@schlessera/brain-ui-server 0.34.1 → 0.35.0

package/dist/ws/turns.d.ts

@@ -1,11 +1,28 @@
 import type { Logger } from "@opentelemetry/api-logs";
 import type { AgentBackend, PermissionDecision, PermissionRequest, AskUserResult, LocationFix } from "@schlessera/brain-ui-sdk/server";
 import type { AskUserQuestion, ChatImageAttachment, ClientEnvironment } from "@schlessera/brain-ui-sdk/protocol";
+import type { TurnRecorder } from "../activity/recorder.js";
+declare const authorizationContextBrand: unique symbol;
+/** Mutable admission decision shared by every asynchronous path from one socket. */
+export interface AuthorizationContext {
+    readonly [authorizationContextBrand]: true;
+    readonly principalId: string;
+    readonly expiresAt: number;
+    valid: boolean;
+    /** Keep this context discoverable until the returned release is called. */
+    retain(): () => void;
+    /** Release the reference acquired when the coordinator opened this context. */
+    release(): void;
+}
 export interface QueuedFollowUp {
+    principalId: string;
+    authorization: AuthorizationContext;
     text: string;
     attachments: ChatImageAttachment[];
     /** Device snapshot taken when the message was sent, not when it runs. */
     client?: ClientEnvironment;
+    /** Queue-owned authorization lease, transferred to the runner on dequeue. */
+    releaseAuthorization: () => void;
 }
 /**
  * Bytes one queued entry keeps alive in this process until its turn runs.
@@ -18,15 +35,25 @@ export interface QueuedFollowUp {
  * on the wire.) The client snapshot is a handful of short fields and is not
  * worth walking.
  */
-export declare function queuedFollowUpBytes(entry: QueuedFollowUp): number;
+export declare function queuedFollowUpBytes(entry: Pick<QueuedFollowUp, "text" | "attachments">): number;
 /** Total bytes currently parked in a session's follow-up queue. */
-export declare function queuedBytes(turn: RunningTurn): number;
+export declare function queuedBytes(turn: Pick<RunningTurn, "queue">): number;
 /**
  * One RUNNING session slot. `abortController`/`timeoutHandle` belong to the
  * turn currently executing; a queued follow-up runs as the next turn in the
  * same slot (same sessionId) after the current one resolves.
  */
 export interface RunningTurn {
+    /** Principal responsible for the CURRENT turn in this session slot. */
+    principalId: string;
+    authorization: AuthorizationContext;
+    /** Activity recorder for the CURRENT turn, once startup reaches the backend. */
+    recorder?: TurnRecorder;
+    /**
+     * Cancelling actors accepted before the recorder exists (while billing is
+     * resolving). Drained into immutable activity events at recorder creation.
+     */
+    pendingCancellationPrincipalIds: string[];
     sessionId: string | null;
     /** Host-minted id of the CURRENT turn in this slot; re-minted per queued follow-up. */
     turnId: string;
