@nylorun/runtime 0.10.0-beta → 0.11.0-beta

package/dist/tenant/auth.js

@@ -0,0 +1,34 @@
+import { hashToken } from "../core/executors.js";
+import { fail, failOpaque } from "./http.js";
+export async function authenticate(ctx, request) {
+    const header = request.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
+    if (!token || !header?.startsWith("Bearer ")) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "missing_bearer",
+        });
+        return failOpaque();
+    }
+    const tokenHash = hashToken(token);
+    const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
+    if (principal)
+        return { kind: "application", principalId: principal.id };
+    const executor = ctx.registry.find(tokenHash);
+    if (!executor) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "unknown_token",
+        });
+        return failOpaque();
+    }
+    return { kind: "executor", executor };
+}
+/** The executor scope must belong to the Action's agent. */
+export function scoped(scope, action) {
+    if (scope.kind !== "executor" || scope.executor.agentId !== action.agentId)
+        fail(403, "Executor scope does not authorize this action");
+}
+export function requireApplication(scope) {
+    if (scope.kind === "application")
+        return scope.principalId;
+    return fail(403, "Application credential required");
+}

package/dist/tenant/commands.d.ts

@@ -0,0 +1,3 @@
+import type { SessionCommand } from "@nylorun/core/contracts";
+import { type AuthScope, type TenantContext } from "./context.js";
+export declare function command(ctx: TenantContext, id: string, input: SessionCommand, scope: AuthScope): Promise<unknown>;

