@nylorun/runtime 0.14.0-beta → 0.15.0-beta

package/dist/tenant/store-pg.js

@@ -1,140 +1,75 @@
 /**
- * The Tenant store over the Postgres Tenant catalog (architecture §8.1, §8.2).
+ * Opens the Host's Tenant on its Postgres database (tenancy.md §4–§5, plan P9).
  *
- * A Tenant exists when its schema `tenant_<id>` exists (`store/postgres/tenants.ts`); the
- * envelope is a row in it, so this store keeps no registry. What stays on the Host root is
- * the Tenant directory `tenants/<id>/`: the vault key (`vault-kek`), `plugin-data/`, `logs/`,
- * and the private `home/`, `tmp/` and `sandboxes/`. It is created with the Tenant and removed
- * with it; nothing in it says whether the Tenant exists.
+ * The database holds one Tenant (`store/postgres/tenant.ts`): opening migrates it, creates
+ * the Tenant on first start (from the Host's configuration: id, name, Studio and derived
+ * principals), and opens the Tenant Runtime on its Session Store. What stays on the Host root
+ * is the Tenant directory `tenant/`: the vault key (`vault-kek`), `plugin-data/`, `logs/`,
+ * and the private `home/`, `tmp/` and `sandboxes/`.
  *
- * - `create` makes the directory, then creates, migrates and bootstraps the schema in one
- *   transaction. A schema that already exists is `exists`; the module compares its bootstrap.
- * - `open` migrates an older schema forward and opens the Tenant Runtime on the schema's
- *   Session Store. A missing schema is `TenantNotFoundError`; a schema newer than this
- *   Runtime, a failed migration, an unreadable envelope or vault ciphertext without its key
- *   throws that quarantine. A failure outside the Tenant (Postgres unreachable, its sweep
- *   not armed) is `TenantUnavailableError`, which the module does not cache.
- * - `trash` drops the schema and removes the directory. There is no `trash/` copy: the key
- *   is useless without the schema.
+ * - A failure in the Tenant (an old layout, a database newer than this Runtime, a failed
+ *   migration, an unreadable Tenant row, vault ciphertext without its key) rejects with that
+ *   `TenantOpenError`; the Host reports it and fails readiness.
+ * - A failure outside the Tenant (Postgres unreachable, its sweep not armed in Restate) is
+ *   `TenantUnavailableError`; the Tenant module retries.
  */
-import { mkdirSync, rmSync } from "node:fs";
-import { tenantSchemaName } from "../store/postgres/names.js";
-import { createPostgresTenantCatalog } from "../store/postgres/tenants.js";
+import { mkdirSync } from "node:fs";
+import { openTenantDatabase, } from "../store/postgres/tenant.js";
+import { TenantOpenError } from "./cause.js";
 import { tenantPaths } from "./paths.js";
-import { QuarantineError, TenantConflictError } from "./quarantine.js";
-import { TenantNotFoundError, TenantUnavailableError, } from "./types.js";
-/** Repair instructions for a Postgres Tenant, naming its schema. */
-function repairFor(code, tenantId) {
-    const status = `nylo tenant status ${tenantId}`;
-    const schema = tenantSchemaName(tenantId);
-    switch (code) {
-        case "schema-too-new":
-            return `${status} — schema ${schema} was migrated by a newer Runtime; run that version or newer`;
-        case "migration-failed":
-            return `${status} — inspect the Runtime log for the failed migration of ${schema}, fix it, then restart the Runtime`;
-        case "envelope-invalid":
-            return `${status} — the tenant table of schema ${schema} is missing or invalid; restore the schema from a Postgres backup`;
-        case "kek-missing":
-            return `${status} — restore vault-kek under the Tenant directory (ciphertext cannot be opened without it)`;
-        default:
-            return `${status} — inspect the Runtime log and Postgres, then restart the Runtime`;
-    }
-}
-function unavailable(tenantId, cause) {
+import { TenantUnavailableError, } from "./types.js";
+function unavailable(cause) {
     return cause instanceof TenantUnavailableError