@@ -60,7 +87,10 @@ export interface PendingApproval {
      * locks; an approval must survive that and reappear, not silently die.
      */
     request: PermissionRequest;
-    resolve: (decision: PermissionDecision) => void;
+    resolve: (decision: PermissionDecision, response?: {
+        principalId: string;
+        always?: boolean;
+    }) => void;
 }
 export interface PendingAskUser {
     turn: RunningTurn;
@@ -99,20 +129,44 @@ export declare class TurnCoordinator {
     readonly running: Set<RunningTurn>;
     readonly bySession: Map<string, RunningTurn>;
     startingSessions: number;
+    /** Reserve a known session before asynchronous backend routing. */
+    readonly startingBySession: Map<string, {
+        queue: QueuedFollowUp[];
+        cancelled: boolean;
+    }>;
     readonly pendingApprovals: Map<string, PendingApproval>;
     readonly pendingAskUser: Map<string, PendingAskUser>;
     readonly pendingLocation: Map<string, PendingLocation>;
     readonly pendingMask: Map<string, PendingMask>;
+    /** Every authorization context with at least one live owner or async lease. */
+    readonly authorizationRegistry: Map<AuthorizationContext, number>;
     private locationCounter;
     private maskCounter;
     nextLocationRequestId(): string;
     nextMaskRequestId(): string;
     /** True while any session has a running turn. */
     isTurnActive(): boolean;
+    /** Construct and synchronously register a context with its initial reference. */
+    openAuthorization(input: {
+        principalId: string;
+        expiresAt: number;
+        valid: boolean;
+    }): AuthorizationContext;
+    /** Add principals whose registered authorization context has expired. */
+    collectExpiredPrincipalIds(now: number, ids: Set<string>): void;
+    /** Invalidate every registered context belonging to one of these principals. */
+    invalidateAuthorizations(principalIds: ReadonlySet<string>): void;
+    /**
+     * Record revocation without aborting running work. Unstarted queued work is
+     * removed per sender, while a current turn merely carries the invalid marker.
+     */
+    revokePrincipals(principalIds: ReadonlySet<string>): RunningTurn[];
     /** Cancel every running turn (used on shutdown). */
     cancelAll(reason: string): boolean;
     /** Cancel a session's current turn and drop its queued follow-ups. */
     cancelTurn(turn: RunningTurn, reason: string): void;
+    /** Record now, or retain the actor across the pre-recorder startup window. */
+    recordCancellation(turn: RunningTurn, principalId: string): void;
     /** Resolve/reject every pending interactive request belonging to one turn. */
     drainPendingForTurn(turn: RunningTurn, reason: string): void;
     /**
@@ -140,4 +194,5 @@ export declare class TurnCoordinator {
     /** Test seam: abort everything and clear all turn/pending state. */
     reset(): void;
 }
+export {};
 //# sourceMappingURL=turns.d.ts.map

