@nylorun/runtime 0.19.0-beta → 0.20.0-beta

package/dist/tenant/resource-server.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The Runtime API as an OAuth 2.1 resource server (protocol 9, Host feature `resource-server`).
+ * Nylorun is never the authorization server: the operator's identity providers are, listed in
+ * the identity file, and this module only says so in the standard places.
+ *
+ * - `GET /.well-known/oauth-protected-resource` (RFC 9728): the resource (`NYLORUN_PUBLIC_URL`,
+ *   else the origin the request reached), every trusted issuer in the file's order, and the
+ *   scopes their tokens may carry. Without trusted issuers there is none: the Runtime takes no
+ *   OAuth tokens.
+ * - `WWW-Authenticate: Bearer` challenges (OAuth 2.1 §5.3, RFC 6750): a missing credential
+ *   carries no error code; a rejected one `error="invalid_token"`; a token missing a route's
+ *   scope `error="insufficient_scope"` with the scopes that would do. On the Runtime API they
+ *   point at the metadata (`resource_metadata`); the Management API takes management keys only
+ *   and is no OAuth resource, so its challenge is a bare `Bearer`.
+ */
+import type { IncomingMessage } from "node:http";
+import type { TrustedIssuers } from "./issuers.js";
+/** Where the protected resource metadata is served (RFC 9728 §3). */
+export declare const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+/** What the metadata and the challenges are made of: `TenantConfig`'s fields of the same names. */
+export interface ResourceServerConfig {
+    /** The URL clients reach the Runtime API at (`NYLORUN_PUBLIC_URL`, no trailing slash). */
+    readonly publicUrl?: string;
+    /** The identity file's trusted issuers. */
+    readonly issuers?: TrustedIssuers;
+}
+/** RFC 9728 protected resource metadata. */
+export interface ProtectedResourceMetadata {
+    readonly resource: string;
+    readonly authorization_servers: readonly string[];
+    readonly scopes_supported: readonly string[];
+    readonly bearer_methods_supported: readonly ["header"];
+    readonly resource_name: string;
+}
+/** The metadata, or undefined when the Runtime trusts no issuer. */
+export declare function protectedResourceMetadata(config: ResourceServerConfig, incoming: IncomingMessage): ProtectedResourceMetadata | undefined;
+/**
+ * The metadata's URL for a challenge's `resource_metadata`, or undefined when there is none.
+ * A resource with a path has its metadata at the origin, the path after the well-known part.
+ */
+export declare function protectedResourceMetadataUrl(config: ResourceServerConfig, incoming: IncomingMessage): string | undefined;
+interface Challenge {
+    readonly error?: "invalid_token" | "insufficient_scope";
+    readonly description?: string;
+    readonly scope?: string;
+    readonly resourceMetadata?: string | undefined;
+}
+/** A `WWW-Authenticate: Bearer` value. Every parameter value is plain ASCII without quotes. */
+export declare function bearerChallenge(challenge?: Challenge): string;
+/**
+ * The `401` for a request without a usable credential: `credential_required` when it sent
+ * none (no error code, OAuth 2.1 §5.3.2), `credential_invalid` when the Tenant refused the one
+ * it sent. The reason is the Runtime's log's, never the client's.
+ */
+export declare function failCredential(kind: "required" | "invalid", resourceMetadata: string | undefined): never;
+export {};

