@nylorun/runtime 0.17.0-beta → 0.19.0-beta

package/dist/tenant/outbound.js

@@ -1,16 +1,18 @@
 /**
- * The Runtime's requests to Action endpoints (design: Action endpoints §8.3): one POST, no
- * redirects, a bounded answer, and the Host's address policy checked on the address actually
- * connected to, so a DNS answer cannot steer a delivery somewhere the Host forbids.
+ * The Runtime's requests to developer URLs: HTTP tools (`gates/http-tool.ts`) and, through
+ * `guardedFetch`, remote MCP servers and OAuth: one request, no redirects, a bounded answer, and
+ * the Host's address policy checked on the address actually connected to, so a DNS answer cannot
+ * steer a request somewhere the Host forbids.
  *
- * The result says whether anything reached the endpoint. A request that failed before its body
- * was flushed (refused connection, unknown host, TLS failure, a refused address) was `not_sent`
- * and is safe to send again, even for a tool; one that failed after (reset, timeout) is `lost`.
+ * The result says whether anything reached the URL. A request that failed before its body was
+ * flushed (refused connection, unknown host, TLS failure, a refused address) was `not_sent`;
+ * one that failed after (reset, timeout) is `lost`.
  */
 import { lookup as dnsLookup } from "node:dns";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { BlockList, isIP } from "node:net";
+import { Readable } from "node:stream";
 /** The largest answer read from an endpoint. */
 export const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 const PRIVATE = new BlockList();
@@ -73,7 +75,10 @@ function guardedLookup(policy) {
         return callback(null, allowed[0].address, allowed[0].family);
     });
 }
-/** POSTs `body` to `url` under `policy`. Never throws; `signal` aborts the request. */
+/**
+ * POSTs (or, with `method`, PUTs or PATCHes) the JSON `body` to `url` under `policy`. Never
+ * throws; `signal` aborts the request.
+ */
 export async function post(target, body, headers, options) {
     const { policy, signal } = options;
     const limit = options.maxResponseBytes ?? MAX_RESPONSE_BYTES;
@@ -96,10 +101,10 @@ export async function post(target, body, headers, options) {
         const failed = (error) => finish({
             kind: sent ? "lost" : "not_sent",
             code: signal.aborted ? "ABORTED" : (error.code ?? error.name),
-            message: signal.aborted ? "The delivery was aborted" : error.message,
+            message: signal.aborted ? "The request was aborted" : error.message,
         });
         const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
-            method: "POST",
+            method: options.method ?? "POST",
             headers: {
                 ...headers,
                 host: originalHost,
@@ -165,10 +170,15 @@ export const FETCH_TIMEOUT_MS = 30_000;
  * unless the caller passes a signal. The gateway calls OAuth discovery, registration, the code
  * exchange and refresh with it. A refused URL or address rejects with `OutboundRefused`, any
  * other failure with `OutboundFailed`.
+ *
+ * `stream`: the Response resolves once the headers arrive and its body streams, unbounded and
+ * with no timeout but the caller's signal: remote MCP servers, whose answers and event streams
+ * stay open (`mcp/connect.ts`).
  */
 export function guardedFetch(policy, options = {}) {
     const limit = options.maxResponseBytes ?? MAX_FETCH_RESPONSE_BYTES;
     const timeoutMs = options.timeoutMs ?? FETCH_TIMEOUT_MS;
+    const stream = options.stream === true;
     const lookup = guardedLookup(policy);
     const guarded = async (input, init = {}) => {
         const request = input instanceof Request ? input : undefined;
@@ -199,7 +209,7 @@ export function guardedFetch(policy, options = {}) {
         }
         const originalHost = url.host;
         dockerHost(url, policy);
-        const signal = init.signal ?? request?.signal ?? AbortSignal.timeout(timeoutMs);
+        const signal = init.signal ?? request?.signal ?? (stream ? undefined : AbortSignal.timeout(timeoutMs));
         const outgoing = { host: originalHost };
         for (const [name, value] of headers)
             outgoing[name] = value;
@@ -215,13 +225,34 @@ export function guardedFetch(policy, options = {}) {
             };
             const failed = (error) => settle(() => reject(error instanceof RefusedAddress
                 ? new OutboundRefused(error.message)
-                : new OutboundFailed(signal.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal.aborted ? "ABORTED" : (error.code ?? error.name))));
-            const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, signal }, (response) => {
+                : new OutboundFailed(signal?.aborted ? `The request to ${originalHost} was aborted or timed out` : error.message, signal?.aborted ? "ABORTED" : (error.code ?? error.name))));
+            const sent = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, { method, headers: outgoing, lookup: lookup, ...(signal ? { signal } : {}) }, (response) => {
                 const status = response.statusCode ?? 0;
                 if (status >= 300 && status < 400 && response.headers.location !== undefined) {
                     response.resume();
                     return settle(() => reject(new OutboundFailed(`${originalHost} answered a redirect, which this Runtime does not follow`, "REDIRECT")));
                 }
+                const noBody = status === 204 || status === 304 || method === "HEAD";
+                const answer = (body) => {
+                    const headers = new Headers();
+                    for (const [name, value] of Object.entries(response.headers)) {
+                        if (value === undefined)
+                            continue;
+                        for (const item of Array.isArray(value) ? value : [value])
+                            headers.append(name, item);
+                    }
+                    return new Response(noBody ? null : body, {
+                        status,
+                        statusText: response.statusMessage ?? "",
+                        headers,
+                    });
+                };
+                if (stream) {
+                    // A failure after this reaches the reader as the body's error.
