@procedures/client 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @procedures/client
 
+## 0.23.0
+
+### Patch Changes
+
+- f20beb1: The task store of an MCP host gives each client a fair share of its tasks (CLI-69). Before, the sessions of one client could fill the store (CLI-51). Then each other client got `TASKS_FULL` until those tasks ended their time.
+  
+  MINOR: a breaking change before 1.0. Near the limit, the store refuses a client with its share or more, also when the store has free slots. Before, the store refused a task only when it was full (decision D13).
+  
+  Changed:
+  
+  - The key of a task (`shareKey`) tells its client. The default `mcpTaskShareKey` gives the principal of the request, else the session. The principal of the host token is the same for each caller, so a request with only the token gets the key of its session.
+  - The share of a client is `maxStored / (k + 1)`. `k` is the number of clients with tasks in the store, the new client included.
+  - When `reserve` slots or fewer are free, a client with its share or more gets no more tasks. Its new task replaces the oldest task of its session that ended. Without such a task, the request gets the error `-32600` with the code `TASKS_FULL`, as for a full store.
+  - A client below its share gets a task while the store has a free slot. Thus one client keeps at most `maxStored - reserve` tasks, also with many sessions.
+  - The total limit (`maxStored`, 1000 by default) and the limit of 100 tasks of a session stay as they are.
+  
+  Added:
+  
+  - The options `reserve`, `shareKey` and `clock` of `McpTaskStore`, and of `tasks` of `createMcpHost()` and `mcpFace()`. The default `reserve` is a tenth of `maxStored`, rounded down: 100 of 1000. `reserve: 0` turns the fair share off.
+  - `mcpTaskShareKey`, and the types `McpTaskShareContext` and `McpTaskCaller`. `createTask` of the store takes the caller as its fifth argument.
+  - `MCP_TASK_LIMITS.reserveDivisor`: 10.
+  - `identify(credentials)` of `ProcedureServer`, and the optional `identify` of `RequestHandler`. It gives the principal of a request before a call, from the checks of each call. The face handler of the procedures host and the narrowed handler of `mcpFace()` give it too. The MCP face uses it for the key of a task. Thus the request hook and the authenticate function run one more time for each new task.
+  
+  Migration:
+  
+  - The site and MiniMongo: no change. They have no MCP host.
+  - Graph: no change. Its MCP hosts have no task store.
+  - jarvis: no change. Its MCP host has no tasks.
+  - polite-crawler-mcp: no change. Each request has the host token, so each session is one client. A session with 100 tasks gets fewer tasks only when ten or more sessions are near the limit. To keep the rule of CLI-51, give `new McpTaskStore({ reserve: 0 })`.
+  - A host whose clients each have many sessions under one principal: each client keeps at most `maxStored - reserve` tasks. To keep the rule of CLI-51, give `reserve: 0` in `tasks` of the host or in `new McpTaskStore()`.
+- 71091a5: Added: the envelope form of a program (coeval, decisions D6, D9 and D10, roadmap item M7). A call is `{ "type": ["client", "add"], "value": input }`, and a reference is `{ "type": "ref", "value": ["names", "sum"] }`. The `$proc` form does not change.
+  
+  - `fromEnvelopeProgram()` changes a program in the envelope form into the `$proc` form. `toEnvelopeProgram()` changes a `$proc` program into the envelope form. `isEnvelopeProgram()` tells which form a value has.
+  - `client.exec()` and `client.execStream()` accept a program in the envelope form at the root. `client.exec(program, input)` puts the fields of `input` over the input, as for a `$proc` program.
+  - The root decides the form. In an envelope program, a `$proc`, `$ref` or `$literal` object is data. In a `$proc` program, an envelope is data, as before.
+  - A call with the value `null` has no input. The header `name` gives `$name`. A ref reads only the root `names`, and `["names", "last"]` reads the step before.
+  - The envelope form has no `$when`. A program that needs `$when` keeps the `$proc` form.
+  - The section "The envelope form" of `PROGRAM-FORMAT.md` gives the mapping and the rules. The section "Open questions and known differences" is now section 12.
+
+## 0.22.1
+
+### Patch Changes
+
+- c931188: The publisher refuses a subscriber of a collection `a.b` with partitions and no storage when its resolver gives no partition and `a` has partitions. Before, that subscriber listened to the plain topic `collections.a.b`. That is also the topic of the partition `b` of `a`. Thus the subscriber got the events of the tenant `b` of `a`, a leak across tenants (roadmap CLI-70, decision D23).
+  
+  - The refusal is `FORBIDDEN` with the reason `partition-not-allowed`, as for the other refusals of a partition.
+  - The publisher does the check at the start of the subscription, at each re-check and before each event. Thus partitions of `a` that come later also end an open subscription, before it gets an event of `a`.
+  - The check is in the one route from the topic of a subscriber to the topic of the bus. Thus each subscriber over HTTP, WebSocket or MCP gets it.
+  - The registration check of CLI-57 cannot find this pair, because the resolver gives the partition only at the call. The calls of `a.b` without a partition already failed, because `a.b` has no storage.
+  - A subscriber of `a.b` whose resolver gives a partition does not change. A subscriber of `a` does not change. A collection `a.b` without the partitions of `a` does not change.
+  
+  PATCH (decision D23): the change refuses only a subscription that gets the events of another tenant. No correct subscriber can rely on it. Each other subscription behaves as before.
+  
+  Migration steps:
+  
+  - Does a subscriber of `a.b` get `FORBIDDEN` with the reason `partition-not-allowed`? Then make the resolver of `a.b` give a partition. Or rename `a.b` to a name without a dot, for example `a_b`.
+  - The site: no change is necessary. It serves no collection.
+  - MiniMongo: no change is necessary. Its server serves no collection.
+  - Graph: no change is necessary. Its one served collection, `examples`, has no dot in its name.
+  - jarvis: no change is necessary. Its host serves no collection.
+
 ## 0.22.0
 
 No changes in this release.