@nylorun/agents 0.14.0-beta → 0.16.1-beta

package/dist/delivery-token.js

@@ -1,159 +0,0 @@
-/**
- * Verifies the delivery token on a request the Runtime sends to an Action endpoint: an ES256
- * JWT signed with the Tenant's current signing key (design: Action endpoints §8.1). WebCrypto
- * only, so the SDK takes no JWT dependency: a JWS ES256 signature is the raw `r || s` pair
- * WebCrypto's ECDSA verifies.
- */
-import { PROTOCOL_HEADER, PROTOCOL_VERSION, isTenantId } from "@nylorun/core/compatibility";
-import { DELIVERY_TOKEN_TYPE, tenantTokenIssuer } from "@nylorun/core/contracts";
-/** The issuer prefix of a Tenant's tokens: `urn:nylorun:tenant:<tenantId>`. */
-const ISSUER_PREFIX = tenantTokenIssuer("");
-/** Why a delivery was refused; `code` is sent back to the Runtime. */
-export class DeliveryVerificationError extends Error {
-    code;
-    name = "DeliveryVerificationError";
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-    }
-}
-/** Clock skew tolerated on `iat` and `exp`, in seconds. */
-const SKEW_SECONDS = 30;
-const FORBIDDEN_HEADERS = ["jku", "jwk", "x5u", "x5c", "x5t", "x5t#S256", "crit"];
-/** The largest token accepted: well above a real one, well below a request limit. */
-const MAX_TOKEN_LENGTH = 4096;
-/**
- * Verifies `token` against `body`. The keys are the installation's, so a valid signature already
- * binds the issuer to its one Tenant: any `urn:nylorun:tenant:<id>` issuer is accepted (and
- * returned in `iss`) unless `tenantId` names the one expected.
- */
-export async function verifyDeliveryToken(token, options) {
-    if (!token)
-        throw new DeliveryVerificationError("signature_missing", "No delivery token");
-    const parts = token.length <= MAX_TOKEN_LENGTH ? token.split(".") : [];
-    if (parts.length !== 3)
-        throw invalid("Not a compact JWS");
-    const [encodedHeader, encodedPayload, encodedSignature] = parts;
-    const header = json(encodedHeader);
-    if (header.alg !== "ES256" ||
-        header.typ !== DELIVERY_TOKEN_TYPE ||
-        typeof header.kid !== "string" ||
-        FORBIDDEN_HEADERS.some((name) => name in header))
-        throw invalid("Unexpected token header");
-    const key = await options.keys(header.kid);
-    if (!key)
-        throw new DeliveryVerificationError("key_unknown", `Unknown signing key ${header.kid}`);
-    const signed = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, bytes(base64url(encodedSignature)), new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`));
-    if (!signed)
-        throw invalid("Bad signature");
-    const claims = json(encodedPayload);
-    if (typeof claims.iss !== "string" ||
-        typeof claims.aud !== "string" ||
-        typeof claims.sub !== "string" ||
-        typeof claims.agt !== "string" ||
-        !Number.isInteger(claims.gen) ||
-        typeof claims.bdy !== "string" ||
-        typeof claims.iat !== "number" ||
-        typeof claims.exp !== "number" ||
-        typeof claims.jti !== "string")
-        throw invalid("Missing claims");
-    if (!claims.iss.startsWith(ISSUER_PREFIX) ||
-        !isTenantId(claims.iss.slice(ISSUER_PREFIX.length)))
-        throw invalid("The token was not issued by a Tenant");
-    if (options.tenantId !== undefined && claims.iss !== tenantTokenIssuer(options.tenantId))
-        throw invalid("The token is for another Tenant");
-    if (options.audience !== undefined && claims.aud !== options.audience)
-        throw invalid(`The token is for ${claims.aud}, not ${options.audience}`);
-    const now = (options.now ?? Date.now()) / 1000;
-    if (claims.exp < now - SKEW_SECONDS || claims.iat > now + SKEW_SECONDS)
