@nylorun/runtime 0.26.0-beta → 0.28.0-beta

package/dist/tenant/sessions.js

@@ -1,108 +1,38 @@
 /**
- * Session and definition resources: `PUT/GET /v1/agents`, `PUT /v1/sessions/:id` (create, or
- * find an identical one), the session list and the session view. Reads use the store's typed
- * queries; `PUT /v1/sessions/:id` runs in one transaction with the Environment's checks.
+ * Session resources: `PUT /v1/sessions/:id` (create, or find an identical one), the session list
+ * and the session view. A session runs on one Agent (protocol 16) and pins the manifest version
+ * the Agent runs when it opens; each turn takes the version the Agent runs then
+ * (`agent-versions.ts`). Reads use the store's typed queries; `PUT /v1/sessions/:id` runs in
+ * one transaction with the Agent's checks.
  */
-import { DefinitionDocumentSchema, definitionFilesOf, } from "@nylorun/core/contracts";
-import { hashManifest } from "@nylorun/core/compatibility";
-import { approvalRefusal, codeToolRefusal } from "@nylorun/core/define";
+import {} from "@nylorun/core/contracts";
 import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
-import { sandboxSpecOf } from "../sandbox/resolve.js";
-import { withRuntimeTools, withSandbox } from "../sandbox/session-sandbox.js";
-import { authoredRuntimeBlocks, declaredSandboxes } from "../sandbox/share.js";
-import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
-import { HARNESS_ID, checkPlacement, requirePods } from "../sandbox/placement.js";
-import { openEnvironment, recordAttachment } from "./environments.js";
-import { harnessOf, } from "./context.js";
+import { readSandboxConfig } from "../sandbox/tenant-config.js";
+import { checkPlacement, requirePods } from "../sandbox/placement.js";
+import { pinOf } from "./agent-versions.js";
+import { openAgent, recordAttachment } from "./agents.js";
+import { harnessOf, reachesAgent, } from "./context.js";
 import { fail } from "./http.js";
-import { missingDefinitionFiles } from "./definition-files.js";
+import { definitionFileIssues } from "./definition-files.js";
+import { limitsInForce, readTenantLimits } from "./limits.js";
 /** A session's creation identity: everything but the request id. */
 const sessionIdentity = (value) => {
     const { requestId: _requestId, ...body } = value ?? {};
     return canonical(body);
 };
-export async function listDefinitions(ctx) {
-    const definitions = await ctx.store.tx((t) => t.listDefinitions());
-    return {
-        agents: definitions.map((d) => ({
-            agentId: d.manifest.id,
-            manifest: d.manifest,
-            manifestHash: d.manifestHash,
-            implementationVersion: d.implementationVersion,
-        })),
-    };
-}
-/**
- * The agents a token caller may see: id, name and description only, never
- * instructions, tools or MCP servers, and only the agents allowed.
- */
-export async function listAgentsPublic(ctx, agents) {
-    const definitions = await ctx.store.tx((t) => t.listDefinitions());
-    return {
-        agents: definitions
-            .filter((d) => agents === "*" || agents.has(d.manifest.id))
-            .map((d) => ({
-            agentId: d.manifest.id,
-            ...(typeof d.manifest.name === "string" ? { name: d.manifest.name } : {}),
-            ...(typeof d.manifest.description === "string"
-                ? { description: d.manifest.description }
-                : {}),
-        })),
-    };
-}
-export async function putDefinition(ctx, agentId, body, options = {}) {
-    if (body.manifest.id !== agentId)
-        fail(400, "Agent id mismatch");
-    DefinitionDocumentSchema.parse(body.manifest);
-    // The Runtime runs agents from their manifests alone (track R2): no tool may need it.
-    const code = codeToolRefusal(body.manifest);
-    if (code)
-        fail(400, code);
-    // Tool approvals are the Tenant's tool policy, decided at the Tool Gate (R5 step 2).
