@nylorun/runtime 0.25.0-beta → 0.27.0-beta

package/dist/tenant/runtime.js

@@ -1,9 +1,9 @@
 import { mkdirSync } from "node:fs";
-import { resolveFlowLimits } from "../core/limits.js";
 import { scriptedModel, toolFixtureModel, } from "../core/provider.js";
 import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
 import { VaultService } from "../vault/service.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
@@ -20,7 +20,8 @@ import { advance } from "./advance.js";
 import { sweep } from "./sweep.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
-import { inProcessToolGate } from "../gates/tool-gate.js";
+import { inProcessToolGate, openMcpThrough } from "../gates/tool-gate.js";
+import { providerModelGate } from "../gates/provider-gate.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 import { createFsBlobStore } from "../blob/index.js";
@@ -31,24 +32,16 @@ import { localWorkspace, remoteWorkspace, withPodWorkspaces, } from "../harness-
 import { hostAuthority } from "../sandbox/join.js";
 import { harnessOfToken } from "./harness-tokens.js";
 import { reconcileSandbox } from "../sandbox/pods/reconcile.js";
-import { sandboxWorkspaceReader } from "../artifacts/workspace.js";
-import { readDefinitionFile } from "./definition-files.js";
-/** Default ownership lease of an advance; the heartbeat renews it every third. */
-const DEFAULT_OWNER_LEASE_MS = 30_000;
+import { hostTuning } from "../tuning.js";
 function validateConfig(config) {
     for (const key of ["leaseMs", "ownerLeaseMs", "sweepIntervalMs"]) {
         const value = config[key];
         if (value !== undefined && (!Number.isFinite(value) || value <= 0))
             throw new Error(`${key} must be finite and positive`);
     }
-    const flowLimits = resolveFlowLimits({
-        flow: config.flow,
-        env: config.flowEnv,
-    });
     if ((config.model.kind === "fixture" || config.model.kind === "scripted") &&
         config.mode === "shared")
         throw new Error("fixture/scripted models require ephemeral or test mode");
-    return flowLimits;
 }
 export class TenantRuntime {
     ctx;
@@ -81,7 +74,7 @@ export class TenantRuntime {
     }
     static async open(config, hooks) {
         const envelope = hooks.envelope;
-        const flowLimits = validateConfig(config);
+        validateConfig(config);
         const paths = config.paths;
         mkdirSync(paths.root, { recursive: true });
         mkdirSync(paths.home, { recursive: true });
@@ -128,6 +121,7 @@ export class TenantRuntime {
                 inProcessToolGate(config.delivery ?? {}, {
                     session: (sessionId) => opened.tx((t) => t.get("sessions", sessionId)),
                     authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                    limits: () => opened.tx((t) => readRuntimeLimits(t)),
                     logger: config.logger,
                 });
             const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
@@ -144,13 +138,9 @@ export class TenantRuntime {
             const preference = seededBackend ?? config.sandbox.backend;
             // With a harness in this process, the Tenant's MCP pool and SandboxManager are its
             // executors; otherwise the harness holds both (F6.2).
-            const mcp = inProcess
-                ? new McpPool({
-                    authorize: (sessionId, request) => authorize(ctx, sessionId, request),
-                    policy: config.delivery ?? {},
-                    ...(toolGate.openMcp ? { openRemote: (server) => toolGate.openMcp(server) } : {}),
-                })
-                : undefined;
+            // The pool opens every server through the Tool Gate: core never authorizes an MCP
+            // connection outside a gate (protocol 15).
+            const mcp = inProcess ? new McpPool({ openRemote: openMcpThrough(toolGate) }) : undefined;
             const ephemeral = config.mode === "ephemeral";
             const manager = inProcess
                 ? new SandboxManager({
@@ -160,12 +150,6 @@ export class TenantRuntime {
                         defaultSandboxBackends({ root: paths.sandboxes }),
                     preference,
                     ephemeral,
-                    definitionFile: async (sha256) => {
-                        const bytes = await readDefinitionFile(blobs, sha256);
-                        if (!bytes)
-                            throw new Error(`The Object store has no bytes for ${sha256}`);