-        throw new DeliveryVerificationError("token_expired", "The delivery token has expired");
-    if (claims.bdy !== (await bodyHash(options.body)))
-        throw invalid("The body does not match the token");
-    return claims;
-}
-/** base64url SHA-256 of `body`: the token's `bdy` claim. */
-export async function bodyHash(body) {
-    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes(body)));
-    return Buffer.from(digest).toString("base64url");
-}
-/**
- * The Tenant's public keys, fetched from `GET /v1/access/jwks` and cached by `kid`. An
- * unknown `kid` refetches once, at most every `refetchMs`, so forged tokens cannot make the
- * endpoint call the Runtime on every request. Concurrent lookups share one in-flight fetch.
- */
-export class JwksCache {
-    source;
-    refetchMs;
-    keys = new Map();
-    lastFetch = 0;
-    pending;
-    constructor(source, refetchMs = 5000) {
-        this.source = source;
-        this.refetchMs = refetchMs;
-    }
-    lookup = async (kid) => {
-        const known = this.keys.get(kid);
-        if (known)
-            return known;
-        // Wait for an in-flight fetch: stamping the cooldown at the start of `load` used
-        // to make a concurrent ping (register + smoke, or tsx watch restart) answer
-        // `key_unknown` before the keys arrived.
-        if (this.pending) {
-            await this.pending;
-            return this.keys.get(kid);
-        }
-        if (Date.now() - this.lastFetch < this.refetchMs && this.lastFetch > 0)
-            return undefined;
-        await (this.pending ??= this.load().finally(() => (this.pending = undefined)));
-        return this.keys.get(kid);
-    };
-    async load() {
-        const keys = "keys" in this.source ? this.source.keys : await this.fetchKeys(this.source);
-        this.lastFetch = Date.now();
-        for (const jwk of keys) {
-            const kid = jwk.kid;
-            if (typeof kid !== "string" || jwk.kty !== "EC" || jwk.crv !== "P-256")
-                continue;
-            if (this.keys.has(kid))
-                continue;
-            this.keys.set(kid, await crypto.subtle.importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y }, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]));
-        }
-    }
-    async fetchKeys(source) {
-        const headers = {
-            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-        };
-        if (source.key)
-            headers.Authorization = `Bearer ${source.key}`;
-        const response = await (source.fetch ?? globalThis.fetch)(`${source.url.replace(/\/$/, "")}/v1/access/jwks`, { headers, redirect: "error", signal: AbortSignal.timeout(10_000) });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new Error(`The Runtime answered ${response.status} for its public keys (GET /v1/access/jwks)`);
-        }
-        const body = (await response.json());
-        return Array.isArray(body.keys) ? body.keys : [];
-    }
-}
-function invalid(message) {
-    return new DeliveryVerificationError("signature_invalid", message);
-}
-function base64url(value) {
-    return new Uint8Array(Buffer.from(value, "base64url"));
-}
-/** A copy backed by a plain `ArrayBuffer`, which WebCrypto's types require. */
-function bytes(value) {
-    const copy = new Uint8Array(value.byteLength);
-    copy.set(value);
-    return copy;
-}
-function json(segment) {
-    try {
-        const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-        if (value && typeof value === "object" && !Array.isArray(value))
-            return value;
-    }
-    catch {
-        /* fall through */
-    }
-    throw invalid("Malformed token");
-}