package/dist/tenant/commands.js

@@ -0,0 +1,384 @@
+/**
+ * The session command service: `message`, `approve`/`respond`, `action_result` and `cancel`,
+ * with per-session idempotency keys. A command locks its session and commits its state
+ * change, events and wakes in one transaction (the store publishes the events and runs the
+ * `afterCommit` wakes), then aborts a cancelled advance and cascades workflow cancels to the
+ * linked agent sessions, one transaction each.
+ *
+ * Wakes (`ctx.wake`, architecture §12.3) carry the command type as the reason and a dedupe
+ * key naming the cause: `<type>:<turnId>:<segment>` for `message`, `approve` and `respond`
+ * (every accepted one writes a new checkpoint segment), and
+ * `action_result:<turnId>:<actionId>:<generation>` for executor results.
+ *
+ * Cancel commits `cancelled` first; the engine host sees it before its next effect and before
+ * settlement on any Worker. It then aborts an advance running on this process
+ * (`ctx.abortLocal`); reaching an advance on another process is the control stream's job.
+ */
+import { randomUUID } from "node:crypto";
+import { createDurableCheckpoint, createFlowCheckpoint, } from "@nylorun/harness/run";
+import { schemaFromJSON, } from "@nylorun/core/define";
+import { commandKey, fenceWorkflowActions, foreignInteractionConflict, isWorkflowManifest, planCancelCascade, wakeForQueuedEffects, wakeLinkedWorkflow, } from "../core/flow-host.js";
+import { resolveMessageManifest } from "../core/turn-manifest.js";
+import { canonical } from "../store/canonical.js";
+import { lockedSession, } from "./context.js";
+import { fail } from "./http.js";
+import { scoped } from "./auth.js";
+import { actionTarget, rebaseSessionState, turnManifestOf, variantStore, } from "./session.js";
+import { signalSessionCancel } from "./streams.js";
+/** A tool result whose output does not match the Action's stored output schema fails the tool. */
+function acceptedToolResult(action, command) {
+    if (action.kind !== "tool" || !action.outputSchema)
+        return command;
+    const value = command.outcome.value;
+    if (isFailedToolValue(value))
+        return command;
+    // Executors wrap successful tool output as `{ kind: "completed", output }`.
+    // Validate the tool payload, not the outcome envelope.
+    const candidate = completedToolOutput(value);
+    let matches = false;
+    try {
+        matches = schemaFromJSON(action.outputSchema).validate(candidate).ok;
+    }
+    catch {
+        matches = false;
+    }
+    if (matches)
+        return command;
+    return {
+        ...command,
+        outcome: {
+            ...command.outcome,
+            value: {
+                kind: "failed",
+                code: "tool.invalid-output",
+                message: "Tool result does not match the output schema stored on the action",
+            },
+        },
+    };
+}
+function completedToolOutput(value) {
+    if (value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        value.kind === "completed" &&
+        "output" in value) {
+        return value.output;
+    }
+    return value;
+}
+function isFailedToolValue(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        value.kind === "failed");
+}
+/** A command's identity for idempotency: everything but the request id. */
+const semantic = (value) => {
+    const { requestId: _, ...body } = value;
+    return canonical(body);
+};
+export async function command(ctx, id, input, scope) {
+    const { store } = ctx;
+    const cascadeCancelIds = [];
+    const response = await store.tx(async (t) => {
+        const s = await lockedSession(t, id);
+        let command = input;
+        if (command.type === "action_result") {
+            const a = (await t.get("actions", command.actionId)) ??
+                fail(404, "Action not found");
+            if (a.sessionId !== id)
+                fail(403, "Action belongs to another session");
+            scoped(scope, a);
+            command = acceptedToolResult(a, command);
+        }
+        else if (scope.kind !== "application")
+            fail(403, "Application credential required");
+        const key = commandKey(id, command.idempotencyKey);
+        const existing = await t.get("commands", key);
+        if (existing) {
+            if (semantic(existing.command) !== semantic(command))
+                fail(409, "Idempotency key already binds another command");
+            return existing.response;
+        }
+        let event;
+        // The turn a `cancel` ended, if one was active.
+        let cancelledTurnId = null;
+        if (command.type === "action_result") {
+            const action = (await t.get("actions", command.actionId));
+            const prior = await t.get("effects", command.actionId);
+            if (action.status === "completed") {
+                if (action.claimId !== command.claimId ||
+                    action.generation !== command.generation ||
+                    canonical(prior.outcome) !== canonical(command.outcome))
+                    fail(409, "Conflicting action result");
+                await t.put("commands", key, { command, response: prior.receipt });
+                return prior.receipt;
+            }
+            if (s.status === "cancelled" ||
+                s.activeTurnId !== action.turnId ||
+                action.status !== "claimed" ||
+                action.claimId !== command.claimId ||
+                action.generation !== command.generation ||
+                Date.parse(action.leaseExpiresAt) <= Date.now())
+                fail(409, "Stale, expired, or cancelled claim");
+            action.status = "completed";
+            await t.put("actions", action.actionId, action);
+            prior.status = "completed";
+            prior.outcome = command.outcome;
+            s.status = "runnable";
+            const resultWake = {
+                reason: "action_result",
+                dedupeKey: `action_result:${action.turnId}:${action.actionId}:${action.generation}`,