         ? cause
-        : new TenantUnavailableError(tenantId, { cause });
-}
-function quarantined(reason, tenantId) {
-    return new QuarantineError({ ...reason, repair: repairFor(reason.code, tenantId) });
+        : new TenantUnavailableError({ cause });
 }
-export function createPostgresTenantStore(options) {
-    const catalog = createPostgresTenantCatalog({
-        sql: options.sql,
-        ...(options.migrations ? { migrations: options.migrations } : {}),
-        onError: (error) => options.logger?.error("post-commit step failed", {
-            message: error instanceof Error ? error.message : String(error),
-        }),
-    });
-    const paths = (id) => tenantPaths(options.hostRoot, id);
-    function makeDirectory(id) {
-        const p = paths(id);
-        mkdirSync(p.root, { recursive: true, mode: 0o700 });
-        for (const dir of [p.home, p.tmp, p.sandboxes, p.pluginData, p.logs])
-            mkdirSync(dir, { recursive: true });
-    }
-    async function readEnvelope(id) {
+export function createPostgresTenantOpener(options) {
+    const { logger } = options;
+    return async () => {
+        const opened = await openTenantDatabase({
+            sql: options.sql,
+            create: options.create,
+            ...(options.migrations ? { migrations: options.migrations } : {}),
+            onError: (error) => logger?.error("post-commit step failed", {
+                message: error instanceof Error ? error.message : String(error),
+            }),
+        }).catch((error) => {
+            if (error instanceof TenantOpenError)
+                throw error;
+            throw unavailable(error);
+        });
+        const { store, envelope } = opened;
+        const tenantId = envelope.id;
+        if (opened.created)
+            logger?.info("tenant created", { tenantId, name: envelope.name });
+        else if (options.create.tenantId !== undefined && options.create.tenantId !== tenantId)
+            logger?.warn("tenant id configured differs", {
+                tenantId,
+                configured: options.create.tenantId,
+                message: "The database already holds a Tenant; the configured id applies only to a new database",
+            });
+        if (opened.migrated.from !== opened.migrated.to)
+            logger?.info("tenant schema migrated", {
+                tenantId,
+                from: opened.migrated.from,
+                to: opened.migrated.to,
+            });
         try {
-            return await catalog.readEnvelope(id);
+            const config = options.configFor(tenantId);
+            const paths = tenantPaths(options.hostRoot);
+            mkdirSync(paths.root, { recursive: true, mode: 0o700 });
+            return await options.openRuntime({ ...config, tenantId }, { store, envelope });
         }
         catch (error) {
-            if (!(error instanceof QuarantineError))
-                throw unavailable(id, error);
-            // Dropped since it was listed (deleted by another process).
-            if (!(await catalog.tenantExists(id).catch(() => true)))
-                throw new TenantNotFoundError(id);
-            throw quarantined(error.toQuarantine(), id);
-        }
-    }
-    return {
-        enumerate: () => catalog.listTenantIds(),
-        readEnvelope,
-        async create(envelope, bootstrap) {
-            makeDirectory(envelope.id);
-            try {
-                const result = await catalog.createTenant({ envelope, principals: bootstrap });
-                return result.status;
-            }
-            catch (error) {
-                // An existing Tenant with other bootstrap material; the module reports the conflict.
-                if (error instanceof TenantConflictError)
-                    return "exists";
+            await store.close().catch(() => undefined);
+            if (error instanceof TenantOpenError) {
+                // The Tenant's own failure (`kek-missing`): report which Tenant it is.
