@capybara-hq/kernel 0.1.0-rc.12 → 0.1.0-rc.14

package/dist/{devices → local-devices}/machines.d.ts

@@ -2,17 +2,17 @@ import type { DeviceHello, DeviceStopArgs, ExtensionContext } from "@capybara-hq
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import type { KernelLogger } from "../log.js";
-import { DeviceRelay } from "./relay.js";
+import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export declare const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
 /** What a machine credential stands for. */
 export interface MachineIdentity {
     machineId: string;
     orgId: string;
-    environmentId: string;
+    deviceId: string;
     accountId: string;
 }
-/** The machine connected to an environment (its unrevoked row). */
+/** The machine connected to a device (its unrevoked row). */
 export interface ActiveMachine {
     id: string;
     orgId: string;
@@ -26,12 +26,12 @@ export interface ActiveMachine {
 }
 /**
  * Connected machines and their credentials (environments spec §13.2). One active machine per
- * device environment: issuing a credential revokes the environment's previous machine. A
+ * local device: issuing a credential revokes the device's previous machine. A
  * credential is `cap_dev_` plus 32 random bytes; only its sha256 is stored. It is accepted only
  * by the device connection route ({@link authenticate}), never by `/api`: it is no `Principal`.
  *
  * A revoked machine is told so after the commit: `stop { reason }` relayed while a replica holds
- * its connection (fire-and-forget, ruling R14) and `device.revoked.<environmentId>` published with
+ * its connection (fire-and-forget, ruling R14) and `device.revoked.<deviceId>` published with
  * `{ machineId }`, so the holder closes that machine's connection.
  */
 export declare class MachinesService {
@@ -40,15 +40,15 @@ export declare class MachinesService {
     private readonly relay;
     private readonly bus;
     private readonly log;
-    constructor(db: KernelDb, txHost: TransactionHost, relay: Pick<DeviceRelay, "holderLive" | "send">, bus: ExtensionContext["bus"], log: Pick<KernelLogger, "warn">);
+    constructor(db: KernelDb, txHost: TransactionHost, relay: Pick<LocalDeviceRelay, "holderLive" | "send">, bus: ExtensionContext["bus"], log: Pick<KernelLogger, "warn">);
     /**
-     * A new machine for the environment and its credential (returned once). Revokes the
-     * environment's active machine first. Joins the caller's transaction (the device confirmation),
-     * which has already checked the environment is the person's own live device environment.
+     * A new machine for the device and its credential (returned once). Revokes the
+     * device's active machine first. Joins the caller's transaction (the device confirmation),
+     * which has already checked the device is the person's own live local device.
      */
     issue(input: {
         orgId: string;
-        environmentId: string;
+        deviceId: string;
         accountId: string;
         name: string;
         os: string;
@@ -59,29 +59,29 @@ export declare class MachinesService {
         credential: string;
     }>;
     /**
-     * Ruling R23: the new machine may serve the environment from another directory or mode (other
+     * Ruling R23: the new machine may serve the device from another directory or mode (other
      * roots), and a login recreates a directory that was lost (ruling R24). So the instance row
      * forgets its instance (status `none`, no handle) and its files count as there again; the next
-     * use creates a fresh instance on the machine (with its roots: a new `environment_paths` event
+     * use creates a fresh instance on the machine (with its roots: a new `device_paths` event
      * follows). The fence moves on, so a lifecycle holder of the old instance fails its next write.
      * The reset count (`fs_resets`) moves on when the files the next instance sees are not the old
      * ones, so conversations that used the old files are told their files were reset, not that they
      * were kept: lost files come back as an empty directory, and another machine (`moved`: name, OS
-     * or arch differ from the environment's previous machine) has other files. Another directory on
+     * or arch differ from the device's previous machine) has other files. Another directory on
      * the same machine is known only from the new machine's first hello ({@link recordHello}).
      */
     private resetInstance;
     /**
-     * Who a machine credential stands for, or null: the machine is not revoked, its environment is
+     * Who a machine credential stands for, or null: the machine is not revoked, its device is
      * live, the org is not deleted (ruling R12), and the person is an active account still a member
      * of the org. Read live on every call (a connection re-checks it as it sees fit).