package/dist/ws/turns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"turns.d.ts","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,yEAAyE;IACzE,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAMjE;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAIrD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC7C,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAKD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,CAAC,QAAQ,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACjD;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACzC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,OAAO,mBAA0B;IAC1C,QAAQ,CAAC,SAAS,2BAAkC;IACpD,gBAAgB,SAAK;IAErB,QAAQ,CAAC,gBAAgB,+BAAsC;IAC/D,QAAQ,CAAC,cAAc,8BAAqC;IAC5D,QAAQ,CAAC,eAAe,+BAAsC;IAC9D,QAAQ,CAAC,WAAW,2BAAkC;IAEtD,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,WAAW,CAAK;IAExB,qBAAqB,IAAI,MAAM;IAI/B,iBAAiB,IAAI,MAAM;IAI3B,iDAAiD;IACjD,YAAY,IAAI,OAAO;IAIvB,oDAAoD;IACpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAMlC,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQnD,8EAA8E;IAC9E,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAc5D;;;;;;;;;OASG;IACH,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAahE;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,GAChB,OAAO;IAaV,oEAAoE;IACpE,KAAK,IAAI,IAAI;CAYd"}
+{"version":3,"file":"turns.d.ts","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,QAAA,MAAM,yBAAyB,EAAE,OAAO,MAAuC,CAAC;AAEhF,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,2EAA2E;IAC3E,MAAM,IAAI,MAAM,IAAI,CAAC;IACrB,+EAA+E;IAC/E,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,yEAAyE;IACzE,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,6EAA6E;IAC7E,oBAAoB,EAAE,MAAM,IAAI,CAAC;CAClC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,aAAa,CAAC,GAClD,MAAM,CAMR;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,CAIpE;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,oBAAoB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,+BAA+B,EAAE,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,YAAY,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,aAAa,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;IAC7C,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAKD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,CACP,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KACjD,IAAI,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACzC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,OAAO,mBAA0B;IAC1C,QAAQ,CAAC,SAAS,2BAAkC;IACpD,gBAAgB,SAAK;IACrB,mEAAmE;IACnE,QAAQ,CAAC,iBAAiB;eAA4B,cAAc,EAAE;mBAAa,OAAO;OAAM;IAEhG,QAAQ,CAAC,gBAAgB,+BAAsC;IAC/D,QAAQ,CAAC,cAAc,8BAAqC;IAC5D,QAAQ,CAAC,eAAe,+BAAsC;IAC9D,QAAQ,CAAC,WAAW,2BAAkC;IAEtD,+EAA+E;IAC/E,QAAQ,CAAC,qBAAqB,oCAA2C;IAEzE,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,WAAW,CAAK;IAExB,qBAAqB,IAAI,MAAM;IAI/B,iBAAiB,IAAI,MAAM;IAI3B,iDAAiD;IACjD,YAAY,IAAI,OAAO;IAIvB,iFAAiF;IACjF,iBAAiB,CAAC,KAAK,EAAE;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,OAAO,CAAC;KAChB,GAAG,oBAAoB;IAkCxB,yEAAyE;IACzE,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI;IAQ/D,gFAAgF;IAChF,wBAAwB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMjE;;;OAGG;IACH,gBAAgB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,EAAE;IAgBlE,oDAAoD;IACpD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAWlC,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAQnD,8EAA8E;IAC9E,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI;IAKhE,8EAA8E;IAC9E,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAc5D;;;;;;;;;OASG;IACH,uBAAuB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAahE;;;;;;;OAOG;IACH,mBAAmB,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,WAAW,GAChB,OAAO;IAaV,oEAAoE;IACpE,KAAK,IAAI,IAAI;CAkBd"}