+                error.envelope ??= envelope;
                 throw error;
             }
-        },
-        bootstrapMatches: (id, bootstrap) => catalog.bootstrapMatches(id, bootstrap),
-        async open(id) {
-            const result = await catalog
-                .openTenant(id)
-                .catch((error) => {
-                throw unavailable(id, error);
-            });
-            if (result.status === "not-found")
-                throw new TenantNotFoundError(id);
-            if (result.status === "quarantined")
-                throw quarantined(result.reason, id);
-            if (result.migrated.from !== result.migrated.to)
-                options.logger?.info("tenant schema migrated", {
-                    tenantId: id,
-                    from: result.migrated.from,
-                    to: result.migrated.to,
-                });
-            try {
-                makeDirectory(id);
-                const config = options.configFor(id);
-                return await options.openRuntime({ ...config, tenantId: id }, { store: result.store, envelope: result.envelope });
-            }
-            catch (error) {
-                await result.store.close().catch(() => undefined);
-                // The Runtime's own quarantines (`kek-missing`) get this store's repair wording.
-                const reason = error?.quarantine;
-                if (reason)
-                    throw quarantined(reason, id);
-                if (error instanceof QuarantineError)
-                    throw error;
-                // Anything else failed outside the Tenant (Postgres, arming its sweep in Restate):
-                // the next use tries again rather than quarantining it.
-                throw unavailable(id, error);
-            }
-        },
-        async trash(id) {
-            await catalog.deleteTenant(id);
-            rmSync(paths(id).root, { recursive: true, force: true });
-        },
-        async removePartial(id) {
-            if (await catalog.tenantExists(id))
-                return;
-            rmSync(paths(id).root, { recursive: true, force: true });
-        },
+            // Anything else failed outside the Tenant (Postgres, arming its sweep in Restate): the
+            // next use tries again.
+            throw unavailable(error);
+        }
     };
 }

package/dist/tenant/streams.d.ts

@@ -4,16 +4,15 @@
  *
  * - **Record.** Every event is written to the record in its transaction (`Tx.event`). The
  *   stream relay (`streams/relay/`) feeds the Tenant's basin from it. On a Host with S2, one
- *   process-wide relay reads every Tenant's record over logical replication (`host/main.ts`);
+ *   process-wide relay reads the record over logical replication (`host/main.ts`);
  *   otherwise (tests, a Host without S2) this module runs a relay of the Tenant's own commits,
  *   which reconciles the record with the streams when it starts.
  * - **Basin generations.** The Tenant's session streams live in its current basin generation
  *   (`streams/basin.ts`). A reset moves it to the next one (`tenantReset`): the old basin gets
  *   a `sessions.reset` signal, every process moves its readers, and the old basin is deleted
  *   after a grace period (again when the Tenant opens, until it is gone).
- * - **Basin.** The current basin is created with the Tenant (`createTenantStreams`) and
- *   checked when it opens. A missing basin (S2 down at creation, a crash in between) is
- *   repaired on first use: a failed `ensureTenant` retries in the background with backoff,
+ * - **Basin.** The current basin is created when the Tenant opens. A missing basin (S2 down
+ *   then, or deleted since) is repaired on first use: a failed `ensureTenant` retries in the background with backoff,
  *   and `streamsStatus` reports the basin's state.
  * - **Readers.** History and session SSE read the session's stream
  *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
@@ -35,7 +34,7 @@ export interface WireStreamsOptions {
     /** Close `streams` with the wiring (streams created for this Tenant alone). */
     ownsStreams?: boolean;
     /**
-     * The Host runs the stream relay for every Tenant (logical replication). Otherwise the
+     * The Host runs the stream relay for the Tenant (logical replication). Otherwise the
      * Tenant relays its own commits.
      */
     hostRelay?: boolean;
@@ -73,12 +72,12 @@ export interface StreamsWiring {
  */
 export declare function wireStreams(ctx: TenantContext, options: WireStreamsOptions): Promise<StreamsWiring>;
 /**
- * Appends `session.cancel` for `sessionId` to `tenant/control`, so the process running its
- * advance aborts it. Call it from `t.afterCommit` after a cancel commits. A lost signal costs
- * latency only (the advance checks the Session Store before every effect), so failures are
- * logged, never thrown.
+ * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
+ * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
+ * commits. A lost signal costs latency only (the advance checks the Session Store before every
+ * effect), so failures are logged, never thrown.
  */
-export declare function signalSessionCancel(ctx: TenantContext, sessionId: string): void;
+export declare function signalSessionCancel(ctx: TenantContext, sessionId: string, turnId: string | null): void;
 /**
  * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
  * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
@@ -100,20 +99,5 @@ export interface StreamsStatus {
 export declare function streamsStatus(ctx: TenantContext, options?: {
     probeTimeoutMs?: number;
 }): Promise<StreamsStatus>;
-/**
- * Creates a new Tenant's basin. Call it when the Tenant is created, after its schema commits;
- * retries transient failures, then throws. A failure need not fail the creation: opening the
- * Tenant repairs a missing basin.
- */
-export declare function createTenantStreams(streams: DurableStreams, tenantId: string, options?: {
-    attempts?: number;
-}): Promise<void>;
-/**
- * Deletes every basin of a Tenant and every stream in them. Call it when the Tenant is
- * deleted. Idempotent; retries transient failures, then throws.
- */
-export declare function deleteTenantStreams(streams: DurableStreams, tenantId: string, options?: {
-    attempts?: number;
-}): Promise<void>;
 /** Close: stops the readers and relay; the observers were ended by `endAllStreams`. */
 export declare function closeStreams(ctx: TenantContext): Promise<void>;

package/dist/tenant/streams.js

@@ -58,7 +58,7 @@ export async function wireStreams(ctx, options) {
     const startControl = () => follow(streams, currentBasin(ctx), CONTROL_STREAM, AbortSignal.any([stop.signal, control.signal]), (body) => {
         const signal = body;
         if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
-            ctx.abortLocal(signal.sessionId);
+            ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
         else if (signal?.type === "sessions.reset")
             void checkSessionStreams(ctx).catch(report("session stream check failed"));
         else if (signal?.type === "subject.revoked" &&
@@ -157,16 +157,16 @@ function commitSource(store, tenantId) {
     };
 }
 /**
- * Appends `session.cancel` for `sessionId` to `tenant/control`, so the process running its
- * advance aborts it. Call it from `t.afterCommit` after a cancel commits. A lost signal costs
- * latency only (the advance checks the Session Store before every effect), so failures are
- * logged, never thrown.
+ * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
+ * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
+ * commits. A lost signal costs latency only (the advance checks the Session Store before every
+ * effect), so failures are logged, never thrown.
  */
-export function signalSessionCancel(ctx, sessionId) {
+export function signalSessionCancel(ctx, sessionId, turnId) {
     const streams = ctx.sessionStreams.wiring?.streams;
     if (!streams)
         return;
-    void signalCancel(streams, currentBasin(ctx), sessionId).catch((error) => ctx.config.logger.warn("cancel signal failed", {
+    void signalCancel(streams, currentBasin(ctx), sessionId, turnId ?? undefined).catch((error) => ctx.config.logger.warn("cancel signal failed", {
         sessionId,
         message: messageOf(error),
     }));
@@ -209,21 +209,6 @@ async function probe(streams, timeoutMs) {
         return false;
     }
 }
-/**
- * Creates a new Tenant's basin. Call it when the Tenant is created, after its schema commits;
- * retries transient failures, then throws. A failure need not fail the creation: opening the
- * Tenant repairs a missing basin.
- */
-export async function createTenantStreams(streams, tenantId, options = {}) {
-    await withRetries(() => streams.ensureTenant(tenantId), options.attempts ?? 3);
-}
-/**
- * Deletes every basin of a Tenant and every stream in them. Call it when the Tenant is
- * deleted. Idempotent; retries transient failures, then throws.