      */
     authenticate(credential: string): Promise<MachineIdentity | null>;
     /**
      * Stores what the program reported in its hello frame and marks the machine seen. On the
-     * machine's first hello, when it is the same machine as the environment's previous one (else
+     * machine's first hello, when it is the same machine as the device's previous one (else
      * {@link issue} already counted the reset) but serves another directory or mode (other roots,
-     * ruling R23), the environment's files are other files: `fs_resets` moves on (maintainer
+     * ruling R23), the device's files are other files: `fs_resets` moves on (maintainer
      * decision 2026-11-08), so conversations get the files-reset notice. A previous machine that
      * never said hello has no known roots: nothing to compare.
      */
@@ -89,26 +89,26 @@ export declare class MachinesService {
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     touch(machineId: string): Promise<void>;
     /**
-     * Disconnects the machine of one of the person's own live device environments (`DELETE
-     * /orgs/:orgId/environments/:id/machine`): revokes it and audits
-     * `environment.machine_revoked`. Anyone else's environment, a cloud one or a missing one →
-     * `environment.not_found`; no machine connected is a no-op.
+     * Disconnects the machine of one of the person's own live local devices (`DELETE
+     * /orgs/:orgId/devices/:id/machine`): revokes it and audits
+     * `device.machine_revoked`. Anyone else's device, a cloud one or a missing one →
+     * `device.not_found`; no machine connected is a no-op.
      */
-    revoke(orgId: string, accountId: string, environmentId: string, actorTokenId?: string): Promise<void>;
+    revoke(orgId: string, accountId: string, deviceId: string, actorTokenId?: string): Promise<void>;
     /**
-     * Revokes the environment's active machine, if any, in the caller's transaction, and after the
+     * Revokes the device's active machine, if any, in the caller's transaction, and after the
      * commit tells it to stop for `reason` (none: only its connection is closed) and closes its
      * connection. Returns the revoked machine's id. Used by {@link issue} (replaced: no stop),
-     * {@link revoke} and the environment's deletion (`deleted`).
+     * {@link revoke} and the device's deletion (`deleted`).
      */
-    revokeActive(environmentId: string, reason: DeviceStopArgs["reason"] | null): Promise<string | null>;
+    revokeActive(deviceId: string, reason: DeviceStopArgs["reason"] | null): Promise<string | null>;
     /**
      * Revokes one machine by id (a sign-in whose credential never reached the program), with the
      * same post-commit disconnect as a replacement (no stop frame). True when it was active.
      */
     revokeMachine(machineId: string): Promise<boolean>;
-    /** The environment's active machine, or null. */
-    activeFor(environmentId: string): Promise<ActiveMachine | null>;
+    /** The device's active machine, or null. */
+    activeFor(deviceId: string): Promise<ActiveMachine | null>;
     /**
      * After a revocation commits: `stop` is queued only while a replica holds the connection (an
      * offline machine must not find it on the list later), then the revocation is published.

package/dist/{devices → local-devices}/machines.js

@@ -17,10 +17,10 @@ import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KERNEL_BUS, KERNEL_LOGGER } from "../infra/tokens.js";
-import { DEVICE_PROVIDER } from "../sandbox/providers.js";
-import { environmentNotFound } from "../sandbox/sandbox.service.js";
+import { LOCAL_PROVIDER } from "../sandbox/providers.js";
+import { deviceNotFound } from "../sandbox/sandbox.service.js";
 import { deviceRevokedTopic } from "./keys.js";
-import { DeviceRelay } from "./relay.js";
+import { LocalDeviceRelay } from "./relay.js";
 /** The machine credential's prefix (`cap_dev_` plus 32 random bytes, base64url). */
 export const MACHINE_CREDENTIAL_PREFIX = "cap_dev_";
 const CREDENTIAL_RE = /^cap_dev_[A-Za-z0-9_-]{43}$/;
@@ -28,12 +28,12 @@ const CREDENTIAL_RE = /^cap_dev_[A-Za-z0-9_-]{43}$/;
 const STOP_DEADLINE_MS = 30_000;
 /**
  * Connected machines and their credentials (environments spec §13.2). One active machine per
- * device environment: issuing a credential revokes the environment's previous machine. A
+ * local device: issuing a credential revokes the device's previous machine. A
  * credential is `cap_dev_` plus 32 random bytes; only its sha256 is stored. It is accepted only
  * by the device connection route ({@link authenticate}), never by `/api`: it is no `Principal`.