package/dist/tenant/resource-server.js

@@ -0,0 +1,62 @@
+import { TOKEN_SCOPES } from "@nylorun/core/contracts";
+import { HttpError } from "./http.js";
+/** Where the protected resource metadata is served (RFC 9728 §3). */
+export const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
+/** The origin `incoming` reached, as `@hono/node-server` builds a request's URL. */
+function requestOrigin(incoming) {
+    const scheme = incoming.socket?.encrypted ? "https" : "http";
+    return `${scheme}://${incoming.headers.host ?? "localhost"}`;
+}
+/** This Runtime API's resource identifier: the public URL, else the request's origin. */
+function resourceOf(config, incoming) {
+    return config.publicUrl ?? requestOrigin(incoming);
+}
+/** The metadata, or undefined when the Runtime trusts no issuer. */
+export function protectedResourceMetadata(config, incoming) {
+    const issuers = config.issuers?.issuers ?? [];
+    if (issuers.length === 0)
+        return undefined;
+    // `studio` signs a person in to Studio; no Runtime API route asks for it.
+    const granted = new Set(issuers.flatMap((issuer) => issuer.config.allowedScopes));
+    return {
+        resource: resourceOf(config, incoming),
+        authorization_servers: issuers.map((issuer) => issuer.config.issuer),
+        scopes_supported: TOKEN_SCOPES.filter((scope) => granted.has(scope)),
+        bearer_methods_supported: ["header"],
+        resource_name: "Nylorun Runtime API",
+    };
+}
+/**
+ * The metadata's URL for a challenge's `resource_metadata`, or undefined when there is none.
+ * A resource with a path has its metadata at the origin, the path after the well-known part.
+ */
+export function protectedResourceMetadataUrl(config, incoming) {
+    if ((config.issuers?.issuers.length ?? 0) === 0)
+        return undefined;
+    const url = new URL(resourceOf(config, incoming));
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/$/, "");
+    return `${url.origin}${PROTECTED_RESOURCE_PATH}${path}`;
+}
+/** A `WWW-Authenticate: Bearer` value. Every parameter value is plain ASCII without quotes. */
+export function bearerChallenge(challenge = {}) {
+    const params = [];
+    if (challenge.error)
+        params.push(`error="${challenge.error}"`);
+    if (challenge.description)
+        params.push(`error_description="${challenge.description}"`);
+    if (challenge.scope)
+        params.push(`scope="${challenge.scope}"`);
+    if (challenge.resourceMetadata)
+        params.push(`resource_metadata="${challenge.resourceMetadata}"`);
+    return params.length === 0 ? "Bearer" : `Bearer ${params.join(", ")}`;
+}
+/**
+ * The `401` for a request without a usable credential: `credential_required` when it sent
+ * none (no error code, OAuth 2.1 §5.3.2), `credential_invalid` when the Tenant refused the one
+ * it sent. The reason is the Runtime's log's, never the client's.
+ */
+export function failCredential(kind, resourceMetadata) {
+    if (kind === "required")
+        throw new HttpError(401, "A bearer credential is required", { code: "credential_required" }, { "www-authenticate": bearerChallenge({ resourceMetadata }) });
+    throw new HttpError(401, "The credential is not valid here", { code: "credential_invalid" }, { "www-authenticate": bearerChallenge({ error: "invalid_token", resourceMetadata }) });
+}

package/dist/tenant/runtime.d.ts

@@ -108,7 +108,7 @@ export declare class TenantRuntime implements TenantHandle {
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
     /**
      * Aborts the advance of `sessionId` if it runs on this process. Cancel calls it after
-     * committing `cancelled`; the control stream calls it for cancels made elsewhere.
+     * committing `cancelled`; the control bus calls it for cancels made elsewhere.
      */
     abortLocal(sessionId: string): void;
     /**

package/dist/tenant/runtime.js

@@ -13,6 +13,7 @@ import { defaultSandboxBackends } from "../sandbox/select.js";
 import { MemoryExecution } from "../execution/memory.js";
 import { openError } from "./cause.js";
 import { MemoryStreams } from "../streams/memory.js";
+import { closeControl, wireControl } from "./control.js";
 import { createSessionStreams, endAllStreams, } from "./session-streams.js";
 import { closeStreams, streamsStatus, wireStreams, } from "./streams.js";
 import { abortAll, abortLocal, createWorkState, drain, waitForIdle, } from "./scheduler.js";
@@ -85,6 +86,7 @@ export class TenantRuntime {
         mkdirSync(paths.logs, { recursive: true });
         const store = hooks.store;
         let wired;
+        let control;
         let detach;
         let harness;
         try {
@@ -303,6 +305,8 @@ export class TenantRuntime {
                 ...(hooks.hostRelay ? { hostRelay: true } : {}),
                 ...(hooks.retireGraceMs !== undefined ? { retireGraceMs: hooks.retireGraceMs } : {}),
             });
+            await wireControl(ctx);
+            control = ctx.control;
             // Register the handlers, then arm the sweep: its first pass runs at once and re-wakes
             // sessions a previous process left runnable or running (takeover handles the rest).
             const worker = {
@@ -324,6 +328,7 @@ export class TenantRuntime {
             await detach?.().catch(() => undefined);
             await harness?.stop().catch(() => undefined);
             await wired?.close().catch(() => undefined);
+            await control?.close().catch(() => undefined);
             await hooks.reads?.close().catch(() => undefined);
             await store.close().catch(() => undefined);
             throw error;
@@ -350,7 +355,7 @@ export class TenantRuntime {
     }
     /**
      * Aborts the advance of `sessionId` if it runs on this process. Cancel calls it after
-     * committing `cancelled`; the control stream calls it for cancels made elsewhere.
+     * committing `cancelled`; the control bus calls it for cancels made elsewhere.
      */
     abortLocal(sessionId) {
         this.ctx.abortLocal(sessionId);
@@ -402,6 +407,7 @@ export class TenantRuntime {
                     return closeStreams(ctx);
                 },
             ],
+            ["control", () => closeControl(ctx)],
             ["reads", () => ctx.reads?.close()],
             ["store", () => ctx.store.close()],
         ];

