@nylorun/harness 0.13.0-beta → 0.15.0-beta

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 0.15.0-beta
+
+### Major Changes
+
+- 2898d02: Extract shared definitions and contracts into core and local orchestration into
+  CLI. Harness becomes execution-only; the SDK no longer installs the engine and
+  Runtime no longer depends on the SDK. Author applications through agents and
+  install cli for the unchanged nylorun commands. See the package architecture and
+  migration guide. Cloud installs published packages from npm independently.
+
+### Minor Changes
+
+- 41e613c: Ship the local SDK registry workflow with an independent SQLite Runtime, connected tool executor, authenticated Studio proxy, and a text-and-tool starter. Replace the legacy Hono starter and AG-UI transport. Require Node 24 and include the SDK in exact release compatibility pins.
+
+  Break the Harness execution import from `/engine` to `/run` and rename hosted execution APIs to durable execution APIs, including RunBinding, BoundRunOptions, and createRunState. Update all consumers without compatibility aliases; retain persisted checkpoint fields and version pins.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [2898d02]
+  - @nylorun/core@0.1.1-beta
+
+## Unreleased
+
+### Minor Changes
+
+- Breaking beta: replace `/engine` with `/run`; rename hosted execution to durable execution.
+  Use `runDurable`, `createDurableCheckpoint`, `DurableCheckpoint`, `DurableResult`,
+  `DurableHost`, `RunBinding`, `BoundRunOptions`, and `createRunState`. No aliases remain.
+  Persisted checkpoint fields and the `hosted-1` compatibility pin are unchanged.
+
+- Breaking beta: the package root is now an alias of `/define`. Import
+  `createExecutionState` / `validateExecutionState` from `@nylorun/harness/run` and
+  `preparedModel` from `@nylorun/harness/model/adapters`. Authoring and wire-contract specifiers remain unchanged.
+- Internal source folder `execution/` is now `loop/` (one `run()` invocation). The
+  `/model/adapters` specifier is unchanged.
+- DX v5.6: Agent usable without `.build()`; `.use()` returns a new agent; top-level `tools` /
+  `instructions` (no `model` on `Agent({})`). `tool()` accepts `input` / `output` / `run`; plain
+  returns complete; export `ToolError`; tool `approval` / `effects`; `ctx.idempotencyKey`,
+  `redelivery`, `state`, `session`, `progress`, and durable waits (`ask` / `approve` / `sleep` /
+  `waitFor` / `step`).
+- Agent-as-JSON: versioned manifest (`schemaVersion: 2`), `toJSON` / `Agent.from`, `hashManifest`,
+  `checkCompatibility`; identity by manifest hash (not WeakMap-only). Session memory on
+  `ExecutionState.state`. Capability `model` is no longer projected into the published manifest.
+- Dynamics: `beforeModelCall` / `afterModelCall` with `Patch` / `Decision`; middleware deprecated
+  but kept through 1.0. Export `@nylorun/harness/run` for run-from-checkpoint; `agent.run` is a
+  1.0 alias. Export type-only `Session` / `Turn` / `Event` / `Result`.
+
 ## 0.13.0-beta
 