package/dist/ws/turns.js

@@ -1,3 +1,4 @@
+const authorizationContextBrand = Symbol("AuthorizationContext");
 /**
  * Bytes one queued entry keeps alive in this process until its turn runs.
  *
@@ -39,10 +40,14 @@ export class TurnCoordinator {
     running = new Set();
     bySession = new Map();
     startingSessions = 0;
+    /** Reserve a known session before asynchronous backend routing. */
+    startingBySession = new Map();
     pendingApprovals = new Map();
     pendingAskUser = new Map();
     pendingLocation = new Map();
     pendingMask = new Map();
+    /** Every authorization context with at least one live owner or async lease. */
+    authorizationRegistry = new Map();
     locationCounter = 0;
     maskCounter = 0;
     nextLocationRequestId() {
@@ -55,9 +60,88 @@ export class TurnCoordinator {
     isTurnActive() {
         return this.running.size > 0;
     }
+    /** Construct and synchronously register a context with its initial reference. */
+    openAuthorization(input) {
+        let initialReleased = false;
+        const releaseReference = () => {
+            const count = this.authorizationRegistry.get(authorization);
+            if (count === undefined)
+                return;
+            if (count === 1)
+                this.authorizationRegistry.delete(authorization);
+            else
+                this.authorizationRegistry.set(authorization, count - 1);
+        };
+        const authorization = {
+            [authorizationContextBrand]: true,
+            ...input,
+            retain: () => {
+                const count = this.authorizationRegistry.get(authorization);
+                if (count === undefined) {
+                    throw new Error("Cannot retain a released authorization context");
+                }
+                this.authorizationRegistry.set(authorization, count + 1);
+                let released = false;
+                return () => {
+                    if (released)
+                        return;
+                    released = true;
+                    releaseReference();
+                };
+            },
+            release: () => {
+                if (initialReleased)
+                    return;
+                initialReleased = true;
+                releaseReference();
+            },
+        };
+        this.authorizationRegistry.set(authorization, 1);
+        return authorization;
+    }
+    /** Add principals whose registered authorization context has expired. */
+    collectExpiredPrincipalIds(now, ids) {
+        for (const authorization of this.authorizationRegistry.keys()) {
+            if (authorization.valid && authorization.expiresAt <= now) {
+                ids.add(authorization.principalId);
+            }
+        }
+    }
+    /** Invalidate every registered context belonging to one of these principals. */
+    invalidateAuthorizations(principalIds) {
+        for (const authorization of this.authorizationRegistry.keys()) {
+            if (principalIds.has(authorization.principalId))
+                authorization.valid = false;
+        }
+    }
+    /**
+     * Record revocation without aborting running work. Unstarted queued work is
+     * removed per sender, while a current turn merely carries the invalid marker.
+     */
+    revokePrincipals(principalIds) {
+        const affectedRunning = [];
+        this.invalidateAuthorizations(principalIds);
+        for (const turn of this.running) {
+            if (principalIds.has(turn.principalId)) {
+                affectedRunning.push(turn);
+            }
+            turn.queue = turn.queue.filter((entry) => {
+                if (!principalIds.has(entry.principalId))
+                    return true;
+                entry.releaseAuthorization();
+                return false;
+            });
+        }
+        return affectedRunning;
+    }
     /** Cancel every running turn (used on shutdown). */
     cancelAll(reason) {
-        if (this.running.size === 0)
+        const hadWork = this.running.size > 0 || this.startingBySession.size > 0;
+        for (const starting of this.startingBySession.values()) {
+            starting.cancelled = true;
+            starting.queue.length = 0;
+        }
+        if (!hadWork)
             return false;
         for (const turn of [...this.running])
             this.cancelTurn(turn, reason);
@@ -66,11 +150,19 @@ export class TurnCoordinator {
     /** Cancel a session's current turn and drop its queued follow-ups. */
     cancelTurn(turn, reason) {
         turn.cancelled = true;
-        turn.queue.length = 0;
+        for (const entry of turn.queue.splice(0))
+            entry.releaseAuthorization();
         clearTimeout(turn.timeoutHandle);
         turn.abortController.abort();
         this.drainPendingForTurn(turn, reason);
     }
+    /** Record now, or retain the actor across the pre-recorder startup window. */
+    recordCancellation(turn, principalId) {
+        if (turn.recorder)
+            turn.recorder.recordCancellation(principalId);
+        else
+            turn.pendingCancellationPrincipalIds.push(principalId);
+    }
     /** Resolve/reject every pending interactive request belonging to one turn. */
     drainPendingForTurn(turn, reason) {
         for (const [id, p] of this.pendingApprovals) {
@@ -136,7 +228,14 @@ export class TurnCoordinator {
         for (const turn of [...this.running]) {
             clearTimeout(turn.timeoutHandle);
             turn.abortController.abort();
+            for (const entry of turn.queue.splice(0))
+                entry.releaseAuthorization();
+        }
+        for (const starting of this.startingBySession.values()) {
+            starting.cancelled = true;
+            starting.queue.length = 0;
         }
+        this.startingBySession.clear();
         this.running.clear();
         this.bySession.clear();
         this.pendingApprovals.clear();