  *
  * A revoked machine is told so after the commit: `stop { reason }` relayed while a replica holds
- * its connection (fire-and-forget, ruling R14) and `device.revoked.<environmentId>` published with
+ * its connection (fire-and-forget, ruling R14) and `device.revoked.<deviceId>` published with
  * `{ machineId }`, so the holder closes that machine's connection.
  */
 let MachinesService = class MachinesService {
@@ -50,16 +50,16 @@ let MachinesService = class MachinesService {
         this.log = log;
     }
     /**
-     * A new machine for the environment and its credential (returned once). Revokes the
-     * environment's active machine first. Joins the caller's transaction (the device confirmation),
-     * which has already checked the environment is the person's own live device environment.
+     * A new machine for the device and its credential (returned once). Revokes the
+     * device's active machine first. Joins the caller's transaction (the device confirmation),
+     * which has already checked the device is the person's own live local device.
      */
     async issue(input) {
-        // the machine the environment was last served from (revoked or not)
+        // the machine the device was last served from (revoked or not)
         const prev = await this.db
-            .selectFrom("environment_machines")
+            .selectFrom("device_machines")
             .select(["name", "os", "arch"])
-            .where("environment_id", "=", input.environmentId)
+            .where("device_id", "=", input.deviceId)
             .orderBy("created_at", "desc")
             .orderBy("id", "desc")
             .limit(1)
@@ -67,14 +67,14 @@ let MachinesService = class MachinesService {
         // another machine has other files (maintainer decision 2026-11-08)
         const moved = prev !== undefined && !sameMachine(prev, input);
         // no stop frame: it would wait on the list and could reach the replacement machine instead
-        await this.revokeActive(input.environmentId, null);
-        await this.resetInstance(input.environmentId, moved);
+        await this.revokeActive(input.deviceId, null);
+        await this.resetInstance(input.deviceId, moved);
         const credential = MACHINE_CREDENTIAL_PREFIX + randomBytes(32).toString("base64url");
         const row = await this.db
-            .insertInto("environment_machines")
+            .insertInto("device_machines")
             .values({
             org_id: input.orgId,
-            environment_id: input.environmentId,
+            device_id: input.deviceId,
             account_id: input.accountId,
             credential_hash: sha256Hex(credential),
             name: input.name,
@@ -87,20 +87,20 @@ let MachinesService = class MachinesService {
         return { machineId: row.id, credential };
     }
     /**
-     * Ruling R23: the new machine may serve the environment from another directory or mode (other
+     * Ruling R23: the new machine may serve the device from another directory or mode (other
      * roots), and a login recreates a directory that was lost (ruling R24). So the instance row
      * forgets its instance (status `none`, no handle) and its files count as there again; the next
-     * use creates a fresh instance on the machine (with its roots: a new `environment_paths` event
+     * use creates a fresh instance on the machine (with its roots: a new `device_paths` event
      * follows). The fence moves on, so a lifecycle holder of the old instance fails its next write.
      * The reset count (`fs_resets`) moves on when the files the next instance sees are not the old
      * ones, so conversations that used the old files are told their files were reset, not that they
      * were kept: lost files come back as an empty directory, and another machine (`moved`: name, OS
-     * or arch differ from the environment's previous machine) has other files. Another directory on
+     * or arch differ from the device's previous machine) has other files. Another directory on
      * the same machine is known only from the new machine's first hello ({@link recordHello}).