 ### Minor Changes

package/HOST_CONTRACT.md

@@ -0,0 +1,27 @@
+# Durable execution and session protocol — beta freeze
+
+Artifact: `@nylorun/harness@0.14.0-beta.3`. Package version is separate from protocol 1, definition schema 2, durable checkpoint 1 / engine `hosted-1`, and inner execution checkpoint 1. Public execution API and shared contracts are the compatibility boundary. Cloud installs published npm packages and does not import the OSS Runtime.
+
+## HTTP (both hosts)
+
+Bearer application credentials: `PUT /v1/agents/:agentId` (`PutAgentRequest`: requestId, complete manifest, implementationVersion); `PUT /v1/sessions/:sessionId` (`PutSessionRequest`: requestId, agentId, trusted ownerUserId, optional info); `GET /v1/sessions/:sessionId`; `POST /v1/sessions/:sessionId/commands`; `GET /v1/sessions/:sessionId/items?cursor=...`; `GET /v1/sessions/:sessionId/events?cursor=...` (SSE, Last-Event-ID also accepted). Commands use `SessionCommandSchema`. Message input is `content`, not text. Runtime configuration selects models; saved definitions do not. Session creation pins manifest hash and implementation version. GET session returns id, agentId, ownerUserId, status, activeTurnId, plus inspectable waits/uncertainty as available. History returns `{items: LiveEvent[], cursor: string|null}`; empty history cursor is null.
+
+Separate scoped executor bearer credentials: `GET /v1/executors/connect` emits `event: work_available` / `data: {"type":"work_available"}` after connection and committed work; `GET /v1/actions` returns `{actions: Action[]}`; `POST /v1/actions/:actionId/claim` uses ActionClaimRequest; `POST /v1/actions/:actionId/heartbeat` uses ActionHeartbeatRequest and returns leaseExpiresAt. Claim returns ActionClaim. Action result is the `action_result` session command with executor authorization, never observer authorization. Claim identity is server-generated and generation monotonically increases. Credentials limit agentId, manifestHash, and implementationVersion; clients cannot broaden their scope. Subscribe before discovery; rediscover after reconnect; notifications never authorize execution.
+
+All command idempotency keys bind to canonical request content within a session; requestId is transport metadata and is excluded from content comparison; exact semantic duplicates return the stored original response; changed content conflicts (409). A completed action's matching claim/generation/outcome returns its original receipt even after expiry. Conflicting duplicates and any other stale/expired claim are rejected. Heartbeat cannot resurrect an expired claim. Expired in-flight customer work is uncertain, not automatically reoffered. Results after cancellation cannot resume a turn. Application observers cannot claim or submit action results. No hardcoded production credentials.
+
+## Engine host
+
+`createDurableCheckpoint({manifest,sessionId,turnId,input,state?,info?,segment?})`, `runDurable({manifest,checkpoint,host,signal?})` from `/run`. `DurableHost.resolveEffect(HostEffect)` atomically creates or reads an individually identified effect and returns `{status:'completed',outcome:{value,statePatch?}}` or `{status:'pending'|'uncertain'}`. Model effect `input` is the complete ModelCall (instructions/history/tools/output schema); context contains a JSON projection of ModelRequest and invocationId. Its completed value is a ModelCandidate or string. Runtime provider code owns credentials and invocation. Tools/hooks have capabilityId, toolName for tools, serialized input and context. Tool result value is a ToolOutcome or a plain tool output; statePatch contains changed session keys. Before/after hook values are Patch/Decision. Tool context includes invocationId, resume, state, info and stable idempotencyKey. Customer implementationVersion is pinned by the runtime outside durable checkpoints.
+
+Persist checkpoint BEFORE scheduling, effect intent BEFORE provider invocation or notification, and outcome BEFORE resumption. Journaling an entire runDurable call as one replayable operation is forbidden. The durable path deterministically reconstructs a segment from its immutable starting checkpoint and individually cached effect outcomes. A waiting result returns that starting checkpoint: do not replace it with an intermediate preview. The journal is required continuation data and must be retained with the checkpoint. Stable IDs include turn/segment and deterministic invocation identity. There is no live continuation or request-held promise while waiting. Runtimes serialize work per session, check cancellation before effects and before settlement, and fence ownership. Lost provider acknowledgement becomes uncertain; do not repeat it merely because a worker restarts.
+
+A terminal/paused result includes `result.state`. Save it. A new message uses a new turnId with prior completed state. Approval/response resumes paused state via a new checkpoint, same turnId, `segment + 1`, with `{kind:'approve',interactionId,approved}` or `{kind:'respond',interactionId,value}`. An action result simply reruns the SAME suspended checkpoint/segment after recording the outcome. Paused plan records pending interactions/deferred calls; waiting on remote action is distinct from a human wait. Cancellation is host-owned and must fence both running and pending work. Runtime supplies canonical events; execution observations are not wire events and reconstruction must not republish duplicate history.
+
+Host resolveEffect must bind the effect ID to the original request and reject drift. Intent/outcome, action transitions, checkpoint settlement and canonical event/outbox writes must use runtime transactions. Restate journals individual effect boundaries, not the loop. Scheduling, storage, publication, lease policy and reconciliation remain runtime-owned.
+
+## Definitions, validation, compatibility
+
+`/define` is execution-free and browser-bundleable; Agent has no `.run()`. Explicit local execution uses `/run` run + bindingFromAgent(agent.build()). `/contracts` never imports checkpoint internals. Tools and before/after hooks are supported remotely. Arbitrary legacy middleware closures are rejected for durable definitions because they cannot be reconstructed from manifests. JSON schemas are reconstructed through Zod's JSON Schema importer; unsupported schemas fail closed. The original manifest hash must survive reconstruction. Model configuration is host-owned. The executor validates its local manifest hash and implementationVersion before claiming and validates tool inputs/outputs locally.
+
+No session migration, arbitrary checkpoint migration, broad model-support, or conformance claims follow from compiling this interface. Studio and conformance tooling remain outside production harness.