package/dist/ws/turns.js.map

@@ -1 +1 @@
-{"version":3,"file":"turns.js","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAwED;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,GAAG,CAAU;IAEJ,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACjC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC;IAEZ,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,eAAe,GAAG,CAAC,CAAC;IACpB,WAAW,GAAG,CAAC,CAAC;IAExB,qBAAqB;QACnB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,MAAc;QACtB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAiB,EAAE,MAAc;QACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACH,uBAAuB,CAAC,IAAiB,EAAE,MAAc;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,GAAmB,EACnB,EAAU,EACV,IAAiB;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;gBACb,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,4DAA4D;gBAClE,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;aACjC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"turns.js","sourceRoot":"","sources":["../../src/ws/turns.ts"],"names":[],"mappings":"AAeA,MAAM,yBAAyB,GAAkB,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAyBhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAmD;IAEnD,IAAI,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAgC;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAqFD;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,GAAG,CAAU;IAEJ,OAAO,GAAG,IAAI,GAAG,EAAe,CAAC;IACjC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,gBAAgB,GAAG,CAAC,CAAC;IACrB,mEAAmE;IAC1D,iBAAiB,GAAG,IAAI,GAAG,EAA2D,CAAC;IAEvF,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEtD,+EAA+E;IACtE,qBAAqB,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEjE,eAAe,GAAG,CAAC,CAAC;IACpB,WAAW,GAAG,CAAC,CAAC;IAExB,qBAAqB;QACnB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IAED,iBAAiB;QACf,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IAED,iDAAiD;IACjD,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,iFAAiF;IACjF,iBAAiB,CAAC,KAIjB;QACC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,gBAAgB,GAAG,GAAG,EAAE;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;;gBAC7D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,MAAM,aAAa,GAAyB;YAC1C,CAAC,yBAAyB,CAAC,EAAE,IAAI;YACjC,GAAG,KAAK;YACR,MAAM,EAAE,GAAG,EAAE;gBACX,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACzD,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,OAAO,GAAG,EAAE;oBACV,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,gBAAgB,EAAE,CAAC;gBACrB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,eAAe;oBAAE,OAAO;gBAC5B,eAAe,GAAG,IAAI,CAAC;gBACvB,gBAAgB,EAAE,CAAC;YACrB,CAAC;SACF,CAAC;QACF,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,yEAAyE;IACzE,0BAA0B,CAAC,GAAW,EAAE,GAAgB;QACtD,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9D,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,wBAAwB,CAAC,YAAiC;QACxD,KAAK,MAAM,aAAa,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9D,IAAI,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC;gBAAE,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,YAAiC;QAChD,MAAM,eAAe,GAAkB,EAAE,CAAC;QAC1C,IAAI,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACtD,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,oDAAoD;IACpD,SAAS,CAAC,MAAc;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC;QACzE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAiB,EAAE,MAAc;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACvE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,kBAAkB,CAAC,IAAiB,EAAE,WAAmB;QACvD,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;;YAC5D,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,IAAiB,EAAE,MAAc;QACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACH,uBAAuB,CAAC,IAAiB,EAAE,MAAc;QACvD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,GAAmB,EACnB,EAAU,EACV,IAAiB;QAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC;gBACb,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,4DAA4D;gBAClE,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;aACjC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;YAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/migrations/011_principals.sql

@@ -0,0 +1,13 @@
+CREATE TABLE principals (
+  id            TEXT PRIMARY KEY NOT NULL,  -- 22 chars base64url, server-generated
+  kind          TEXT NOT NULL CHECK (kind IN ('owner','agent','ambient','system')),
+  auth_method   TEXT NOT NULL CHECK (auth_method IN ('password','passkey','delegated','ambient')),
+  label         TEXT NOT NULL,              -- ≤64 chars, never rendered as HTML
+  credential_id TEXT,                       -- passkey_credentials.id, else NULL
+  created_by    TEXT,                       -- minting principal, for delegation
+  created_at    INTEGER NOT NULL,
+  expires_at    INTEGER NOT NULL,
+  last_seen_at  INTEGER,
+  revoked_at    INTEGER
+);
+CREATE INDEX idx_principals_live ON principals(revoked_at, expires_at);

package/migrations/012_activity_principals.sql

@@ -0,0 +1,12 @@
+-- Principal attribution for activity spans and durable run rollups.
+--
+-- Deliberately NO backfill and no owner default: activity recorded before
+-- this migration remains NULL (= unattributed). Rollups snapshot the live
+-- principal's label and kind when they are first written because principal
+-- rows expire and are pruned while activity_run_rollups are retained.
+ALTER TABLE activity_spans ADD COLUMN principal_id TEXT;
+
+ALTER TABLE activity_run_rollups ADD COLUMN principal_id TEXT;
+ALTER TABLE activity_run_rollups ADD COLUMN principal_label TEXT;
+ALTER TABLE activity_run_rollups ADD COLUMN principal_kind TEXT
+  CHECK (principal_kind IN ('owner', 'agent', 'ambient', 'system'));