-                        return bytes;
-                    },
                     emit: async (sessionId, turnId, type, payload) => {
                         if (ctx.closed)
                             return;
@@ -201,9 +185,13 @@ export class TenantRuntime {
                     isPod: async (sandboxId) => (await opened.tx((t) => t.environment(sandboxId)))?.kind === "pod",
                 })
                 : workspaces;
-            const useVaultModel = config.model.kind === "vault";
+            // A model that is not the vault's (scripted, the fixture, an embedder's provider) is
+            // served by a gate over it, metered like any (protocol 15): no harness calls a provider.
+            const scripted = config.model.kind !== "vault";
             let modelProvider;
-            if (hooks.modelProvider)
+            if (!scripted)
+                modelProvider = undefined;
+            else if (hooks.modelProvider)
                 modelProvider = hooks.modelProvider;
             else if (config.model.kind === "scripted")
                 modelProvider = scriptedModel(config.model.output);
@@ -214,21 +202,23 @@ export class TenantRuntime {
             const blobs = hooks.blobs ?? createFsBlobStore({ root: paths.blobs });
             // With the gates service the loop never reads a model credential: only a Runtime
             // without one (embedding, the ephemeral Runtime, tests) reads it here.
-            const modelGate = hooks.modelGate ??
-                tenantModelGate({
-                    store: opened,
-                    kek: ensureKek,
-                    root: paths.home,
-                    logger: config.logger,
-                    blobs,
-                    ...(config.modelCall ? { settings: config.modelCall } : {}),
-                });
+            const modelGate = modelProvider
+                ? providerModelGate(modelProvider, { store: opened, logger: config.logger })
+                : (hooks.modelGate ??
+                    tenantModelGate({
+                        store: opened,
+                        kek: ensureKek,
+                        root: paths.home,
+                        logger: config.logger,
+                        blobs,
+                    }));
             const sessionStreams = createSessionStreams();
             const workers = hooks.execution?.workers ?? new TenantWorkers();
             const local = hooks.execution
                 ? undefined
                 : new MemoryExecution({
-                    sweepIntervalMs: config.sweepIntervalMs ?? Math.min(config.leaseMs ?? 30_000, 5000),
+                    sweepIntervalMs: config.sweepIntervalMs ??
+                        Math.min(config.leaseMs ?? Infinity, hostTuning().sweep.intervalMs),
                     // Close's `detach` step waits no longer for running work than for its advances.
                     stopGraceMs: workers.graceMs,
                     onError: (error) => config.logger.error("tenant execution failed", {
@@ -245,9 +235,7 @@ export class TenantRuntime {
                 vault,
                 ...(mcp ? { mcp } : {}),
                 sandbox,
-                flowLimits,
-                modelProvider,
-                useVaultModel,
+                scriptedModel: scripted,
                 modelGate,
                 toolGate,
                 get harness() {
@@ -260,11 +248,10 @@ export class TenantRuntime {
                 signingKeys,
                 keys,
                 blobs,
-                workspaces: sandboxWorkspaceReader(sandbox),
                 ...(hooks.traces ? { traces: hooks.traces } : {}),
                 ...(hooks.runGrants ? { runGrants: hooks.runGrants } : {}),
                 workerId: hooks.workerId ?? WORKER_ID,
-                ownerLeaseMs: config.ownerLeaseMs ?? DEFAULT_OWNER_LEASE_MS,
+                ownerLeaseMs: config.ownerLeaseMs ?? hostTuning().tenant.ownerLeaseMs,
                 wake: async (sessionId, wake) => {
                     if (ctx.closing || ctx.closed)
                         return false;
@@ -372,7 +359,7 @@ export class TenantRuntime {
             harness: harnessStatusOf(this.ctx),
         };
     }
-    drain(activeWork, timeoutMs = 30_000) {
+    drain(activeWork, timeoutMs = hostTuning().tenant.drainTimeoutMs) {
         return drain(this.ctx, activeWork, timeoutMs);
     }
     /**

