@nylorun/runtime 0.22.0-beta → 0.24.0-beta

package/dist/store/postgres/schema.js

@@ -69,14 +69,14 @@ export const sessions = nylorun.table("sessions", {
     ownerExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
     /** The session owner (`ownerUserId`), not the lease column `owner`. */
     ownerUserId: field("->>'ownerUserId'"),
-    /** The sandbox resource the session is attached to (`sandbox: { id }`). */
-    sandboxId: field("->>'sandboxId'"),
+    /** The Environment the session names (`environment`, protocol 11). */
+    environmentId: field("->>'environmentId'"),
 }, (t) => [
     index("sessions_created").on(t.createdAt.desc().nullsLast(), t.id.desc().nullsFirst()),
     index("sessions_status").on(t.status, t.ownerExpiresAt),
     index("sessions_agent").on(t.agentId),
     index("sessions_owner_user").on(t.ownerUserId),
-    index("sessions_sandbox").on(t.sandboxId),
+    index("sessions_environment").on(t.environmentId),
 ]);
 export const commands = documents("commands");
 export const effects = nylorun.table("effects", {
@@ -107,22 +107,92 @@ export const principals = nylorun.table("principals", {
     idempotencyKey: text(),
     createdAt: text().notNull(),
 });
+/**
+ * An Environment (D55, protocol 11): its id, kind, labels, the recipe the app asked for and the
+ * recipe its compute runs (`applied`, copied from `recipe` when a stopped pod is asked to run),
+ * the owner guard, and when it was last used. Kind `pod` adds the pod's lifecycle columns.
+ * Sessions name it by id (the session body's `environmentId`). Not the `sandboxes` document
+ * table, which holds the virtual backend's compute records, keyed by workspace key.
+ */
+export const environments = nylorun.table("environments", {
+    id: textC().primaryKey(),
+    kind: text({ enum: ["virtual", "pod", "none"] }).notNull(),
+    /** `{ key: value }`, filtered through `nylorun.doc(labels)`. */
+    labels: jsonText().notNull(),
+    /** What the app asked for (`EnvironmentRecipe`), resolved against the Tenant's limits. */
+    recipe: jsonText().notNull(),
+    /** The recipe the current pod or workspace runs. */
+    applied: jsonText().notNull(),
+    version: integer().notNull().default(1),
+    appliedVersion: integer().notNull().default(1),
+    /** The owner guard: only this owner's sessions may name the Environment. */
+    ownerUserId: text(),
+    /** A turn's end, a recipe change, a secret write, a stop or a reset (`lifecycle.deleteAfter`). */
+    lastUsedAt: timestamp({ withTimezone: true, mode: "string" }).notNull().defaultNow(),
+    createdAt: textC().notNull(),
+    updatedAt: textC().notNull(),
+    // Kind `pod` (F7.2, D34): null otherwise. `tenant/environments.ts` and the `Sandbox`
+    // object's reconcile (`sandbox/pods/reconcile.ts`) are the only writers.
+    /** The agent-sandbox Sandbox's name, `sbx-<16 base32>-g<volume_gen>` (`podName`). */
+    k8sName: textC(),
+    /** Bumped by every reset: a new Sandbox on a new volume. */
+    volumeGen: integer().notNull().default(0),
+    /** `running`, `suspended` or `deleted`. */
+    desired: text({ enum: ["running", "suspended", "deleted"] }),
+    /** `creating`, `running`, `suspended`, `lost`, `failed` or `deleting`. */
+    observed: text({ enum: ["creating", "running", "suspended", "lost", "failed", "deleting"] }),
+    /** The UID of the pod that last joined. */
+    podUid: text(),
+    /**
+     * Bumped by every join (`host.join`), relaunch, loss and reset: host and egress tokens carry
+     * it (`epc`), and one of an older epoch is refused (egress-gate reads it too).
+     */
+    hostEpoch: integer().notNull().default(0),
+    /** sha256 (hex) of the incarnation's join token; the token itself is never stored. */
+    joinTokenHash: text(),
+    /** Bumped by every change the Runtime asks of the pod: the sandboxes service's `opId`. */
+    rev: integer().notNull().default(0),
+    /** When a turn last ended on it, for the idle timer. */
+    lastActiveAt: timestamp({ withTimezone: true }),
+    /** When the current incarnation was asked to run, for the ready deadline. */
+    startedAt: timestamp({ withTimezone: true }),
+    /** Why it failed or was lost. */
+    reason: text(),
+    /** An earlier incarnation's Sandbox still to delete (after a reset or a loss). */
+    retiring: textC(),
+    /**
+     * The id the engine keeps on the volume (`/harness/volume-id`), recorded at the first join:
+     * a join with another one means the volume was replaced (its files are gone), so `lost`.