package/migrations/013_push_subscription_principals.sql

@@ -0,0 +1,7 @@
+-- Legacy subscriptions deliberately remain NULL and therefore inert until an
+-- authenticated client re-registers the endpoint for its current principal.
+ALTER TABLE push_subscriptions
+  ADD COLUMN principal_id TEXT REFERENCES principals(id) ON DELETE SET NULL;
+
+CREATE INDEX idx_push_subscriptions_principal
+  ON push_subscriptions(principal_id);

package/migrations/014_invalidate_legacy_sessions.sql

@@ -0,0 +1,14 @@
+-- Advance the legacy v1 cookie epoch once at upgrade so every pre-upgrade
+-- cookie stays invalid if the deployment rolls back to the v1 verifier.
+INSERT INTO settings (key, value, updated_at)
+VALUES ('auth.sessionsEpoch', '1', CAST(strftime('%s', 'now') AS INTEGER) * 1000)
+ON CONFLICT(key) DO UPDATE SET
+  value = CASE
+    WHEN json_valid(value) THEN CASE
+      WHEN json_type(value) = 'integer' AND CAST(value AS INTEGER) >= 0
+        THEN CAST(CAST(value AS INTEGER) + 1 AS TEXT)
+      ELSE '1'
+    END
+    ELSE '1'
+  END,
+  updated_at = excluded.updated_at;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schlessera/brain-ui-server",
-  "version": "0.34.1",
+  "version": "0.35.0",
   "description": "brain-kit chat-UI server: Hono app factory, WebSocket turn coordinator, auth (password/passkeys/tailscale/proxy), session catalog, and brain/files/voice routes",
   "license": "MIT",
   "keywords": [
@@ -54,8 +54,8 @@
   "dependencies": {
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "0.221.0",
-    "@schlessera/brain-render-template": "0.34.1",
-    "@schlessera/brain-ui-sdk": "0.34.1",
+    "@schlessera/brain-render-template": "0.35.0",
+    "@schlessera/brain-ui-sdk": "0.35.0",
     "@simplewebauthn/server": "^13.3.2",
     "fflate": "^0.8.2",
     "gray-matter": "^4.0.3",

package/src/activity/notify.ts

@@ -23,7 +23,7 @@ import type { Database } from "bun:sqlite";
 import type { Logger } from "@opentelemetry/api-logs";
 import { isFailureOutcome } from "@schlessera/brain-ui-sdk/protocol";
 
-import { getSetting } from "../db/settings.js";
+import { getSetting, setSetting } from "../db/settings.js";
 import type { ActivityStore, SpanRow } from "./store.js";
 
 export type IntentKind = "failure" | "completion" | "stuck";
@@ -76,7 +76,7 @@ const DEFAULT_STUCK_THRESHOLD_MS = 45 * 60 * 1000;
 
 export function createActivityNotifier(deps: ActivityNotifierDeps): ActivityNotifier {
   const { db, store, isWatched, log } = deps;
-  let cursor = latestCursor(db);
+  const cursorKey = "activity.notify.cursor";
   /** Runs already flagged as stuck this process lifetime (tag also guards). */
   const stuckFlagged = new Set<string>();
 
@@ -97,6 +97,9 @@ export function createActivityNotifier(deps: ActivityNotifierDeps): ActivityNoti
     suppressed?: boolean;
   }): void {
     const now = Date.now();
+    // Replay on first upgrade must not resurrect an acknowledged notification.
+    if (db.query("SELECT id FROM notification_intents WHERE run_id = ? AND kind = ? LIMIT 1")
+      .get(input.runId, input.kind)) return;
     // Tag dedupe: one live (unacknowledged) intent per tag — repeats coalesce.
     const existing = db
       .query(
@@ -180,11 +183,17 @@ export function createActivityNotifier(deps: ActivityNotifierDeps): ActivityNoti
         // The head is read BEFORE the detection query so advancing past
         // non-terminal changes can never skip a terminal write committed
         // in between; a change seen twice is absorbed by the tag dedupe.
-        const head = latestCursor(db);
-        const rows = store.terminalRootChangesSince(cursor, 500);
-        for (const { span } of rows) intentForSpan(span);
-        const lastSeen = rows.length > 0 ? rows[rows.length - 1]!.changeId : cursor;
-        cursor = rows.length === 500 ? lastSeen : Math.max(head, lastSeen);
+        db.transaction(() => {
+          const saved = getSetting<unknown>(db, cursorKey, 0, log);
+          const cursor = typeof saved === "number" && Number.isSafeInteger(saved) && saved >= 0 ? saved : 0;
+          const head = latestCursor(db);
+          const rows = store.terminalRootChangesSince(cursor, 500);
+          for (const { span } of rows) intentForSpan(span);
+          const lastSeen = rows.length > 0 ? rows[rows.length - 1]!.changeId : cursor;
+          // Commit intents and progress together. A crash retries the entire
+          // batch; another notifier reads the committed cursor under this lock.
+          setSetting(db, cursorKey, rows.length === 500 ? lastSeen : Math.max(head, lastSeen));
+        }).immediate();
 