+                    if (noBody)
+                        response.resume();
+                    return settle(() => resolve(answer(noBody ? null : Readable.toWeb(response))));
+                }
                 const chunks = [];
                 let size = 0;
                 response.on("data", (chunk) => {
@@ -233,21 +264,7 @@ export function guardedFetch(policy, options = {}) {
                     }
                     chunks.push(chunk);
                 });
-                response.on("end", () => settle(() => {
-                    const answer = new Headers();
-                    for (const [name, value] of Object.entries(response.headers)) {
-                        if (value === undefined)
-                            continue;
-                        for (const item of Array.isArray(value) ? value : [value])
-                            answer.append(name, item);
-                    }
-                    const noBody = status === 204 || status === 304 || method === "HEAD";
-                    resolve(new Response(noBody ? null : Buffer.concat(chunks), {
-                        status,
-                        statusText: response.statusMessage ?? "",
-                        headers: answer,
-                    }));
-                }));
+                response.on("end", () => settle(() => resolve(answer(Buffer.concat(chunks)))));
                 response.on("error", failed);
                 response.on("aborted", () => failed(Object.assign(new Error("The answer was cut off"), { code: "ECONNRESET" })));
             });

package/dist/tenant/paths.d.ts

@@ -16,7 +16,7 @@ export declare function hostPaths(hostRoot: string): HostPaths;
  * root after realpath.
  *
  * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
- * `tmp/`, `sandboxes/`, `plugin-data/`, `blobs/` (the `fs` BlobStore, when the Host has no
+ * `sandboxes/`, `blobs/` (the `fs` BlobStore, when the Host has no
  * Object store), `logs/tenant.log`. The vault key is the one exception:
  * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
  * mounts only into the gateway (F4.2), never into the runtime container.

package/dist/tenant/paths.js

@@ -24,7 +24,7 @@ export function hostPaths(hostRoot) {
  * root after realpath.
  *
  * The directory holds what stays on the Host (the Tenant's data is its database): `home/`,
- * `tmp/`, `sandboxes/`, `plugin-data/`, `blobs/` (the `fs` BlobStore, when the Host has no
+ * `sandboxes/`, `blobs/` (the `fs` BlobStore, when the Host has no
  * Object store), `logs/tenant.log`. The vault key is the one exception:
  * it lives beside the Tenant directory, in `<hostRoot>/keys/vault-kek`, which the local stack
  * mounts only into the gateway (F4.2), never into the runtime container.
@@ -39,9 +39,7 @@ export function tenantPaths(hostRoot) {
         root,
         kek: join(host, "keys", "vault-kek"),
         home: join(root, "home"),
-        tmp: join(root, "tmp"),
         sandboxes: join(root, "sandboxes"),
-        pluginData: join(root, "plugin-data"),
         blobs: join(root, "blobs"),
         logs: join(root, "logs"),
         log: join(root, "logs", "tenant.log"),

package/dist/tenant/principals.d.ts

@@ -2,8 +2,12 @@ import type { InitialPrincipal } from "../store/postgres/tenant.js";
 export type { PrincipalRow } from "../store/types.js";
 /** Principal id of the Studio key derived from the admin key. */
 export declare const STUDIO_PRINCIPAL_ID = "studio";
-/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
-export declare function deriveStudioKey(adminKey: string, tenantId: string): string;
+/**
+ * The Studio key: HMAC-SHA256 of the admin key over `nylorun/studio/v2`. It names no Tenant
+ * (protocol 8): Studio derives it before it can learn the Tenant's id, and the admin key is
+ * already one per installation.