package/dist/execute-action.d.ts

@@ -1,16 +0,0 @@
-import { type BuiltAgent, type BuiltWorkflow } from "@nylorun/core/define";
-import type { Action, ActionOutcome } from "@nylorun/core/contracts";
-import type { ActionSandbox } from "./sandbox/client.js";
-export type ExecutableDefinition = BuiltAgent | BuiltWorkflow;
-export type ExecuteActionOptions = {
-    /** Claim-scoped sandbox client; omitted when the session has no sandbox. */
-    readonly sandbox?: ActionSandbox;
-};
-/** Executes code only after a host-issued claim. No engine dependency. */
-export declare function executeAction(action: Action, root: ExecutableDefinition, signal: AbortSignal, options?: ExecuteActionOptions): Promise<ActionOutcome>;
-/**
- * True when `action` runs a tool marked `background` (`ToolDefinition.background`): an Action
- * endpoint answers its delivery at once and posts the outcome later. False for anything it
- * cannot find; `executeAction` reports those.
- */
-export declare function runsInBackground(action: Action, root: ExecutableDefinition): boolean;

package/dist/execute-action.js

@@ -1,288 +0,0 @@
-import { delegateOf, implementationsFor, isBuiltWorkflow, isToolError, normalizeToolDefinition, normalizedSchemasFor, runHookPoint, } from "@nylorun/core/define";
-class Suspend {
-    outcome;
-    constructor(outcome) {
-        this.outcome = outcome;
-    }
-}
-const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
-    ? value
-    : {};
-/** Executes code only after a host-issued claim. No engine dependency. */
-export async function executeAction(action, root, signal, options = {}) {
-    const sandbox = options.sandbox;
-    if (action.kind === "fn" || action.kind === "verify") {
-        if (!isBuiltWorkflow(root))
-            throw new Error(`Action ${action.kind} requires a workflow definition`);
-        return executeWorkflowFn(action, root.getBinding(), signal, sandbox);
-    }
-    if (isBuiltWorkflow(root)) {
-        if (action.kind === "tool" && "key" in action && typeof action.key === "string")
-            return executeWorkflowTool(action, root.getBinding(), signal, sandbox);
-        throw new Error(`Unsupported action kind ${action.kind} on workflow`);
-    }
-    // Work for an agent used as a tool runs that agent's code, served from the root's binding.
-    const agent = action.agent ? delegatedAgent(root, action.agent.id) : root;
-    const ref = action.agent ?? { id: root.id, path: root.id };
-    if (action.kind === "hook")
-        // All capabilities at this hook point run concurrently in one action. Never throws.
-        return {
-            value: {
-                results: await runHookPoint(implementationsFor(agent), action.hook, action.input),
-            },
-        };
-    if (action.kind !== "tool" || !("capabilityId" in action))
-        throw new Error(`Unsupported action kind ${action.kind}`);
-    const impl = implementationsFor(agent)[action.capabilityId];
-    if (!impl)
-        throw new Error(`No capability ${action.capabilityId}`);
-    const raw = impl.tools?.[action.toolName];
-    if (!raw)
-        throw new Error("Missing tool implementation");
-    const tool = normalizeToolDefinition(raw);
-    return runTool(action, tool, ref, signal, sandbox);
-}
-/**
- * True when `action` runs a tool marked `background` (`ToolDefinition.background`): an Action
- * endpoint answers its delivery at once and posts the outcome later. False for anything it
- * cannot find; `executeAction` reports those.
- */
-export function runsInBackground(action, root) {
-    if (action.kind !== "tool")
-        return false;
-    try {
-        if (isBuiltWorkflow(root)) {
-            const key = action.key;
-            const impl = typeof key === "string" ? root.getBinding().nodes[key] : undefined;
-            return impl?.kind === "tool" && impl.tool.background === true;
-        }
-        if (!("capabilityId" in action))
-            return false;
-        const agent = action.agent ? delegatedAgent(root, action.agent.id) : root;
-        const raw = implementationsFor(agent)[action.capabilityId]?.tools?.[action.toolName];
-        return raw !== undefined && normalizeToolDefinition(raw).background === true;
-    }
-    catch {
-        return false;
-    }
-}
-async function executeWorkflowTool(action, binding, signal, sandbox) {
-    const impl = binding.nodes[action.key];
