@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/store/postgres/schema.js

@@ -69,14 +69,14 @@ export const sessions = nylorun.table("sessions", {
     ownerExpiresAt: timestamp({ withTimezone: true, mode: "date" }),
     /** The session owner (`ownerUserId`), not the lease column `owner`. */
     ownerUserId: field("->>'ownerUserId'"),
-    /** The sandbox resource the session is attached to (`sandbox: { id }`). */
-    sandboxId: field("->>'sandboxId'"),
+    /** The Environment the session names (`environment`, protocol 11). */
+    environmentId: field("->>'environmentId'"),
 }, (t) => [
     index("sessions_created").on(t.createdAt.desc().nullsLast(), t.id.desc().nullsFirst()),
     index("sessions_status").on(t.status, t.ownerExpiresAt),
     index("sessions_agent").on(t.agentId),
     index("sessions_owner_user").on(t.ownerUserId),
-    index("sessions_sandbox").on(t.sandboxId),
+    index("sessions_environment").on(t.environmentId),
 ]);
 export const commands = documents("commands");
 export const effects = nylorun.table("effects", {
@@ -107,22 +107,126 @@ export const principals = nylorun.table("principals", {
     idempotencyKey: text(),
     createdAt: text().notNull(),
 });
+/**
+ * An Environment (D55, protocol 11): its id, kind, labels, the recipe the app asked for and the
+ * recipe its compute runs (`applied`, copied from `recipe` when a stopped pod is asked to run),
+ * the owner guard, and when it was last used. Kind `pod` adds the pod's lifecycle columns.
+ * Sessions name it by id (the session body's `environmentId`). Not the `sandboxes` document
+ * table, which holds the virtual backend's compute records, keyed by workspace key.
+ */
+export const environments = nylorun.table("environments", {
+    id: textC().primaryKey(),
+    kind: text({ enum: ["virtual", "pod", "none"] }).notNull(),
+    /** `{ key: value }`, filtered through `nylorun.doc(labels)`. */
+    labels: jsonText().notNull(),
+    /** What the app asked for (`EnvironmentRecipe`), resolved against the Tenant's limits. */
+    recipe: jsonText().notNull(),
+    /** The recipe the current pod or workspace runs. */
+    applied: jsonText().notNull(),
+    version: integer().notNull().default(1),
+    appliedVersion: integer().notNull().default(1),
+    /** The owner guard: only this owner's sessions may name the Environment. */
+    ownerUserId: text(),
+    /** A turn's end, a recipe change, a secret write, a stop or a reset (`lifecycle.deleteAfter`). */
+    lastUsedAt: timestamp({ withTimezone: true, mode: "string" }).notNull().defaultNow(),
+    createdAt: textC().notNull(),
+    updatedAt: textC().notNull(),
+    // Kind `pod` (F7.2, D34): null otherwise. `tenant/environments.ts` and the `Sandbox`
+    // object's reconcile (`sandbox/pods/reconcile.ts`) are the only writers.
+    /** The agent-sandbox Sandbox's name, `sbx-<16 base32>-g<volume_gen>` (`podName`). */
+    k8sName: textC(),
+    /** Bumped by every reset: a new Sandbox on a new volume. */
+    volumeGen: integer().notNull().default(0),
+    /** `running`, `suspended` or `deleted`. */
+    desired: text({ enum: ["running", "suspended", "deleted"] }),
+    /** `creating`, `running`, `suspended`, `lost`, `failed` or `deleting`. */
+    observed: text({ enum: ["creating", "running", "suspended", "lost", "failed", "deleting"] }),
+    /** The UID of the pod that last joined. */
+    podUid: text(),
+    /**
+     * Bumped by every join (`host.join`), relaunch, loss and reset: host and egress tokens carry
+     * it (`epc`), and one of an older epoch is refused (egress-gate reads it too).