-    const approval = approvalRefusal(body.manifest);
-    if (approval)
-        fail(400, approval);
-    const declared = declaredSandboxes(body.manifest);
-    if (declared.length > 0)
-        fail(400, `${declared.join(", ")} declares a sandbox. Agents no longer declare one: remove .sandbox(), create an Environment with the sandbox (PUT /v1/environments/{id}) and open the session on it, createSession({ environment }). See MIGRATION.md.`);
-    const runtime = authoredRuntimeBlocks(body.manifest);
-    if (runtime.length > 0)
-        fail(400, `${runtime.join(", ")} sets runtime, which only the Runtime writes when it pins a session's agent. Remove it and register the manifest your builder makes.`);
-    const definition = {
-        ...body,
-        manifestHash: hashManifest(body.manifest),
-    };
-    const files = [...definitionFilesOf(body.manifest)];
-    await ctx.store.tx(async (t) => {
-        const missing = await missingDefinitionFiles(t, body.manifest);
-        if (missing.length > 0)
-            fail(400, `The definition names ${missing.length} file(s) the Runtime does not hold; upload each with PUT /v1/files/<sha256> first: ${missing.join(", ")}`, { code: "definition_files_missing", details: { missing } });
-        if (options.dryRun)
-            return;
-        await t.put("definitions", agentId, definition);
-        await t.insertDefinitionFileUses(agentId, definition.manifestHash, files);
-    });
-    return {
-        agentId,
-        manifestHash: definition.manifestHash,
-        implementationVersion: body.implementationVersion,
-        ...(options.dryRun ? { dryRun: true } : {}),
-    };
-}
 /**
- * `access`, when the request acts for a person, limits the list to that person's sessions of
- * the agents they may use.
+ * `access`, when the request acts for a person, limits the list to that person's sessions on
+ * the Agents they may use.
  */
 export async function listSessions(ctx, agentId, access) {
     const sessions = await ctx.store.tx((t) => t.listSessions({
         ...(agentId === null ? {} : { agentId }),
         ...(access === undefined ? {} : { ownerUserId: access.owner }),
     }));
-    const allowed = access?.agents;
     return {
         sessions: sessions
-            .filter((s) => allowed === undefined || allowed.has(s.agentId))
+            .filter((s) => reachesAgent(access, s.agentId))
             .map((s) => ({
             id: s.id,
             agentId: s.agentId,
@@ -113,137 +43,90 @@ export async function listSessions(ctx, agentId, access) {
     };
 }
 /**
- * Create a session from its definition, or find an identical one. `access`, when the request
- * acts for a subject, must be the session's owner: another owner's session id is the 404 of a
- * missing one (not the 409 of a mismatch), and so is an Environment whose owner guard names
- * another owner.
+ * Create a session on an Agent, or find an identical one. `access`, when the request acts for a
+ * subject, must be the session's owner: another owner's session id is the 404 of a missing one
+ * (not the 409 of a mismatch), and so is an Agent whose owner guard names another owner.
  *
- * The session's Environment is fixed for its life: its sandbox (kinds `virtual` and `pod`) is
- * the session's, with the spec of the Environment's applied recipe pinned now, and its vault
- * holds the session's credentials. Without one the session has no sandbox and no credentials.
+ * The session runs on its Agent for its life: the Agent's sandbox (kinds `virtual` and `pod`) is
+ * the session's, with the spec of what the Agent runs pinned now, and the Agent's vault holds the
+ * session's credentials. It pins the manifest version the Agent runs (`definition`), as the loop
+ * manifest that version's harness section makes, and the harness that section names (`pinOf`);
+ * a turn's first segment pins the version the Agent runs then (`repinTurn`).
  */
 export async function putSession(ctx, id, body, access, options = {}) {
     const opaque = access !== undefined;
     if (opaque && body.ownerUserId !== access.owner)
         fail(403, "ownerUserId must be the subject");
-    // An agent the subject may not use is the 404 of a missing definition.