         // Watchdog: an over-threshold LIVE root run is stuck — a signal, not
         // an outcome. Threshold from settings, per-job override supported.

package/src/activity/push-sender.ts

@@ -27,13 +27,21 @@ export interface PushSubscriptionRow {
   label: string | null;
   createdAt: number;
   lastUsedAt: number | null;
+  principalId: string | null;
 }
 
 export interface PushSender {
   publicKey(): string;
-  subscribe(sub: { endpoint: string; keys: { p256dh: string; auth: string } }, label?: string): void;
-  unsubscribe(endpoint: string): boolean;
-  subscriptions(): PushSubscriptionRow[];
+  /** Bind (or re-bind) an endpoint only while the registering principal is live. */
+  subscribe(
+    sub: { endpoint: string; keys: { p256dh: string; auth: string } },
+    principalId: string,
+    label?: string
+  ): boolean;
+  unsubscribe(endpoint: string, principalId: string): boolean;
+  subscriptions(principalId?: string): PushSubscriptionRow[];
+  /** Make one revoked principal's endpoints inert without deleting browser state. */
+  unbindPrincipal(principalId: string): number;
   /** Deliver pending intents to every subscription. Returns sends attempted. */
   deliverPending(notifier: ActivityNotifier): Promise<number>;
 }
@@ -86,9 +94,9 @@ export function createPushSender(
     return vapid();
   }
 
-  function rows(): PushSubscriptionRow[] {
+  function mapRows(dbRows: any[]): PushSubscriptionRow[] {
     return (
-      db.query("SELECT * FROM push_subscriptions ORDER BY created_at").all() as any[]
+      dbRows
     ).map((r) => ({
       endpoint: r.endpoint,
       p256dh: r.p256dh,
@@ -96,33 +104,88 @@ export function createPushSender(
       label: r.label,
       createdAt: r.created_at,
       lastUsedAt: r.last_used_at,
+      principalId: r.principal_id,
     }));
   }
 
+  function rows(principalId?: string): PushSubscriptionRow[] {
+    const dbRows = principalId === undefined
+      ? db.query("SELECT * FROM push_subscriptions ORDER BY created_at").all()
+      : db
+          .query(
+            `SELECT * FROM push_subscriptions
+             WHERE principal_id = ? ORDER BY created_at`
+          )
+          .all(principalId);
+    return mapRows(dbRows as any[]);
+  }
+
+  function deliverableRows(now: number): PushSubscriptionRow[] {
+    return mapRows(
+      db
+        .query(
+          `SELECT s.* FROM push_subscriptions s
+           JOIN principals p ON p.id = s.principal_id
+           WHERE p.revoked_at IS NULL
+             AND typeof(p.expires_at) = 'integer'
+             AND p.expires_at > ?
+           ORDER BY s.created_at`
+        )
+        .all(now) as any[]
+    );
+  }
+
   return {
     publicKey() {
       return vapid().publicKey;
     },
 