package/dist/tenant/scheduler.d.ts

@@ -9,7 +9,7 @@ export interface WorkState {
 export declare function createWorkState(): WorkState;
 /**
  * Abort the advance of `id` if it runs on this process.
- * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
+ * Cancel calls it after committing `cancelled`, and so does the control bus for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
 export declare function abortLocal(ctx: TenantContext, id: string, kind?: AdvanceAbortKind, turnId?: string): void;

package/dist/tenant/scheduler.js

@@ -27,7 +27,7 @@ function abortWith(controller, kind) {
 }
 /**
  * Abort the advance of `id` if it runs on this process.
- * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
+ * Cancel calls it after committing `cancelled`, and so does the control bus for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
 export function abortLocal(ctx, id, kind = "cancel", turnId) {

package/dist/tenant/streams.d.ts

@@ -8,23 +8,24 @@
  *   otherwise (tests, a Host without S2) this module runs a relay of the Tenant's own commits,
  *   which reconciles the record with the streams when it starts.
  * - **Basin generations.** The Tenant's session streams live in its current basin generation
- *   (`streams/basin.ts`). A reset moves it to the next one (`tenantReset`): the old basin gets
- *   a `sessions.reset` signal, every process moves its readers, and the old basin is deleted
- *   after a grace period (again when the Tenant opens, until it is gone).
+ *   (`streams/basin.ts`). A reset moves it to the next one: its transaction puts a
+ *   `sessions.reset` signal on the control bus (`control.ts`), every process moves its readers
+ *   (`tenantReset` here, `checkSessionStreams` elsewhere), and the old basin is deleted after a
+ *   grace period (again when the Tenant opens, until it is gone).
  * - **Basin.** The current basin is created when the Tenant opens. A missing basin (S2 down
  *   then, or deleted since) is repaired on first use: a failed `ensureTenant` retries in the background with backoff,
  *   and `streamsStatus` reports the basin's state.
  * - **Readers.** History and session SSE read the session's stream
- *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
- *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`
- *   and checks the session streams for each `sessions.reset`.
+ *   (`tenant/session-streams.ts`). Those are the only readers: S2 serves API listeners, and
+ *   nothing internal reads or writes it (D48). Signals between processes go over the control
+ *   bus on Postgres (`control.ts`).
  *
  * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
  * local development Host (not durable).
  */
 import type { SessionStore } from "../store/types.js";
 import { type StreamRelay, type StreamRelayStatus } from "../streams/relay/core.js";
-import { type DurableStreams } from "../streams/types.js";
+import type { DurableStreams } from "../streams/types.js";
 import type { TenantContext } from "./context.js";
 export interface WireStreamsOptions {
     tenantId: string;
@@ -56,7 +57,7 @@ export interface StreamsWiring {
     readonly relay: StreamRelay | undefined;
     /** The current basin's state (`streamsStatus`). */
     basin(): BasinStatus;
-    /** Moves this process's readers and control reader to basin generation `generation`. */
+    /** Moves this process's readers to basin generation `generation`. */
     moveTo(generation: number): void;
     /** Deletes the basins of retired generations after the grace period. */
     retire(generations: readonly number[]): void;
@@ -65,23 +66,16 @@ export interface StreamsWiring {
 }
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
- * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
- * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
- * `ctx` is built and before the Tenant serves requests.
+ * the Tenant's relay (unless the Host relays) and the retired basins' deletion, and records
+ * the handles on `ctx.sessionStreams.wiring`. Call it once, after `ctx` is built and before
+ * the Tenant serves requests.
  */
 export declare function wireStreams(ctx: TenantContext, options: WireStreamsOptions): Promise<StreamsWiring>;
 /**
- * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
- * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
- * commits. A lost signal costs latency only (the advance checks the Session Store before every
- * effect), so failures are logged, never thrown.
- */
-export declare function signalSessionCancel(ctx: TenantContext, sessionId: string, turnId: string | null): void;
-/**
- * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
- * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
- * moves this process's readers, and deletes the old basin after the grace period. Failures
- * are logged; the periodic check and the next open finish the job.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: moves
+ * this process's readers at once and deletes the old basin after the grace period. The other
+ * processes move on the reset's `sessions.reset` signal (`control.ts`); the periodic check
+ * and the next open finish the job.
  */
 export declare function tenantReset(ctx: TenantContext): Promise<void>;
 /** Tenant status of the streams seam (for `GET /v1/tenant`). */