- */
-export async function deleteTenantStreams(streams, tenantId, options = {}) {
-    await withRetries(() => streams.deleteTenant(tenantId, { allGenerations: true }), options.attempts ?? 5);
-}
 /** Close: stops the readers and relay; the observers were ended by `endAllStreams`. */
 export async function closeStreams(ctx) {
     await ctx.sessionStreams.wiring?.close();

package/dist/tenant/tokens.js

@@ -8,7 +8,7 @@
  * `401 token_expired`, so clients always react the same way: get a new token.
  */
 import { randomUUID } from "node:crypto";
-import { errors, jwtVerify, SignJWT } from "jose";
+import { errors, jwtVerify } from "jose";
 import { isSubject, SUBJECT_TOKEN_AUDIENCE, SUBJECT_TOKEN_TYPE, subjectTokenIssuer, TOKEN_SCOPES, TOKEN_TTL_MIN_SECONDS, } from "@nylorun/core/contracts";
 import { agentAllowed, readPolicy, resolveRole } from "./access-policy.js";
 import { fail, failOpaque, HttpError } from "./http.js";
@@ -29,9 +29,8 @@ function rejected(ctx, reason) {
     return failOpaque();
 }
 export async function mintToken(ctx, body) {
-    const kek = ctx.signingKeys.kek();
     const tenantId = ctx.config.tenantId;
-    const { access, epoch, row, ttl } = await ctx.store.tx(async (t) => {
+    const { access, epoch, ttl } = await ctx.store.tx(async (t) => {
         const policy = await readPolicy(t);
         const role = Object.hasOwn(policy.roles, body.role)
             ? policy.roles[body.role]
@@ -61,11 +60,9 @@ export async function mintToken(ctx, body) {
         return {
             access: resolveRole(policy, body.role, scopes, body.agents),
             epoch: await t.subjectEpoch(body.subject),
-            row: await ctx.signingKeys.ensure(t, kek),
             ttl,
         };
     });
-    const signer = await ctx.signingKeys.privateKey(row, kek);
     const iat = Math.floor(Date.now() / 1000);
     const jti = randomUUID();
     const scopes = [...access.scopes];
@@ -76,15 +73,20 @@ export async function mintToken(ctx, body) {
         ...(body.agents ? { agt: [...body.agents] } : {}),
         epc: epoch,
     };
-    const token = await new SignJWT(claims)
-        .setProtectedHeader({ alg: "ES256", typ: SUBJECT_TOKEN_TYPE, kid: signer.id })
-        .setIssuer(subjectTokenIssuer(tenantId))
-        .setAudience(SUBJECT_TOKEN_AUDIENCE)
-        .setSubject(body.subject)
-        .setIssuedAt(iat)
-        .setExpirationTime(iat + ttl)
-        .setJti(jti)
-        .sign(signer.key);
+    // Signed by the keys service (F4.2): this process never holds the private key.
+    const { token, keyId } = await ctx.keys.sign({
+        typ: SUBJECT_TOKEN_TYPE,
+        claims: {
+            ...claims,
+            iss: subjectTokenIssuer(tenantId),
+            aud: SUBJECT_TOKEN_AUDIENCE,
+            sub: body.subject,
+            iat,
+            exp: iat + ttl,
+            jti,
+        },
+    });
+    const signer = { id: keyId };
     ctx.config.logger.info("subject token minted", {
         jti,
         kid: signer.id,

package/dist/tenant/types.d.ts

@@ -1,14 +1,15 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { AdminTenant, AdminTenantStatus, HostAggregate, TenantEnvelope } from "@nylorun/core/contracts";
+import type { HostAggregate, HostTenant, TenantEnvelope } from "@nylorun/core/contracts";
 import type { FlowLimits } from "../core/limits.js";
 import type { SessionStore } from "../store/types.js";
 import type { SandboxBackend } from "../sandbox/types.js";
+import type { TenantCause } from "./cause.js";
 import type { OutboundPolicy } from "./outbound.js";
 import type { TenantWorker } from "./worker.js";
 export type TenantMode = "shared" | "ephemeral" | "test";
 /**
- * The Tenant directory on the Host root. The Tenant's data lives in its store (a Postgres
- * schema); this holds what stays on the Host: the vault key, plugin data, logs, and the
+ * The Tenant directory on the Host root (`<Host root>/tenant/`). The Tenant's data lives in
+ * its database; this holds what stays on the Host: the vault key, plugin data, logs, and the
  * private home, tmp and sandbox directories.