package/README.md

@@ -1,129 +1,91 @@
 # `@nylorun/harness`
 
-Observable, portable, composable agent execution. Harness runs a model/tool loop with invocation-local progress; an application or optional Runtime owns sessions.
+Execution engine, checkpoints and durable host effects. Shared authoring and wire
+contracts live in `@nylorun/core`; applications use `@nylorun/agents`.
+OSS publishes harness for local Runtime; Cloud installs published packages from
+npm independently. See the
+[package architecture](../docs/design/package-architecture.md).
 
-> **Breaking beta:** this interface replaces the Session-returning `run()` API. See [migration](../MIGRATION.md).
+Use `/run` for explicit execution, `/model/adapters` for provider format adapters,
+and `/compatibility` for checkpoint compatibility. Definitions and protocol
+schemas are no longer harness exports.
 
-## Run an agent
+> **DX v5.6:** definition ⊥ engine. `model` is not on `Agent({})` — Runtime injects `onModelCall`. Host data stays `info` (not `user`); session memory is `state`.
 
-```ts
-import { Agent } from "@nylorun/harness";
+## Compose an agent
 
-const agent = Agent({ id: "assistant", name: "Assistant" }).build();
-const result = await agent.run({
-  input: "Hello",
-  onModelCall: async (call) => "Hello back!", // Your model adapter
-});
-if (result.status === "completed") console.log(result.output);
+```ts
+import { Agent, tool, ToolError, capability } from "@nylorun/agents/define";
+import { z } from "zod";
 
-const next = await agent.run({
-  state: result.state,
-  input: "Continue our conversation",
-  onModelCall,
+const lookup = tool({
+  name: "lookup_order",
+  input: z.object({ orderId: z.string() }),
+  effects: "read",
+  async run({ orderId }, ctx) {
+    const order = await orders.find(orderId, { info: ctx.info, signal: ctx.signal });
+    if (!order) throw new ToolError("not_found", "No such order.");
+    return order; // plain return = completed
+  },
 });
-```
-
-Every call returns a Promise. Omitted state starts an empty execution. The built agent retains definitions, not progress; supplied state is never mutated. Multiple calls may use the same agent concurrently. Applications must coordinate concurrent updates to the same conversation.
-
-Outcomes are `completed` (with `output`), `paused` (with `pending`), `cancelled`, or `failed` (with `error`). Each includes serializable `state`. Invalid options, incompatible state, and invalid continuation inputs reject before model/tool execution. Operational failures return `failed`. Recording failures reject.
 
