@nebutra/agent-runtime 0.2.1 → 2.0.0

package/dist/orchestration.d.ts

@@ -5,6 +5,32 @@ interface BudgetCap {
     readonly costUsd: number;
     readonly tokenLimit: number;
 }
+/** Thinking/reasoning effort for a node (maps to provider reasoning controls). */
+type ReasoningEffort = "low" | "medium" | "high" | "xhigh";
+/** Output modality a node produces. Mirrors @nebutra/ai-providers ModelModality. */
+type ModelModality = "text" | "image" | "video" | "audio" | "embedding";
+/**
+ * Per-node model selection — the full model meta-info a node can declare. ALL
+ * fields optional; an unset field inherits the run-level default
+ * (WorkflowDefinition.defaultModel / runTurn config). The executor resolves
+ * these HINTS against @nebutra/ai-providers/catalog (listModelsByModality /
+ * resolveFrontierModel) to a concrete model — so a node can either PIN one
+ * (`id`) or DESCRIBE what it needs ("the latest fast text model with vision").
+ */
+interface NodeModelSpec {
+    /** Explicit pin: preset alias (`flagship`/`reasoning`/`fast`) or `provider/model` id. */
+    readonly id?: string;
+    /** Thinking effort: `low` → cheap/quick, `xhigh` → deepest reasoning. */
+    readonly reasoningEffort?: ReasoningEffort;
+    /** Output modality — selects a model of this modality when `id` is unset. */
+    readonly modality?: ModelModality;
+    /** Capabilities the selected model MUST have (e.g. a node needing image input). */
+    readonly capabilities?: {
+        readonly vision?: boolean;
+        readonly toolCall?: boolean;
+        readonly reasoning?: boolean;
+    };
+}
 interface Brief {
     readonly id: string;
     readonly objective: string;
@@ -14,6 +40,8 @@ interface Brief {
     readonly boundaries: readonly string[];
     readonly budget: BudgetCap;
     readonly dependsOn?: readonly string[];
+    /** Per-node model meta-info (id/preset · thinking effort · modality · capabilities). */
+    readonly model?: NodeModelSpec;
 }
 type DispatchStrategy = "auto" | "sequential" | "fanout";
 interface DispatchPlan {
@@ -36,8 +64,21 @@ interface SubagentCostReport {
     readonly maxDurationMs: number;
     readonly subagents: number;
 }
+/**
+ * Dependency-resolved execution WAVES — the agent node-topology scheduler. Each
+ * wave is the set of briefs whose dependencies are satisfied by earlier waves;
+ * waves run in order, briefs within a wave run in parallel. Input order is
+ * preserved within a wave.
+ */
+declare function planWaves(briefs: readonly Brief[]): readonly (readonly Brief[])[];
 declare function planSubagentDispatch(briefs: readonly Brief[], options?: DispatchPlanOptions): DispatchPlan;
 declare function fanOutSubagents(briefs: readonly Brief[], run: (brief: Brief) => Promise<SubagentResult>): Promise<readonly SubagentResult[]>;
+/**
+ * Execute briefs as a dependency graph: each wave runs in parallel, waves run
+ * sequentially. The node-topology execution path — `fanOutSubagents` is the
+ * degenerate single-wave (all-independent) case of this.
+ */
+declare function runAgentWaves(briefs: readonly Brief[], run: (brief: Brief) => Promise<SubagentResult>): Promise<readonly SubagentResult[]>;
 declare function costReport(results: readonly SubagentResult[]): SubagentCostReport;
 
