@nebutra/agent-runtime 0.2.0

package/README.md

@@ -0,0 +1,50 @@
+# @nebutra/agent-runtime
+
+> Status: WIP — not yet integrated into a production app. Track-B kernel
+> transport and durable-turn queue binding are interface-only.
+
+Multi-tenant **agent-runtime grammar**. A faithful re-expression of a terminal
+coding-agent's runtime *design* into Sailor's grammar — TypeScript,
+multi-tenant, zero infra changes, **no in-process untrusted-code execution**.
+
+## Why this exists
+
+Sailor already covers the surrounding capabilities (`@nebutra/agents` for model
+execution + provider routing + fallback + telemetry, `@nebutra/tenant`,
+`@nebutra/db`, `@nebutra/permissions`, `@nebutra/queue`, `@nebutra/mcp`,
+`backends/gateway`). What it lacked was a *coherent runtime grammar*: a
+thread/turn/item model, a two-axis approval/capability policy, an event-sourced
+session trace, and a uniform tool/MCP abstraction. This package supplies exactly
+that and nothing else — it **wraps** existing primitives, it does not rebuild
+them.
+
+## Dual-track architecture
+
+- **Track A (this package)** — policy, protocol contract, model, rollout. All
+  tenant-scoped. Runs inside Sailor's TS web runtime.
+- **Track B (decoupled, not this repo)** — an optional self-hosted isolator /
+  kernel sidecar that implements `ExternalSandbox` over the `./protocol`
+  contract. The protocol is the only coupling seam.
+
+## Modules
+
+| Export | Capability | What it gives you |
+|---|---|---|
+| `./model` | thread/turn/item + event lifecycle | discriminated-union item taxonomy, `started/updated/completed/failed` SM, per-turn config snapshot+override |
+| `./policy` | approval × capability axes | `ApprovalPolicy`, `CapabilityPolicy` (default `external_sandbox`), rule `Decision`, rich `ReviewDecision` |
+| `./protocol` | JSON-RPC contract | method registry, **tenant+thread serialization scope**, server-initiated approval requests, notifications |
+| `./tools` | uniform tool/MCP | `ToolRegistry` (registry→router→hooks), `adaptMcpTool` (MCP-as-adapter) |
+| `./rollout` | event-sourced trace | append-only typed log, replay-to-state, compaction marker, per-item persistence policy |
+| `./sandbox` | external-sandbox seam | `ExternalSandbox` delegation interface; fail-closed `REFUSING_SANDBOX` default |
+| `./adapters/*` | reusable concrete bindings | MCP catalog, Web-standard SSE transport, and Prisma rollout persistence without a separate package |
+
+## Non-negotiables enforced here
+
+- **Multi-tenant**: every scope, store key, and dispatch carries `tenantId`;
+  cross-tenant requests can never share a serialization scope.
+- **No infra change**: no sandbox runtime, no new datastore — only interfaces.
+- **No in-process untrusted exec**: the default executor refuses; real
+  execution is delegated to a decoupled isolator.
+
+See `docs/capabilities/agent-runtime/` for the capability map and replication
+guide.

package/dist/adapters/dispatcher-sse.d.ts

@@ -0,0 +1,68 @@
+import { ProtocolDispatcher } from '../dispatcher.js';
+import { ThreadEvent } from '../model.js';
+import { NotificationName } from '../protocol.js';
+import 'zod';
+
+/**
+ * Runtime-agnostic SSE / HTTP transport binding for `ProtocolDispatcher`.
+ *
+ * Built on Web-standard primitives ONLY — `Request`, `Response`,
+ * `ReadableStream`, `TextEncoder`, `AbortSignal`. There is no Hono / Express /
+ * `node:http` dependency, so the same code runs unchanged on edge runtimes,
+ * Cloudflare Workers, Deno, Bun, and Node (>=18, where these globals exist).
+ *
+ * Design goals:
+ *  - Pure functions returning Web objects; nothing is mutated in place.
+ *  - The dispatcher already fails closed on a missing `tenantId` (its
+ *    `requestEnvelopeSchema` makes `tenantId` mandatory). This binding does
+ *    not re-implement that policy — it faithfully relays the JSON-RPC error.
+ *  - Never throw across the transport boundary and never leak a stack trace:
+ *    a malformed body becomes a well-formed JSON-RPC parse error.
+ *
+ * Wire framing (SSE): each event is emitted as
+ *   `event: <ThreadEvent.type>\n` + `data: <JSON(event)>\n\n`
+ */
+
+/**
+ * Build a Web-standard request handler bound to a dispatcher.
+ *
+ * Contract:
+ *  - Unparseable body → `400` with a JSON-RPC parse-error envelope.
+ *  - Any parseable body (incl. missing tenant / unknown method / handler
+ *    failure) → `200` with the dispatcher's own JSON-RPC envelope. The HTTP
+ *    layer stays `200` for business-level JSON-RPC errors per JSON-RPC-over-
+ *    HTTP convention; the error lives in the envelope, not the status line.
+ *  - The returned function never throws and never emits a 500-with-stack.
+ */
+declare function createRpcHandler(dispatcher: ProtocolDispatcher): (request: Request) => Promise<Response>;
+interface SseOptions {
+    /** Cancels the stream cleanly; closing the consumer also cancels it. */
+    readonly signal?: AbortSignal;
+}
+/**
+ * Adapt an async `ThreadEvent` stream into a Web-standard
+ * `text/event-stream` `Response`.
+ *
+ * Guarantees:
+ *  - Incremental flush: each event is enqueued as soon as it is produced.
+ *  - Clean termination: the stream closes when the iterable is exhausted.
+ *  - Error surfacing: an iterable error is emitted as a final
+ *    `event: error` frame, then the stream closes (it never hangs).
+ *  - Cancellation: an aborted `signal` (or a cancelled reader) stops
+ *    pulling from the source and releases its iterator.
+ */
+declare function sseResponse(stream: AsyncIterable<ThreadEvent>, opts?: SseOptions): Response;
+interface NotificationFrame {
+    readonly name: NotificationName;
+    readonly payload: unknown;
+}
+/**
+ * Bridge `dispatcher.onNotification` (a push listener API) into a pull-based
+ * `AsyncIterable`. A bounded backlog buffers events that arrive between
+ * `next()` calls; pending readers are resolved immediately when an event
+ * arrives. Calling `return()` (or breaking a `for await`) unsubscribes every
+ * underlying listener — no leaks, fail-closed teardown.
+ */
+declare function subscribeNotifications(dispatcher: ProtocolDispatcher, names: readonly NotificationName[]): AsyncIterable<NotificationFrame>;
+
+export { type NotificationFrame, type SseOptions, createRpcHandler, sseResponse, subscribeNotifications };