-    subscribe(sub, label) {
-      db.query(
-        `INSERT INTO push_subscriptions (endpoint, p256dh, auth, label, created_at)
-         VALUES (?, ?, ?, ?, ?)
-         ON CONFLICT(endpoint) DO UPDATE SET p256dh = excluded.p256dh, auth = excluded.auth`
-      ).run(sub.endpoint, sub.keys.p256dh, sub.keys.auth, label ?? null, Date.now());
+    subscribe(sub, principalId, label) {
+      const now = Date.now();
+      return db.query(
+        `INSERT INTO push_subscriptions
+           (endpoint, p256dh, auth, label, created_at, principal_id)
+         SELECT ?, ?, ?, ?, ?, id FROM principals
+         WHERE id = ? AND revoked_at IS NULL
+           AND typeof(expires_at) = 'integer' AND expires_at > ?
+         ON CONFLICT(endpoint) DO UPDATE SET
+           p256dh = excluded.p256dh,
+           auth = excluded.auth,
+           label = excluded.label,
+           principal_id = excluded.principal_id`
+      ).run(
+        sub.endpoint,
+        sub.keys.p256dh,
+        sub.keys.auth,
+        label ?? null,
+        now,
+        principalId,
+        now
+      ).changes > 0;
     },
 
-    unsubscribe(endpoint) {
-      return db.query("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint)
-        .changes > 0;
+    unsubscribe(endpoint, principalId) {
+      return db
+        .query(
+          "DELETE FROM push_subscriptions WHERE endpoint = ? AND principal_id = ?"
+        )
+        .run(endpoint, principalId).changes > 0;
     },
 
     subscriptions: rows,
 
+    unbindPrincipal(principalId) {
+      return db
+        .query(
+          "UPDATE push_subscriptions SET principal_id = NULL WHERE principal_id = ?"
+        )
+        .run(principalId).changes;
+    },
+
     async deliverPending(notifier) {
       const pending = notifier.pending();
       if (pending.length === 0) return 0;
-      if (rows().length === 0) {
+      if (deliverableRows(Date.now()).length === 0) {
         // No devices: the inbox already has it; nothing to deliver. Leave
         // the intents pending so a device subscribing later still gets them
         // if they are fresh, and the boot sweep can retry.
@@ -134,7 +197,7 @@ export function createPushSender(
       for (const intent of pending) {
         // Re-read per intent: an endpoint pruned as dead during the previous
         // intent's pass must not be attempted again in this one.
-        const subs = rows();
+        const subs = deliverableRows(Date.now());
         if (subs.length === 0) break;
         // Minimized payload; the tag coalesces repeats per run across devices.
         const payload = JSON.stringify({

package/src/activity/query.ts

@@ -50,6 +50,9 @@ export function runActivityQuery(
           name: r.name,
           jobName: r.jobName,
           sessionId: r.sessionId,
+          principalId: r.principalId,
+          principalLabel: r.principalLabel,
+          principalKind: r.principalKind,
           startedAt: iso(r.startedAt),
           outcome: r.outcome,
           durationMs: r.durationMs,
@@ -89,6 +92,7 @@ export function runActivityQuery(
             parent: s.parentSpanId,
             name: s.name,
             kind: s.kind,
+            principalId: s.principalId,
             startedAt: iso(s.startedAt),
             endedAt: s.endedAt ? iso(s.endedAt) : null,
             outcome: s.outcome,
@@ -112,6 +116,9 @@ export function runActivityQuery(
         rollup: {
           name: rollup.name,
           jobName: rollup.jobName,
+          principalId: rollup.principalId,
+          principalLabel: rollup.principalLabel,
+          principalKind: rollup.principalKind,
           outcome: rollup.outcome,
           startedAt: iso(rollup.startedAt),
           durationMs: rollup.durationMs,
@@ -173,6 +180,7 @@ function liveSummary(span: SpanRow) {
     name: span.name,
     jobName: span.jobName,
     sessionId: span.sessionId,
+    principalId: span.principalId,
     startedAt: iso(span.startedAt),
     elapsedMs: Date.now() - span.startedAt,
   };