-    if (access?.agents !== undefined && !access.agents.has(body.agentId))
-        fail(404, "Definition not found");
-    return ctx.store.tx(async (t) => {
-        const prior = await t.lockSession(id);
-        if (opaque &&
-            prior &&
-            (prior.ownerUserId !== access.owner ||
-                (access.agents !== undefined && !access.agents.has(prior.agentId))))
-            fail(404, "Session not found");
-        if (prior && options.createOnly) {
-            if (prior.ownerUserId !== body.ownerUserId ||
-                prior.agentId !== body.agentId)
-                fail(404, "Session not found");
-            return prior;
-        }
-        if (prior) {
-            if (sessionIdentity(prior.creation) !== sessionIdentity(body))
-                fail(409, "Session already exists with different creation parameters");
-            return prior;
-        }
-        const definition = (await t.get("definitions", body.agentId)) ??
-            fail(404, "Definition not found");
-        const environment = body.environment === undefined
-            ? undefined
-            : await openEnvironment(t, body.environment, {
-                ...(options.environmentGrants === undefined ? {} : { grants: options.environmentGrants }),
-                ownerUserId: body.ownerUserId,
-                opaque,
-            });
-        if (!isWorkflowManifest(definition.manifest))
-            await checkRequirements(t, definition.manifest, environment);
-        const config = await readSandboxConfig(t);
-        // The harness the session runs for its life (R4.1): its Environment's, else ours. A flow
-        // runs in core and our engine, whatever its Environment names.
-        const harness = isWorkflowManifest(definition.manifest) || environment === undefined
-            ? HARNESS_ID
-            : environment.applied.harness;
-        // Placement (D38, D52): where this session's harness may run, decided now and kept.
-        checkPlacement(config, environment?.kind, harness);
-        if (environment?.kind === "pod")
-            await requirePods(ctx.pods, `Environment ${environment.id}`);
-        const spec = environment === undefined || environment.kind === "none"
-            ? undefined
-            : sandboxSpecOf(environment.applied, effectiveSandboxConfig(config).limits.idle);
-        const pinned = spec === undefined ? runtimeTools(definition) : pin(definition, spec);
-        const created = {
-            id,
-            agentId: body.agentId,
-            ownerUserId: body.ownerUserId,
-            manifest: pinned.manifest ?? definition.manifest,
-            manifestHash: pinned.manifestHash ?? definition.manifestHash,
-            definitionHash: definition.manifestHash,
-            implementationVersion: definition.implementationVersion,
-            info: body.info,
-            status: "idle",
-            activeTurnId: null,
-            creation: body,
-            harness,
-            ...(environment === undefined
-                ? {}
-                : { environmentId: environment.id, environmentVersion: environment.version }),
-            ...(spec === undefined ? {} : { sandbox: spec }),
-        };
-        await t.put("sessions", id, created);
-        if (environment !== undefined)
-            await recordAttachment(t, id, environment.id);
-        return created;
-    });
+    // An Agent the subject may not use is the 404 of a missing one.
+    if (!reachesAgent(access, body.agent))
+        fail(404, "Agent not found");
+    return ctx.store.tx((t) => openSessionIn(ctx, t, id, body, access, options));
 }
 /**
- * Refuses a session whose agent requires what its Environment lacks (protocol 14, D65): a
- * sandbox (`any`: kind `virtual` or `pod`), a pod, or a secret its vault does not hold. Every
- * gap is named in one `409 environment_unsuitable`.
+ * `putSession`'s work in transaction `t`: also how a trigger's first run opens the session it
+ * names (track T4), in the run's transaction.