-export { type Brief, type BudgetCap, type DispatchPlan, type DispatchPlanOptions, type DispatchStrategy, type SubagentCostReport, type SubagentResult, costReport, fanOutSubagents, planSubagentDispatch };
+export { type Brief, type BudgetCap, type DispatchPlan, type DispatchPlanOptions, type DispatchStrategy, type ModelModality, type NodeModelSpec, type ReasoningEffort, type SubagentCostReport, type SubagentResult, costReport, fanOutSubagents, planSubagentDispatch, planWaves, runAgentWaves };

package/dist/orchestration.js

@@ -1,12 +1,16 @@
 import {
   costReport,
   fanOutSubagents,
-  planSubagentDispatch
-} from "./chunk-MX2WL43P.js";
+  planSubagentDispatch,
+  planWaves,
+  runAgentWaves
+} from "./chunk-Q62VKHIT.js";
 import "./chunk-424PT5DM.js";
 export {
   costReport,
   fanOutSubagents,
-  planSubagentDispatch
+  planSubagentDispatch,
+  planWaves,
+  runAgentWaves
 };
 //# sourceMappingURL=orchestration.js.map

package/dist/pulsar.js

@@ -2,12 +2,12 @@ import {
   Pulsar,
   PulsarBuilder,
   PulsarThread
-} from "./chunk-KCNN4QUQ.js";
+} from "./chunk-5UGIUYJR.js";
 import "./chunk-D4YAPLOW.js";
 import "./chunk-37BBB2P2.js";
-import "./chunk-4Y25ZTKI.js";
 import "./chunk-6EGG2OZC.js";
 import "./chunk-CGRCUKGT.js";
+import "./chunk-4Y25ZTKI.js";
 import "./chunk-424PT5DM.js";
 export {
   Pulsar,