package/dist/tenant/session-streams.js

@@ -21,6 +21,7 @@
 import { historyCursor, historyResume } from "../reads/cursor.js";
 import { decodeCursor, encodeCursor } from "../record/index.js";
 import { sleep } from "../retry.js";
+import { hostTuning } from "../tuning.js";
 import { basinOf } from "../streams/basin.js";
 import { sessionStream, } from "../streams/types.js";
 import { fail } from "./http.js";
@@ -33,8 +34,6 @@ export function streamHolderOf(scope) {
 export function createSessionStreams() {
     return { wiring: undefined, generation: 0, sessions: new Map() };
 }
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
 function frame(event) {
     return `id: ${event.cursor}\nevent: ${event.type}\ndata: ${JSON.stringify(event)}\n\n`;
 }
@@ -66,7 +65,7 @@ export function openSse(request, response, onClose) {
         "x-accel-buffering": "no",
     });
     response.flushHeaders();
-    const timer = setInterval(() => send(response, ": keepalive\n\n"), 15000);
+    const timer = setInterval(() => send(response, ": keepalive\n\n"), hostTuning().api.eventStreamKeepaliveMs);
     timer.unref();
     request.on("close", () => {
         clearInterval(timer);
@@ -313,7 +312,9 @@ function runFeed(ctx, feed) {
     const read = feed.read;
     const signal = read.signal;
     void (async () => {
-        let delay = RETRY_MIN_MS;
+        // A failed read is retried after `streams.retry` (Host tuning), doubling.
+        const { minMs: retryMinMs, maxMs: retryMaxMs } = hostTuning().streams.retry;
+        let delay = retryMinMs;
         while (!signal.aborted) {
             const streams = ctx.sessionStreams.wiring?.streams;
             if (!streams)
@@ -326,7 +327,7 @@ function runFeed(ctx, feed) {
                     if (record.seq < feed.next)
                         continue;
                     feed.next = record.seq + 1;
-                    delay = RETRY_MIN_MS;
+                    delay = retryMinMs;
                     for (const observer of feed.observers)
                         deliver(observer, record);
                 }
@@ -345,7 +346,7 @@ function runFeed(ctx, feed) {
             if (!(await stillCurrent(ctx, feed)))
                 break;
             await sleep(delay, signal);
-            delay = Math.min(delay * 2, RETRY_MAX_MS);
+            delay = Math.min(delay * 2, retryMaxMs);
         }
         if (signal.aborted || feed.read !== read)
             return;

package/dist/tenant/session.d.ts

@@ -9,7 +9,7 @@
 import type { AgentManifest } from "@nylorun/core/define";
 import type { TurnManifestStore } from "../core/turn-manifest.js";
 import type { Session } from "./context.js";
-export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
+export { manifestFor } from "../mcp/snapshot.js";
 /** Turn-manifest store backed by the session's `variants` map (no schema change). */
 export declare function variantStore(session: Session): TurnManifestStore;
 /** Manifest this turn's checkpoint is pinned to (session pin or a stored variant). */

package/dist/tenant/session.js

@@ -1,4 +1,4 @@
-export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
+export { manifestFor } from "../mcp/snapshot.js";
 /** Turn-manifest store backed by the session's `variants` map (no schema change). */
 export function variantStore(session) {
     return {