  */
-async function checkRequirements(t, manifest, environment) {
-    const requires = manifest.requires;
-    if (requires === undefined)
-        return;
-    const missing = [];
-    const kind = environment?.kind;
-    if (requires.sandbox === "any" && kind !== "virtual" && kind !== "pod")
-        missing.push("sandbox");
-    if (requires.sandbox === "pod" && kind !== "pod")
-        missing.push("pod");
-    if (requires.secrets?.length) {
-        const vault = environment === undefined ? undefined : await t.vaultOfEnvironment(environment.id);
-        const held = new Set(vault ? (await t.credentialsForVault(vault.id)).map((row) => row.name) : []);
-        for (const name of requires.secrets)
-            if (!held.has(name))
-                missing.push(`secret:${name}`);
+export async function openSessionIn(ctx, t, id, body, access, options = {}) {
+    const opaque = access !== undefined;
+    const prior = await t.lockSession(id);
+    if (opaque && prior && (prior.ownerUserId !== access.owner || !reachesAgent(access, prior.agentId)))
+        fail(404, "Session not found");
+    if (prior && options.createOnly) {
+        if (prior.ownerUserId !== body.ownerUserId || prior.agentId !== body.agent)
+            fail(404, "Session not found");
+        return prior;
     }
-    if (missing.length === 0)
-        return;
-    const where = environment === undefined ? "the session names no Environment" : `Environment ${environment.id} lacks it`;
-    fail(409, `Agent ${manifest.id} requires ${missing.map((gap) => (gap.startsWith("secret:") ? `the secret ${gap.slice(7)}` : gap === "pod" ? "a pod Environment" : "a sandbox")).join(", ")}, and ${where}.`, { code: "environment_unsuitable", details: { missing } });
+    if (prior) {
+        if (sessionIdentity(prior.creation) !== sessionIdentity(body))
+            fail(409, "Session already exists with different creation parameters");
+        return prior;
+    }
+    const agent = await openAgent(t, body.agent, {
+        ...(options.agentGrants === undefined ? {} : { grants: options.agentGrants }),
+        ownerUserId: body.ownerUserId,
+        opaque,
+    });
+    // The version the Agent runs, both sections (T3): its loop manifest, harness and sandbox spec.
+    const { pin } = await pinOf(t, agent);
+    await checkSkillLimit(t, pin.manifest, agent);
+    const config = await readSandboxConfig(t);
+    // Placement (D38, D52): where this session's harness may run, decided now and kept.
+    checkPlacement(config, agent.kind, pin.harness);
+    if (agent.kind === "pod")
+        await requirePods(ctx.pods, `Agent ${agent.id}`);
+    const created = {
+        id,
+        agentId: agent.id,
+        ownerUserId: body.ownerUserId,
+        manifest: pin.manifest,
+        manifestHash: pin.manifestHash,
+        definition: { ...pin.definition },
+        ...(pin.loop === undefined ? {} : { loop: pin.loop }),
+        info: body.info,
+        status: "idle",
+        activeTurnId: null,
+        creation: body,
+        harness: pin.harness,
+        environmentId: agent.id,
+        environmentVersion: agent.version,
+        ...(pin.sandbox === undefined ? {} : { sandbox: pin.sandbox }),
+    };
+    await t.put("sessions", id, created);
+    await recordAttachment(t, id, agent.id);
+    return created;
 }
 /**
- * The manifest a session without a sandbox pins: each agent's `runtime` block, with
- * `read_artifact` (R2b C11) and its skill tools; nothing for a workflow.
+ * Refuses a session whose Agent's manifest carries a skill larger than the Agent allows now: its
+ * manifest's `limits.skills.totalBytes`, else the Tenant's, never above the Tenant's, which may
+ * have been lowered since the manifest was saved. `413 limit_exceeded`, with each skill and its
+ * size in `details.skills`.
  */
-function runtimeTools(definition) {
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const pinned = withRuntimeTools(definition.manifest);
-    if (!pinned.ok)
-        return fail(400, pinned.message);
-    return { manifest: pinned.manifest, manifestHash: pinned.manifestHash };
-}
-/** The manifest a session with a sandbox pins: the definition with the sandbox in its `runtime` block. */
-function pin(definition, spec) {
-    // A workflow's manifest stays as registered: its agents inherit the sandbox when they start.