package/dist/sandbox-DfcRttXt.d.ts

@@ -0,0 +1,219 @@
+import { CapabilityPolicy } from './policy.js';
+
+/**
+ * Carina native transport: newline-delimited JSON-RPC 2.0 over a Unix socket
+ * (same wire as @carina/sdk and `carina-daemon -socket`).
+ *
+ * Node-only — not for edge runtimes without `node:net`.
+ */
+declare const defaultCarinaSocketPath: () => string;
+/** Production co-deploy layout on the Sailor ECS api host. */
+declare const CODEPLOY_CARINA_SOCKET_PATH = "/var/carina/run/daemon.sock";
+declare const CODEPLOY_CARINA_WORKSPACE_ROOT = "/var/carina/ws";
+declare const CODEPLOY_CARINA_STATE_DIR = "/var/carina/state";
+declare const CODEPLOY_CARINA_BIN_DIR = "/var/carina/bin";
+declare class CarinaNdjsonError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+type NdjsonRpcClient = {
+    call: <T>(method: string, params: Record<string, unknown>) => Promise<T>;
+    close: () => void;
+};
+/**
+ * Create a reusable NDJSON JSON-RPC client for a Carina unix socket.
+ */
+declare function createCarinaNdjsonClient(socketPath: string, callTimeoutMs?: number): NdjsonRpcClient;
+
+/**
+ * External-sandbox delegation seam (PORT — capability #11).
+ *
+ * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
+ * web runtime NEVER executes untrusted code itself and introduces no isolation
+ * infrastructure. It only:
+ *   1. carries the capability policy (see ./policy),
+ *   2. delegates execution to an external isolator behind this interface
+ *      (Track B = **Carina** upstream kernel),
+ *   3. records the outcome as a `command_execution` item (see ./model).
+ *
+ * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
+ * restricted token) are deliberately NOT ported — they are single-host and
+ * out of scope for a multi-tenant web product.
+ *
+ * @see docs/architecture/2026-08-03-carina-track-b-upstream.md
+ */
+
+interface SandboxExecRequest {
+    /** Mandatory tenant scope — every delegated exec is tenant-bound. */
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly command: string;
+    /** The capabilities the external isolator must honor. */
+    readonly capabilityPolicy: CapabilityPolicy;
+    /** Optional inputs the executor should materialize before running. */
+    readonly inputs?: Readonly<Record<string, string>>;
+}
+interface SandboxExecResult {
+    readonly exitCode: number;
+    readonly aggregatedOutput: string;
+    /** Identifier of the isolator that actually ran the command. */
+    readonly executedOn: string;
+    /** Carina permission decision id when present (audit correlation). */
+    readonly decisionId?: string;
+    /** Host correlation id sent on the wire (JSON-RPC id or extension). */
+    readonly correlationId?: string;
+}
+/**
+ * The only thing Track A depends on for execution. Implemented by a decoupled
+ * isolator over Carina's public RPC catalog; never implemented in-process here.
+ */
+interface ExternalSandbox {
+    exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
+}
+/**
+ * Fail-closed default. Wiring this in production requires a real
+ * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
+ */
+declare class NoExecutorConfiguredError extends Error {
+    constructor();
+}
+declare const REFUSING_SANDBOX: ExternalSandbox;
+declare class SandboxDelegationError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(message: string, status: number, code?: string | undefined);
+}
+declare class CarinaProtocolError extends Error {
+    constructor(message: string);
+}
+/**
+ * Generic HTTP POST of a Sailor-shaped body. Prefer {@link createCarinaSandbox}
+ * for production Track B — Carina owns the kernel and speaks JSON-RPC.
+ */
+declare function createHttpSandbox(baseUrl: string, fetchImpl?: typeof fetch, path?: string): ExternalSandbox;
+/** Minimum `protocol_version` we accept from `gateway.hello` (Carina catalog). */
+declare const CARINA_MIN_PROTOCOL_VERSION = 1;
+type CarinaSandboxOptions = {
+    /**
+     * HTTP JSON-RPC base URL (optional if {@link socketPath} is set).
+     * Prefer unix socket co-deploy on the same host as the gateway.
+     */
+    readonly baseUrl?: string;
+    /**
+     * Native Carina unix socket path (NDJSON JSON-RPC). Preferred for same-host
+     * co-deploy — full command.exec authority (TCP diagnostic is read-limited).
+     */
+    readonly socketPath?: string;
+    /**
+     * Gateway token for HTTP transport only. Never a local owner unlock token.
+     */
+    readonly token?: string;
+    readonly fetchImpl?: typeof fetch;
+    /**
+     * Path under baseUrl for JSON-RPC POST. Default `""` posts to baseUrl itself.
+     */
+    readonly rpcPath?: string;
+    /** Fail closed if hello reports a lower protocol_version. Default {@link CARINA_MIN_PROTOCOL_VERSION}. */
+    readonly minProtocolVersion?: number;
+    /** Skip gateway.hello (tests only). Production should leave this false. */
+    readonly skipHello?: boolean;
+    /** Label when the wire body has no node id. */
+    readonly executedOn?: string;
+    /** Map Sailor thread → Carina `session_id`. Default: `threadId`. */
+    readonly resolveSessionId?: (request: SandboxExecRequest) => string;
+    /**
+     * Optional client metadata sent on hello (discovery only — not an auth grant).