      */
-    async resetInstance(environmentId, moved) {
+    async resetInstance(deviceId, moved) {
         await this.db
-            .updateTable("environment_instances")
+            .updateTable("device_instances")
             .set((eb) => ({
             status: "none",
             handle: null,
@@ -113,11 +113,11 @@ let MachinesService = class MachinesService {
                 ? sql `fs_resets + 1`
                 : sql `CASE WHEN fs_status = 'lost' THEN fs_resets + 1 ELSE fs_resets END`,
         }))
-            .where("environment_id", "=", environmentId)
+            .where("device_id", "=", deviceId)
             .execute();
     }
     /**
-     * Who a machine credential stands for, or null: the machine is not revoked, its environment is
+     * Who a machine credential stands for, or null: the machine is not revoked, its device is
      * live, the org is not deleted (ruling R12), and the person is an active account still a member
      * of the org. Read live on every call (a connection re-checks it as it sees fit).
      */
@@ -125,17 +125,17 @@ let MachinesService = class MachinesService {
         if (!CREDENTIAL_RE.test(credential))
             return null;
         const row = await this.db
-            .selectFrom("environment_machines as m")
-            .innerJoin("environments as e", "e.id", "m.environment_id")
+            .selectFrom("device_machines as m")
+            .innerJoin("devices as e", "e.id", "m.device_id")
             .innerJoin("orgs as o", "o.id", "m.org_id")
             .innerJoin("memberships as ms", (j) => j.onRef("ms.org_id", "=", "m.org_id").onRef("ms.account_id", "=", "m.account_id"))
             .innerJoin("accounts as a", "a.id", "m.account_id")
-            .select(["m.id", "m.org_id", "m.environment_id", "m.account_id"])
+            .select(["m.id", "m.org_id", "m.device_id", "m.account_id"])
             .where("m.credential_hash", "=", sha256Hex(credential))
             .where("m.revoked_at", "is", null)
             .whereRef("e.org_id", "=", "m.org_id")
             .where("e.deleted_at", "is", null)
-            .where("e.source", "=", "device")
+            .where("e.source", "=", "local")
             .where("o.deleted_at", "is", null)
             .where("a.status", "=", "active")
             .executeTakeFirst();
@@ -143,23 +143,23 @@ let MachinesService = class MachinesService {
             ? {
                 machineId: row.id,
                 orgId: row.org_id,
-                environmentId: row.environment_id,
+                deviceId: row.device_id,
                 accountId: row.account_id,
             }
             : null;
     }
     /**
      * Stores what the program reported in its hello frame and marks the machine seen. On the
-     * machine's first hello, when it is the same machine as the environment's previous one (else
+     * machine's first hello, when it is the same machine as the device's previous one (else
      * {@link issue} already counted the reset) but serves another directory or mode (other roots,
-     * ruling R23), the environment's files are other files: `fs_resets` moves on (maintainer
+     * ruling R23), the device's files are other files: `fs_resets` moves on (maintainer
      * decision 2026-11-08), so conversations get the files-reset notice. A previous machine that
      * never said hello has no known roots: nothing to compare.