package/dist/adapters/dispatcher-sse.js

@@ -0,0 +1,11 @@
+import {
+  createRpcHandler,
+  sseResponse,
+  subscribeNotifications
+} from "../chunk-ZTSKS42I.js";
+export {
+  createRpcHandler,
+  sseResponse,
+  subscribeNotifications
+};
+//# sourceMappingURL=dispatcher-sse.js.map

package/dist/adapters/dispatcher-sse.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapters/index.d.ts

@@ -0,0 +1,12 @@
+export { NotificationFrame, SseOptions, createRpcHandler, sseResponse, subscribeNotifications } from './dispatcher-sse.js';
+export { McpExecutorLike, McpRegistryLike, createMcpClientPort, createMcpServerCatalog } from './mcp-catalog.js';
+export { PrismaRolloutDelegate, RolloutDelegateResolver, createPrismaRolloutPersistence } from './prisma-rollout.js';
+import '../dispatcher.js';
+import '../protocol.js';
+import 'zod';
+import '../model.js';
+import '@nebutra/mcp';
+import '../mcp-bridge.js';
+import '../tools.js';
+import '../rollout-store-persistent.js';
+import '../rollout.js';

package/dist/adapters/index.js

@@ -0,0 +1,21 @@
+import {
+  createRpcHandler,
+  sseResponse,
+  subscribeNotifications
+} from "../chunk-ZTSKS42I.js";
+import {
+  createMcpClientPort,
+  createMcpServerCatalog
+} from "../chunk-24ZXP7FI.js";
+import {
+  createPrismaRolloutPersistence
+} from "../chunk-57W3AR43.js";
+export {
+  createMcpClientPort,
+  createMcpServerCatalog,
+  createPrismaRolloutPersistence,
+  createRpcHandler,
+  sseResponse,
+  subscribeNotifications
+};
+//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapters/mcp-catalog.d.ts

@@ -0,0 +1,58 @@
+import { MCPContext, ToolExecutionResult, MCPServerRegistry } from '@nebutra/mcp';
+import { McpServerCatalogPort } from '../mcp-bridge.js';
+import { McpClientLike } from '../tools.js';
+import 'zod';
+
+/**
+ * MCP catalog adapter — concrete wiring of `@nebutra/mcp` into
+ * `@nebutra/agent-runtime`'s injectable ports.
+ *
+ * `@nebutra/agent-runtime` is intentionally dependency-free: it declares the
+ * `McpServerCatalogPort` / `McpClientLike` ports and an `activateMcpTools`
+ * composer, but never imports `@nebutra/mcp`. This module supplies the only
+ * concrete bridge so apps/backends reuse it instead of re-implementing glue.
+ *
+ * Invariants:
+ *  - tenantId is mandatory and validated *before* any registry/client call
+ *    (fail-closed): an empty/blank tenant can never enumerate or execute.
+ *  - Plan/tenant gating is delegated to `MCPServerRegistry` — a tenant only
+ *    ever sees the tools its plan/tenant policy permits.
+ *  - MCP `parameters` are translated into a Zod `inputSchema`; a tool with no
+ *    usable schema still yields a permissive, never-crashing definition.
+ *  - The MCP `ToolExecutionResult` envelope is unwrapped: a non-success
+ *    result throws (fail-closed) rather than leaking a falsy value upstream.
+ *
+ * Both factories accept an injected dependency (registry / client) and default
+ * to the `@nebutra/mcp` singletons, keeping the module free of hidden globals
+ * and fully unit-testable.
+ */
+
+/** Narrow structural shapes — we depend on behaviour, not concrete classes. */
+/** The slice of `MCPServerRegistry` the catalog port needs. */
+type McpRegistryLike = Pick<MCPServerRegistry, "getAccessibleTools">;
+/** The slice of `mcpClient` the client port needs. */
+interface McpExecutorLike {
+    executeTool(name: string, args: Record<string, unknown>, ctx: MCPContext): Promise<ToolExecutionResult>;
+}
+/**
+ * Adapt `MCPServerRegistry`'s plan/tenant-gated tool listing into the
+ * agent-runtime `McpServerCatalogPort`.
+ *
+ * @param registry  Defaults to `@nebutra/mcp`'s `serverRegistry` singleton;
+ *                   inject a fresh `MCPServerRegistry` for tests/multi-tenant
+ *                   isolation.
+ */
+declare function createMcpServerCatalog(registry?: McpRegistryLike): McpServerCatalogPort;
+/**
+ * Adapt `@nebutra/mcp`'s `mcpClient` into agent-runtime's `McpClientLike`.
+ *
+ * Maps `{ requestId, tenantId }` → the richer `MCPContext`, and unwraps the
+ * `ToolExecutionResult` envelope: a non-success result throws so a failed MCP
+ * call never silently surfaces as a falsy tool output.
+ *
+ * @param client  Defaults to `@nebutra/mcp`'s `mcpClient` singleton;
+ *                inject a fake for tests.
+ */
+declare function createMcpClientPort(client?: McpExecutorLike): McpClientLike;
+
+export { type McpExecutorLike, type McpRegistryLike, createMcpClientPort, createMcpServerCatalog };

