord, onError) {
     let started;
     const ready = new Promise((resolve) => (started = resolve));
     void (async () => {
@@ -384,12 +301,12 @@ function follow(streams, tenantId, stream, signal, onRecord, onError) {
         while (!signal.aborted) {
             try {
                 try {
-                    from ??= await streams.tail(tenantId, stream);
+                    from ??= await streams.tail(basin, stream);
                 }
                 finally {
                     started();
                 }
-                for await (const record of streams.read(tenantId, stream, from, {
+                for await (const record of streams.read(basin, stream, from, {
                     signal,
                 })) {
                     from = record.seq + 1;

package/dist/tenant/subject-limits.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Subject limits (Host feature `subject-tokens`): a subject token's role may cap how many turns
+ * its subject starts per hour and how many run at once. Every turn spends the Tenant's model
+ * budget, so these ship with the first credential that reaches the Runtime without an app
+ * server in between.
+ *
+ * Turns per hour is a token bucket per subject (capacity `turnsPerHour`, refilled
+ * continuously): no hourly rows and no burst at a window boundary. Concurrent turns counts the
+ * subject's sessions with work in flight; `paused` is not counted, so an unanswered approval
+ * never locks a person out. Checked inside the command's transaction, after the session row
+ * lock, so one subject's messages serialize on the bucket row.
+ */
+import type { RoleLimits } from "@nylorun/core/contracts";
+import type { Tx } from "../store/types.js";
+/** Charges one turn to `subject`, or answers `429 limit_exceeded`. */
+export declare function chargeTurn(t: Tx, subject: string, limits: RoleLimits, now?: number): Promise<void>;

package/dist/tenant/subject-limits.js

@@ -0,0 +1,45 @@
+import { fail } from "./http.js";
+/** Session statuses that hold a turn in flight. */
+const ACTIVE_STATUSES = ["runnable", "running", "waiting"];
+const CONCURRENT_RETRY_SECONDS = 5;
+/** Floating-point slack when a refill lands exactly on a whole turn. */
+const EPSILON = 1e-9;
+/** Charges one turn to `subject`, or answers `429 limit_exceeded`. */
+export async function chargeTurn(t, subject, limits, now = Date.now()) {
+    if (limits.concurrentTurns !== undefined) {
+        const active = await t.countOwnerSessions(subject, ACTIVE_STATUSES);
+        if (active >= limits.concurrentTurns)
+            fail(429, `At most ${limits.concurrentTurns} turns may run at once`, {
+                code: "limit_exceeded",
+                details: {
+                    limit: "concurrentTurns",
+                    retryAfterSeconds: CONCURRENT_RETRY_SECONDS,
+                },
+            }, { "retry-after": String(CONCURRENT_RETRY_SECONDS) });
+    }
+    const capacity = limits.turnsPerHour;
+    if (capacity === undefined)
+        return;
+    const perMs = capacity / 3_600_000;
+    const usage = await t.lockSubjectUsage({
+        subject,
+        turnTokens: capacity,
+        refilledAt: new Date(now).toISOString(),
+    });
+    const elapsed = Math.max(0, now - Date.parse(usage.refilledAt));
+    const tokens = Math.min(capacity, usage.turnTokens + elapsed * perMs);
+    if (tokens < 1 - EPSILON) {
+        // Rounded before the ceiling so floating-point dust never adds a second.
+        const wait = Math.round(((1 - tokens) / perMs / 1000) * 1000) / 1000;
+        const retryAfterSeconds = Math.max(1, Math.ceil(wait));
+        fail(429, `At most ${capacity} turns per hour`, {
+            code: "limit_exceeded",
+            details: { limit: "turnsPerHour", retryAfterSeconds },
+        }, { "retry-after": String(retryAfterSeconds) });
+    }
+    await t.putSubjectUsage({
+        subject,
+        turnTokens: Math.max(0, tokens - 1),
+        refilledAt: new Date(now).toISOString(),
+    });
+}

package/dist/tenant/sweep.d.ts

@@ -1,14 +1,5 @@
 import type { TenantContext } from "./context.js";
-export declare function sweep(ctx: TenantContext, options?: {
-    afterOpen?: boolean;
-}): Promise<void>;
-/**
- * Expire lapsed Action claims: hooks, fn and verify are offered again, tools become
- * `uncertain`. One transaction per claim, so each locks only its own session.
- */
-export declare function expireClaims(ctx: Pick<TenantContext, "store">, now?: Date): Promise<number>;
-/** Offer claimed `fn`/`verify` Actions again, one transaction each. Returns how many. */
-export declare function reofferFnVerifyClaims(ctx: Pick<TenantContext, "store">): Promise<number>;
+export declare function sweep(ctx: TenantContext): Promise<void>;
 /** Settle pending workflow `agent` effects whose linked turn already finished. */
 export declare function reconcileLinkedAgents(ctx: Pick<TenantContext, "store" | "wake">): Promise<void>;
 /** Wake `running`/`runnable` sessions without a live owner. Returns the ids woken. */