package/dist/tenant/sessions.js

@@ -9,14 +9,17 @@ import { approvalRefusal, codeToolRefusal } from "@nylorun/core/define";
 import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
 import { sandboxSpecOf } from "../sandbox/resolve.js";
-import { withRuntimeTools, withSandbox } from "../sandbox/session-sandbox.js";
-import { authoredRuntimeBlocks, declaredSandboxes } from "../sandbox/share.js";
+import { declaredSandboxes } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
 import { HARNESS_ID, checkPlacement, requirePods } from "../sandbox/placement.js";
 import { openEnvironment, recordAttachment } from "./environments.js";
 import { harnessOf, } from "./context.js";
 import { fail } from "./http.js";
-import { missingDefinitionFiles } from "./definition-files.js";
+import { definitionFileIssues } from "./definition-files.js";
+import { limitsInForce, readSkillLimits, readTenantLimits } from "./limits.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+import { httpToolTimeoutIssues } from "../gates/http-tool.js";
+import { requiresIssues } from "./limits.js";
 /** A session's creation identity: everything but the request id. */
 const sessionIdentity = (value) => {
     const { requestId: _requestId, ...body } = value ?? {};
@@ -66,18 +69,25 @@ export async function putDefinition(ctx, agentId, body, options = {}) {
     const declared = declaredSandboxes(body.manifest);
     if (declared.length > 0)
         fail(400, `${declared.join(", ")} declares a sandbox. Agents no longer declare one: remove .sandbox(), create an Environment with the sandbox (PUT /v1/environments/{id}) and open the session on it, createSession({ environment }). See MIGRATION.md.`);
-    const runtime = authoredRuntimeBlocks(body.manifest);
-    if (runtime.length > 0)
-        fail(400, `${runtime.join(", ")} sets runtime, which only the Runtime writes when it pins a session's agent. Remove it and register the manifest your builder makes.`);
     const definition = {
         ...body,
         manifestHash: hashManifest(body.manifest),
     };
     const files = [...definitionFilesOf(body.manifest)];
     await ctx.store.tx(async (t) => {
-        const missing = await missingDefinitionFiles(t, body.manifest);
+        const limits = await readRuntimeLimits(t);
+        const issues = [
+            ...httpToolTimeoutIssues(body.manifest, limits.httpToolTimeoutMs),
+            ...requiresIssues(body.manifest.requires, limits),
+        ];
+        if (issues.length > 0)
+            fail(400, issues.join(" "));
+        const { totalBytes } = await readSkillLimits(t);
+        const { missing, oversized } = await definitionFileIssues(t, body.manifest, totalBytes);
         if (missing.length > 0)
             fail(400, `The definition names ${missing.length} file(s) the Runtime does not hold; upload each with PUT /v1/files/<sha256> first: ${missing.join(", ")}`, { code: "definition_files_missing", details: { missing } });
+        if (oversized.length > 0)
+            fail(413, `This Tenant allows a skill's files at most ${totalBytes} bytes together: ${oversized.map((skill) => `'${skill.name}' holds ${skill.bytes}`).join(", ")}`, { code: "limit_exceeded", details: { limitBytes: totalBytes, skills: oversized } });
         if (options.dryRun)
             return;
         await t.put("definitions", agentId, definition);
@@ -158,6 +168,8 @@ export async function putSession(ctx, id, body, access, options = {}) {
             });
         if (!isWorkflowManifest(definition.manifest))
             await checkRequirements(t, definition.manifest, environment);
+        if (environment !== undefined)
+            await checkSkillLimit(t, definition.manifest, environment);
         const config = await readSandboxConfig(t);
         // The harness the session runs for its life (R4.1): its Environment's, else ours. A flow
         // runs in core and our engine, whatever its Environment names.
@@ -171,13 +183,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         const spec = environment === undefined || environment.kind === "none"
             ? undefined
             : sandboxSpecOf(environment.applied, effectiveSandboxConfig(config).limits.idle);
-        const pinned = spec === undefined ? runtimeTools(definition) : pin(definition, spec);
+        // The session pins its definition as registered (protocol 15): the sandbox's spec stays on
+        // the session, and the harness words the facts and defines the tools.
         const created = {
             id,
             agentId: body.agentId,
             ownerUserId: body.ownerUserId,
-            manifest: pinned.manifest ?? definition.manifest,
-            manifestHash: pinned.manifestHash ?? definition.manifestHash,
+            manifest: definition.manifest,
+            manifestHash: definition.manifestHash,
             definitionHash: definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             info: body.info,
@@ -224,26 +237,16 @@ async function checkRequirements(t, manifest, environment) {
     fail(409, `Agent ${manifest.id} requires ${missing.map((gap) => (gap.startsWith("secret:") ? `the secret ${gap.slice(7)}` : gap === "pod" ? "a pod Environment" : "a sandbox")).join(", ")}, and ${where}.`, { code: "environment_unsuitable", details: { missing } });
 }
 /**
- * The manifest a session without a sandbox pins: each agent's `runtime` block, with
- * `read_artifact` (R2b C11) and its skill tools; nothing for a workflow.
+ * Refuses a session whose agent carries a skill larger than its Environment allows: its
+ * manifest's `limits.skills.totalBytes`, else the Tenant's, never above the Tenant's.
+ * `409 environment_unsuitable`, with each skill and its size in `details.skills`.
  */
-function runtimeTools(definition) {
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const pinned = withRuntimeTools(definition.manifest);
-    if (!pinned.ok)
-        return fail(400, pinned.message);
-    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
-}
-/** The manifest a session with a sandbox pins: the definition with the sandbox in its `runtime` block. */
-function pin(definition, spec) {
-    // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const sandboxed = withSandbox(definition.manifest, spec);
-    if (!sandboxed.ok)
-        return fail(400, sandboxed.message);
-    return { manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
+async function checkSkillLimit(t, manifest, environment) {
+    const limitBytes = limitsInForce(await readTenantLimits(t), environment.applied.limits).skills.totalBytes;
+    const { oversized } = await definitionFileIssues(t, manifest, limitBytes);
+    if (oversized.length === 0)
+        return;
+    fail(409, `Environment ${environment.id} allows a skill's files at most ${limitBytes} bytes together, and agent ${manifest.id} carries ${oversized.map((skill) => `'${skill.name}' (${skill.bytes})`).join(", ")}.`, { code: "environment_unsuitable", details: { limitBytes, skills: oversized } });
 }
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export async function sessionView(t, s) {