+            };
+            t.afterCommit(() => ctx.wake(id, resultWake));
+            event = await t.event(id, s.activeTurnId, "action.completed", {
+                actionId: action.actionId,
+                ...actionTarget(action),
+                kind: action.kind,
+                result: command.outcome.value,
+            });
+            if (action.kind === "verify") {
+                const verdict = command.outcome.value;
+                if (verdict?.kind !== "failed") {
+                    await t.event(id, s.activeTurnId, "loop.verified", {
+                        path: String(action.context?.loopPath ?? action.path ?? ""),
+                        n: Number(action.context?.n ?? 1),
+                        pass: Boolean(verdict?.pass),
+                        ...(verdict?.feedback !== undefined
+                            ? { feedback: verdict.feedback }
+                            : {}),
+                        ...(verdict?.data !== undefined ? { data: verdict.data } : {}),
+                    });
+                }
+            }
+            else if (action.kind === "fn" && action.context?.role === "decide") {
+                const decision = command.outcome.value;
+                await t.event(id, s.activeTurnId, "loop.decided", {
+                    path: String(action.context?.loopPath ?? action.path ?? ""),
+                    n: Number(action.context?.n ?? 1),
+                    next: "output" in decision && !("input" in decision)
+                        ? "output"
+                        : "input",
+                    patched: Boolean(decision.agent),
+                });
+            }
+            const receipt = {
+                status: "accepted",
+                turnId: s.activeTurnId,
+                cursor: event.cursor,
+                requestId: command.requestId,
+            };
+            prior.receipt = receipt;
+            await t.put("effects", action.actionId, prior);
+            if (isWorkflowManifest(s.manifest) && s.activeTurnId) {
+                await wakeForQueuedEffects({
+                    t,
+                    workflowSessionId: id,
+                    turnId: s.activeTurnId,
+                    limits: ctx.flowLimits,
+                    schedule: ctx.wake,
+                });
+            }
+        }
+        else if (command.type === "cancel") {
+            cancelledTurnId = s.activeTurnId;
+            const workflowCancel = isWorkflowManifest(s.manifest);
+            const cascade = workflowCancel
+                ? await planCancelCascade({
+                    t,
+                    workflowSessionId: id,
+                    turnId: cancelledTurnId,
+                })
+                : null;
+            s.status = "cancelled";
+            if (workflowCancel) {
+                await fenceWorkflowActions({
+                    t,
+                    workflowSessionId: id,
+                    turnId: cancelledTurnId,
+                });
+            }
+            else if (cancelledTurnId !== null) {
+                for (const a of await t.actionsForSession(id, {
+                    turnId: cancelledTurnId,
+                    statuses: ["pending", "claimed"],
+                })) {
+                    // Claimed work may already have an external effect. Preserve it for reconciliation.
+                    a.status = a.status === "claimed" ? "uncertain" : "cancelled";
+                    await t.put("actions", a.actionId, a);
+                    const effect = await t.get("effects", a.actionId);
+                    if (effect) {
+                        effect.status = a.status;
+                        await t.put("effects", a.actionId, effect);
+                    }
+                }
+            }
+            if (cancelledTurnId !== null)
+                for (const effect of await t.effectsForTurn(id, cancelledTurnId, ["invoking"])) {
+                    effect.status = "uncertain";
+                    effect.error =
+                        "Turn cancelled before model outcome was durably recorded";
+                    await t.put("effects", effect.request.effectId, effect);
+                }
+            event = await t.event(id, cancelledTurnId, "turn.cancelled", {
+                reason: command.reason,
+            });
+            // The process running the advance aborts it on `session.cancel` (tenant/control).
+            t.afterCommit(() => signalSessionCancel(ctx, id));
+            s.activeTurnId = null;
+            if (cancelledTurnId !== null)
+                s.lastTurnId = cancelledTurnId;
+            // The next turn starts from the state preceding the cancelled turn, never its paused plan.
+            if (cancelledTurnId !== null)
+                s.state = s.turnStartState;
+            s.checkpoint = undefined;
+            s.waits = undefined;
+            s.error = undefined;
+            // Cascade: cancel linked agent sessions deepest-first (after fencing this session), each
+            // in its own transaction after this one commits (child sessions are never locked here).
+            if (cascade) {
+                for (const agentId of cascade.agentSessionIds) {
+                    const agent = await t.get("sessions", agentId);
+                    if (!agent ||
+                        !agent.activeTurnId ||
+                        ["idle", "completed", "failed", "cancelled"].includes(agent.status))
+                        continue;
+                    cascadeCancelIds.push(agentId);
+                }
+            }
+        }
+        else {
+            if (command.type === "message") {
+                if (!["idle", "completed", "failed", "cancelled"].includes(s.status))
+                    fail(409, "Session has active or unresolved work");
+                s.turnStartState = s.state;
+                s.activeTurnId = randomUUID();
+                if (isWorkflowManifest(s.manifest)) {