+ */
+export declare function deriveStudioKey(adminKey: string): string;
 /**
  * The principals a Host's Tenant is created with: `studio`, and an application principal when
  * a key is given (the ephemeral Runtime). Keys are hashed here.
@@ -16,4 +20,9 @@ export declare function hostPrincipals(options: {
     };
     /** Registers `studio` with this hash instead of the admin key's derivation. */
     studioCredentialHash?: string;
+    /**
+     * The management key of `NYLORUN_MANAGEMENT_KEY_FILE`: registered as `bootstrap`, and
+     * replaced at the next start when the file changed.
+     */
+    bootstrapKey?: string;
 }): (tenantId: string) => InitialPrincipal[];

package/dist/tenant/principals.js

@@ -2,27 +2,42 @@
  * The principals the Host gives its Tenant when it creates it (tenancy.md §4): the Studio
  * principal, whose key the admin key derives, so Studio (and an app embedding it) stores none,
  * and, for the ephemeral Runtime, one application principal with a key of its own. The Tenant
- * keeps only their hashes. Every other application key is an operator key
- * (`PUT /v1/admin/keys/{id}`, `operator-keys.ts`); no other key is derived.
+ * keeps only their hashes. Every other key is put by name (`PUT /v1/tenant/keys/{keyId}`,
+ * `nylorun-operate keys`, `operator-keys.ts`); no other key is derived.
  *
  * The derivation is the one `@nylorun/admin` computes on the client side
  * (`admin/src/derived-credentials.ts`: `deriveStudioToken`); both sides must stay byte for byte
  * the same.
  */
 import { createHmac } from "node:crypto";
+import { BOOTSTRAP_KEY_ID } from "@nylorun/core/compatibility";
 import { hashToken } from "../core/bearer.js";
 /** Principal id of the Studio key derived from the admin key. */
 export const STUDIO_PRINCIPAL_ID = "studio";
-/** The Studio key of `tenantId`: HMAC-SHA256 of the admin key. */
-export function deriveStudioKey(adminKey, tenantId) {
-    return hmac(adminKey, ["nylorun/studio/v1", tenantId]);
+/**
+ * The Studio key: HMAC-SHA256 of the admin key over `nylorun/studio/v2`. It names no Tenant
+ * (protocol 8): Studio derives it before it can learn the Tenant's id, and the admin key is
+ * already one per installation.
+ */
+export function deriveStudioKey(adminKey) {
+    return hmac(adminKey, ["nylorun/studio/v2"]);
 }
 /**
  * The principals a Host's Tenant is created with: `studio`, and an application principal when
  * a key is given (the ephemeral Runtime). Keys are hashed here.
  */
 export function hostPrincipals(options) {
-    return (tenantId) => [
+    return () => [
+        ...(options.bootstrapKey
+            ? [
+                {
+                    id: BOOTSTRAP_KEY_ID,
+                    role: "management",
+                    credentialHash: hashToken(options.bootstrapKey),
+                    replace: true,
+                },
+            ]
+            : []),
         ...(options.application
             ? [
                 {
@@ -33,8 +48,12 @@ export function hostPrincipals(options) {
             : []),
         {
             id: STUDIO_PRINCIPAL_ID,
-            credentialHash: options.studioCredentialHash ??
-                hashToken(deriveStudioKey(options.adminKey, tenantId)),
+            // Studio runs sessions and edits the Tenant's settings: both APIs (protocol 8).
+            role: "studio",
+            credentialHash: options.studioCredentialHash ?? hashToken(deriveStudioKey(options.adminKey)),
+            // Its key derives from the admin key: a database holding an older derivation (v1, with
+            // the Tenant id) takes this one at the next start.
+            replace: true,
         },
     ];
 }

package/dist/tenant/run-token.js

@@ -4,9 +4,9 @@
  * remote MCP calls. The gates take session, turn and agent from it, never from the body, and
  * check on every call that the lease it names is still the session's (`staleRun`).