package/dist/tenant/streams.js

@@ -1,7 +1,5 @@
 import { basinOf } from "../streams/basin.js";
-import { signalCancel, signalSessionsReset } from "../streams/control.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
-import { CONTROL_STREAM, } from "../streams/types.js";
 import { checkSessionStreams, currentBasin, sleep, } from "./session-streams.js";
 const RETRY_MIN_MS = 100;
 const RETRY_MAX_MS = 2000;
@@ -16,9 +14,9 @@ const RETIRE_GRACE_MS = 60_000;
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
- * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
- * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
- * `ctx` is built and before the Tenant serves requests.
+ * the Tenant's relay (unless the Host relays) and the retired basins' deletion, and records
+ * the handles on `ctx.sessionStreams.wiring`. Call it once, after `ctx` is built and before
+ * the Tenant serves requests.
  */
 export async function wireStreams(ctx, options) {
     if (ctx.sessionStreams.wiring)
@@ -53,17 +51,6 @@ export async function wireStreams(ctx, options) {
             },
         });
     relay?.start();
-    // One control reader, on the current basin; moving to a new generation restarts it there.
-    let control = new AbortController();
-    const startControl = () => follow(streams, currentBasin(ctx), CONTROL_STREAM, AbortSignal.any([stop.signal, control.signal]), (body) => {
-        const signal = body;
-        if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
-            ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
-        else if (signal?.type === "sessions.reset")
-            void checkSessionStreams(ctx).catch(report("session stream check failed"));
-    }, report("control stream read failed; retrying"));
-    // Signals appended from here on reach this process.
-    await startControl();
     // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
     const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
     feedCheck.unref();
@@ -78,9 +65,6 @@ export async function wireStreams(ctx, options) {
                 return;
             ctx.sessionStreams.generation = generation;
             basin.repair();
-            control.abort();
-            control = new AbortController();
-            void startControl();
         },
         retire(retired) {
             for (const generation of retired) {
@@ -153,33 +137,16 @@ function commitSource(store, tenantId) {
     };
 }
 /**
- * Appends `session.cancel` for `sessionId` and its cancelled turn to `tenant/control`, so the
- * process running that turn's advance aborts it. Call it from `t.afterCommit` after a cancel
- * commits. A lost signal costs latency only (the advance checks the Session Store before every
- * effect), so failures are logged, never thrown.
- */
-export function signalSessionCancel(ctx, sessionId, turnId) {
-    const streams = ctx.sessionStreams.wiring?.streams;
-    if (!streams)
-        return;
-    void signalCancel(streams, currentBasin(ctx), sessionId, turnId ?? undefined).catch((error) => ctx.config.logger.warn("cancel signal failed", {
-        sessionId,
-        message: messageOf(error),
-    }));
-}
-/**
- * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
- * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
- * moves this process's readers, and deletes the old basin after the grace period. Failures
- * are logged; the periodic check and the next open finish the job.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: moves
+ * this process's readers at once and deletes the old basin after the grace period. The other
+ * processes move on the reset's `sessions.reset` signal (`control.ts`); the periodic check
+ * and the next open finish the job.
  */
 export async function tenantReset(ctx) {
     const wiring = ctx.sessionStreams.wiring;
     if (!wiring)
         return;
-    const previous = currentBasin(ctx);
     const generations = await ctx.store.tx((t) => t.basinGenerations());
-    await signalSessionsReset(wiring.streams, previous, generations.current).catch((error) => ctx.config.logger.warn("sessions.reset signal failed", { message: messageOf(error) }));
     wiring.moveTo(generations.current);
     wiring.retire(generations.retired);
 }
@@ -283,50 +250,3 @@ function basinKeeper(streams, basinKey, signal, onError) {
         status: () => ({ ready, failures, lastError }),
     };
 }
-/**
- * Follows a signal stream from its tail at start, calling `onRecord` for each record, until
- * `signal` aborts. Failed reads retry with backoff; a read that ends by itself (the basin was
- * deleted) starts again from the new tail. Resolves once the first tail is known (or failed).
- */
-function follow(streams, basin, stream, signal, onRecord, onError) {
-    let started;
-    const ready = new Promise((resolve) => (started = resolve));
-    void (async () => {
-        let from;
-        let delay = RETRY_MIN_MS;
-        while (!signal.aborted) {
-            try {
-                try {
-                    from ??= await streams.tail(basin, stream);
-                }
-                finally {
-                    started();
-                }
-                for await (const record of streams.read(basin, stream, from, {
-                    signal,
-                })) {
-                    from = record.seq + 1;
-                    delay = RETRY_MIN_MS;
-                    try {
-                        onRecord(record.body);
-                    }
-                    catch (error) {
-                        onError(error);
-                    }
-                }
-                if (signal.aborted)
-                    return;
-                from = undefined;
-            }
-            catch (error) {
-                if (signal.aborted)
-                    return;
-                onError(error);
-            }
-            await sleep(delay, signal);
-            delay = Math.min(delay * 2, RETRY_MAX_MS);
-        }
-        started();
-    })();
-    return ready;
-}