+     */
+    hostEpoch: integer().notNull().default(0),
+    /** sha256 (hex) of the incarnation's join token; the token itself is never stored. */
+    joinTokenHash: text(),
+    /** Bumped by every change the Runtime asks of the pod: the sandboxes service's `opId`. */
+    rev: integer().notNull().default(0),
+    /** When a turn last ended on it, for the idle timer. */
+    lastActiveAt: timestamp({ withTimezone: true }),
+    /** When the current incarnation was asked to run, for the ready deadline. */
+    startedAt: timestamp({ withTimezone: true }),
+    /** Why it failed or was lost. */
+    reason: text(),
+    /** An earlier incarnation's Sandbox still to delete (after a reset or a loss). */
+    retiring: textC(),
+    /**
+     * The id the engine keeps on the volume (`/harness/volume-id`), recorded at the first join:
+     * a join with another one means the volume was replaced (its files are gone), so `lost`.
+     */
+    volumeId: text(),
+    /** The workload image by digest, from the first ready pod on (Q14): later pods run it. */
+    imageDigest: textC(),
+    /**
+     * The disk lease (R2d step 3): `{ kind, version?, startedAt, until }` while a snapshot, a
+     * restore or a seed copies the disk; turns are refused until it ends or `until` passes.
+     */
+    diskOp: jsonText(),
+    /**
+     * The disk version the next volume starts from: `{ artifactId, version }` (R2d step 3). A
+     * fork onto other setup adds `setup: true` (Q17): once the version is written (`written`),
+     * the seed stays until the engine reports the setup done, and turns wait for both.
+     */
+    diskSeed: jsonText(),
+    /**
+     * The environment manifest it was made from and its version (D63): null for an Environment
+     * made from an inline manifest. Never changed after creation.
+     */
+    manifestName: textC(),
+    manifestVersion: integer(),
+    /** The hash of what it runs (`recipe`), from creation on. */
+    manifestHash: textC(),
+    /** The Environment it was forked from: `{ environment, disk }` (Q15). Never changed. */
+    forkedFrom: jsonText(),
+}, (t) => [
+    check("environments_kind_check", sql `${t.kind} IN ('virtual', 'pod', 'none')`),
+    index("environments_manifest").on(t.manifestName, t.manifestVersion),
+]);
+/**
+ * An environment manifest's versions (D63): a named, versioned definition of a kind of
+ * Environment, saved like an agent. A version is written once and never changed; a save whose
+ * body hashes the same as the latest writes nothing.
+ */
+export const environmentManifests = nylorun.table("environment_manifests", {
+    name: textC().notNull(),
+    version: integer().notNull(),
+    /** The manifest (`EnvironmentManifest`) as saved. */
+    body: jsonText().notNull(),
+    hash: textC().notNull(),
+    /** `{ actor }`: the subject the save acted for, else `application`. */
+    savedBy: jsonText().notNull(),
+    createdAt: textC().notNull(),
+}, (t) => [primaryKey({ name: "environment_manifests_pkey", columns: [t.name, t.version] })]);
+/**
+ * A vault (D56): the host model's (`id = 'host'`), or one Environment's, created and deleted with
+ * it (`environment_id`, unique, deleted with the Environment's row). No other vault exists.
+ */
 export const vaults = nylorun.table("vaults", {
     id: textC().primaryKey(),
     name: text().notNull(),
-    ownerUserId: text().notNull(),
     /** JSON text, or null. */
     metadataJson: text(),
     createdAt: textC().notNull(),
-    /**
-     * `user`: one person's (owner `ownerUserId`); `installation`: the installation's own,
-     * attachable to any session (owner `installation`); `host`: the model vault, never attached.