package/dist/adapters/mcp-catalog.js

@@ -0,0 +1,9 @@
+import {
+  createMcpClientPort,
+  createMcpServerCatalog
+} from "../chunk-24ZXP7FI.js";
+export {
+  createMcpClientPort,
+  createMcpServerCatalog
+};
+//# sourceMappingURL=mcp-catalog.js.map

package/dist/adapters/mcp-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/adapters/prisma-rollout.d.ts

@@ -0,0 +1,60 @@
+import { RolloutPersistencePort } from '../rollout-store-persistent.js';
+import '../rollout.js';
+import '../model.js';
+
+/**
+ * Durable rollout-store backend: `RolloutPersistencePort` over Prisma.
+ *
+ * This is the fail-loud system-of-record adapter (table `agent_rollout_lines`,
+ * migration `20260519000000_add_agent_rollout_store`). Unlike a best-effort
+ * audit log it never swallows a failed write — a rejected `put` propagates so
+ * the caller's "never silently drop" contract holds.
+ *
+ * Reusability: it depends only on a minimal injected delegate (the
+ * `PrismaAuditDelegate` pattern), NOT on the generated Prisma client or
+ * `@nebutra/db`. Any tenant-scoped Prisma client (`getTenantDb(orgId)`)
+ * structurally satisfies it, so this package stays dependency-light.
+ */
+
+/**
+ * Minimal structural slice of `prisma.agentRolloutLine`. Decoupled from the
+ * generated client on purpose — only these two operations are needed.
+ */
+interface PrismaRolloutDelegate {
+    create(args: {
+        data: {
+            tenantId: string;
+            threadId: string;
+            seq: number;
+            at: Date;
+            payload: string;
+        };
+    }): Promise<unknown>;
+    findMany(args: {
+        where: {
+            tenantId: string;
+            threadId: string;
+        };
+        orderBy: {
+            seq: "asc";
+        };
+        select: {
+            seq: true;
+            payload: true;
+        };
+    }): Promise<{
+        seq: number;
+        payload: string;
+    }[]>;
+}
+/** Resolves the delegate per call so a request-scoped (RLS) client can be used. */
+type RolloutDelegateResolver = PrismaRolloutDelegate | ((tenantId: string) => PrismaRolloutDelegate | Promise<PrismaRolloutDelegate>);
+/**
+ * Build a {@link RolloutPersistencePort} backed by Prisma.
+ *
+ * @param delegate a `PrismaRolloutDelegate`, or a resolver mapping a tenantId
+ *   to one (use the latter to obtain a per-tenant RLS client per call).
+ */
+declare function createPrismaRolloutPersistence(delegate: RolloutDelegateResolver): RolloutPersistencePort;
+
+export { type PrismaRolloutDelegate, type RolloutDelegateResolver, createPrismaRolloutPersistence };

package/dist/adapters/prisma-rollout.js

@@ -0,0 +1,7 @@
+import {
+  createPrismaRolloutPersistence
+} from "../chunk-57W3AR43.js";
+export {
+  createPrismaRolloutPersistence
+};
+//# sourceMappingURL=prisma-rollout.js.map

package/dist/adapters/prisma-rollout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-24ZXP7FI.js

@@ -0,0 +1,93 @@
+// src/adapters/mcp-catalog.ts
+import { mcpClient, serverRegistry } from "@nebutra/mcp";
+import { z } from "zod";
+var tenantSchema = z.string({ message: "tenantId is required (fail-closed)" }).trim().min(1, "tenantId is required (fail-closed)");
+var catalogCtxSchema = z.object({
+  tenantId: tenantSchema,
+  plan: z.string().min(1).optional()
+});
+var clientCtxSchema = z.object({
+  requestId: z.string().min(1, "requestId is required"),
+  tenantId: tenantSchema
+});
+function paramToZod(param) {
+  switch (param.type) {
+    case "string":
+      return z.string();
+    case "number":
+      return z.number();
+    case "boolean":
+      return z.boolean();
+    case "array":
+      return z.array(z.unknown());
+    case "object":
+      return z.record(z.string(), z.unknown());
+    default:
+      return z.unknown();
+  }
+}
+function toInputSchema(parameters) {
+  const entries = parameters ? Object.entries(parameters) : [];
+  if (entries.length === 0) {
+    return z.record(z.string(), z.unknown());
+  }
+  const shape = {};
+  for (const [key, param] of entries) {
+    let leaf = paramToZod(param);
+    if (param.required !== true) {
+      leaf = leaf.optional();
+    }
+    shape[key] = leaf;
+  }
+  return z.object(shape).passthrough();
+}
+function toToolDefinition(tool) {
+  return {
+    name: tool.name,
+    description: tool.description ?? tool.name,
+    inputSchema: toInputSchema(tool.parameters)
+  };
+}
+function createMcpServerCatalog(registry = serverRegistry) {
+  return {
+    async listTools(ctx) {
+      const scope = catalogCtxSchema.parse(ctx);
+      const mcpCtx = {
+        requestId: "catalog-list",
+        tenantId: scope.tenantId,
+        ...scope.plan === void 0 ? {} : { plan: scope.plan }
+      };
+      const tools = registry.getAccessibleTools(mcpCtx);
+      return tools.map((tool) => ({
+        server: tool.serverId,
+        definition: toToolDefinition(tool)
+      }));
+    }
+  };
+}
+function createMcpClientPort(client = mcpClient) {
+  return {
+    async executeTool(name, args, ctx) {
+      const scope = clientCtxSchema.parse(ctx);
+      const mcpCtx = {
+        requestId: scope.requestId,
+        tenantId: scope.tenantId
+      };
+      const result = await client.executeTool(
+        name,
+        args ?? {},
+        mcpCtx
+      );
+      if (!result.success) {
+        throw new Error(`MCP tool "${name}" failed: ${result.error ?? "unknown error"}`);
+      }
+      return result.result;
+    }
+  };
+}
+
+export {
+  createMcpServerCatalog,
+  createMcpClientPort
+};
+//# sourceMappingURL=chunk-24ZXP7FI.js.map