-    if (!impl || impl.kind !== "tool")
-        throw new Error(`No tool implementation for key ${action.key}`);
-    const path = "path" in action && typeof action.path === "string" ? action.path : action.key;
-    return runTool(action, impl.tool, { id: action.agentId, path }, signal, sandbox);
-}
-async function runTool(action, raw, ref, signal, sandbox) {
-    const tool = "execute" in raw && typeof raw.execute === "function" && "inputSchema" in raw
-        ? raw
-        : normalizeToolDefinition(raw);
-    const schemas = "inputSchema" in tool && tool.inputSchema && "validate" in tool.inputSchema
-        ? {
-            inputSchema: tool.inputSchema,
-            outputSchema: "outputSchema" in tool ? tool.outputSchema : undefined,
-        }
-        : normalizedSchemasFor(tool);
-    const input = schemas.inputSchema.validate(action.input);
-    if (!input.ok)
-        return {
-            value: {
-                kind: "failed",
-                code: "tool.invalid-input",
-                message: JSON.stringify(input.issues),
-            },
-        };
-    const ctx = action.context;
-    const state = { ...object(ctx.state) };
-    const statePatch = {};
-    const resume = object(ctx.resume);
-    const token = object(resume.token);
-    const memo = object(token._nylorun);
-    const steps = { ...object(memo.steps) };
-    const answers = { ...object(memo.answers) };
-    let waitIndex = 0;
-    let gateApproved = Boolean(memo.gateApproved) ||
-        Boolean(memo.approvalGate && resume.kind === "approval" && resume.approved);
-    const durableToken = (extra = {}) => ({
-        _nylorun: { steps, answers, waitIndex, gateApproved, ...extra },
-    });
-    const wait = async (kind, prompt, metadata) => {
-        const index = String(waitIndex++);
-        if (index in answers)
-            return answers[index];
-        if (!memo.approvalGate &&
-            resume.kind === kind &&
-            Number(memo.waitIndex ?? 0) === Number(index)) {
-            const answer = kind === "approval" ? Boolean(resume.approved) : resume.value;
-            answers[index] = answer;
-            return answer;
-        }
-        throw new Suspend({
-            kind: "interaction-required",
-            interaction: { kind, prompt, ...(metadata ? { metadata } : {}) },
-            token: {
-                _nylorun: { steps, answers, waitIndex: Number(index), gateApproved },
-            },
-        });
-    };
-    const context = {
-        executionId: String(ctx.executionId ?? action.sessionId),
-        turnId: String(ctx.turnId ?? action.turnId),
-        stepId: String(ctx.stepId ?? ""),
-        callId: String(ctx.callId ?? action.actionId),
-        invocationId: String(ctx.invocationId ?? action.actionId),
-        idempotencyKey: String(ctx.idempotencyKey ?? action.actionId),
-        signal,
-        info: ctx.info,
-        session: { id: action.sessionId },
-        agent: ref,
-        ...(ctx.resume ? { resume: ctx.resume } : {}),
-        ...(sandbox ? { sandbox } : {}),
-        state: {
-            get: (key) => state[key],
-            set: (key, value) => {
-                state[key] = value;
-                statePatch[key] = value;
-            },
-            entries: () => ({ ...state }),
-        },
-        progress() {
-            /* Canonical events are host-owned; progress transport is deferred. */
-        },
-        ask: (prompt, options) => wait("response", prompt, options),
-        approve: (prompt) => wait("approval", prompt),
-        sleep: async (duration) => {
-            throw new Suspend({
-                kind: "deferred",
-                token: durableToken({ wait: { kind: "sleep", duration } }),
-            });
-        },
-        waitFor: async (event, options) => {
-            throw new Suspend({
-                kind: "deferred",
-                token: durableToken({ wait: { kind: "waitFor", event, ...options } }),
-            });
-        },
-        step: async (name, fn) => {
-            if (Object.prototype.hasOwnProperty.call(steps, name))
-                return steps[name];
-            signal.throwIfAborted();
-            const value = await fn();
-            // Memoized values are durable only with a persisted action outcome. Interrupted actions stay uncertain.