-     */
-    scope: text({ enum: ["user", "installation", "host"] }).notNull().default("user"),
+    /** The Environment the vault belongs to; null only for the host vault. */
+    environmentId: textC(),
 }, (t) => [
-    index("vaults_owner").on(t.ownerUserId, t.createdAt, t.id),
-    uniqueIndex("vaults_one_host").on(t.scope).where(sql `scope = 'host'`),
-    check("vaults_scope_check", sql `scope IN ('user', 'installation', 'host')`),
+    uniqueIndex("vaults_environment").on(t.environmentId),
+    foreignKey({
+        name: "vaults_environment_id_fkey",
+        columns: [t.environmentId],
+        foreignColumns: [environments.id],
+    }).onDelete("cascade"),
+    check("vaults_owner_check", sql `(${t.id} = 'host') = (${t.environmentId} IS NULL)`),
 ]);
 /** A credential of a vault: its binding in the clear, its secret sealed. */
 export const vaultCredentials = nylorun.table("vault_credentials", {
@@ -146,6 +250,7 @@ export const vaultCredentials = nylorun.table("vault_credentials", {
         foreignColumns: [vaults.id],
     }).onDelete("cascade"),
     index("vault_credentials_vault").on(t.vaultId, t.createdAt, t.id),
+    uniqueIndex("vault_credentials_name").on(t.vaultId, t.name),
 ]);
 export const vaultAudit = nylorun.table("vault_audit", {
     ord: bigint({ mode: "number" }).primaryKey().generatedAlwaysAsIdentity(),
@@ -198,7 +303,9 @@ export const signingKeys = nylorun.table("signing_keys", {
  * The model usage ledger (P1.3): one row per model call a gate served, written after the call.
  * A second row for the same effect (a call the gate ran again after a gateway restart) is
  * flagged `duplicate`; both were billed. Budgets read their spend from it. Token counts are 0
- * when the provider sent none.
+ * when the provider sent none. `startedAt`, `endedAt` and `firstTokenMs` are the gate's own
+ * timing of the call (R7.1, migration 0022); null on rows written before, and `firstTokenMs`
+ * when the provider streamed nothing.
  */
 export const modelUsage = nylorun.table("model_usage", {
     id: textC().primaryKey(),
@@ -222,6 +329,12 @@ export const modelUsage = nylorun.table("model_usage", {
     /** True when an earlier row has the same `effectKey`: the provider billed the call twice. */
     duplicate: boolean().notNull(),
     createdAt: text().notNull(),
+    /** When the gate sent the call to the provider. */
+    startedAt: text(),
+    /** When the provider's answer was complete. */
+    endedAt: text(),
+    /** From `startedAt` to the provider's first stream event. */
+    firstTokenMs: integer(),
 }, (t) => [
     index("model_usage_session").on(t.sessionId, t.createdAt, t.id),
     index("model_usage_export").on(t.txid, t.id),
@@ -260,60 +373,6 @@ export const toolCrossings = nylorun.table("tool_crossings", {
     /** The gate's answer (`McpAnswer`), once the call ended; null while it runs or once lost. */
     answer: jsonText(),
 }, (t) => [index("tool_crossings_settled").on(t.settledAt)]);
-/**
- * A sandbox resource (blueprint D39, F7.1): its id, kind, the spec resolved against the
- * Tenant's limits when it was created, and the developer's labels. Sessions attach to it by id
- * (the session body's `sandboxId`). Not the `sandboxes` document table, which holds the virtual
- * backend's compute records, keyed by workspace key.
- */
-export const sandboxResources = nylorun.table("sandbox_resources", {
-    id: textC().primaryKey(),
-    kind: text({ enum: ["virtual", "pod"] }).notNull(),
-    /** The resolved `SandboxManifest`. */
-    spec: jsonText().notNull(),
-    /** `{ key: value }`, filtered through `nylorun.doc(labels)`. */
-    labels: jsonText().notNull(),
-    createdAt: textC().notNull(),
-    updatedAt: textC().notNull(),
-    // Kind `pod` (F7.2, D34): null for a virtual sandbox. `tenant/sandboxes.ts` and the
-    // `Sandbox` object's reconcile (`sandbox/pods/reconcile.ts`) are the only writers.
-    /** The agent-sandbox Sandbox's name, `sbx-<16 base32>-g<volume_gen>` (`podName`). */
-    k8sName: textC(),
-    /** Bumped by every reset: a new Sandbox on a new volume. */
-    volumeGen: integer().notNull().default(0),
-    /** `running`, `suspended` or `deleted`. */
-    desired: text({ enum: ["running", "suspended", "deleted"] }),
-    /** `creating`, `running`, `suspended`, `expired`, `lost`, `failed` or `deleting`. */
-    observed: text({
-        enum: ["creating", "running", "suspended", "expired", "lost", "failed", "deleting"],
-    }),
-    /** The UID of the pod that last joined. */
-    podUid: text(),
-    /**
-     * Bumped by every join (`host.join`), relaunch, loss and reset: host and egress tokens carry
-     * it (`epc`), and one of an older epoch is refused (egress-gate reads it too).