package/dist/chunk-24ZXP7FI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/mcp-catalog.ts"],"sourcesContent":["/**\n * MCP catalog adapter — concrete wiring of `@nebutra/mcp` into\n * `@nebutra/agent-runtime`'s injectable ports.\n *\n * `@nebutra/agent-runtime` is intentionally dependency-free: it declares the\n * `McpServerCatalogPort` / `McpClientLike` ports and an `activateMcpTools`\n * composer, but never imports `@nebutra/mcp`. This module supplies the only\n * concrete bridge so apps/backends reuse it instead of re-implementing glue.\n *\n * Invariants:\n *  - tenantId is mandatory and validated *before* any registry/client call\n *    (fail-closed): an empty/blank tenant can never enumerate or execute.\n *  - Plan/tenant gating is delegated to `MCPServerRegistry` — a tenant only\n *    ever sees the tools its plan/tenant policy permits.\n *  - MCP `parameters` are translated into a Zod `inputSchema`; a tool with no\n *    usable schema still yields a permissive, never-crashing definition.\n *  - The MCP `ToolExecutionResult` envelope is unwrapped: a non-success\n *    result throws (fail-closed) rather than leaking a falsy value upstream.\n *\n * Both factories accept an injected dependency (registry / client) and default\n * to the `@nebutra/mcp` singletons, keeping the module free of hidden globals\n * and fully unit-testable.\n */\n\nimport type { MCPContext, MCPServerRegistry, ToolExecutionResult } from \"@nebutra/mcp\";\nimport { mcpClient, serverRegistry } from \"@nebutra/mcp\";\nimport { z } from \"zod\";\nimport type { McpServerCatalogPort } from \"../mcp-bridge\";\nimport type { McpClientLike, ToolDefinition } from \"../tools\";\n\n/** Narrow structural shapes — we depend on behaviour, not concrete classes. */\n\n/** The slice of `MCPServerRegistry` the catalog port needs. */\nexport type McpRegistryLike = Pick<MCPServerRegistry, \"getAccessibleTools\">;\n\n/** The slice of `mcpClient` the client port needs. */\nexport interface McpExecutorLike {\n  executeTool(\n    name: string,\n    args: Record<string, unknown>,\n    ctx: MCPContext,\n  ): Promise<ToolExecutionResult>;\n}\n\ntype McpParameter = {\n  type?: \"string\" | \"number\" | \"boolean\" | \"object\" | \"array\";\n  description?: string;\n  required?: boolean;\n  default?: unknown;\n};\n\ntype McpToolShape = {\n  name: string;\n  description?: string;\n  parameters?: Record<string, McpParameter> | undefined;\n  serverId: string;\n};\n\n/** Fail-closed tenant guard — the single chokepoint for both ports. */\nconst tenantSchema = z\n  .string({ message: \"tenantId is required (fail-closed)\" })\n  .trim()\n  .min(1, \"tenantId is required (fail-closed)\");\n\nconst catalogCtxSchema = z.object({\n  tenantId: tenantSchema,\n  plan: z.string().min(1).optional(),\n});\n\nconst clientCtxSchema = z.object({\n  requestId: z.string().min(1, \"requestId is required\"),\n  tenantId: tenantSchema,\n});\n\n/** Map one MCP parameter to its Zod leaf type. Unknown → permissive. */\nfunction paramToZod(param: McpParameter): z.ZodTypeAny {\n  switch (param.type) {\n    case \"string\":\n      return z.string();\n    case \"number\":\n      return z.number();\n    case \"boolean\":\n      return z.boolean();\n    case \"array\":\n      return z.array(z.unknown());\n    case \"object\":\n      return z.record(z.string(), z.unknown());\n    default:\n      return z.unknown();\n  }\n}\n\n/**\n * Build a Zod `inputSchema` from an MCP tool's `parameters`. A tool with no\n * declared parameters becomes a permissive passthrough object (never throws on\n * unknown keys) so schema-less MCP tools remain dispatchable.\n */\nfunction toInputSchema(parameters: Record<string, McpParameter> | undefined): z.ZodType {\n  const entries = parameters ? Object.entries(parameters) : [];\n  if (entries.length === 0) {\n    return z.record(z.string(), z.unknown());\n  }\n\n  const shape: Record<string, z.ZodTypeAny> = {};\n  for (const [key, param] of entries) {\n    let leaf = paramToZod(param);\n    if (param.required !== true) {\n      leaf = leaf.optional();\n    }\n    shape[key] = leaf;\n  }\n  // `passthrough` keeps unknown keys: MCP schemas are advisory, not strict.