+     */
+    volumeId: text(),
+    /**
+     * The disk lease (R2d step 3): `{ kind, version?, startedAt, until }` while a snapshot, a
+     * restore or a seed copies the disk; turns are refused until it ends or `until` passes.
+     */
+    diskOp: jsonText(),
+    /** The disk version the next volume starts from: `{ artifactId, version }` (R2d step 3). */
+    diskSeed: jsonText(),
+}, (t) => [check("environments_kind_check", sql `${t.kind} IN ('virtual', 'pod', 'none')`)]);
+/**
+ * A vault (D56): the host model's (`id = 'host'`), or one Environment's, created and deleted with
+ * it (`environment_id`, unique, deleted with the Environment's row). No other vault exists.
+ */
 export const vaults = nylorun.table("vaults", {
     id: textC().primaryKey(),
     name: text().notNull(),
-    ownerUserId: text().notNull(),
     /** JSON text, or null. */
     metadataJson: text(),
     createdAt: textC().notNull(),
-    /**
-     * `user`: one person's (owner `ownerUserId`); `installation`: the installation's own,
-     * attachable to any session (owner `installation`); `host`: the model vault, never attached.
-     */
-    scope: text({ enum: ["user", "installation", "host"] }).notNull().default("user"),
+    /** The Environment the vault belongs to; null only for the host vault. */
+    environmentId: textC(),
 }, (t) => [
-    index("vaults_owner").on(t.ownerUserId, t.createdAt, t.id),
-    uniqueIndex("vaults_one_host").on(t.scope).where(sql `scope = 'host'`),
-    check("vaults_scope_check", sql `scope IN ('user', 'installation', 'host')`),
+    uniqueIndex("vaults_environment").on(t.environmentId),
+    foreignKey({
+        name: "vaults_environment_id_fkey",
+        columns: [t.environmentId],
+        foreignColumns: [environments.id],
+    }).onDelete("cascade"),
+    check("vaults_owner_check", sql `(${t.id} = 'host') = (${t.environmentId} IS NULL)`),
 ]);
 /** A credential of a vault: its binding in the clear, its secret sealed. */
 export const vaultCredentials = nylorun.table("vault_credentials", {
@@ -146,6 +216,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
         foreignColumns: [vaults.id],
     }).onDelete("cascade"),
     index("vault_credentials_vault").on(t.vaultId, t.createdAt, t.id),
+    uniqueIndex("vault_credentials_name").on(t.vaultId, t.name),
 ]);
 export const vaultAudit = nylorun.table("vault_audit", {
     ord: bigint({ mode: "number" }).primaryKey().generatedAlwaysAsIdentity(),
@@ -198,7 +269,9 @@ export const signingKeys = nylorun.table("signing_keys", {
  * The model usage ledger (P1.3): one row per model call a gate served, written after the call.
  * A second row for the same effect (a call the gate ran again after a gateway restart) is
  * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
- * when the provider sent none.
+ * when the provider sent none. `startedAt`, `endedAt` and `firstTokenMs` are the gate's own
+ * timing of the call (R7.1, migration 0022); null on rows written before, and `firstTokenMs`
+ * when the provider streamed nothing.
  */
 export const modelUsage = nylorun.table("model_usage", {
     id: textC().primaryKey(),
@@ -222,6 +295,12 @@ export const modelUsage = nylorun.table("model_usage", {
     /** True when an earlier row has the same `effectKey`: the provider billed the call twice. */
     duplicate: boolean().notNull(),
     createdAt: text().notNull(),
+    /** When the gate sent the call to the provider. */
+    startedAt: text(),
+    /** When the provider's answer was complete. */
+    endedAt: text(),
+    /** From `startedAt` to the provider's first stream event. */
+    firstTokenMs: integer(),
 }, (t) => [
     index("model_usage_session").on(t.sessionId, t.createdAt, t.id),
     index("model_usage_export").on(t.txid, t.id),
@@ -260,60 +339,6 @@ export const toolCrossings = nylorun.table("tool_crossings", {
     /** The gate's answer (`McpAnswer`), once the call ended; null while it runs or once lost. */
     answer: jsonText(),
 }, (t) => [index("tool_crossings_settled").on(t.settledAt)]);
-/**
- * A sandbox resource (blueprint D39, F7.1): its id, kind, the spec resolved against the
- * Tenant's limits when it was created, and the developer's labels. Sessions attach to it by id
- * (the session body's `sandboxId`). Not the `sandboxes` document table, which holds the virtual
- * backend's compute records, keyed by workspace key.