-## Built agent interface
+export const supportAgent = Agent({
+  id: "support",
+  name: "Support",
+  instructions: "You help customers with orders. Be brief.",
+  tools: [lookup],
+})
+  .use(capability({ id: "policy", afterModelCall: ({ text }) => ({}) }))
+  .beforeModelCall(({ info, state }) => ({ instructions: [`Tenant ${info?.tenantId}`] }));
 
-`Agent(...).use(...).build()` returns a `BuiltAgent<Info, Output>`. Import `BuiltAgent` with `import type`; it has no runtime constructor or `instanceof` check. Its public members are `id`, `name`, `manifest`, and `run`. The manifest is a frozen capability catalog (`id`, `name`, optional `outputSchema`, and `capabilities`); compiled middleware, the tool registry, and output validators remain internal. Correlate traces by `event.middlewareId` / `ToolReference.capabilityId` to `manifest.capabilities[].id`.
+// Optional: .build() is a no-op facade
+const agent = supportAgent.build();
 
-`createExecutionState(agent)` requires the original built agent so it can include the configured output contract. Adding application-owned methods such as `close()` with `Object.assign(agent, { close })` preserves this identity. If you wrap or copy an agent, initialize state using the original agent. State remains serializable and inspectable.
-
-Model adapters receive immutable `ToolDescriptor` values in `context.request.tools` and `context.request.configuration.tools`. Descriptors preserve `name`, optional `description`, `owner`, `inputSchema.jsonSchema`, and optional `outputSchema.jsonSchema`. They contain no executable tool, original definition, or validator. Implement tools through registered capabilities; adapters return tool-call candidates for Harness to validate and dispatch.
-
-## Optional controls
-
-```ts
-const result = await agent.run({
-  state,
-  input,
-  onModelCall,
-  info: { userId, tenantId },
-  signal: controller.signal,
-  onEvent: (event) => console.log(event),
-  record: (state) => sessionStore.save(sessionId, state),
-});
+JSON.stringify(supportAgent); // manifest
+Agent.from(supportAgent.toJSON(), implementations);
 ```
 
-`info` is extra application data available as `request.info` in middleware and `context.info` in tools. Type it with `Agent<MyInfo>(...)`. Harness does not put info into state, observations, or model requests. Middleware can deliberately add model-visible data through its existing `request.context` interface. The application owns authentication and authorization, including checking access to the original resource after continuation.
-
-`signal` is cooperative: Harness checks before further work, forwards it to adapters and tools, and waits for dispatched work to settle. Cancellation preserves settled results, cannot undo external effects, and cannot forcibly stop an uncooperative dependency. Harness has no cancellation or shutdown method. The developer owns clients, connections, subprocesses, and their cleanup.
-
-To cancel a saved pause, call `run({ state, input: { kind: "continue" }, signal: AbortSignal.abort(), onModelCall })`. This settles the pending plan without dispatching it. `state.cancelledCalls` retains unresolved invocation references and deferred tokens for reconciliation, outside the model transcript; cancelling a deferred job does not stop external work by itself. Runtime's `host.cancel(agent, sessionId)` applies this transition and persists it before accepting replacement work.
+`.use()` returns a **new** agent. Top-level `tools` / `instructions` are first-class. Do **not** put `model` on `Agent({})` — Runtime resolves and calls the model.
 
-`onEvent` reports ordered events with execution, run, turn, step, model invocation, and tool call identifiers where applicable. Observer exceptions produce `observation.failed` diagnostics without changing results. Observations describe execution; they do not acknowledge durable commits. Explicit model-visible content and tool output can appear in events, so applications still control sensitive data they put there.
+## Run the loop
 
-`record` receives independent immutable JSON snapshots, serially. Harness awaits each recording barrier: accepted plans after middleware unwinds and before dispatch, active work markers, settled tool batches, pauses, and final outcomes. A rejected recording stops further dispatch; active work has settled before rejection. An external operation may succeed before a write fails. An intermediate active snapshot requires reconciliation and never authorizes automatic replay.
-
-## Final output contracts
+Taught path for hosts/Runtime:
 