\n  return z.object(shape).passthrough();\n}\n\n/** Adapt one registry tool entry into an agent-runtime `ToolDefinition`. */\nfunction toToolDefinition(tool: McpToolShape): ToolDefinition {\n  return {\n    name: tool.name,\n    description: tool.description ?? tool.name,\n    inputSchema: toInputSchema(tool.parameters),\n  };\n}\n\n/**\n * Adapt `MCPServerRegistry`'s plan/tenant-gated tool listing into the\n * agent-runtime `McpServerCatalogPort`.\n *\n * @param registry  Defaults to `@nebutra/mcp`'s `serverRegistry` singleton;\n *                   inject a fresh `MCPServerRegistry` for tests/multi-tenant\n *                   isolation.\n */\nexport function createMcpServerCatalog(\n  registry: McpRegistryLike = serverRegistry,\n): McpServerCatalogPort {\n  return {\n    async listTools(ctx) {\n      const scope = catalogCtxSchema.parse(ctx); // fail-closed first\n\n      const mcpCtx: MCPContext = {\n        requestId: \"catalog-list\",\n        tenantId: scope.tenantId,\n        ...(scope.plan === undefined ? {} : { plan: scope.plan }),\n      };\n\n      const tools = registry.getAccessibleTools(mcpCtx) as McpToolShape[];\n\n      return tools.map((tool) => ({\n        server: tool.serverId,\n        definition: toToolDefinition(tool),\n      }));\n    },\n  };\n}\n\n/**\n * Adapt `@nebutra/mcp`'s `mcpClient` into agent-runtime's `McpClientLike`.\n *\n * Maps `{ requestId, tenantId }` → the richer `MCPContext`, and unwraps the\n * `ToolExecutionResult` envelope: a non-success result throws so a failed MCP\n * call never silently surfaces as a falsy tool output.\n *\n * @param client  Defaults to `@nebutra/mcp`'s `mcpClient` singleton;\n *                inject a fake for tests.\n */\nexport function createMcpClientPort(client: McpExecutorLike = mcpClient): McpClientLike {\n  return {\n    async executeTool(name, args, ctx) {\n      const scope = clientCtxSchema.parse(ctx); // fail-closed first\n\n      const mcpCtx: MCPContext = {\n        requestId: scope.requestId,\n        tenantId: scope.tenantId,\n      };\n\n      const result = await client.executeTool(\n        name,\n        (args ?? {}) as Record<string, unknown>,\n        mcpCtx,\n      );\n\n      if (!result.success) {\n        throw new Error(`MCP tool \"${name}\" failed: ${result.error ?? \"unknown error\"}`);\n      }\n      return result.result;\n    },\n  };\n}\n"],"mappings":";AAyBA,SAAS,WAAW,sBAAsB;AAC1C,SAAS,SAAS;AAiClB,IAAM,eAAe,EAClB,OAAO,EAAE,SAAS,qCAAqC,CAAC,EACxD,KAAK,EACL,IAAI,GAAG,oCAAoC;AAE9C,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,UAAU;AAAA,EACV,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AACnC,CAAC;AAED,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,uBAAuB;AAAA,EACpD,UAAU;AACZ,CAAC;AAGD,SAAS,WAAW,OAAmC;AACrD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO,EAAE,OAAO;AAAA,IAClB,KAAK;AACH,aAAO,EAAE,OAAO;AAAA,IAClB,KAAK;AACH,aAAO,EAAE,QAAQ;AAAA,IACnB,KAAK;AACH,aAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;AAAA,IAC5B,KAAK;AACH,aAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,IACzC;AACE,aAAO,EAAE,QAAQ;AAAA,EACrB;AACF;AAOA,SAAS,cAAc,YAAiE;AACtF,QAAM,UAAU,aAAa,OAAO,QAAQ,UAAU,IAAI,CAAC;AAC3D,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACzC;AAEA,QAAM,QAAsC,CAAC;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,OAAO,WAAW,KAAK;AAC3B,QAAI,MAAM,aAAa,MAAM;AAC3B,aAAO,KAAK,SAAS;AAAA,IACvB;AACA,UAAM,GAAG,IAAI;AAAA,EACf;AAEA,SAAO,EAAE,OAAO,KAAK,EAAE,YAAY;AACrC;AAGA,SAAS,iBAAiB,MAAoC;AAC5D,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe,KAAK;AAAA,IACtC,aAAa,cAAc,KAAK,UAAU;AAAA,EAC5C;AACF;AAUO,SAAS,uBACd,WAA4B,gBACN;AACtB,SAAO;AAAA,IACL,MAAM,UAAU,KAAK;AACnB,YAAM,QAAQ,iBAAiB,MAAM,GAAG;AAExC,YAAM,SAAqB;AAAA,QACzB,WAAW;AAAA,QACX,UAAU,MAAM;AAAA,QAChB,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAK;AAAA,MACzD;AAEA,YAAM,QAAQ,SAAS,mBAAmB,MAAM;AAEhD,aAAO,MAAM,IAAI,CAAC,UAAU;AAAA,QAC1B,QAAQ,KAAK;AAAA,QACb,YAAY,iBAAiB,IAAI;AAAA,MACnC,EAAE;AAAA,IACJ;AAAA,EACF;AACF;AAYO,SAAS,oBAAoB,SAA0B,WAA0B;AACtF,SAAO;AAAA,IACL,MAAM,YAAY,MAAM,MAAM,KAAK;AACjC,YAAM,QAAQ,gBAAgB,MAAM,GAAG;AAEvC,YAAM,SAAqB;AAAA,QACzB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,MAClB;AAEA,YAAM,SAAS,MAAM,OAAO;AAAA,QAC1B;AAAA,QACC,QAAQ,CAAC;AAAA,QACV;AAAA,MACF;AAEA,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI,MAAM,aAAa,IAAI,aAAa,OAAO,SAAS,eAAe,EAAE;AAAA,MACjF;AACA,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-2DA6Q6TN.js