+     */
+    readonly clientId?: string;
+    /**
+     * When true, `command.exec` that returns `requires_approval` will call
+     * `governance.approval.resolve` (approve=true) once and retry. Default false
+     * (fail closed). Operators set via CARINA_AUTO_APPROVE=1 for unattended nodes.
+     */
+    readonly autoApproveOnRequire?: boolean;
+};
+type CarinaEnsureSessionRequest = {
+    /** Sailor thread id — used as cache key and default correlation. */
+    readonly threadId: string;
+    /** Absolute workspace path on the Carina host (catalog-required). */
+    readonly workspaceRoot: string;
+    readonly tenantId?: string;
+    readonly profile?: string;
+    /** Carina session approval_mode when supported by the daemon. */
+    readonly approvalMode?: string;
+};
+/**
+ * Track-B handle: {@link ExternalSandbox} plus host session lifecycle.
+ * `command.exec` requires a Carina session; call {@link CarinaSandbox.ensureSession}
+ * before the first exec for a thread (or let {@link registerCommandExecTool} do it).
+ */
+type CarinaApprovalResolveRequest = {
+    readonly decisionId: string;
+    readonly approve: boolean;
+    readonly approver?: string;
+    readonly scope?: "once" | "session" | "project";
+};
+interface CarinaSandbox extends ExternalSandbox {
+    /**
+     * Create (or reuse cached) Carina session for a Sailor thread.
+     * Maps `threadId` → Carina `session_id` for subsequent `command.exec`.
+     */
+    ensureSession(request: CarinaEnsureSessionRequest): Promise<string>;
+    /** Peek cached Carina session id for a Sailor thread, if any. */
+    resolveMappedSessionId(threadId: string): string | undefined;
+    /**
+     * Host HITL: map product approve/deny → Carina `governance.approval.resolve`.
+     */
+    resolveApproval(request: CarinaApprovalResolveRequest): Promise<unknown>;
+    /** Lightweight connectivity probe (`gateway.hello`). */
+    probe(): Promise<{
+        protocolVersion: number;
+        ok: true;
+    }>;
+}
+/**
+ * Track-B adapter: Sailor control plane → **Carina** public RPC catalog (v0.8.x).
+ *
+ * Mapping (Sailor → Carina, never the reverse ownership):
+ * - `threadId` → `command.exec` `session_id` (via ensureSession cache, else threadId)
+ * - `command` → `argv` via `/bin/sh -c` (kernel still gates the joined command string)
+ * - denied / requires_approval → {@link SandboxDelegationError} (fail closed)
+ * - allowed + CommandResult → {@link SandboxExecResult}
+ * - host lifecycle → `session.create` via {@link CarinaSandbox.ensureSession}
+ *
+ * Kernel protocol is maintained in `Nebutra/carina`. This file only maps.
+ *
+ * @see docs/architecture/2026-08-03-carina-track-b-upstream.md
+ */
+declare function createCarinaSandbox(options: CarinaSandboxOptions): CarinaSandbox;
+/** Guard: reject the most dangerous posture unless explicitly opted in. */
+declare function assertSafePosture(policy: CapabilityPolicy, allowDanger?: boolean): void;
+/** Env bag for Carina host config. Compatible with `process.env`. */
+type CarinaEnv = Readonly<Record<string, string | undefined>>;
+/**
+ * Resolve workspace path for a tenant/thread.
+ * Order: CARINA_WORKSPACE_MAP[tenant] → TEMPLATE → CARINA_WORKSPACE_ROOT.
+ */
+declare function resolveCarinaWorkspaceRoot(tenantId: string, env?: CarinaEnv, threadId?: string): string | undefined;
+/**
+ * Co-deploy is on unless explicitly disabled (`CARINA_CODEPLOY=0|false`).
+ * Same-host default: unix socket {@link CODEPLOY_CARINA_SOCKET_PATH}.
+ */
+declare function isCarinaCodeployEnabled(env?: CarinaEnv): boolean;
+/**
+ * Resolve Track-B sandbox from environment.
+ *
+ * Priority:
+ * 1. `CARINA_JSONRPC_URL` → HTTP JSON-RPC
+ * 2. `CARINA_DAEMON_SOCK` → unix NDJSON
+ * 3. co-deploy default → {@link CODEPLOY_CARINA_SOCKET_PATH}
+ * 4. developer home socket → `~/.carina/daemon.sock` when co-deploy and no prod path intent
+ * 5. otherwise {@link REFUSING_SANDBOX}
+ */
+declare function resolveCarinaSandboxFromEnv(env?: CarinaEnv, overrides?: Partial<CarinaSandboxOptions>): ExternalSandbox;
+/** Default workspace when co-deploy is enabled and no override is set. */
+declare function resolveCarinaWorkspaceRootWithCodeploy(tenantId: string, env?: CarinaEnv, threadId?: string): string | undefined;
+declare function isCarinaSandbox(sandbox: ExternalSandbox): sandbox is CarinaSandbox;
+
+export { CARINA_MIN_PROTOCOL_VERSION as C, type ExternalSandbox as E, type NdjsonRpcClient as N, REFUSING_SANDBOX as R, SandboxDelegationError as S, CODEPLOY_CARINA_BIN_DIR as a, CODEPLOY_CARINA_SOCKET_PATH as b, CODEPLOY_CARINA_STATE_DIR as c, CODEPLOY_CARINA_WORKSPACE_ROOT as d, type CarinaApprovalResolveRequest as e, type CarinaEnsureSessionRequest as f, type CarinaEnv as g, CarinaNdjsonError as h, CarinaProtocolError as i, type CarinaSandbox as j, type CarinaSandboxOptions as k, NoExecutorConfiguredError as l, type SandboxExecRequest as m, type SandboxExecResult as n, assertSafePosture as o, createCarinaNdjsonClient as p, createCarinaSandbox as q, createHttpSandbox as r, defaultCarinaSocketPath as s, isCarinaCodeployEnabled as t, isCarinaSandbox as u, resolveCarinaSandboxFromEnv as v, resolveCarinaWorkspaceRoot as w, resolveCarinaWorkspaceRootWithCodeploy as x };