  *
- * Signed by the keys service with the Tenant's current signing key, like subject and delivery
- * tokens, and told apart from them by `typ` and `aud`. Internal: not in `openapi.json`. A token
- * lives `RUN_TOKEN_TTL_SECONDS`, no longer than a delivery token, so a key rotation never
+ * Signed by the keys service with the Tenant's current signing key, like capability links,
+ * and told apart from them by `typ` and `aud`. Internal: not in `openapi.json`. A token lives
+ * `RUN_TOKEN_TTL_SECONDS`, no longer than `TOKEN_TTL_MAX_SECONDS`, so a key rotation never
  * revokes a live one (`signing-keys.ts`).
  *
  * ```text

package/dist/tenant/runtime.d.ts

@@ -1,4 +1,4 @@
-import type { TenantEnvelope } from "@nylorun/core/contracts";
+import type { HarnessStatus, TenantEnvelope } from "@nylorun/core/contracts";
 import { type ModelProvider } from "../core/provider.js";
 import type { ModelGate } from "../gates/model-gate.js";
 import { type AuthorizeResult } from "../vault/service.js";
@@ -14,7 +14,6 @@ import type { HarnessChannel, MemoryPortsOptions } from "@nylorun/core/harness-a
 import { type HarnessPeer } from "../harness-api/server.js";
 import { type HostAuthority } from "../sandbox/join.js";
 import type { TenantPods } from "./context.js";
-import { type OperatorKeys } from "./operator-keys.js";
 /** TENANTS-CCR: test/injection hooks until TenantConfig gains them. */
 export type TenantOpenHooks = {
     modelProvider?: ModelProvider;
@@ -24,8 +23,8 @@ export type TenantOpenHooks = {
      */
     modelGate?: ModelGate;
     /**
-     * Serves the Tenant's remote MCP servers and Action deliveries (the gates service's client).
-     * Without one, the Tenant opens them and POSTs deliveries in this process.
+     * Serves the Tenant's remote MCP servers and HTTP tools (the gates service's client).
+     * Without one, the Tenant opens and calls them in this process.
      */
     toolGate?: ToolGate;
     /**
@@ -120,8 +119,7 @@ export declare class TenantRuntime implements TenantHandle {
     /** Adds a callback to the Tenant sweep. Returns a function that removes it. */
     onSweep(hook: () => Promise<void>): () => void;
     attachHarness(channel: HarnessChannel, peer: HarnessPeer): () => void;
-    /** The Tenant's operator keys (F9 I1), over its store. */
-    operatorKeys(): OperatorKeys;
+    harnessStatus(): HarnessStatus;
     close(): Promise<void>;
 }
 /**

package/dist/tenant/runtime.js

@@ -18,7 +18,6 @@ import { closeStreams, streamsStatus, wireStreams, } from "./streams.js";
 import { abortAll, abortLocal, createWorkState, drain, waitForIdle, } from "./scheduler.js";
 import { advance } from "./advance.js";
 import { sweep } from "./sweep.js";
-import { deliverAction } from "./delivery.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
 import { inProcessToolGate } from "../gates/tool-gate.js";
@@ -33,7 +32,7 @@ import { localWorkspace, remoteWorkspace, withPodWorkspaces, } from "../harness-
 import { hostAuthority } from "../sandbox/join.js";
 import { reconcileSandbox } from "../sandbox/pods/reconcile.js";
 import { sandboxWorkspaceReader } from "../artifacts/workspace.js";
-import { operatorKeys } from "./operator-keys.js";
+import { readDefinitionFile } from "./definition-files.js";
 /** Default ownership lease of an advance; the heartbeat renews it every third. */
 const DEFAULT_OWNER_LEASE_MS = 30_000;
 function validateConfig(config) {
@@ -82,9 +81,7 @@ export class TenantRuntime {
         const paths = config.paths;
         mkdirSync(paths.root, { recursive: true });
         mkdirSync(paths.home, { recursive: true });
-        mkdirSync(paths.tmp, { recursive: true });
         mkdirSync(paths.sandboxes, { recursive: true });
-        mkdirSync(paths.pluginData, { recursive: true });
         mkdirSync(paths.logs, { recursive: true });
         const store = hooks.store;
         let wired;
@@ -131,7 +128,12 @@ export class TenantRuntime {
             });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
-            const toolGate = hooks.toolGate ?? inProcessToolGate(config.delivery ?? {});
+            const toolGate = hooks.toolGate ??