package/dist/tenant/sweep.js

@@ -13,7 +13,9 @@
  *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
  *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
  *    workspaces). Idle MCP connections of the in-process harness are closed.
- * 4. **Hooks.** Callbacks registered with `ctx.onSweep`.
+ * 4. **Control signals.** Signals on the control bus older than `SIGNAL_RETENTION_MS` are
+ *    deleted: followers read back only the last two minutes (`store/postgres/control.ts`).
+ * 5. **Hooks.** Callbacks registered with `ctx.onSweep`.
  *
  * Every step runs one transaction per session it changes (a linked agent and its workflow
  * share one, child first), so the sweep follows the lock order in `store/types.ts`. A failing
@@ -22,6 +24,8 @@
  */
 import { pendingAgentEffects, reconcilePendingAgentEffect, } from "../core/flow-host.js";
 const BATCH = 100;
+/** How long a control signal is kept after it was written. */
+const SIGNAL_RETENTION_MS = 60 * 60 * 1000;
 export async function sweep(ctx) {
     if (ctx.closing || ctx.closed)
         return;
@@ -40,6 +44,10 @@ export async function sweep(ctx) {
         ["pods", () => reconcileStalePods(ctx, now)],
         // A harness elsewhere closes its own idle MCP connections.
         ["mcp", async () => ctx.mcp?.sweep()],
+        [
+            "signals",
+            () => ctx.store.tx((t) => t.pruneSignals(new Date(now.getTime() - SIGNAL_RETENTION_MS))),
+        ],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
     let failure;

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.19.0-beta";
+export declare const RUNTIME_VERSION = "0.20.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.19.0-beta";
+export const RUNTIME_VERSION = "0.20.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.19.0-beta",
+  "version": "0.20.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.31.0",
-    "@nylorun/core": "0.15.0-beta",
-    "@nylorun/harness": "0.23.0-beta",
+    "@nylorun/core": "0.16.0-beta",
+    "@nylorun/harness": "0.23.1-beta",
     "@restatedev/restate-sdk": "1.17.2",
     "@s2-dev/streamstore": "0.28.0",
     "aws4fetch": "1.0.20",

package/dist/streams/control.d.ts

@@ -1,13 +0,0 @@
-/**
- * Signals on a basin's `tenant/control` stream (Durable Streams §8). They are appended
- * directly, never recorded: a lost signal costs latency, never correctness (the epoch fence
- * stops a cancelled turn's effects; readers also check their sessions periodically).
- */
-import { type DurableStreams } from "./types.js";
-/** Appends a `session.cancel` signal: the process running the session's advance aborts it. */
-export declare function signalCancel(streams: DurableStreams, basin: string, sessionId: string, turnId?: string): Promise<void>;
-/**
- * Appends a `sessions.reset` signal to the old generation's basin: every process with the
- * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.
- */
-export declare function signalSessionsReset(streams: DurableStreams, basin: string, generation: number): Promise<void>;

package/dist/streams/control.js

@@ -1,25 +0,0 @@
-/**
- * Signals on a basin's `tenant/control` stream (Durable Streams §8). They are appended
- * directly, never recorded: a lost signal costs latency, never correctness (the epoch fence
- * stops a cancelled turn's effects; readers also check their sessions periodically).
- */
-import { CONTROL_STREAM } from "./types.js";
-/** Appends a `session.cancel` signal: the process running the session's advance aborts it. */
-export async function signalCancel(streams, basin, sessionId, turnId) {
-    if (!sessionId)
-        throw new Error("sessionId is required");
-    const signal = {
-        type: "session.cancel",
-        sessionId,
-        ...(turnId ? { turnId } : {}),
-    };
-    await streams.append(basin, CONTROL_STREAM, [signal]);
-}
-/**
- * Appends a `sessions.reset` signal to the old generation's basin: every process with the
- * Tenant open moves its readers to `generation` and ends the streams of deleted sessions.
- */
-export async function signalSessionsReset(streams, basin, generation) {
-    const signal = { type: "sessions.reset", generation };
-    await streams.append(basin, CONTROL_STREAM, [signal]);
-}