 ```ts
-import { z } from "zod";
-const agent = Agent({
-  id: "extractor",
-  name: "Extractor",
-  outputSchema: z.object({ answer: z.string() }),
-}).build();
-// A completed result.output is inferred as { answer: string }.
-```
-
-The schema belongs to the agent definition, is supplied to adapters, and validates the accepted final response after middleware. Adapters return a JSON output block for structured results. There is no per-run or per-turn schema override. Tool output schemas remain tool-specific. With an explicitly typed info bag and output schema, use `Agent<MyInfo, typeof schema>({...})`.
+import { run, bindingFromAgent } from "@nylorun/harness/run";
 
-## Register and expose tools
-
-```ts
-const lookup = {
-  name: "lookup",
-  inputSchema: z.object({ id: z.string() }),
-  execute: async ({ id }, { info, signal }) => ({
-    kind: "completed" as const,
-    output: await database.lookup(id, { info, signal }),
-  }),
-};
-const agent = Agent({ id: "assistant", name: "Assistant" })
-  .use({ id: "database", tools: [lookup] })
-  .build();
+const result = await run({
+  binding: bindingFromAgent(supportAgent.build()),
+  input: "Hello",
+  onModelCall: async () => "Hello back!",
+  info: { tenantId: "acme" },
+  record: (state) => store.save(state),
+});
 ```
 
-`.use()` registers code. Middleware selects registered tools through `request.configuration.tools.set(slot, tools)`. Changing the subset needs no restoration callback. Unregistered executable closures are rejected before a model call. Middleware wrapping order is preserved; tool plans are accepted only after the stack unwinds.
+This is a breaking beta: `agent.run()` has been removed. Application execution uses SDK sessions. Durable execution uses `createDurableCheckpoint` and `runDurable` with individually persisted model/tool/hook effects; a suspended checkpoint requires its effect journal.
 
-When identity depends on discovered data, keep one registered tool and put that data in the arguments (or authorize it from `info`):
+## Tools
 
-```ts
-const queryTable = {
-  name: "query_table",
-  inputSchema: z.object({ table: z.string(), query: z.string() }),
-  execute: async ({ table, query }, { info, signal }) => ({
-    kind: "completed" as const,
-    output: await warehouse.query({ table, query, principal: info, signal }),
-  }),
-};
-```
+Prefer `input` / `output` / `run`. Legacy `inputSchema` / `execute` and tagged `{ kind: "completed" }` outcomes still work.
 
-## Pause and continue
+- `approval` — declarative pause before execute (code-only; not in the manifest)
+- `effects` — `"read" | "idempotent" | "write"` (code-only)
+- `ctx.idempotencyKey`, `ctx.redelivery`, `ctx.state`, `ctx.session`, `ctx.progress`
+- Durable waits: `ctx.ask`, `ctx.approve`, `ctx.sleep`, `ctx.waitFor`, `ctx.step`
 
-An approval or response request, or a tool returning `{ kind: "deferred", token }`, settles the invocation as `paused`. Persist the returned state intact. Rebuild the same agent definition and call `run()` again:
+Definitions must not import `@nylorun/runtime`.
 
-```ts
-await agent.run({
-  state: savedState,
-  input: { kind: "approve", interactionId, approved: true },
-  info: freshApplicationInfo,
-  onModelCall,
-});
-// A response uses { kind: "respond", interactionId, value }.
-// A deferred settlement uses { kind: "settle", invocationId, outcome:
-//   { kind: "completed", output: jobResult } }.
-```
+## Dynamics
+
+`beforeModelCall` → `Patch` (capabilities/tools/instructions/state/block — no `model`).
+`afterModelCall` → `Decision` (text/deny/approve/retry/block).
+Local explicit engine execution retains middleware. Durable manifests reject arbitrary middleware closures; use before/after hooks.
 
-Registered tools restore by name from the rebuilt definition. Accepted descriptors, arguments, ordering, decisions, and invocation IDs survive; settled tools and middleware are not rerun for restoration. An execute-time interaction may re-enter that tool with `context.resume`; use its saved token to continue, not repeat prior effects.