@@ -0,0 +1,126 @@
+// src/rollout-store-persistent.ts
+import { z } from "zod";
+var RoundTripError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "RoundTripError";
+  }
+};
+var tenantId = z.string().min(1, "tenantId is required");
+var threadId = z.string().min(1, "threadId is required");
+var at = z.string().min(1);
+var turnConfigSchema = z.object({
+  model: z.string(),
+  provider: z.string(),
+  approvalPolicy: z.string(),
+  capabilityPolicy: z.string(),
+  reasoningEffort: z.enum(["low", "medium", "high"]).optional()
+});
+var threadEventSchema = z.custom(
+  (v) => typeof v === "object" && v !== null && typeof v.type === "string",
+  { message: "invalid ThreadEvent" }
+);
+var rolloutLineSchema = z.discriminatedUnion("type", [
+  z.object({
+    tenantId,
+    threadId,
+    type: z.literal("session_meta"),
+    config: turnConfigSchema,
+    at
+  }),
+  z.object({
+    tenantId,
+    threadId,
+    type: z.literal("event"),
+    event: threadEventSchema,
+    at
+  }),
+  z.object({
+    tenantId,
+    threadId,
+    type: z.literal("turn_context"),
+    config: turnConfigSchema,
+    at
+  }),
+  z.object({
+    tenantId,
+    threadId,
+    type: z.literal("compacted"),
+    summary: z.string(),
+    droppedThrough: z.string(),
+    at
+  })
+]);
+var tenantThreadSchema = z.object({ tenantId, threadId });
+var PersistentRolloutStore = class {
+  #port;
+  /**
+   * Per-(tenant,thread) seq allocation chained through a promise so concurrent
+   * `append` calls to the same thread serialize and never collide on seq —
+   * without blocking appends to other threads.
+   */
+  #tails = /* @__PURE__ */ new Map();
+  constructor(port) {
+    this.#port = port;
+  }
+  #key(t, th) {
+    return `${t}::${th}`;
+  }
+  async append(line) {
+    const validated = rolloutLineSchema.parse(line);
+    const key = this.#key(validated.tenantId, validated.threadId);
+    const prev = this.#tails.get(key) ?? Promise.resolve(-1);
+    const next = prev.then(async (last) => {
+      const seq = last + 1;
+      await this.#port.put({
+        tenantId: validated.tenantId,
+        threadId: validated.threadId,
+        seq,
+        at: validated.at,
+        payload: JSON.stringify(validated)
+      });
+      return seq;
+    });
+    this.#tails.set(
+      key,
+      next.catch(() => this.#tails.get(key) === next ? -1 : next)
+    );
+    await next;
+  }
+  async read(tenantIdArg, threadIdArg) {
+    const { tenantId: t, threadId: th } = tenantThreadSchema.parse({
+      tenantId: tenantIdArg,
+      threadId: threadIdArg
+    });
+    const records = await this.#port.list(t, th);
+    const ordered = [...records].sort((a, b) => a.seq - b.seq);
+    return ordered.map((r) => {
+      let parsed;
+      try {
+        parsed = JSON.parse(r.payload);
+      } catch (cause) {
+        throw new RoundTripError(`malformed stored payload at seq ${r.seq} for ${t}::${th}`, {
+          cause
+        });
+      }
+      const result = rolloutLineSchema.safeParse(parsed);
+      if (!result.success) {
+        throw new RoundTripError(
+          `structurally-invalid stored payload at seq ${r.seq} for ${t}::${th}`,
+          { cause: result.error }
+        );
+      }
+      const reconstructed = result.data;
+      if (reconstructed.tenantId !== t || reconstructed.threadId !== th) {
+        throw new RoundTripError(`tenant/thread mismatch at seq ${r.seq} for ${t}::${th}`);
+      }
+      return reconstructed;
+    });
+  }
+};
+
+export {
+  RoundTripError,
+  PersistentRolloutStore
+};
+//# sourceMappingURL=chunk-2DA6Q6TN.js.map