package/dist/sandbox.d.ts

@@ -1,65 +1,3 @@
-import { CapabilityPolicy } from './policy.js';
+import './policy.js';
+export { C as CARINA_MIN_PROTOCOL_VERSION, b as CODEPLOY_CARINA_SOCKET_PATH, d as CODEPLOY_CARINA_WORKSPACE_ROOT, e as CarinaApprovalResolveRequest, f as CarinaEnsureSessionRequest, g as CarinaEnv, i as CarinaProtocolError, j as CarinaSandbox, k as CarinaSandboxOptions, E as ExternalSandbox, l as NoExecutorConfiguredError, R as REFUSING_SANDBOX, S as SandboxDelegationError, m as SandboxExecRequest, n as SandboxExecResult, o as assertSafePosture, q as createCarinaSandbox, r as createHttpSandbox, s as defaultCarinaSocketPath, t as isCarinaCodeployEnabled, u as isCarinaSandbox, v as resolveCarinaSandboxFromEnv, w as resolveCarinaWorkspaceRoot, x as resolveCarinaWorkspaceRootWithCodeploy } from './sandbox-DfcRttXt.js';
 import 'zod';
-
-/**
- * External-sandbox delegation seam (PORT — capability #11).
- *
- * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
- * web runtime NEVER executes untrusted code itself and introduces no isolation
- * infrastructure. It only:
- *   1. carries the capability policy (see ./policy),
- *   2. delegates execution to an external isolator behind this interface
- *      (a self-hosted kernel sidecar — Track B — or any other executor),
- *   3. records the outcome as a `command_execution` item (see ./model).
- *
- * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
- * restricted token) are deliberately NOT ported — they are single-host and
- * out of scope for a multi-tenant web product.
- */
-
-interface SandboxExecRequest {
-    /** Mandatory tenant scope — every delegated exec is tenant-bound. */
-    readonly tenantId: string;
-    readonly threadId: string;
-    readonly command: string;
-    /** The capabilities the external isolator must honor. */
-    readonly capabilityPolicy: CapabilityPolicy;
-    /** Optional inputs the executor should materialize before running. */
-    readonly inputs?: Readonly<Record<string, string>>;
-}
-interface SandboxExecResult {
-    readonly exitCode: number;
-    readonly aggregatedOutput: string;
-    /** Identifier of the isolator that actually ran the command. */
-    readonly executedOn: string;
-}
-/**
- * The only thing Track A depends on for execution. Implemented by a decoupled
- * isolator over the ./protocol contract; never implemented in-process here.
- */
-interface ExternalSandbox {
-    exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
-}
-/**
- * Fail-closed default. Wiring this in production requires a real
- * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
- */
-declare class NoExecutorConfiguredError extends Error {
-    constructor();
-}
-declare const REFUSING_SANDBOX: ExternalSandbox;
-declare class SandboxDelegationError extends Error {
-    readonly status: number;
-    constructor(message: string, status: number);
-}
-/**
- * The concrete Track-B coupling: delegate execution over HTTP to the decoupled
- * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The
- * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an
- * error and never coerced into a fabricated result.
- */
-declare function createHttpSandbox(baseUrl: string, fetchImpl?: typeof fetch): ExternalSandbox;
-/** Guard: reject the most dangerous posture unless explicitly opted in. */
-declare function assertSafePosture(policy: CapabilityPolicy, allowDanger?: boolean): void;
-
-export { type ExternalSandbox, NoExecutorConfiguredError, REFUSING_SANDBOX, SandboxDelegationError, type SandboxExecRequest, type SandboxExecResult, assertSafePosture, createHttpSandbox };