package/dist/tenant/signing-keys.d.ts

@@ -48,7 +48,7 @@ export declare class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;

package/dist/tenant/signing-keys.js

@@ -15,12 +15,10 @@
  */
 import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
 import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
-import { TOKEN_TTL_MAX_SECONDS } from "@nylorun/core/contracts";
 import { decryptSecret, encryptSecret } from "../vault/crypto.js";
 import { fail } from "./http.js";
+import { hostTuning } from "../tuning.js";
 const ALG = "ES256";
-/** Grace added to the longest token lifetime before a previous key may be revoked. */
-const ROTATION_GRACE_MS = 60_000;
 export class SigningKeys {
     options;
     publicKeys = new Map();
@@ -107,7 +105,7 @@ export class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     async rotate(t, kek, maxTtlSeconds, force) {
@@ -118,8 +116,9 @@ export class SigningKeys {
         const [previous] = await t.signingKeys(["previous"]);
         if (previous && !force) {
             const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
-            const longest = Math.max(maxTtlSeconds, TOKEN_TTL_MAX_SECONDS);
-            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            const longest = Math.max(maxTtlSeconds, hostTuning().keys.tokenTtlMaxSeconds);
+            // The grace added to the longest token lifetime before a previous key may be revoked.
+            const until = retired + longest * 1000 + hostTuning().tenant.signingKeyRotationGraceMs;
             if (until > now.getTime())
                 fail(409, "The previous key may still verify live tokens", {
                     code: "request_rejected",

package/dist/tenant/status.js

@@ -1,11 +1,10 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
 import { ENVIRONMENTS_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
+import { hostTuning } from "../tuning.js";
 /** The Tenant's harnesses, for its status and the Host's. */
 export function harnessStatusOf(ctx) {
     return { mode: ctx.mcp ? "in-process" : "remote", ...ctx.harness.status() };
 }
-/** How long status waits for the execution to list stuck invocations. */
-const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
 async function executionStatus(stuckInvocations) {
     let timer;
@@ -13,7 +12,9 @@ async function executionStatus(stuckInvocations) {
         const stuck = await Promise.race([
             stuckInvocations(),
             new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), STUCK_TIMEOUT_MS);
+                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), 
+                // How long status waits for the execution to list stuck invocations.
+                hostTuning().tenant.statusTimeoutMs);
             }),
         ]);
         return {