-            steps[name] = JSON.parse(JSON.stringify(value ?? null));
-            return value;
-        },
-    };
-    try {
-        signal.throwIfAborted();
-        const approval = "approval" in tool ? tool.approval : undefined;
-        if (approval && !gateApproved) {
-            const result = await approval(input.value);
-            if (result)
-                throw new Suspend({
-                    kind: "interaction-required",
-                    interaction: {
-                        kind: "approval",
-                        prompt: typeof result === "string"
-                            ? result
-                            : `Approve ${"name" in tool ? tool.name : "tool"}?`,
-                    },
-                    token: durableToken({ approvalGate: true }),
-                });
-            gateApproved = true;
-        }
-        if (resume.kind === "approval" && resume.approved === false)
-            return { value: { kind: "denied", reason: "Approval denied" } };
-        const execute = "execute" in tool && typeof tool.execute === "function"
-            ? tool.execute
-            : undefined;
-        if (!execute)
-            throw new Error("Missing tool implementation");
-        const value = await execute(input.value, context);
-        const tagged = object(value);
-        let outcome;
-        if ([
-            "completed",
-            "failed",
-            "denied",
-            "interaction-required",
-            "deferred",
-        ].includes(tagged.kind))
-            outcome = value;
-        else
-            outcome = { kind: "completed", output: value ?? null };
-        if (outcome.kind === "completed" && schemas.outputSchema) {
-            const parsed = schemas.outputSchema.validate(outcome.output);
-            outcome = parsed.ok
-                ? { ...outcome, output: parsed.value }
-                : {
-                    kind: "failed",
-                    code: "tool.invalid-output",
-                    message: JSON.stringify(parsed.issues),
-                };
-        }
-        return { value: outcome, statePatch };
-    }
-    catch (error) {
-        if (signal.aborted)
-            throw signal.reason;
-        return {
-            value: error instanceof Suspend
-                ? error.outcome
-                : {
-                    kind: "failed",
-                    code: isToolError(error) ? error.code : "tool.execution-failed",
-                    message: message(error),
-                },
-            statePatch,
-        };
-    }
-}
-async function executeWorkflowFn(action, binding, signal, sandbox) {
-    const impl = binding.nodes[action.key];
-    if (!impl || impl.kind !== action.kind)
-        throw new Error(`No ${action.kind} implementation for key ${action.key}`);
-    signal.throwIfAborted();
-    try {
-        // Verify may receive a tool-like context later (L3/L4); tracer passes input only.
-        const value = action.kind === "verify"
-            ? await impl.fn(action.input, {
-                signal,
-                info: action.context.info,
-                session: { id: action.sessionId },
-                ...(sandbox ? { sandbox } : {}),
-                step: async (_name, fn) => fn(),
-                approve: async () => {
-                    throw new Error("Approvals in verify are not available in the tracer");
-                },
-                ask: async () => {
-                    throw new Error("ask in verify is not available in the tracer");
-                },
-                progress() { },
-            })
-            : await impl.fn(action.input);
-        return { value };
-    }
-    catch (error) {
-        if (signal.aborted)
-            throw signal.reason;
-        return {
-            value: {
-                kind: "failed",
-                code: action.kind === "verify" ? "loop.verify-failed" : "fn.failed",
-                message: message(error),
-            },
-        };
-    }
-}
-function delegatedAgent(root, id) {
-    for (const capability of Object.values(implementationsFor(root))) {
-        const child = delegateOf(capability.tools?.[id])?.agent;
-        if (child)
-            return child;
-    }
-    throw new Error(`Agent '${root.id}' does not use '${id}' as a tool`);
-}
-function message(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/plugins/launch.d.ts