  */
 export interface TenantPaths {
@@ -23,10 +24,6 @@ export interface TenantPaths {
 }
 export type TenantModelConfig = {
     kind: "vault";
-} | {
-    kind: "gateway";
-    url: string;
-    model: string;
 } | {
     kind: "fixture";
 } | {
@@ -52,7 +49,7 @@ export interface TenantConfig {
         ms?: number;
     };
     /** Retries and timeouts for model calls (Model Calls §5, §6). Defaults in `piModel`. */
-    modelCall?: import("../model/pi-model.js").ModelCallSettings;
+    modelCall?: import("../gates/model-gate.js").ModelCallSettings;
     childEnv: Readonly<Record<string, string>>;
     /** Action claim lease. Default 30 s. */
     /** How the Runtime may call Action endpoints (Host settings). Default: http and private addresses allowed. */
@@ -111,115 +108,67 @@ export interface TenantHandle {
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
     close(): Promise<void>;
 }
+/**
+ * The Host's Tenant for a request: open, or unavailable. `cause` says why when opening it
+ * failed; without one the Host is starting or closing. Either way the request gets the opaque
+ * 404.
+ */
 export type TenantResolution = {
     kind: "open";
     handle: TenantHandle;
 } | {
-    kind: "not-found";
-} | {
-    kind: "quarantined";
-    quarantine: Quarantine;
+    kind: "unavailable";
+    cause?: TenantCause;
 };
-export interface Quarantine {
-    code: "kek-missing" | "corrupt" | "schema-too-new" | "migration-failed" | "envelope-invalid" | "open-timeout" | "open-failed";
-    message: string;
-    repair: string;
-}
-export interface BootstrapPrincipal {
-    principalId: string;
-    credentialHash: string;
-    idempotencyKey: string;
-    /** When set, also registers application principal `studio` with this hash. */
-    studioCredentialHash?: string;
-    /** Application principals whose keys the admin key derives (feature `derived-principals`). */
-    derivedPrincipals?: readonly DerivedPrincipal[];
-}
-export interface DerivedPrincipal {
-    id: string;
-    credentialHash: string;
-}
 /**
- * The deep module (§8). HTTP, CLI and tests use only this.
+ * The deep module (§8): the one Tenant a Host serves (tenancy.md §5). HTTP, the Worker and
+ * tests use only this.
  *
- * Tenants open on demand (architecture §8.2): the first `resolve`, `status`, `worker` or
- * `delete` naming a Tenant opens it (bounded by the open timeout) and caches the handle or
- * the quarantine; `start` only marks discovery done, so a Host with many Tenants opens none
- * at startup.
+ * `start` opens the Tenant; the Host has it open from readiness to shutdown. There is no
+ * Tenant list, no opening on demand of other Tenants and no quarantine cache: when opening
+ * fails for a reason in the Tenant (a `TenantCause`), the Host fails readiness and reports
+ * the cause until it is restarted. A failure outside the Tenant (`TenantUnavailableError`:
+ * Postgres unreachable) is retried in the background and by the next request.
  */
 export interface TenantModule {
-    /** Marks discovery done (`/ready`). Opens nothing. */
+    /** Opens the Tenant. Never rejects: a failure is recorded and reported by `tenant()`. */
     start(): Promise<void>;
-    readonly started: boolean;
-    /** Opens the Tenant on first use; a missing Tenant is `not-found`. */
-    resolve(id: string): Promise<TenantResolution>;
+    /** The Tenant is open (`/ready`). */
+    readonly ready: boolean;
     /**
-     * The Tenant's Worker handlers, opening it on demand, for `TenantWorkers.resolve`.