package/dist/chunk-2DA6Q6TN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rollout-store-persistent.ts"],"sourcesContent":["/**\n * Production-grade, tenant-scoped {@link RolloutStore} backed by an injectable\n * persistence port. This package depends on NO datastore: a Postgres /\n * ClickHouse / `@nebutra/db` / `@nebutra/audit` adapter satisfies\n * {@link RolloutPersistencePort} from the outside, so the \"no infra change\"\n * promise stays honest — swap the adapter, keep the interface.\n *\n * Tenancy is structural: `tenantId` is part of the storage key AND Zod-validated\n * on every read and write. Cross-tenant access is impossible by construction.\n * The store fails closed — empty identifiers and malformed stored payloads\n * raise typed errors; records are never silently dropped.\n */\n\nimport { z } from \"zod\";\nimport type { RolloutLine, RolloutStore } from \"./rollout\";\n\n/**\n * Minimal append-only persistence seam. Implementations MUST persist records\n * durably and return them ascending by `seq` for a given (tenant, thread).\n */\nexport interface RolloutPersistencePort {\n  put(record: {\n    tenantId: string;\n    threadId: string;\n    seq: number;\n    at: string;\n    payload: string;\n  }): Promise<void>;\n  /** Records for one (tenant, thread), ascending by seq. */\n  list(tenantId: string, threadId: string): Promise<{ seq: number; payload: string }[]>;\n}\n\n/** Raised when a stored payload cannot be faithfully reconstructed. */\nexport class RoundTripError extends Error {\n  constructor(message: string, options?: { cause?: unknown }) {\n    super(message, options);\n    this.name = \"RoundTripError\";\n  }\n}\n\nconst tenantId = z.string().min(1, \"tenantId is required\");\nconst threadId = z.string().min(1, \"threadId is required\");\nconst at = z.string().min(1);\n\nconst turnConfigSchema = z.object({\n  model: z.string(),\n  provider: z.string(),\n  approvalPolicy: z.string(),\n  capabilityPolicy: z.string(),\n  reasoningEffort: z.enum([\"low\", \"medium\", \"high\"]).optional(),\n});\n\nconst threadEventSchema = z.custom<RolloutLine extends { event: infer E } ? E : never>(\n  (v) => typeof v === \"object\" && v !== null && typeof (v as { type?: unknown }).type === \"string\",\n  { message: \"invalid ThreadEvent\" },\n);\n\nconst rolloutLineSchema: z.ZodType<RolloutLine> = z.discriminatedUnion(\"type\", [\n  z.object({\n    tenantId,\n    threadId,\n    type: z.literal(\"session_meta\"),\n    config: turnConfigSchema,\n    at,\n  }),\n  z.object({\n    tenantId,\n    threadId,\n    type: z.literal(\"event\"),\n    event: threadEventSchema,\n    at,\n  }),\n  z.object({\n    tenantId,\n    threadId,\n    type: z.literal(\"turn_context\"),\n    config: turnConfigSchema,\n    at,\n  }),\n  z.object({\n    tenantId,\n    threadId,\n    type: z.literal(\"compacted\"),\n    summary: z.string(),\n    droppedThrough: z.string(),\n    at,\n  }),\n]) as z.ZodType<RolloutLine>;\n\nconst tenantThreadSchema = z.object({ tenantId, threadId });\n\nexport class PersistentRolloutStore implements RolloutStore {\n  readonly #port: RolloutPersistencePort;\n  /**\n   * Per-(tenant,thread) seq allocation chained through a promise so concurrent\n   * `append` calls to the same thread serialize and never collide on seq —\n   * without blocking appends to other threads.\n   */\n  readonly #tails = new Map<string, Promise<number>>();\n\n  constructor(port: RolloutPersistencePort) {\n    this.#port = port;\n  }\n\n  #key(t: string, th: string): string {\n    return `${t}::${th}`;\n  }\n\n  async append(line: RolloutLine): Promise<void> {\n    const validated = rolloutLineSchema.parse(line);\n    const key = this.#key(validated.tenantId, validated.threadId);\n\n    const prev = this.#tails.get(key) ?? Promise.resolve(-1);\n    const next = prev.then(async (last) => {\n      const seq = last + 1;\n      await this.#port.put({\n        tenantId: validated.tenantId,\n        threadId: validated.threadId,\n        seq,\n        at: validated.at,\n        payload: JSON.stringify(validated),\n      });\n      return seq;\n    });\n    // Keep the chain advancing even if a put fails (fail-closed for the caller,\n    // but the next append must not deadlock on a rejected tail).\n    this.#tails.set(\n      key,\n      next.catch(() => (this.#tails.get(key) === next ? -1 : next)),\n    );\n    await next;\n  }\n\n  async read(tenantIdArg: string, threadIdArg: string): Promise<readonly RolloutLine[]> {\n    const { tenantId: t, threadId: th } = tenantThreadSchema.parse({\n      tenantId: tenantIdArg,\n      threadId: threadIdArg,\n    });\n\n    const records = await this.#port.list(t, th);\n    const ordered = [...records].sort((a, b) => a.seq - b.seq);\n\n    return ordered.map((r) => {\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(r.payload);\n      } catch (cause) {\n        throw new RoundTripError(`malformed stored payload at seq ${r.seq} for ${t}::${th}`, {\n          cause,\n        });\n      }\n      const result = rolloutLineSchema.safeParse(parsed);\n      if (!result.success) {\n        throw new RoundTripError(\n          `structurally-invalid stored payload at seq ${r.seq} for ${t}::${th}`,\n          { cause: result.error },\n        );\n      }\n      const reconstructed = result.data;\n      if (reconstructed.tenantId !== t || reconstructed.threadId !== th) {\n        throw new RoundTripError(`tenant/thread mismatch at seq ${r.seq} for ${t}::${th}`);\n      }\n      return reconstructed;\n    });\n  }\n}\n"],"mappings":";AAaA,SAAS,SAAS;AAoBX,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB,SAA+B;AAC1D,UAAM,SAAS,OAAO;AACtB,SAAK,OAAO;AAAA,EACd;AACF;AAEA,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,sBAAsB;AACzD,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,sBAAsB;AACzD,IAAM,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAE3B,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AAAA,EACnB,gBAAgB,EAAE,OAAO;AAAA,EACzB,kBAAkB,EAAE,OAAO;AAAA,EAC3B,iBAAiB,EAAE,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,EAAE,SAAS;AAC9D,CAAC;AAED,IAAM,oBAAoB,EAAE;AAAA,EAC1B,CAAC,MAAM,OAAO,MAAM,YAAY,MAAM,QAAQ,OAAQ,EAAyB,SAAS;AAAA,EACxF,EAAE,SAAS,sBAAsB;AACnC;AAEA,IAAM,oBAA4C,EAAE,mBAAmB,QAAQ;AAAA,EAC7E,EAAE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,MAAM,EAAE,QAAQ,cAAc;AAAA,IAC9B,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,MAAM,EAAE,QAAQ,cAAc;AAAA,IAC9B,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA,MAAM,EAAE,QAAQ,WAAW;AAAA,IAC3B,SAAS,EAAE,OAAO;AAAA,IAClB,gBAAgB,EAAE,OAAO;AAAA,IACzB;AAAA,EACF,CAAC;AACH,CAAC;AAED,IAAM,qBAAqB,EAAE,OAAO,EAAE,UAAU,SAAS,CAAC;AAEnD,IAAM,yBAAN,MAAqD;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,oBAAI,IAA6B;AAAA,EAEnD,YAAY,MAA8B;AACxC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,KAAK,GAAW,IAAoB;AAClC,WAAO,GAAG,CAAC,KAAK,EAAE;AAAA,EACpB;AAAA,EAEA,MAAM,OAAO,MAAkC;AAC7C,UAAM,YAAY,kBAAkB,MAAM,IAAI;AAC9C,UAAM,MAAM,KAAK,KAAK,UAAU,UAAU,UAAU,QAAQ;AAE5D,UAAM,OAAO,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,QAAQ,EAAE;AACvD,UAAM,OAAO,KAAK,KAAK,OAAO,SAAS;AACrC,YAAM,MAAM,OAAO;AACnB,YAAM,KAAK,MAAM,IAAI;AAAA,QACnB,UAAU,UAAU;AAAA,QACpB,UAAU,UAAU;AAAA,QACpB;AAAA,QACA,IAAI,UAAU;AAAA,QACd,SAAS,KAAK,UAAU,SAAS;AAAA,MACnC,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAGD,SAAK,OAAO;AAAA,MACV;AAAA,MACA,KAAK,MAAM,MAAO,KAAK,OAAO,IAAI,GAAG,MAAM,OAAO,KAAK,IAAK;AAAA,IAC9D;AACA,UAAM;AAAA,EACR;AAAA,EAEA,MAAM,KAAK,aAAqB,aAAsD;AACpF,UAAM,EAAE,UAAU,GAAG,UAAU,GAAG,IAAI,mBAAmB,MAAM;AAAA,MAC7D,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAED,UAAM,UAAU,MAAM,KAAK,MAAM,KAAK,GAAG,EAAE;AAC3C,UAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG;AAEzD,WAAO,QAAQ,IAAI,CAAC,MAAM;AACxB,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,EAAE,OAAO;AAAA,MAC/B,SAAS,OAAO;AACd,cAAM,IAAI,eAAe,mCAAmC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI;AAAA,UACnF;AAAA,QACF,CAAC;AAAA,MACH;AACA,YAAM,SAAS,kBAAkB,UAAU,MAAM;AACjD,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,IAAI;AAAA,UACR,8CAA8C,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE;AAAA,UACnE,EAAE,OAAO,OAAO,MAAM;AAAA,QACxB;AAAA,MACF;AACA,YAAM,gBAAgB,OAAO;AAC7B,UAAI,cAAc,aAAa,KAAK,cAAc,aAAa,IAAI;AACjE,cAAM,IAAI,eAAe,iCAAiC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE;AAAA,MACnF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/chunk-37BBB2P2.js