@@ -1,17 +0,0 @@
-import type { McpServerManifest } from "@nylorun/core/define";
-/** Single-pass replacement. Text inserted for a token is not scanned again. */
-export declare function expandPluginPlaceholders(value: string, pluginRoot: string, pluginData: string): string;
-export interface StdioLaunch {
-    readonly command: string;
-    readonly args: readonly string[];
-    readonly cwd: string;
-    readonly env: Readonly<Record<string, string>>;
-}
-export declare function prepareStdioLaunch(server: Extract<McpServerManifest, {
-    type: "stdio";
-}>, options: {
-    readonly pluginRoot: string;
-    readonly pluginData: string;
-    readonly baseEnv?: Readonly<Record<string, string | undefined>>;
-}): StdioLaunch;
-export declare function resolveContainedCwd(cwd: string, pluginRoot: string, pluginData: string): string;

package/dist/plugins/launch.js

@@ -1,71 +0,0 @@
-import { mkdirSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
-const ROOT_TOKEN = "${PLUGIN_ROOT}";
-const DATA_TOKEN = "${PLUGIN_DATA}";
-/** Single-pass replacement. Text inserted for a token is not scanned again. */
-export function expandPluginPlaceholders(value, pluginRoot, pluginData) {
-    let out = "";
-    for (let index = 0; index < value.length;) {
-        if (value.startsWith(ROOT_TOKEN, index)) {
-            out += pluginRoot;
-            index += ROOT_TOKEN.length;
-            continue;
-        }
-        if (value.startsWith(DATA_TOKEN, index)) {
-            out += pluginData;
-            index += DATA_TOKEN.length;
-            continue;
-        }
-        out += value[index];
-        index += 1;
-    }
-    return out;
-}
-export function prepareStdioLaunch(server, options) {
-    const pluginRoot = options.pluginRoot;
-    const pluginData = options.pluginData;
-    mkdirSync(pluginData, { recursive: true });
-    const command = resolveCommand(server.command, pluginRoot);
-    const args = (server.args ?? []).map((arg) => expandPluginPlaceholders(arg, pluginRoot, pluginData));
-    const cwd = server.cwd
-        ? resolveContainedCwd(server.cwd, pluginRoot, pluginData)
-        : pluginRoot;
-    const env = {};
-    for (const [key, value] of Object.entries(options.baseEnv ?? {})) {
-        if (typeof value === "string")
-            setEnv(env, key, value);
-    }
-    for (const [key, value] of Object.entries(server.env ?? {}))
-        setEnv(env, key, expandPluginPlaceholders(value, pluginRoot, pluginData));
-    setEnv(env, "PLUGIN_ROOT", pluginRoot);
-    setEnv(env, "PLUGIN_DATA", pluginData);
-    return { command, args, cwd, env };
-}
-function resolveCommand(command, pluginRoot) {
-    if (command.startsWith("./"))
-        return resolve(pluginRoot, command);
-    return command;
-}
-export function resolveContainedCwd(cwd, pluginRoot, pluginData) {
-    const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginData);
-    const absolute = isAbsolute(expanded) ? expanded : resolve(pluginRoot, expanded);
-    const root = cwdTargetsData(cwd) ? pluginData : pluginRoot;
-    if (!isInside(root, absolute))
-        throw new Error(`Working directory escapes ${root}`);
-    return absolute;
-}
-function cwdTargetsData(cwd) {
-    return cwd === DATA_TOKEN || cwd.startsWith(`${DATA_TOKEN}/`);
-}
-function isInside(root, target) {
-    const rel = relative(root, target);
-    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
-}
-function setEnv(env, key, value) {
-    if (process.platform === "win32") {
-        const existing = Object.keys(env).find((name) => name.toLowerCase() === key.toLowerCase());
-        if (existing && existing !== key)
-            delete env[existing];
-    }
-    env[key] = value;
-}