+                inProcessToolGate(config.delivery ?? {}, {
+                    session: (sessionId) => opened.tx((t) => t.get("sessions", sessionId)),
+                    authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                    logger: config.logger,
+                });
             const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
             const keys = hooks.keys ?? inProcessKeys({ store: opened, vault, signingKeys, kek: ensureKek });
             const harnessMode = hooks.harness ?? "memory";
@@ -141,9 +143,8 @@ export class TenantRuntime {
             // executors; otherwise the harness holds both (F6.2).
             const mcp = inProcess
                 ? new McpPool({
-                    pluginData: paths.pluginData,
-                    childEnv: config.childEnv,
                     authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                    policy: config.delivery ?? {},
                     ...(toolGate.openMcp ? { openRemote: (server) => toolGate.openMcp(server) } : {}),
                 })
                 : undefined;
@@ -156,6 +157,12 @@ export class TenantRuntime {
                         defaultSandboxBackends({ root: paths.sandboxes }),
                     preference,
                     ephemeral,
+                    definitionFile: async (sha256) => {
+                        const bytes = await readDefinitionFile(blobs, sha256);
+                        if (!bytes)
+                            throw new Error(`The Object store has no bytes for ${sha256}`);
+                        return bytes;
+                    },
                     emit: async (sessionId, turnId, type, payload) => {
                         if (ctx.closed)
                             return;
@@ -230,6 +237,7 @@ export class TenantRuntime {
             ctx = {
                 config,
                 envelope,
+                reads: hooks.reads,
                 store: opened,
                 vault,
                 credentials,
@@ -260,11 +268,6 @@ export class TenantRuntime {
                     await execution.wake(config.tenantId, sessionId, wake);
                 },
                 abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
-                deliver: async (actionId) => {
-                    if (ctx.closing || ctx.closed)
-                        return;
-                    await execution.deliver(config.tenantId, actionId);
-                },
                 ...(hooks.pods ? { pods: hooks.pods } : {}),
                 sandboxSignal: async (sandboxId, signal) => {
                     if (ctx.closing || ctx.closed || !execution.sandbox)
@@ -304,7 +307,6 @@ export class TenantRuntime {
             // sessions a previous process left runnable or running (takeover handles the rest).
             const worker = {
                 advance: (sessionId, signal) => advance(ctx, sessionId, signal),
-                deliver: (actionId, signal) => deliverAction(ctx, actionId, signal),
                 sweep: () => sweep(ctx),
                 sandbox: (sandboxId, trigger) => reconcileSandbox(ctx, sandboxId, trigger),
             };
@@ -322,6 +324,7 @@ export class TenantRuntime {
             await detach?.().catch(() => undefined);
             await harness?.stop().catch(() => undefined);
             await wired?.close().catch(() => undefined);
+            await hooks.reads?.close().catch(() => undefined);
             await store.close().catch(() => undefined);
             throw error;
         }
@@ -338,8 +341,6 @@ export class TenantRuntime {
         return {
             ready: !this.ctx.closing && !this.ctx.closed,
             runningSessions: counts.runningSessions,
-            inFlightDeliveries: [...this.ctx.work.deliveries.values()].reduce((n, set) => n + set.size, 0),
-            pendingActions: counts.pendingActions,
             uncertainEffects: counts.uncertainEffects,
             harness: harnessStatusOf(this.ctx),
         };
@@ -368,9 +369,8 @@ export class TenantRuntime {
     attachHarness(channel, peer) {
         return this.ctx.harness.attach(channel, peer);
     }
-    /** The Tenant's operator keys (F9 I1), over its store. */
-    operatorKeys() {
-        return operatorKeys(this.ctx.store);
+    harnessStatus() {
+        return harnessStatusOf(this.ctx);
     }
     async close() {
         const ctx = this.ctx;
@@ -402,6 +402,7 @@ export class TenantRuntime {
                     return closeStreams(ctx);
                 },
             ],
+            ["reads", () => ctx.reads?.close()],
             ["store", () => ctx.store.close()],
         ];
         let failure;

package/dist/tenant/sandboxes.d.ts

@@ -30,7 +30,8 @@
  */
 import { type PutSandboxRequest, type SandboxView } from "@nylorun/core/contracts";
 import type { SandboxResource, Tx } from "../store/types.js";
-import type { AuthScope, Session, TenantContext } from "./context.js";
+import type { SandboxRouteDeps } from "../core/sandbox-routes.js";
+import { type AuthScope, type Session, type TenantContext } from "./context.js";
 /** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export declare function sandboxGrantsOf(scope: AuthScope): readonly string[] | undefined;
 /** A sandbox resource, unless it is gone or being deleted. */
@@ -117,3 +118,5 @@ export declare function touchPodSandbox(ctx: TenantContext, id: string): Promise
  * timer is set). Best effort.