      */
     async recordHello(machineId, hello) {
         const self = await this.db
-            .selectFrom("environment_machines")
-            .select(["environment_id", "name", "os", "arch", "roots", "created_at"])
+            .selectFrom("device_machines")
+            .select(["device_id", "name", "os", "arch", "roots", "created_at"])
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
             .forUpdate()
@@ -168,10 +168,10 @@ let MachinesService = class MachinesService {
             return;
         if (self.roots === null) {
             const prev = await this.db
-                .selectFrom("environment_machines")
+                .selectFrom("device_machines")
                 .select(["name", "os", "arch", "mode"])
                 .select(sql `roots = ${JSON.stringify(hello.roots)}::jsonb`.as("same_roots"))
-                .where("environment_id", "=", self.environment_id)
+                .where("device_id", "=", self.device_id)
                 .where("id", "!=", machineId)
                 .where("created_at", "<=", self.created_at)
                 .where("roots", "is not", null)
@@ -183,14 +183,14 @@ let MachinesService = class MachinesService {
                 sameMachine(prev, self) &&
                 (!prev.same_roots || prev.mode !== hello.mode)) {
                 await this.db
-                    .updateTable("environment_instances")
+                    .updateTable("device_instances")
                     .set({ fs_resets: sql `fs_resets + 1` })
-                    .where("environment_id", "=", self.environment_id)
+                    .where("device_id", "=", self.device_id)
                     .execute();
             }
         }
         await this.db
-            .updateTable("environment_machines")
+            .updateTable("device_machines")
             .set({
             program_version: hello.programVersion,
             os: hello.os,
@@ -207,7 +207,7 @@ let MachinesService = class MachinesService {
     /** Marks the machine seen (a ping); writes at most once every 60 seconds. */
     async touch(machineId) {
         await this.db
-            .updateTable("environment_machines")
+            .updateTable("device_machines")
             .set({ last_seen_at: sql `now()` })
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
@@ -218,56 +218,56 @@ let MachinesService = class MachinesService {
             .execute();
     }
     /**
-     * Disconnects the machine of one of the person's own live device environments (`DELETE
-     * /orgs/:orgId/environments/:id/machine`): revokes it and audits
-     * `environment.machine_revoked`. Anyone else's environment, a cloud one or a missing one →
-     * `environment.not_found`; no machine connected is a no-op.
+     * Disconnects the machine of one of the person's own live local devices (`DELETE
+     * /orgs/:orgId/devices/:id/machine`): revokes it and audits
+     * `device.machine_revoked`. Anyone else's device, a cloud one or a missing one →
+     * `device.not_found`; no machine connected is a no-op.
      */
-    async revoke(orgId, accountId, environmentId, actorTokenId) {
+    async revoke(orgId, accountId, deviceId, actorTokenId) {
         const env = await this.db
-            .selectFrom("environments")
+            .selectFrom("devices")
             .select("id")
-            .where("id", "=", environmentId)
+            .where("id", "=", deviceId)
             .where("org_id", "=", orgId)
             .where("owner_kind", "=", "personal")
             .where("owner_account_id", "=", accountId)
-            .where("source", "=", "device")
-            .where("provider", "=", DEVICE_PROVIDER)
+            .where("source", "=", "local")
+            .where("provider", "=", LOCAL_PROVIDER)
             .where("deleted_at", "is", null)
             .forNoKeyUpdate()
             .executeTakeFirst();
         if (!env)
-            throw environmentNotFound();
-        const machineId = await this.revokeActive(environmentId, "revoked");
+            throw deviceNotFound();
+        const machineId = await this.revokeActive(deviceId, "revoked");
         if (machineId === null)
             return;
         await audit(this.db.db, {
             actorAccountId: accountId,
             ...(actorTokenId !== undefined && { actorTokenId }),
             orgId,
-            action: "environment.machine_revoked",
-            target: environmentId,
+            action: "device.machine_revoked",
+            target: deviceId,
             detail: { machineId },
         });
     }
     /**
-     * Revokes the environment's active machine, if any, in the caller's transaction, and after the
+     * Revokes the device's active machine, if any, in the caller's transaction, and after the
      * commit tells it to stop for `reason` (none: only its connection is closed) and closes its
      * connection. Returns the revoked machine's id. Used by {@link issue} (replaced: no stop),
-     * {@link revoke} and the environment's deletion (`deleted`).
+     * {@link revoke} and the device's deletion (`deleted`).