+## Checkpoint / durability
 
-`createExecutionState(agent)` and `validateExecutionState(value)` help initialize and validate state. Applications should not hand-author pending plans. State is a trusted continuation record, not an authorization credential; never accept client-controlled state without validation and access control.
+`ExecutionState` is the continuation token (plus `manifestHash`). Runtime persists `record(state)` at durable boundaries and resumes with `continue` / `approve` / `respond` / `settle`. `checkCompatibility(manifest, state)` fails on hash mismatch.
 
-Missing definitions, changed contracts or bindings, and duplicate/mismatched continuation inputs reject. Family versions must change for incompatible implementations. Schema comparisons cannot detect arbitrary behavior changes inside JavaScript functions. Hosts own agent generation, drain of old definitions, and any migrate-in-place of saved state.
+## Client types
 
-Completed turns and explicit pauses can continue in a new process. Automatic crash replay and deferred model continuation are not supported. One-shot child work is `await child.run(...)`; separately addressable child sessions belong to a host.
+The authoritative session/action wire schemas live in `/contracts` and do not import durable checkpoint types. Use `@nylorun/agents` for the session client and SSE executor. Historical root client types remain for deferred local tooling; they are not the new wire contract.

package/dist/compatibility.d.ts

@@ -0,0 +1,3 @@
+export { checkCompatibility } from "./definition/compatibility.js";
+export declare const CHECKPOINT_VERSION = 1;
+export declare const ENGINE_VERSION = "hosted-1";

package/dist/compatibility.js

@@ -0,0 +1,3 @@
+export { checkCompatibility } from "./definition/compatibility.js";
+export const CHECKPOINT_VERSION = 1;
+export const ENGINE_VERSION = "hosted-1";

package/dist/definition/agent-definition.d.ts

@@ -1,11 +1,19 @@
-import type { BoundMiddleware } from "./bound.js";
+import type { BoundMiddleware } from "@nylorun/core/define";
 import type { ToolRegistry } from "./registry.js";
-import type { TurnOutputContract } from "./output-contract.js";
+import type { TurnOutputContract } from "@nylorun/core/define";
+import type { AgentManifest } from "@nylorun/core/define";
+import type { Implementations } from "@nylorun/core/define";
 export interface AgentDefinition {
     readonly id: string;
     readonly middleware: readonly BoundMiddleware[];
     readonly registry: ToolRegistry;
     readonly output?: TurnOutputContract;
+    readonly manifest: AgentManifest;
+    readonly hash: string;
+    readonly implementations: Implementations;
 }
-export declare function registerDefinition(agent: object, definition: AgentDefinition): void;
+export type { Implementations };
+import type { AgentBinding } from "@nylorun/core/define";
 export declare function definitionFor(agent: object): AgentDefinition;
+export declare function definitionFromBinding(binding: AgentBinding): AgentDefinition;
+export declare function tryDefinitionFor(agent: object): AgentDefinition | undefined;

package/dist/definition/agent-definition.js

@@ -1,12 +1,20 @@
-import { HarnessError } from "../errors.js";
-// Definition lookup only; execution progress is never retained here.
-const definitions = new WeakMap();
-export function registerDefinition(agent, definition) {
-    definitions.set(agent, definition);
-}
+import { bindingFromAgent, bindOutputContract } from "@nylorun/core/define";
+import { ToolRegistry as Registry } from "./registry.js";
+import { hashManifest } from "@nylorun/core/compatibility";
 export function definitionFor(agent) {
-    const definition = definitions.get(agent);
-    if (!definition)
-        throw new HarnessError("execution.invalid-input", "createExecutionState() requires the original agent returned by Agent(...).build(); initialize wrapper state with that original agent.");