-     * Undefined when the Tenant does not exist, is quarantined or is being deleted, or the
-     * module is closed.
+     * The open Tenant, waiting for an open in progress. Rejects with `TenantUnavailableError`
+     * when it cannot be reached for a reason outside it.
      */
-    worker(id: string): Promise<TenantWorker | undefined>;
-    create(input: {
-        tenantId: string;
-        name: string;
-    } & BootstrapPrincipal): Promise<{
-        envelope: TenantEnvelope;
-        created: boolean;
-    }>;
+    resolve(): Promise<TenantResolution>;
     /**
-     * Every Tenant the store holds, without opening any. A Tenant not opened yet is listed
-     * `open` when its envelope reads; opening it may still quarantine it.
+     * The Tenant's Worker handlers when `id` is the open Tenant's, for `TenantWorkers.resolve`.
+     * Undefined otherwise, or once the module is closed.
      */
-    list(): Promise<readonly AdminTenant[]>;
-    status(id: string): Promise<AdminTenantStatus | undefined>;
-    delete(id: string, activeWork: "refuse" | "drain" | "cancel"): Promise<void>;
+    worker(id: string): Promise<TenantWorker | undefined>;
+    /** The Tenant as `/v1/admin/status` reports it. */
+    tenant(): HostTenant;
     summarize(): Promise<HostAggregate>;
     close(): Promise<void>;
 }
 /**
- * Storage adapter behind the module (§8): a Postgres schema per Tenant (`store-pg.ts`), and
- * in-memory for tests (`store-memory.ts`).
+ * Opens the Host's Tenant (`store-pg.ts`): migrates its database, creates the Tenant when it
+ * has none, and opens the Tenant Runtime. Rejects with a `TenantOpenError` (`cause.ts`) when
+ * the Tenant itself cannot be opened, and with `TenantUnavailableError` when something
+ * outside it failed.
  */
-export interface TenantStore {
-    /** Ids of every Tenant the store holds. */
-    enumerate(): Promise<readonly string[]>;
-    /** Throws a quarantine error when unreadable, `TenantNotFoundError` when gone. */
-    readEnvelope(id: string): Promise<TenantEnvelope>;
-    /**
-     * Creates the Tenant, or returns `exists` when it already exists (whatever its bootstrap
-     * material; the module compares it with `bootstrapMatches`). The stored envelope's
-     * `schemaVersion` is the store's own; read it back with `readEnvelope`.
-     */
-    create(envelope: TenantEnvelope, bootstrap: BootstrapPrincipal): Promise<"created" | "exists">;
-    bootstrapMatches(id: string, bootstrap: BootstrapPrincipal): Promise<boolean>;
-    /**
-     * Opens the Tenant Runtime; runs migration. Throws `TenantNotFoundError` when the Tenant
-     * does not exist, `TenantUnavailableError` when something outside the Tenant failed, and
-     * any other error (a quarantine error, ideally) when the Tenant itself cannot be opened.
-     */
-    open(id: string): Promise<TenantHandle>;
-    /** Removes the Tenant: its data and its Tenant directory. */
-    trash(id: string, now: Date): Promise<void>;
-    /** Removes what a failed `create` left, never an existing Tenant. */
-    removePartial(id: string): Promise<void>;
-}
+export type TenantOpener = () => Promise<TenantHandle>;
 /**
- * Thrown by a store when a Tenant cannot be reached for a reason outside it (the database
- * or Durable Session Execution is unavailable). The module does not quarantine it: the next
- * use tries again. The Host answers 503.
+ * Thrown when the Tenant cannot be reached for a reason outside it (the database or Durable
+ * Session Execution is unavailable). Not a cause: the next use tries again. The Host answers
+ * 503.