      */
-    async revokeActive(environmentId, reason) {
+    async revokeActive(deviceId, reason) {
         const row = await this.db
-            .updateTable("environment_machines")
+            .updateTable("device_machines")
             .set({ revoked_at: sql `now()` })
-            .where("environment_id", "=", environmentId)
+            .where("device_id", "=", deviceId)
             .where("revoked_at", "is", null)
             .returning("id")
             .executeTakeFirst();
         if (!row)
             return null;
         const machineId = row.id;
-        afterCommit(() => this.disconnect(environmentId, machineId, reason));
+        afterCommit(() => this.disconnect(deviceId, machineId, reason));
         return machineId;
     }
     /**
@@ -276,22 +276,22 @@ let MachinesService = class MachinesService {
      */
     async revokeMachine(machineId) {
         const row = await this.db
-            .updateTable("environment_machines")
+            .updateTable("device_machines")
             .set({ revoked_at: sql `now()` })
             .where("id", "=", machineId)
             .where("revoked_at", "is", null)
-            .returning("environment_id")
+            .returning("device_id")
             .executeTakeFirst();
         if (!row)
             return false;
-        const environmentId = row.environment_id;
-        afterCommit(() => this.disconnect(environmentId, machineId, null));
+        const deviceId = row.device_id;
+        afterCommit(() => this.disconnect(deviceId, machineId, null));
         return true;
     }
-    /** The environment's active machine, or null. */
-    async activeFor(environmentId) {
+    /** The device's active machine, or null. */
+    async activeFor(deviceId) {
         const r = await this.db
-            .selectFrom("environment_machines")
+            .selectFrom("device_machines")
             .select([
             "id",
             "org_id",
@@ -303,7 +303,7 @@ let MachinesService = class MachinesService {
             "last_seen_at",
             "created_at",
         ])
-            .where("environment_id", "=", environmentId)
+            .where("device_id", "=", deviceId)
             .where("revoked_at", "is", null)
             .executeTakeFirst();
         return r
@@ -325,20 +325,20 @@ let MachinesService = class MachinesService {
      * offline machine must not find it on the list later), then the revocation is published.
      * Failures are logged; the revocation itself stands.
      */
-    async disconnect(environmentId, machineId, reason) {
+    async disconnect(deviceId, machineId, reason) {
         try {
-            if (reason !== null && (await this.relay.holderLive(environmentId))) {
-                await this.relay.send(environmentId, "stop", { reason }, STOP_DEADLINE_MS);
+            if (reason !== null && (await this.relay.holderLive(deviceId))) {
+                await this.relay.send(deviceId, "stop", { reason }, STOP_DEADLINE_MS);
             }
         }
         catch (err) {
-            this.log.warn("could not tell a revoked machine to stop", { environmentId, machineId, err });
+            this.log.warn("could not tell a revoked machine to stop", { deviceId, machineId, err });
         }
         try {
-            await this.bus.publish(deviceRevokedTopic(environmentId), { machineId });
+            await this.bus.publish(deviceRevokedTopic(deviceId), { machineId });
         }
         catch (err) {
-            this.log.warn("could not publish a machine revocation", { environmentId, machineId, err });
+            this.log.warn("could not publish a machine revocation", { deviceId, machineId, err });
         }
     }
 };
@@ -355,7 +355,7 @@ MachinesService = __decorate([
     Injectable(),
     __param(0, Inject(KernelDb)),
     __param(1, Inject(TransactionHost)),
-    __param(2, Inject(DeviceRelay)),
+    __param(2, Inject(LocalDeviceRelay)),
     __param(3, Inject(KERNEL_BUS)),
     __param(4, Inject(KERNEL_LOGGER))
 ], MachinesService);

package/dist/{devices → local-devices}/relay.d.ts

@@ -5,10 +5,10 @@ import { KernelConfigService } from "../infra/config/kernel-config.service.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import type { KernelLogger } from "../log.js";
 import { DeviceTargets } from "./targets.js";
-/** The environment's connected machine is not connected (no replica holds its lease). */
-export declare const environmentOffline: () => ApiError;
+/** The device's connected machine is not connected (no replica holds its lease). */
+export declare const deviceOffline: () => ApiError;
 /**
- * The environment's machine was disconnected (revoked, signed out): 403 `environment.forbidden`
+ * The device's machine was disconnected (revoked, signed out): 403 `device.forbidden`
  * with `details: [{ reason: "machine_revoked" }]`, so the tools tell the model what to ask for.
  */
 export declare const machineRevoked: () => ApiError;
@@ -31,8 +31,8 @@ export interface DeviceCallOptions {
 }
 /**
  * The caller side of the device relay (environments spec §13.4). A request goes onto the
- * environment's Redis list (`capk:device-req:<environmentId>`) and is announced on
- * `device.req.<environmentId>`; whichever gateway replica holds the machine's lease drains the
+ * device's Redis list (`capk:device-req:<deviceId>`) and is announced on
+ * `device.req.<deviceId>`; whichever gateway replica holds the machine's lease drains the
  * list and forwards the frames to the machine.