-    if (isWorkflowManifest(definition.manifest))
-        return {};
-    const sandboxed = withSandbox(definition.manifest, spec);
-    if (!sandboxed.ok)
-        return fail(400, sandboxed.message);
-    return { manifest: sandboxed.manifest, manifestHash: sandboxed.manifestHash };
+async function checkSkillLimit(t, manifest, agent) {
+    const limitBytes = limitsInForce(await readTenantLimits(t), agent.applied.limits).skills.totalBytes;
+    const { oversized } = await definitionFileIssues(t, manifest, limitBytes);
+    if (oversized.length === 0)
+        return;
+    fail(413, `Agent ${agent.id} allows a skill's files at most ${limitBytes} bytes together, and its manifest carries ${oversized.map((skill) => `'${skill.name}' (${skill.bytes})`).join(", ")}.`, { code: "limit_exceeded", details: { limitBytes, skills: oversized } });
 }
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export async function sessionView(t, s) {
@@ -267,14 +150,11 @@ export async function sessionView(t, s) {
         id: s.id,
         agentId: s.agentId,
         ownerUserId: s.ownerUserId,
+        manifest: s.definition ?? null,
         manifestHash: s.manifestHash,
-        ...(s.definitionHash === undefined ? {} : { definitionHash: s.definitionHash }),
-        implementationVersion: s.implementationVersion,
         status: s.status,
         activeTurnId: s.activeTurnId,
-        environment: s.environmentId === undefined
-            ? null
-            : { id: s.environmentId, version: s.environmentVersion ?? 1 },
+        queuedMessages: await t.countQueuedMessages(s.id),
         harness: harnessOf(s),
         ...(s.closedReason === undefined ? {} : { closedReason: s.closedReason }),
         mcpSnapshot: s.mcpSnapshot ?? null,

package/dist/tenant/signing-keys.d.ts

@@ -48,7 +48,7 @@ export declare class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;

package/dist/tenant/signing-keys.js

@@ -15,12 +15,10 @@
  */
 import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
 import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
-import { TOKEN_TTL_MAX_SECONDS } from "@nylorun/core/contracts";
 import { decryptSecret, encryptSecret } from "../vault/crypto.js";
 import { fail } from "./http.js";
+import { hostTuning } from "../tuning.js";
 const ALG = "ES256";
-/** Grace added to the longest token lifetime before a previous key may be revoked. */
-const ROTATION_GRACE_MS = 60_000;
 export class SigningKeys {
     options;
     publicKeys = new Map();
@@ -107,7 +105,7 @@ export class SigningKeys {
     /**
      * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
      * with 409 while the previous key may still verify live tokens (retired less than the
-     * longest token lifetime, `maxTtlSeconds` or `TOKEN_TTL_MAX_SECONDS`, plus a minute ago), unless
+     * longest token lifetime, `maxTtlSeconds` or `keys.tokenTtlMaxSeconds`, plus a minute ago), unless
      * `force`.
      */
     async rotate(t, kek, maxTtlSeconds, force) {
@@ -118,8 +116,9 @@ export class SigningKeys {
         const [previous] = await t.signingKeys(["previous"]);
         if (previous && !force) {
             const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
-            const longest = Math.max(maxTtlSeconds, TOKEN_TTL_MAX_SECONDS);
-            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            const longest = Math.max(maxTtlSeconds, hostTuning().keys.tokenTtlMaxSeconds);
+            // The grace added to the longest token lifetime before a previous key may be revoked.
+            const until = retired + longest * 1000 + hostTuning().tenant.signingKeyRotationGraceMs;
             if (until > now.getTime())
                 fail(409, "The previous key may still verify live tokens", {
                     code: "request_rejected",

package/dist/tenant/status.js

@@ -1,11 +1,10 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
 import { ENVIRONMENTS_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
+import { hostTuning } from "../tuning.js";
 /** The Tenant's harnesses, for its status and the Host's. */
 export function harnessStatusOf(ctx) {
     return { mode: ctx.mcp ? "in-process" : "remote", ...ctx.harness.status() };
 }
-/** How long status waits for the execution to list stuck invocations. */
-const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
 async function executionStatus(stuckInvocations) {
     let timer;
@@ -13,7 +12,9 @@ async function executionStatus(stuckInvocations) {
         const stuck = await Promise.race([
             stuckInvocations(),
             new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), STUCK_TIMEOUT_MS);
+                timer = setTimeout(() => reject(new Error("Timed out listing stuck invocations")), 
+                // How long status waits for the execution to list stuck invocations.