package/dist/sandbox.js

@@ -1,16 +1,38 @@
 import {
+  CARINA_MIN_PROTOCOL_VERSION,
+  CODEPLOY_CARINA_SOCKET_PATH,
+  CODEPLOY_CARINA_WORKSPACE_ROOT,
+  CarinaProtocolError,
   NoExecutorConfiguredError,
   REFUSING_SANDBOX,
   SandboxDelegationError,
   assertSafePosture,
-  createHttpSandbox
-} from "./chunk-MUF7ZZTO.js";
+  createCarinaSandbox,
+  createHttpSandbox,
+  defaultCarinaSocketPath,
+  isCarinaCodeployEnabled,
+  isCarinaSandbox,
+  resolveCarinaSandboxFromEnv,
+  resolveCarinaWorkspaceRoot,
+  resolveCarinaWorkspaceRootWithCodeploy
+} from "./chunk-VXILZAXK.js";
 import "./chunk-424PT5DM.js";
 export {
+  CARINA_MIN_PROTOCOL_VERSION,
+  CODEPLOY_CARINA_SOCKET_PATH,
+  CODEPLOY_CARINA_WORKSPACE_ROOT,
+  CarinaProtocolError,
   NoExecutorConfiguredError,
   REFUSING_SANDBOX,
   SandboxDelegationError,
   assertSafePosture,
-  createHttpSandbox
+  createCarinaSandbox,
+  createHttpSandbox,
+  defaultCarinaSocketPath,
+  isCarinaCodeployEnabled,
+  isCarinaSandbox,
+  resolveCarinaSandboxFromEnv,
+  resolveCarinaWorkspaceRoot,
+  resolveCarinaWorkspaceRootWithCodeploy
 };
 //# sourceMappingURL=sandbox.js.map