- */
-export const sandboxResources = nylorun.table("sandbox_resources", {
-    id: textC().primaryKey(),
-    kind: text({ enum: ["virtual", "pod"] }).notNull(),
-    /** The resolved `SandboxManifest`. */
-    spec: jsonText().notNull(),
-    /** `{ key: value }`, filtered through `nylorun.doc(labels)`. */
-    labels: jsonText().notNull(),
-    createdAt: textC().notNull(),
-    updatedAt: textC().notNull(),
-    // Kind `pod` (F7.2, D34): null for a virtual sandbox. `tenant/sandboxes.ts` and the
-    // `Sandbox` object's reconcile (`sandbox/pods/reconcile.ts`) are the only writers.
-    /** The agent-sandbox Sandbox's name, `sbx-<16 base32>-g<volume_gen>` (`podName`). */
-    k8sName: textC(),
-    /** Bumped by every reset: a new Sandbox on a new volume. */
-    volumeGen: integer().notNull().default(0),
-    /** `running`, `suspended` or `deleted`. */
-    desired: text({ enum: ["running", "suspended", "deleted"] }),
-    /** `creating`, `running`, `suspended`, `expired`, `lost`, `failed` or `deleting`. */
-    observed: text({
-        enum: ["creating", "running", "suspended", "expired", "lost", "failed", "deleting"],
-    }),
-    /** The UID of the pod that last joined. */
-    podUid: text(),
-    /**
-     * Bumped by every join (`host.join`), relaunch, loss and reset: host and egress tokens carry
-     * it (`epc`), and one of an older epoch is refused (egress-gate reads it too).
-     */
-    hostEpoch: integer().notNull().default(0),
-    /** sha256 (hex) of the incarnation's join token; the token itself is never stored. */
-    joinTokenHash: text(),
-    /** Bumped by every change the Runtime asks of the pod: the sandboxes service's `opId`. */
-    rev: integer().notNull().default(0),
-    /** When a turn last ended on it, for the idle timer. */
-    lastActiveAt: timestamp({ withTimezone: true }),
-    /** When its TTL passes (`createdAt + lifecycle.ttl`). */
-    expiresAt: timestamp({ withTimezone: true }),
-    /** When the current incarnation was asked to run, for the ready deadline. */
-    startedAt: timestamp({ withTimezone: true }),
-    /** Why it failed or was lost. */
-    reason: text(),
-    /** An earlier incarnation's Sandbox still to delete (after a reset or a loss). */
-    retiring: textC(),
-    /**
-     * The id the engine keeps on the volume (`/harness/volume-id`), recorded at the first join:
-     * a join with another one means the volume was replaced (its files are gone), so `lost`.
-     */
-    volumeId: text(),
-});
 /**
  * Artifacts (blueprint D35, F8.1 and F8.2): an id, a name and numbered versions. The bytes are in
  * the Object store under each version's `blobKey` (a folder's: its manifest); a blob counts only
@@ -331,8 +356,12 @@ export const artifacts = nylorun.table("artifacts", {
     labelsJson: text(),
     createdAt: textC().notNull(),
     updatedAt: text().notNull(),
+    /** The Environment whose disk versions this folder holds (R2d step 3); one per Environment. */
+    environmentId: textC(),
 }, (t) => [
     index("artifacts_session").on(t.sessionId, t.createdAt, t.id),
+    uniqueIndex("artifacts_environment_disk").on(t.environmentId).where(sql `environment_id IS NOT NULL`),
+    index("artifacts_creation_order").on(t.createdAt, t.id),
     check("artifacts_kind_check", sql `kind IN ('file', 'folder')`),
 ]);
 /** The versions of an artifact, immutable once written. */
@@ -344,7 +373,7 @@ export const artifactVersions = nylorun.table("artifact_versions", {
     size: bigint({ mode: "number" }).notNull(),
     sha256: text().notNull(),
     contentType: text().notNull(),
-    source: text({ enum: ["upload", "engine", "export"] }).notNull(),
+    source: text({ enum: ["upload", "engine", "export", "snapshot"] }).notNull(),
     createdAt: textC().notNull(),
 }, (t) => [
     primaryKey({ name: "artifact_versions_pkey", columns: [t.artifactId, t.version] }),
@@ -406,7 +435,8 @@ export const definitionFileUses = nylorun.table("definition_file_uses", {
  * written in the transaction that commits what they announce and notified on
  * `nylorun_control` at commit (`control.ts`). A row outlives its notification so a process
  * whose listener was down catches up; the Tenant sweep deletes old ones. `created_at` is the
- * insert's own clock (`clock_timestamp()`), not its transaction's start.