+                hostTuning().tenant.statusTimeoutMs);
             }),
         ]);
         return {
@@ -46,9 +47,9 @@ async function executionStatus(stuckInvocations) {
 /** Build `TenantStatusSchema` with secrets redacted (A14). */
 export async function buildTenantStatus(ctx) {
     const health = await ctx.store.health();
-    const { counts, definitions } = await ctx.store.tx(async (t) => ({
+    const { counts, rows } = await ctx.store.tx(async (t) => ({
         counts: await t.counts(),
-        definitions: await t.listDefinitions(),
+        rows: await t.listEnvironments(),
     }));
     const [modelView, sandboxReport, execution, streams] = await Promise.all([
         ctx.vault.getHostModel(),
@@ -56,11 +57,10 @@ export async function buildTenantStatus(ctx) {
         ctx.stuckInvocations ? executionStatus(ctx.stuckInvocations) : undefined,
         ctx.streamsStatus?.(),
     ]);
-    const agents = [
-        ...new Set(definitions
-            .map((d) => d.manifest?.id)
-            .filter((id) => typeof id === "string")),
-    ]
+    // The Tenant's Agents; a pod Agent being deleted is none.
+    const agents = rows
+        .filter((row) => row.pod?.desired !== "deleted")
+        .map((row) => row.id)
         .sort()
         .map((agentId) => ({ agentId }));
     return {

package/dist/tenant/streams.js

@@ -1,17 +1,16 @@
 import { basinOf } from "../streams/basin.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
 import { retry } from "../retry.js";
+import { hostTuning } from "../tuning.js";
 import { checkSessionStreams, currentBasin } from "./session-streams.js";
-const RETRY_MIN_MS = 100;
-const RETRY_MAX_MS = 2000;
-/** The longest wait between two `ensureTenant` attempts while the basin is being repaired. */
-const BASIN_RETRY_MAX_MS = 5000;
-/** A repair started within this long after the last one succeeded waits for the next failure. */
-const BASIN_REPAIR_COOLDOWN_MS = 1000;
-/** How often every session stream is checked against its session (backstop for lost signals). */
-const FEED_CHECK_MS = 30_000;
-/** How long a retired basin stays for readers that have not moved yet. */
-const RETIRE_GRACE_MS = 60_000;
+/*
+ * Timings are the Host tuning's `streams` group (`tuning.ts`): `retry` for deletions and
+ * repairs, `basinRetryMaxMs` (the longest wait between two `ensureTenant` attempts while the
+ * basin is being repaired), `basinRepairCooldownMs` (a repair started within this long after the
+ * last one succeeded waits for the next failure), `feedCheckMs` (how often every session stream is
+ * checked against its session, the backstop for lost signals), `retireGraceMs` (how long a retired
+ * basin stays for readers that have not moved yet).
+ */
 const messageOf = (error) => error instanceof Error ? error.message : String(error);
 /**
  * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
@@ -25,7 +24,7 @@ export async function wireStreams(ctx, options) {
     const { store, streams, tenantId } = options;
     const logger = ctx.config.logger;
     const stop = new AbortController();
-    const graceMs = options.retireGraceMs ?? RETIRE_GRACE_MS;
+    const graceMs = options.retireGraceMs ?? hostTuning().streams.retireGraceMs;
     // Nothing is reported once the wiring stops: the Tenant (and its log directory) may be gone,
     // and a throwing report in a detached loop would be an unhandled rejection.
     const report = (what) => (error) => {
@@ -53,7 +52,7 @@ export async function wireStreams(ctx, options) {
         });
     relay?.start();
     // Streams whose session was reset end on the `sessions.reset` signal; this catches lost ones.