-    return definition;
+    return definitionFromBinding(bindingFromAgent(agent));
+}
+export function definitionFromBinding(binding) {
+    return Object.freeze({
+        id: binding.manifest.id,
+        manifest: binding.manifest,
+        hash: hashManifest(binding.manifest),
+        middleware: binding.declarations,
+        implementations: binding.implementations,
+        registry: new Registry(binding.declarations, binding.tools),
+        ...(binding.outputSchema ? { output: bindOutputContract(binding.outputSchema) } : {}),
+    });
+}
+export function tryDefinitionFor(agent) {
+    return typeof agent.getBinding === "function" ? definitionFor(agent) : undefined;
 }

package/dist/definition/compatibility.d.ts

@@ -0,0 +1,11 @@
+import { HarnessError } from "@nylorun/core/define";
+import type { AgentManifest } from "@nylorun/core/define";
+import type { ExecutionState } from "../types/execution.js";
+export type CompatibilityResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: HarnessError;
+};
+/** Fail loud when a checkpoint was bound to a different definition. */
+export declare function checkCompatibility(manifest: AgentManifest, state: ExecutionState): CompatibilityResult;

package/dist/definition/compatibility.js

@@ -0,0 +1,30 @@
+import { HarnessError } from "@nylorun/core/define";
+import { hashManifest } from "@nylorun/core/define";
+/** Fail loud when a checkpoint was bound to a different definition. */
+export function checkCompatibility(manifest, state) {
+    const expected = hashManifest(manifest);
+    if (state.manifestHash && state.manifestHash !== expected) {
+        return {
+            ok: false,
+            error: new HarnessError("execution.incompatible", "Saved state manifestHash does not match the supplied agent manifest", {
+                details: {
+                    expected: expected.slice(0, 12),
+                    actual: state.manifestHash.slice(0, 12),
+                },
+            }),
+        };
+    }
+    if (state.agentId !== manifest.id) {
+        return {
+            ok: false,
+            error: new HarnessError("execution.incompatible", "Saved state agentId does not match the supplied agent manifest", { details: { expected: manifest.id, actual: state.agentId } }),
+        };
+    }
+    if (state.version !== 1) {
+        return {
+            ok: false,
+            error: new HarnessError("execution.incompatible", `Unsupported ExecutionState version ${state.version}`),
+        };
+    }
+    return { ok: true };
+}

package/dist/definition/registry.d.ts

@@ -1,10 +1,10 @@
-import type { BoundMiddleware, BoundToolDefinition } from "./bound.js";
+import type { BoundMiddleware, BoundToolDefinition } from "@nylorun/core/define";
 import type { ToolReference } from "../types/execution.js";
 /** Definition-only lookup; no per-run selections or progress live here. */
 export declare class ToolRegistry {
     private readonly tools;
     private readonly owners;
-    constructor(middleware: readonly BoundMiddleware[]);
+    constructor(middleware: readonly BoundMiddleware[], snapshots?: readonly BoundToolDefinition[]);
     reference(tool: BoundToolDefinition): ToolReference;
     restore(reference: ToolReference): BoundToolDefinition;
 }

package/dist/definition/registry.js

@@ -1,18 +1,19 @@
-import { bindTool } from "./bind-tool.js";
-import { HarnessError } from "../errors.js";
-import { canonical } from "../utils/canonical.js";
-import { copyJson } from "../utils/immutable.js";
+import { bindTool } from "@nylorun/core/define";
+import { HarnessError } from "@nylorun/core/define";
+import { canonical } from "@nylorun/core/define";
+import { copyJson } from "@nylorun/core/define";
 /** Definition-only lookup; no per-run selections or progress live here. */
 export class ToolRegistry {
     tools = new Map();
     owners = new WeakMap();
-    constructor(middleware) {