  *
  * **The holder's half of the wire** (Task 6 follows it): items on the list are `KernelReq` or
@@ -45,13 +45,13 @@ export interface DeviceCallOptions {
  * The caller subscribes to its result topic before pushing and reads the result key once after,
  * and once more before giving up (the run-abort pattern; a publish lost while the subscriber
  * reconnects is still found). It waits within its own call for at most `deadlineMs` plus
- * `environments.device.reconnectGraceSeconds`; when the lease disappears meanwhile (checked every
+ * `devices.local.reconnectGraceSeconds`; when the lease disappears meanwhile (checked every
  * {@link HOLDER_POLL_MS}) the wait ends at most one grace later. A result produced while the
  * machine was disconnected arrives after it reconnects. Giving up (grace, abort, a bad result)
  * removes the request from the list, or queues a `cancel` when the machine already took it
  * (ruling R15). Nothing is kept in process memory beyond the call.
  */
-export declare class DeviceRelay {
+export declare class LocalDeviceRelay {
     private readonly redis;
     private readonly bus;
     private readonly locks;
@@ -60,27 +60,27 @@ export declare class DeviceRelay {
     private readonly targets;
     constructor(redis: Redis, bus: ExtensionContext["bus"], locks: Pick<LockService, "holderOf">, config: Pick<KernelConfigService, "get">, log: Pick<KernelLogger, "warn">, targets: Pick<DeviceTargets, "state">);
     /** Whether a gateway replica holds the machine's connection now. */
-    holderLive(environmentId: string): Promise<boolean>;
+    holderLive(deviceId: string): Promise<boolean>;
     /**
      * Queues `op` for the machine without waiting for an answer (ruling R14: `stop`). The caller
      * checks {@link holderLive} first; the frame waits on the list for the grace like any request.
      */
-    send(environmentId: string, op: DeviceOp, args: unknown, deadlineMs: number): Promise<void>;
+    send(deviceId: string, op: DeviceOp, args: unknown, deadlineMs: number): Promise<void>;
     /**
-     * Runs `op` on the environment's machine and returns its validated result. Throws
-     * `environment.offline` when no replica holds the machine at send time or when the wait ran
-     * out, but `environment.forbidden` ({@link machineRevoked}) when the machine was revoked and
-     * `environment.not_found` when the environment was deleted (checked whenever the connection is
+     * Runs `op` on the device's machine and returns its validated result. Throws
+     * `device.offline` when no replica holds the machine at send time or when the wait ran
+     * out, but `device.forbidden` ({@link machineRevoked}) when the machine was revoked and
+     * `device.not_found` when the device was deleted (checked whenever the connection is
      * missing, ruling R27); the machine's failures map to `SandboxGoneError` (`gone`),
      * `FileSystemGoneError` (`fs_gone`) or a `ToolError` (`policy`, and `error` prefixed
      * {@link ON_MACHINE_PREFIX}); an invalid answer throws a `DeviceProtocolError`. On abort the
      * abort reason is thrown.
      */
-    call<Op extends DeviceOp>(environmentId: string, op: Op, args: unknown, opts: DeviceCallOptions): Promise<DeviceOpResults[Op]>;
+    call<Op extends DeviceOp>(deviceId: string, op: Op, args: unknown, opts: DeviceCallOptions): Promise<DeviceOpResults[Op]>;
     /** {@link holderLive}, or undefined when it takes longer than {@link LEASE_CHECK_TIMEOUT_MS}. */
     private leaseCheck;
     /**
-     * The environment's state ({@link DeviceTargets}), or undefined when it cannot be read within
+     * The device's state ({@link DeviceTargets}), or undefined when it cannot be read within
      * {@link LEASE_CHECK_TIMEOUT_MS} (a failure only logs: the caller keeps its other rules).
      */
     private targetState;