-    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), FEED_CHECK_MS);
+    const feedCheck = setInterval(() => void checkSessionStreams(ctx).catch(report("session stream check failed")), hostTuning().streams.feedCheckMs);
     feedCheck.unref();
     const retiring = new Set();
     const timers = new Set();
@@ -94,9 +93,8 @@ export async function wireStreams(ctx, options) {
     async function deleteRetired(generation) {
         try {
             await retry(() => streams.deleteTenant(basinOf(tenantId, generation)), {
-                minMs: RETRY_MIN_MS,
-                maxMs: RETRY_MAX_MS,
-                attempts: 5,
+                ...hostTuning().streams.retry,
+                attempts: hostTuning().streams.retireAttempts,
             });
             await store.tx((t) => t.forgetRetiredGeneration(generation));
             logger.info("retired stream basin deleted", { generation });
@@ -160,7 +158,7 @@ export async function streamsStatus(ctx, options = {}) {
     const wiring = ctx.sessionStreams.wiring;
     return {
         reachable: wiring
-            ? await probe(wiring.streams, options.probeTimeoutMs ?? 2000)
+            ? await probe(wiring.streams, options.probeTimeoutMs ?? hostTuning().streams.probeTimeoutMs)
             : false,
         basin: wiring?.basin() ?? { ready: false, failures: 0, lastError: null },
         generation: ctx.sessionStreams.generation,
@@ -215,17 +213,17 @@ function basinKeeper(streams, basinKey, signal, onError) {
         repair() {
             if (repairing || signal.aborted)
                 return;
-            if (ready && readyFor === basinKey() && Date.now() - repairedAt < BASIN_REPAIR_COOLDOWN_MS)
+            if (ready && readyFor === basinKey() && Date.now() - repairedAt < hostTuning().streams.basinRepairCooldownMs)
                 return;
             repairing = true;
             ready = false;
             void (async () => {
                 await retry(ensure, {
-                    minMs: RETRY_MIN_MS,
-                    maxMs: BASIN_RETRY_MAX_MS,
+                    minMs: hostTuning().streams.retry.minMs,
+                    maxMs: hostTuning().streams.basinRetryMaxMs,
                     signal,
                     onError: (error) => {
-                        if (failures === 1 || failures % 10 === 0)
+                        if (failures === 1 || failures % hostTuning().streams.basinLogEveryFailures === 0)
                             onError(error);
                     },
                 }).then(() => (repairedAt = Date.now()), () => undefined);

package/dist/tenant/sweep.d.ts

@@ -1,32 +1,12 @@
 import type { PendingRequest } from "../store/types.js";
 import type { TenantContext } from "./context.js";
-/**
- * How old an outbox row is before the sweep delivers it, unless its delivery after commit
- * already failed (then it is due at once): longer than that delivery can take with its
- * retries, so the sweep does not send again, and double the load on, an execution that is
- * only slow. Sending one twice is harmless either way (the idempotency key).
- */
-export declare const OUTBOX_GRACE_MS = 30000;
-/**
- * How often the orphan scan, and the stale pod sandbox check, run after the first pass of a
- * Tenant opened on this process.
- */
-export declare const ORPHAN_SCAN_MS = 60000;
-/**
- * How long one pass may spend draining the outbox, and paging through orphaned sessions.
- * A backlog is worked off over several passes rather than holding one (and with it the
- * Tenant's sweep object in the execution) for long.
- */
-export declare const DRAIN_BUDGET_MS = 2000;
 export declare function sweep(ctx: TenantContext): Promise<void>;
-/** Failed deliveries after which the sweep parks an outbox row (`Tx.failOutbox`). */
-export declare const MAX_OUTBOX_ATTEMPTS = 10;
 /**
  * Deliver the outbox rows that are due (`Tx.pendingOutbox`: older than `graceMs`, or whose
  * delivery failed), oldest first, batch after batch until none is left or `budgetMs` is
  * spent, and delete the delivered ones. Each row is delivered on its own: one that fails
  * (Restate refuses it, or a Runtime that does not know a wake's reason) is tried again later,
- * with backoff, so it never holds back the rows behind it, and after `MAX_OUTBOX_ATTEMPTS`
+ * with backoff, so it never holds back the rows behind it, and after `sweep.outboxAttempts`
  * failures it is parked: logged once, at error, and kept in the outbox for an operator. A
  * parked wake's session is still re-woken by the orphan scan while it is runnable, and a
  * parked sandbox signal's pod by the stale pod check. A row the Tenant declines (it is