  */
 export declare function rearmPodTimers(ctx: TenantContext): Promise<void>;
+/** Session lookups for the sandbox route handlers (`core/sandbox-routes.ts`). */
+export declare function sandboxRouteDeps(ctx: TenantContext): SandboxRouteDeps;

package/dist/tenant/sandboxes.js

@@ -37,6 +37,7 @@ import { podName } from "../sandbox/pods/name.js";
 import { expiresAtOf, podLifecycleConfig } from "../sandbox/pods/spec.js";
 import { requirePods } from "../sandbox/placement.js";
 import { parseSandboxDuration } from "@nylorun/core/define";
+import { sandboxLookup, sessionOf } from "./context.js";
 import { fail } from "./http.js";
 /** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export function sandboxGrantsOf(scope) {
@@ -549,3 +550,13 @@ export async function rearmPodTimers(ctx) {
         });
     }
 }
+/** Session lookups for the sandbox route handlers (`core/sandbox-routes.ts`). */
+export function sandboxRouteDeps(ctx) {
+    return {
+        sandbox: ctx.sandbox,
+        session: (id) => ctx.store.tx(async (t) => {
+            const session = await sessionOf(t, id);
+            return { session, lookup: await sandboxLookup(t, id) };
+        }),
+    };
+}

package/dist/tenant/scheduler.d.ts

@@ -5,14 +5,10 @@ export interface WorkState {
     readonly running: Map<string, AbortController>;
     /** The turn each running advance belongs to, by session id (`null`: none). */
     readonly runningTurns: Map<string, string | null>;
-    /** Deliveries to Action endpoints in flight on this process, by their Action's session id. */
-    readonly deliveries: Map<string, Set<AbortController>>;
-    /** When each Action last reported a failed delivery (`action.delivery_failed` throttling). */
-    readonly deliveryNotices: Map<string, number>;
 }
 export declare function createWorkState(): WorkState;
 /**
- * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
+ * Abort the advance of `id` if it runs on this process.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */

package/dist/tenant/scheduler.js

@@ -13,7 +13,7 @@ import { randomUUID } from "node:crypto";
 import { command } from "./commands.js";
 import { AdvanceAbort } from "./worker.js";
 export function createWorkState() {
-    return { running: new Map(), runningTurns: new Map(), deliveries: new Map(), deliveryNotices: new Map() };
+    return { running: new Map(), runningTurns: new Map() };
 }
 const MESSAGES = {
     cancel: "Turn cancelled",
@@ -26,7 +26,7 @@ function abortWith(controller, kind) {
         controller.abort(new AdvanceAbort(kind, MESSAGES[kind]));
 }
 /**
- * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
+ * Abort the advance of `id` if it runs on this process.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
@@ -34,9 +34,6 @@ export function abortLocal(ctx, id, kind = "cancel", turnId) {
     const controller = ctx.work.running.get(id);
     if (controller && (turnId === undefined || ctx.work.runningTurns.get(id) === turnId))
         abortWith(controller, kind);
-    // A cancel also closes the session's deliveries, which aborts the tools' `ctx.signal`.
-    for (const delivery of ctx.work.deliveries.get(id) ?? [])
-        abortWith(delivery, kind);
 }
 /** Reset: abort every advance running on this process; their sessions are being cleared. */
 export function clearWork(ctx) {

package/dist/tenant/session-streams.d.ts

@@ -79,9 +79,10 @@ export declare function currentBasin(ctx: TenantContext): string;
  * read starts. The cursor returned is the last record read (the request's cursor when none
  * was), whatever the `agent` filter kept.
  */
-export declare function readHistory(ctx: TenantContext, sessionId: string, cursor: string | undefined, agent: string | undefined): Promise<{
+export declare function readHistory(ctx: TenantContext, sessionId: string, cursor: string | undefined, agent: string | undefined, limit?: number): Promise<{
     items: LiveEvent[];
     cursor: string | null;
+    tail?: boolean;
 }>;
 /**
  * `GET /v1/sessions/:id/events`: joins the session's shared read at the client's cursor and

package/dist/tenant/session-streams.js

@@ -1,3 +1,24 @@
+/**
+ * Live delivery over Durable Streams (architecture §12.4, "Reading"): session history
+ * (`GET /v1/sessions/:id/items`) and session SSE (`GET /v1/sessions/:id/events`).