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@nebutra/agent-runtime",
-  "version": "0.2.1",
+  "version": "2.0.0",
   "private": false,
   "license": "MIT",
   "type": "module",
   "nebutra": {
+    "graph": "runtime",
     "status": "wip",
     "productionReady": false,
     "requires": [
@@ -22,43 +23,90 @@
     "surface": "agent-runtime",
     "summary": "Multi-tenant agent-runtime grammar: thread/turn/item model, approval+capability policy, tool/MCP abstraction, event-sourced rollout, external-sandbox delegation seam"
   },
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts",
-    "./model": "./src/model.ts",
-    "./protocol": "./src/protocol.ts",
-    "./pulsar": "./src/pulsar.ts",
-    "./orchestration": "./src/orchestration.ts",
-    "./policy": "./src/policy.ts",
-    "./tools": "./src/tools.ts",
-    "./rollout": "./src/rollout.ts",
-    "./sandbox": "./src/sandbox.ts",
-    "./adapters": "./src/adapters/index.ts",
-    "./adapters/mcp-catalog": "./src/adapters/mcp-catalog.ts",
-    "./adapters/dispatcher-sse": "./src/adapters/dispatcher-sse.ts",
-    "./adapters/prisma-rollout": "./src/adapters/prisma-rollout.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./model": {
+      "types": "./dist/model.d.ts",
+      "import": "./dist/model.js",
+      "default": "./dist/model.js"
+    },
+    "./protocol": {
+      "types": "./dist/protocol.d.ts",
+      "import": "./dist/protocol.js",
+      "default": "./dist/protocol.js"
+    },
+    "./pulsar": {
+      "types": "./dist/pulsar.d.ts",
+      "import": "./dist/pulsar.js",
+      "default": "./dist/pulsar.js"
+    },
+    "./orchestration": {
+      "types": "./dist/orchestration.d.ts",
+      "import": "./dist/orchestration.js",
+      "default": "./dist/orchestration.js"
+    },
+    "./policy": {
+      "types": "./dist/policy.d.ts",
+      "import": "./dist/policy.js",
+      "default": "./dist/policy.js"
+    },
+    "./tools": {
+      "types": "./dist/tools.d.ts",
+      "import": "./dist/tools.js",
+      "default": "./dist/tools.js"
+    },
+    "./rollout": {
+      "types": "./dist/rollout.d.ts",
+      "import": "./dist/rollout.js",
+      "default": "./dist/rollout.js"
+    },
+    "./sandbox": {
+      "types": "./dist/sandbox.d.ts",
+      "import": "./dist/sandbox.js",
+      "default": "./dist/sandbox.js"
+    },
+    "./adapters": {
+      "types": "./dist/adapters/index.d.ts",
+      "import": "./dist/adapters/index.js",
+      "default": "./dist/adapters/index.js"
+    },
+    "./adapters/mcp-catalog": {
+      "types": "./dist/adapters/mcp-catalog.d.ts",
+      "import": "./dist/adapters/mcp-catalog.js",
+      "default": "./dist/adapters/mcp-catalog.js"
+    },
+    "./adapters/dispatcher-sse": {
+      "types": "./dist/adapters/dispatcher-sse.d.ts",
+      "import": "./dist/adapters/dispatcher-sse.js",
+      "default": "./dist/adapters/dispatcher-sse.js"
+    },
+    "./adapters/prisma-rollout": {
+      "types": "./dist/adapters/prisma-rollout.d.ts",
+      "import": "./dist/adapters/prisma-rollout.js",
+      "default": "./dist/adapters/prisma-rollout.js"
+    }
   },
   "dependencies": {
+    "p-limit": "^7.3.0",
     "zod": "^4.3.6",
-    "@nebutra/ai-primitives": "0.1.1",
-    "@nebutra/capability-kit": "0.2.1",
-    "@nebutra/execution-policy": "0.1.1"
-  },
-  "peerDependencies": {
-    "@nebutra/mcp": "0.1.2"
-  },
-  "peerDependenciesMeta": {
-    "@nebutra/mcp": {
-      "optional": true
-    }
+    "@nebutra/agents": "2.0.0",
+    "@nebutra/ai-primitives": "0.1.3",
+    "@nebutra/capability-kit": "2.0.0",
+    "@nebutra/execution-policy": "2.0.0",
+    "@nebutra/graph-model": "2.0.0",
+    "@nebutra/mcp": "2.0.0"
   },
   "devDependencies": {
-    "@types/node": "^22.19.15",
+    "@types/node": "^25.9.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18",
-    "@nebutra/mcp": "0.1.2"
+    "vitest": "^4.0.18"
   },
   "homepage": "https://github.com/Nebutra/Nebutra-Sailor/tree/main/packages/ai/agent-runtime#readme",
   "repository": {
@@ -72,6 +120,9 @@
   "publishConfig": {
     "access": "public"
   },
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",