@@ -0,0 +1,73 @@
+// src/rollout.ts
+var PERSISTED_OUTPUT_MAX_BYTES = 1e4;
+function isPersisted(item, mode) {
+  if (item.type === "reasoning") return mode === "extended";
+  return true;
+}
+function sanitizeForPersist(item) {
+  if (item.type !== "command_execution") return item;
+  const bytes = Buffer.byteLength(item.aggregatedOutput, "utf8");
+  if (bytes <= PERSISTED_OUTPUT_MAX_BYTES) return item;
+  const truncated = Buffer.from(item.aggregatedOutput, "utf8").subarray(0, PERSISTED_OUTPUT_MAX_BYTES).toString("utf8");
+  return { ...item, aggregatedOutput: `${truncated}
+\u2026[truncated]` };
+}
+var InMemoryRolloutStore = class {
+  #lines = /* @__PURE__ */ new Map();
+  #key(tenantId, threadId) {
+    return `${tenantId}::${threadId}`;
+  }
+  async append(line) {
+    const key = this.#key(line.tenantId, line.threadId);
+    const list = this.#lines.get(key) ?? [];
+    list.push(line);
+    this.#lines.set(key, list);
+  }
+  async read(tenantId, threadId) {
+    return [...this.#lines.get(this.#key(tenantId, threadId)) ?? []];
+  }
+};
+function replay(lines) {
+  const first = lines[0];
+  if (!first) return null;
+  const projection = {
+    tenantId: first.tenantId,
+    threadId: first.threadId,
+    items: []
+  };
+  for (const line of lines) {
+    switch (line.type) {
+      case "session_meta":
+      case "turn_context":
+        projection.config = line.config;
+        break;
+      case "compacted":
+        projection.compactionSummary = line.summary;
+        projection.items.length = 0;
+        break;
+      case "event": {
+        const e = line.event;
+        if (e.type === "item.completed" || e.type === "item.started") {
+          const idx = projection.items.findIndex((i) => i.id === e.item.id);
+          if (idx >= 0) projection.items[idx] = e.item;
+          else projection.items.push(e.item);
+        } else if (e.type === "item.updated") {
+          const idx = projection.items.findIndex((i) => i.id === e.item.id);
+          if (idx >= 0) projection.items[idx] = e.item;
+          else projection.items.push(e.item);
+        }
+        break;
+      }
+    }
+  }
+  return projection;
+}
+
+export {
+  PERSISTED_OUTPUT_MAX_BYTES,
+  isPersisted,
+  sanitizeForPersist,
+  InMemoryRolloutStore,
+  replay
+};
+//# sourceMappingURL=chunk-37BBB2P2.js.map