-     */
-    hostEpoch: integer().notNull().default(0),
-    /** sha256 (hex) of the incarnation's join token; the token itself is never stored. */
-    joinTokenHash: text(),
-    /** Bumped by every change the Runtime asks of the pod: the sandboxes service's `opId`. */
-    rev: integer().notNull().default(0),
-    /** When a turn last ended on it, for the idle timer. */
-    lastActiveAt: timestamp({ withTimezone: true }),
-    /** When its TTL passes (`createdAt + lifecycle.ttl`). */
-    expiresAt: timestamp({ withTimezone: true }),
-    /** When the current incarnation was asked to run, for the ready deadline. */
-    startedAt: timestamp({ withTimezone: true }),
-    /** Why it failed or was lost. */
-    reason: text(),
-    /** An earlier incarnation's Sandbox still to delete (after a reset or a loss). */
-    retiring: textC(),
-    /**
-     * The id the engine keeps on the volume (`/harness/volume-id`), recorded at the first join:
-     * a join with another one means the volume was replaced (its files are gone), so `lost`.
-     */
-    volumeId: text(),
-});
 /**
  * Artifacts (blueprint D35, F8.1 and F8.2): an id, a name and numbered versions. The bytes are in
  * the Object store under each version's `blobKey` (a folder's: its manifest); a blob counts only
@@ -331,8 +390,12 @@ export const artifacts = nylorun.table("artifacts", {
     labelsJson: text(),
     createdAt: textC().notNull(),
     updatedAt: text().notNull(),
+    /** The Environment whose disk versions this folder holds (R2d step 3); one per Environment. */
+    environmentId: textC(),
 }, (t) => [
     index("artifacts_session").on(t.sessionId, t.createdAt, t.id),
+    uniqueIndex("artifacts_environment_disk").on(t.environmentId).where(sql `environment_id IS NOT NULL`),
+    index("artifacts_creation_order").on(t.createdAt, t.id),
     check("artifacts_kind_check", sql `kind IN ('file', 'folder')`),
 ]);
 /** The versions of an artifact, immutable once written. */
@@ -344,7 +407,7 @@ export const artifactVersions = nylorun.table("artifact_versions", {
     size: bigint({ mode: "number" }).notNull(),
     sha256: text().notNull(),
     contentType: text().notNull(),
-    source: text({ enum: ["upload", "engine", "export"] }).notNull(),
+    source: text({ enum: ["upload", "engine", "export", "snapshot"] }).notNull(),
     createdAt: textC().notNull(),
 }, (t) => [
     primaryKey({ name: "artifact_versions_pkey", columns: [t.artifactId, t.version] }),
@@ -471,16 +534,16 @@ export const sandboxSignals = nylorun.table("sandbox_signals", {
 // ---------------------------------------------------------------------------
 // nylorun_streams: the record
 /**
- * Each sandbox's lifecycle stream (`nylorun.sandbox-event/1`), numbered from 0 per sandbox id.
- * Written only by the record module; not published to the stream relay.
+ * Each Environment's lifecycle stream (`nylorun.environment-event/1`), numbered from 0 per
+ * Environment id. Written only by the record module; not published to the stream relay.
  */
-export const sandboxEvents = nylorunStreams.table("sandbox_events", {
-    sandboxId: textC().notNull(),
+export const environmentEvents = nylorunStreams.table("environment_events", {
+    environmentId: textC().notNull(),
     seq: bigint({ mode: "number" }).notNull(),
     type: text().notNull(),
     body: jsonText().notNull(),
     committedAt: timestamp({ withTimezone: true, mode: "string" }).notNull().defaultNow(),
-}, (t) => [primaryKey({ name: "sandbox_events_pkey", columns: [t.sandboxId, t.seq] })]);
+}, (t) => [primaryKey({ name: "environment_events_pkey", columns: [t.environmentId, t.seq] })]);
 /** Each session's log head: the next seq and the basin generation its events go to. */
 export const sessionLogHeads = nylorunStreams.table("session_log_heads", {
     sessionId: textC().primaryKey(),