package/dist/sandbox/client.d.ts

@@ -1,63 +0,0 @@
-/**
- * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
- * over a transport whose credential is the Action's delivery token.
- */
-import { type SandboxToolName } from "@nylorun/core/define";
-import { type Transport } from "../http.js";
-export type ActionSandboxToolResult = {
-    readonly kind: "completed";
-    readonly output: unknown;
-} | {
-    readonly kind: "failed";
-    readonly code: string;
-    readonly message: string;
-};
-export type ActionSandbox = {
-    readonly bash: (input: {
-        command: string;
-        timeout?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly read: (input: {
-        path: string;
-        offset?: number;
-        limit?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly write: (input: {
-        path: string;
-        content: string;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly edit: (input: {
-        path: string;
-        old_string: string;
-        new_string: string;
-        replace_all?: boolean;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly grep: (input: {
-        pattern: string;
-        path?: string;
-        glob?: string;
-        ignore_case?: boolean;
-        max_results?: number;
-    }) => Promise<ActionSandboxToolResult>;
-    readonly glob: (input: {
-        pattern: string;
-        path?: string;
-    }) => Promise<ActionSandboxToolResult>;
-};
-export type CreateActionSandboxOptions = {
-    /** The transport's key is the delivery token, which names the Action and its generation. */
-    readonly transport: Transport;
-    readonly actionId: string;
-    readonly signal?: AbortSignal;
-};
-/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
-export declare function createActionSandbox(options: CreateActionSandboxOptions): ActionSandbox;
-export declare function isActionSandboxTool(name: string): name is SandboxToolName;
-/** True when the executable declares a sandbox the Runtime can share. */
-export declare function definitionDeclaresSandbox(manifest: {
-    kind?: string;
-    sandbox?: unknown;
-    capabilities?: readonly {
-        sandbox?: unknown;
-    }[];
-}): boolean;

package/dist/sandbox/client.js

@@ -1,29 +0,0 @@
-/**
- * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
- * over a transport whose credential is the Action's delivery token.
- */
-import { SANDBOX_TOOL_NAMES, } from "@nylorun/core/define";
-import { segment } from "../http.js";
-/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
-export function createActionSandbox(options) {
-    const call = (tool, input) => options.transport.json(`/v1/actions/${segment(options.actionId)}/sandbox/${tool}`, "POST", input, options.signal);
-    const sandbox = {
-        bash: (input) => call("bash", input),
-        read: (input) => call("read", input),
-        write: (input) => call("write", input),
-        edit: (input) => call("edit", input),
-        grep: (input) => call("grep", input),
-        glob: (input) => call("glob", input),
-    };
-    // Freeze so tools cannot replace built-ins.
-    return Object.freeze(sandbox);
-}
-export function isActionSandboxTool(name) {
-    return SANDBOX_TOOL_NAMES.includes(name);
-}
-/** True when the executable declares a sandbox the Runtime can share. */
-export function definitionDeclaresSandbox(manifest) {
-    if (manifest.kind === "workflow")
-        return manifest.sandbox !== undefined;
-    return (manifest.capabilities ?? []).some((item) => item.sandbox !== undefined);
-}

package/dist/sandbox/index.d.ts

@@ -1,2 +0,0 @@
-export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";
-export type { ActionSandbox, ActionSandboxToolResult, CreateActionSandboxOptions, } from "./client.js";

package/dist/sandbox/index.js

@@ -1 +0,0 @@
-export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";

package/dist/served-definitions.d.ts

@@ -1,20 +0,0 @@
-import { type BuiltWorkflow } from "@nylorun/core/define";
-import { type AgentSource } from "./client.js";
-import type { ExecutableDefinition } from "./execute-action.js";
-/** The implementation version to register: the option, `NYLORUN_IMPLEMENTATION_VERSION`, or `dev`. */
-export declare function implementationVersionOf(options: {
-    implementationVersion?: string;
-}): string;
-/** The ids among `agents` that are saved only as part of another definition. */
-export declare function embeddedIn(agents: Map<string, ExecutableDefinition>): ReadonlySet<string>;
-/**
- * Every definition `sources` serves, by id: the agents and workflows passed in, the agents
- * a v2 workflow embeds, and flow agents used as tools. `owner` names the caller in errors.
- */
-export declare function buildAgents(sources: readonly (AgentSource | BuiltWorkflow)[], owner: string): Map<string, ExecutableDefinition>;
-/**
- * The manifest hash served for a workflow's flow actions. A run is pinned to one workflow
- * manifest, and its stage keys may shift between deploys, so flow actions for another hash
- * are left for whoever serves it.
- */
-export declare function flowManifestHash(agent: ExecutableDefinition): string | undefined;