package/dist/tenant/streams.js

@@ -1,17 +1,16 @@
 import { basinOf } from "../streams/basin.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
 import { retry } from "../retry.js";
+import { hostTuning } from "../tuning.js";
 import { checkSessionStreams, currentBasin } from "./session-streams.js";
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
-/** The longest wait between two `ensureTenant` attempts while the basin is being repaired. */
-const BASIN_RETRY_MAX_MS = 5000;
-/** A repair started within this long after the last one succeeded waits for the next failure. */
-const BASIN_REPAIR_COOLDOWN_MS = 1000;
-/** How often every session stream is checked against its session (backstop for lost signals). */
-const FEED_CHECK_MS = 30_000;
-/** How long a retired basin stays for readers that have not moved yet. */
-const RETIRE_GRACE_MS = 60_000;
+/*
+ * Timings are the Host tuning's `streams` group (`tuning.ts`): `retry` for deletions and
+ * repairs, `basinRetryMaxMs` (the longest wait between two `ensureTenant` attempts while the
+ * basin is being repaired), `basinRepairCooldownMs` (a repair started within this long after the
+ * last one succeeded waits for the next failure), `feedCheckMs` (how often every session stream is
+ * checked against its session, the backstop for lost signals), `retireGraceMs` (how long a retired
+ * basin stays for readers that have not moved yet).
+ */
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
@@ -25,7 +24,7 @@ export async function wireStreams(ctx, options) {
     const { store, streams, tenantId } = options;
     const logger = ctx.config.logger;
     const stop = new AbortController();
-    const graceMs = options.retireGraceMs ?? RETIRE_GRACE_MS;
+    const graceMs = options.retireGraceMs ?? hostTuning().streams.retireGraceMs;
     // Nothing is reported once the wiring stops: the Tenant (and its log directory) may be gone,
     // and a throwing report in a detached loop would be an unhandled rejection.
     const report = (what) => (error) => {
@@ -53,7 +52,7 @@ export async function wireStreams(ctx, options) {
         });
     relay?.start();
     // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
-    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
+    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), hostTuning().streams.feedCheckMs);
     feedCheck.unref();
     const retiring = new Set();
     const timers = new Set();
@@ -94,9 +93,8 @@ export async function wireStreams(ctx, options) {
     async function deleteRetired(generation) {
         try {
             await retry(() => streams.deleteTenant(basinOf(tenantId, generation)), {
-                minMs: RETRY_MIN_MS,
-                maxMs: RETRY_MAX_MS,
-                attempts: 5,
+                ...hostTuning().streams.retry,
+                attempts: hostTuning().streams.retireAttempts,
             });
             await store.tx((t) => t.forgetRetiredGeneration(generation));
             logger.info("retired stream basin deleted", { generation });
@@ -160,7 +158,7 @@ export async function streamsStatus(ctx, options = {}) {
     const wiring = ctx.sessionStreams.wiring;
     return {
         reachable: wiring
-            ? await probe(wiring.streams, options.probeTimeoutMs ?? 2000)
+            ? await probe(wiring.streams, options.probeTimeoutMs ?? hostTuning().streams.probeTimeoutMs)
             : false,
         basin: wiring?.basin() ?? { ready: false, failures: 0, lastError: null },
         generation: ctx.sessionStreams.generation,
@@ -215,17 +213,17 @@ function basinKeeper(streams, basinKey, signal, onError) {
         repair() {
             if (repairing || signal.aborted)
                 return;
-            if (ready && readyFor === basinKey() && Date.now() - repairedAt < BASIN_REPAIR_COOLDOWN_MS)
+            if (ready && readyFor === basinKey() && Date.now() - repairedAt < hostTuning().streams.basinRepairCooldownMs)
                 return;
             repairing = true;
             ready = false;
             void (async () => {
                 await retry(ensure, {
-                    minMs: RETRY_MIN_MS,
-                    maxMs: BASIN_RETRY_MAX_MS,
+                    minMs: hostTuning().streams.retry.minMs,
+                    maxMs: hostTuning().streams.basinRetryMaxMs,
                     signal,
                     onError: (error) => {
-                        if (failures === 1 || failures % 10 === 0)
+                        if (failures === 1 || failures % hostTuning().streams.basinLogEveryFailures === 0)
                             onError(error);
                     },
                 }).then(() => (repairedAt = Date.now()), () => undefined);

package/dist/tenant/sweep.d.ts

@@ -1,32 +1,12 @@
 import type { PendingRequest } from "../store/types.js";
 import type { TenantContext } from "./context.js";
-/**
- * How old an outbox row is before the sweep delivers it, unless its delivery after commit
- * already failed (then it is due at once): longer than that delivery can take with its
- * retries, so the sweep does not send again, and double the load on, an execution that is
- * only slow. Sending one twice is harmless either way (the idempotency key).
- */
-export declare const OUTBOX_GRACE_MS = 30000;
-/**
- * How often the orphan scan, and the stale pod sandbox check, run after the first pass of a
- * Tenant opened on this process.
- */
-export declare const ORPHAN_SCAN_MS = 60000;
-/**
- * How long one pass may spend draining the outbox, and paging through orphaned sessions.
- * A backlog is worked off over several passes rather than holding one (and with it the
- * Tenant's sweep object in the execution) for long.
- */
-export declare const DRAIN_BUDGET_MS = 2000;
 export declare function sweep(ctx: TenantContext): Promise<void>;
-/** Failed deliveries after which the sweep parks an outbox row (`Tx.failOutbox`). */
-export declare const MAX_OUTBOX_ATTEMPTS = 10;
 /**
  * Deliver the outbox rows that are due (`Tx.pendingOutbox`: older than `graceMs`, or whose
  * delivery failed), oldest first, batch after batch until none is left or `budgetMs` is
  * spent, and delete the delivered ones. Each row is delivered on its own: one that fails
  * (Restate refuses it, or a Runtime that does not know a wake's reason) is tried again later,
- * with backoff, so it never holds back the rows behind it, and after `MAX_OUTBOX_ATTEMPTS`
+ * with backoff, so it never holds back the rows behind it, and after `sweep.outboxAttempts`
  * failures it is parked: logged once, at error, and kept in the outbox for an operator. A
  * parked wake's session is still re-woken by the orphan scan while it is runnable, and a
  * parked sandbox signal's pod by the stale pod check. A row the Tenant declines (it is