+ * insert's own clock (`clock_timestamp()`), not its transaction's start. `sandbox_id` and
+ * `epoch` are a `host.revoked` signal's.
  */
 export const controlSignals = nylorun.table("control_signals", {
     id: bigint({ mode: "number" }).primaryKey().generatedAlwaysAsIdentity(),
@@ -417,16 +447,20 @@ export const controlSignals = nylorun.table("control_signals", {
     createdAt: timestamp({ withTimezone: true, mode: "string" })
         .notNull()
         .default(sql `clock_timestamp()`),
+    sandboxId: textC(),
+    epoch: integer(),
 }, (t) => [
     index("control_signals_created_at").on(t.createdAt),
-    check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset')`),
+    check("control_signals_kind_check", sql `${t.kind} IN ('session.cancel', 'sessions.reset', 'host.revoked')`),
 ]);
 /**
  * The wake outbox (architecture §12.3): one row per wake a committed transaction asked for
  * (`Tx.wake`), written in that transaction, so a commit never loses its wake. The row is
  * deleted once Durable Session Execution has accepted the wake; until then the Tenant sweep
  * delivers it again, with the same idempotency key (`dedupe_key`, or `wake:<id>` without
- * one). `created_at` is the insert's own clock (`clock_timestamp()`).
+ * one). `created_at` is the insert's own clock (`clock_timestamp()`). `attempts` counts the
+ * sweep's failed deliveries, `retry_at` is when it tries the row again, and a row
+ * `parked_at` is never tried again: it stays for an operator (`Tx.failOutbox`).
  */
 export const wakes = nylorun.table("wakes", {
     id: textC().primaryKey(),
@@ -436,20 +470,46 @@ export const wakes = nylorun.table("wakes", {
     createdAt: timestamp({ withTimezone: true, mode: "date" })
         .notNull()
         .default(sql `clock_timestamp()`),
+    attempts: integer().notNull().default(0),
+    retryAt: timestamp({ withTimezone: true, mode: "date" }),
+    parkedAt: timestamp({ withTimezone: true, mode: "date" }),
 }, (t) => [index("wakes_created_at").on(t.createdAt)]);
+/**
+ * The sandbox signal outbox (F7.2): one row per pod sandbox reconcile or timer a committed
+ * transaction asked for (`Tx.signalSandbox`), kept and delivered as the wake outbox's rows are
+ * (`attempts`, `retry_at`, `parked_at`). A reconcile is sent with the idempotency key
+ * `signal:<id>`; a timer (`kind` `arm`) is its `timer` at `at` (ms since the epoch). Not in
+ * `wakes`, so a Runtime that delivers only wakes never reads one.
+ */
+export const sandboxSignals = nylorun.table("sandbox_signals", {
+    id: textC().primaryKey(),
+    sandboxId: textC().notNull(),
+    kind: text().notNull(),
+    timer: text(),
+    at: bigint({ mode: "number" }),
+    createdAt: timestamp({ withTimezone: true, mode: "date" })
+        .notNull()
+        .default(sql `clock_timestamp()`),
+    attempts: integer().notNull().default(0),
+    retryAt: timestamp({ withTimezone: true, mode: "date" }),
+    parkedAt: timestamp({ withTimezone: true, mode: "date" }),
+}, (t) => [
+    index("sandbox_signals_created_at").on(t.createdAt),
+    check("sandbox_signals_kind_check", sql `${t.kind} IN ('reconcile', 'arm')`),
+]);
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**
- * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
- * Written only by the record module; not published to the stream relay.
+ * Each Environment's lifecycle stream (`nylorun.environment-event/1`), numbered from 0 per
+ * Environment id. Written only by the record module; not published to the stream relay.
  */
-export const sandboxEvents = nylorunStreams.table("sandbox_events", {
-    sandboxId: textC().notNull(),
+export const environmentEvents = nylorunStreams.table("environment_events", {
+    environmentId: textC().notNull(),
     seq: bigint({ mode: "number" }).notNull(),
     type: text().notNull(),
     body: jsonText().notNull(),
     committedAt: timestamp({ withTimezone: true, mode: "string" }).notNull().defaultNow(),
-}, (t) => [primaryKey({ name: "sandbox_events_pkey", columns: [t.sandboxId, t.seq] })]);
+}, (t) => [primaryKey({ name: "environment_events_pkey", columns: [t.environmentId, t.seq] })]);
 /** Each session's log head: the next seq and the basin generation its events go to. */
 export const sessionLogHeads = nylorunStreams.table("session_log_heads", {
     sessionId: textC().primaryKey(),