+    constructor(middleware, snapshots) {
         for (const capability of middleware) {
             for (const tool of capability.tools ?? []) {
                 const key = JSON.stringify([capability.id, tool.name]);
                 if (this.tools.has(key) || this.owners.has(tool))
                     throw new HarnessError("tool.invalid", `Duplicate registered tool '${tool.name}' in '${capability.id}'`);
-                this.tools.set(key, bindTool(tool, { middlewareId: capability.id, slot: capability.id }));
+                this.tools.set(key, snapshots?.find((snapshot) => snapshot.source === tool) ??
+                    bindTool(tool, { middlewareId: capability.id, slot: capability.id }));
                 this.owners.set(tool, capability.id);
             }
         }

package/dist/index.d.ts

@@ -1,18 +1,4 @@
-export { Agent, AgentBuilder, AgentBuildError, AgentLifecycleError } from "./definition/builder.js";
-export type { AgentOptions } from "./definition/builder.js";
-export { HarnessError, isHarnessError } from "./errors.js";
-export type { HarnessErrorCode, HarnessErrorDetails, HarnessErrorOptions } from "./errors.js";
-export type { BuiltAgent } from "./types/agent.js";
-export { middleware, model, tool } from "./definition/helpers.js";
-export { defineSchema } from "./definition/schema.js";
-export { preparedModel } from "./execution/model/prepared.js";
-export type { PreparedModelOptions } from "./execution/model/prepared.js";
-export type { AgentManifest, CapabilityManifest, ManifestTool } from "./types/manifest.js";
-export type { CapabilityDeclaration, CapabilityItems, MiddlewareContributions, StepMiddleware, StepRequest, StepResponse, } from "./types/middleware.js";
-export type { ModelCandidate, ModelControls, ModelDirective, ModelEvidence, ModelFinishReason, ModelAdapter, ModelAdapterContext, ModelPreparedCall, ContextContributor, ContextMutationOptions, ContextSnapshot, ModelCall, ModelCallTool, ModelOutputBlock, PromptContentPart, PromptItem, ModelConfigurationContributor, ModelConfigurationInstruction, ModelConfigurationMutationOptions, ModelConfigurationSnapshot, ModelConfigurationTool, ModelRequest, ModelToolCall, ModelUsage, } from "./types/model.js";
-export type { BuildDiagnostic, ContextItem, DeferredOutcome, JsonObject, JsonPrimitive, JsonValue, Tripwire, } from "./types/shared.js";
-export type { ObserveEvent, ObserveModelConfigurationSnapshot, ObserveModelRequested, ObserveSealedCall, ObserveToolSnapshot, Observer, } from "./types/observe.js";
-export type { InputEvent, MessageInput, InteractionReply, TranscriptEntry, UserContentPart, } from "./types/transcript.js";
-export type { ExecutionInput, ExecutionState, ExecutionEvent, RunOptions, RunResult, SavedToolCall, ExecutionPlan, ToolReference, } from "./types/execution.js";
-export { createExecutionState, validateExecutionState } from "./execution/state.js";
-export type { Interaction, RequiredInteraction, ToolContent, ToolDefinition, ToolDescriptor, ToolExecutionContext, ToolExecutionResume, ToolInputSchema, ToolOutputSchema, ToolSchema, ToolSchemaSource, StandardToolSchema, StandardSchemaIssue, SchemaIssue, SchemaValidation, SchemaOutput, ToolOwner, ToolOutcome, ToolResult, ToolValidationFailureDetails, } from "./types/tool.js";
+export * from "./run/index.js";
+export type * from "./types/execution.js";
+export type * from "./types/client.js";
+export type { PreparedModelOptions } from "./loop/model/prepared.js";

package/dist/index.js

@@ -1,6 +1 @@
-export { Agent, AgentBuilder, AgentBuildError, AgentLifecycleError } from "./definition/builder.js";
-export { HarnessError, isHarnessError } from "./errors.js";
-export { middleware, model, tool } from "./definition/helpers.js";
-export { defineSchema } from "./definition/schema.js";
-export { preparedModel } from "./execution/model/prepared.js";
-export { createExecutionState, validateExecutionState } from "./execution/state.js";
+export * from "./run/index.js";