+ *
+ * - **Streams.** A session's events are in `sessions/<id>` in the Tenant's current basin
+ *   generation (`currentBasin`); cursors carry only the session id and sequence.
+ * - **History** reads the session's stream from the cursor up to the tail seen when the read
+ *   starts. The `agent` filter runs here, and the response cursor is the last record read. If
+ *   the streams fail, history answers `503`.
+ * - **SSE** shares one stream read per observed session in this process (a `SessionStream`)
+ *   among that session's observers. Each observer keeps the next sequence it needs and skips
+ *   what it already has, so a client resuming from `Last-Event-ID` sees no gap and no
+ *   duplicate. An observer behind the feed restarts the shared read from its own position.
+ *   A feed follows one basin generation: it ends once its session is gone or the Tenant moved
+ *   to a new generation (a reset, possibly on another node), checked when a client joins, when
+ *   its read fails, on a `sessions.reset` signal, and periodically (`checkSessionStreams`).
+ *
+ * Business code never writes here: events reach streams only through the stream relay, from
+ * the record, after commit.
+ */
+import { historyCursor, historyResume } from "../reads/cursor.js";
 import { decodeCursor, encodeCursor } from "../record/index.js";
 import { basinOf } from "../streams/basin.js";
 import { sessionStream, } from "../streams/types.js";
@@ -85,17 +106,27 @@ function streamsOf(ctx) {
  * read starts. The cursor returned is the last record read (the request's cursor when none
  * was), whatever the `agent` filter kept.
  */
-export async function readHistory(ctx, sessionId, cursor, agent) {
-    const from = startSeq(sessionId, cursor);
+export async function readHistory(ctx, sessionId, cursor, agent, limit) {
+    const codec = limit === undefined ? undefined : historyCursor(ctx.config.tenantId, sessionId, agent);
+    const from = startSeq(sessionId, codec ? codec.decode(cursor) : historyResume(ctx.config.tenantId, sessionId, cursor));
     const streams = streamsOf(ctx);
     const ref = (await currentStream(ctx, sessionId)) ?? fail(404, "Session not found");
     const items = [];
     let last;
+    let atTail = true;
+    let examined = 0;
     try {
+        const tail = limit === undefined ? undefined : await streams.tail(ref.basin, ref.stream);
         for await (const record of streams.read(ref.basin, ref.stream, from, { follow: false })) {
+            if (tail !== undefined && record.seq >= tail)
+                break;
             last = record.seq;
             if (served(record.body) && (agent === undefined || belongsTo(record.body, agent)))
                 items.push(record.body);
+            if (limit !== undefined && ++examined >= limit) {
+                atTail = last >= tail - 1;
+                break;
+            }
         }
     }
     catch (error) {
@@ -107,7 +138,10 @@ export async function readHistory(ctx, sessionId, cursor, agent) {
     }
     return {
         items,
-        cursor: last !== undefined ? encodeCursor(sessionId, last) : cursor ?? null,
+        ...(limit === undefined ? {} : { tail: atTail }),
+        cursor: last !== undefined
+            ? (codec ? codec.encode(encodeCursor(sessionId, last)) : encodeCursor(sessionId, last))
+            : cursor ?? null,
     };
 }
 /**
@@ -117,7 +151,7 @@ export async function readHistory(ctx, sessionId, cursor, agent) {
 export async function streamSessionEvents(ctx, request, response, sessionId, cursor, holder) {
     const observer = {
         sink: sseSink(response),
-        next: startSeq(sessionId, cursor),
+        next: startSeq(sessionId, historyResume(ctx.config.tenantId, sessionId, cursor)),
         ...(holder ? { holder } : {}),
     };
     const joined = await join(ctx, sessionId, observer);
@@ -162,7 +196,7 @@ export async function* observeSession(ctx, sessionId, cursor, options) {
                 notify();
             },
         },
-        next: startSeq(sessionId, cursor),
+        next: startSeq(sessionId, historyResume(ctx.config.tenantId, sessionId, cursor)),
         ...(options.holder ? { holder: options.holder } : {}),
     };
     const joined = await join(ctx, sessionId, observer);