  */
 export declare class TenantUnavailableError extends Error {
-    readonly tenantId: string;
     readonly status = 503;
-    constructor(tenantId: string, options?: {
+    constructor(options?: {
         cause?: unknown;
     });
 }
-/** Thrown by `TenantStore.open` for a Tenant that does not exist. */
-export declare class TenantNotFoundError extends Error {
-    readonly tenantId: string;
-    constructor(tenantId: string);
-}
-/** What a Tenant store hands the Tenant Runtime it opens. */
+/** What the Tenant opener hands the Tenant Runtime it opens. */
 export interface OpenedTenant {
     /**
      * The Tenant's opened Session Store. The Tenant Runtime owns it from here on and closes it
@@ -229,5 +178,5 @@ export interface OpenedTenant {
     /** The Tenant envelope as its store reports it. */
     envelope: TenantEnvelope;
 }
-/** Opens the Tenant Runtime on a store the Tenant store opened (injected, so tests can fake it). */
+/** Opens the Tenant Runtime on an opened store (injected, so tests can fake it). */
 export type OpenTenantRuntime = (config: TenantConfig, opened: OpenedTenant) => Promise<TenantHandle>;

package/dist/tenant/types.js

@@ -1,23 +1,12 @@
 /**
- * Thrown by a store when a Tenant cannot be reached for a reason outside it (the database
- * or Durable Session Execution is unavailable). The module does not quarantine it: the next
- * use tries again. The Host answers 503.
+ * Thrown when the Tenant cannot be reached for a reason outside it (the database or Durable
+ * Session Execution is unavailable). Not a cause: the next use tries again. The Host answers
+ * 503.
  */
 export class TenantUnavailableError extends Error {
-    tenantId;
     status = 503;
-    constructor(tenantId, options) {
+    constructor(options) {
         super("Tenant is temporarily unavailable", options);
-        this.tenantId = tenantId;
         this.name = "TenantUnavailableError";
     }
 }
-/** Thrown by `TenantStore.open` for a Tenant that does not exist. */
-export class TenantNotFoundError extends Error {
-    tenantId;
-    constructor(tenantId) {
-        super(`Tenant ${tenantId} not found`);
-        this.tenantId = tenantId;
-        this.name = "TenantNotFoundError";
-    }
-}

package/dist/tenant/worker.js

@@ -1,7 +1,6 @@
 /**
  * The Worker side of Durable Session Execution (architecture §12.3): what a `DurableExecution`
- * calls for one Tenant, and the registry that lets one execution serve every Tenant open on
- * this process.
+ * calls for the Tenant, and the registry its handlers dispatch through by Tenant id.
  *
  * - `TenantWorker` is one open Tenant's handlers: `advance(sessionId, signal)` (§10.5, in
  *   `advance.ts`), `sweep()` (the Tenant sweep, in `sweep.ts`) and, optionally,
@@ -9,12 +8,13 @@
  * - `TenantWorkers` is the registry. Its `handlers` are the `WorkerHandlers` an execution is
  *   started with; they dispatch by `tenantId` to the registered `TenantWorker`. A Tenant
  *   registers when it opens and unregisters when it closes. A call for a Tenant that is not
- *   open here asks the optional `resolve` hook (the Host can open it on demand); without one,
+ *   open here asks the optional `resolve` hook (the Host's, which waits for its Tenant to
+ *   open, and knows no other); without one,
  *   the advance and the delivery return `done` and the sweep does nothing. Nothing is lost:
  *   the Tenant's sweep re-wakes its orphaned sessions once it is open again, and an Action
  *   that was not delivered stays pending.
  * - `TenantExecution` pairs an execution with its registry. The Host creates one per process
- *   (`host/execution.ts`) and passes it to every Tenant it opens; a Tenant opened without one
+ *   (`host/execution.ts`) and passes it to its Tenant; a Tenant opened without one
  *   (tests, ephemeral) gets its own in-process `MemoryExecution`.
  *
  * ## Advance deadline