+                    const input = "content" in command ? command.content : command.data;
+                    s.checkpoint = createFlowCheckpoint({
+                        manifest: s.manifest,
+                        sessionId: id,
+                        turnId: s.activeTurnId,
+                        input,
+                    });
+                }
+                else {
+                    // Optional message.manifest: validate as variant, pin by hash, apply this turn only.
+                    const resolved = resolveMessageManifest({
+                        pinned: s.manifest,
+                        pinnedHash: s.manifestHash,
+                        messageManifest: command.manifest,
+                        store: variantStore(s),
+                    });
+                    if (!resolved.ok) {
+                        fail(400, resolved.message);
+                    }
+                    else {
+                        rebaseSessionState(s, resolved.hash);
+                        s.checkpoint = createDurableCheckpoint({
+                            manifest: resolved.manifest,
+                            sessionId: id,
+                            turnId: s.activeTurnId,
+                            input: "content" in command
+                                ? command.content
+                                : typeof command.data === "string"
+                                    ? command.data
+                                    : JSON.stringify(command.data),
+                            state: s.state,
+                            info: s.info,
+                        });
+                    }
+                }
+            }
+            else {
+                if (s.status !== "paused" || !s.state || !s.activeTurnId)
+                    fail(409, "Session is not awaiting a response");
+                const pending = s.state.plan?.calls ?? [];
+                if (!pending.some((c) => c.status === "interaction" &&
+                    c.interaction?.id === command.interactionId &&
+                    (command.type === "approve") ===
+                        (c.interaction?.kind === "approval")))
+                    fail(409, "Unknown interaction");
+                const input = command.type === "approve"
+                    ? {
+                        kind: "approve",
+                        interactionId: command.interactionId,
+                        approved: command.approved,
+                    }
+                    : {
+                        kind: "respond",
+                        interactionId: command.interactionId,
+                        value: command.value,
+                    };
+                if (isWorkflowManifest(s.manifest)) {
+                    // Approvals owned by linked agent sessions must be answered there (WF-R52).
+                    const conflict = await foreignInteractionConflict({
+                        t,
+                        workflowSessionId: id,
+                        interactionId: command.interactionId,
+                    });
+                    if (conflict)
+                        fail(409, conflict.message);
+                    // Workflow-owned interactions (tool-node / verify) resume on this session once
+                    // the flow engine supports pause segments; tracer root Loop has none yet.
+                    fail(409, "Workflow sessions do not accept approve/respond on the root without a pending interaction");
+                }
+                s.checkpoint = createDurableCheckpoint({
+                    manifest: turnManifestOf(s),
+                    sessionId: id,
+                    turnId: s.activeTurnId,
+                    input: input,
+                    state: s.state,
+                    info: s.info,
+                    segment: (s.checkpoint?.segment ?? 0) + 1,
+                });
+            }
+            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, s.checkpoint.segment]), { checkpoint: s.checkpoint, status: "runnable" });
+            s.status = "runnable";
+            s.waits = undefined;
+            const commandWake = {
+                reason: command.type,
+                dedupeKey: `${command.type}:${s.activeTurnId}:${s.checkpoint.segment}`,
+            };
+            t.afterCommit(() => ctx.wake(id, commandWake));
+            event = await t.event(id, s.activeTurnId, `command.${command.type}`, command);
+        }
+        await t.put("sessions", id, s);
+        // Direct cancel of a linked agent fails that node with agent.cancelled (WF-R54). The agent
+        // session is locked above, before wakeLinkedWorkflow locks its workflow.
+        if (command.type === "cancel")
+            await wakeLinkedWorkflow({
+                t,
+                agentSessionId: id,
+                turnId: cancelledTurnId,
+                cancelled: true,
+                error: "Agent turn was cancelled",
+                schedule: ctx.wake,
+            });
+        const response = {
+            status: "accepted",
+            turnId: s.activeTurnId,
+            cursor: event.cursor,
+            requestId: command.requestId,
+        };
+        await t.put("commands", key, { command, response });
+        return response;
+    });
+    if (input.type === "cancel")
+        ctx.abortLocal(id);
+    // Cascade cancel linked agents deepest-first under existing fencing (WF-R53).
+    for (const agentId of cascadeCancelIds) {
+        try {
+            await command(ctx, agentId, {
+                type: "cancel",
+                requestId: `flow-cascade-${id}-${agentId}`,
+                idempotencyKey: `flow-cascade-cancel:${id}:${agentId}`,
+                reason: "workflow cancelled",
+            }, scope);
+        }
+        catch {
+            /* agent may already be terminal */
+        }
+    }
+    return response;
+}

package/dist/tenant/context.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The shared Tenant context: every Tenant module function takes a `TenantContext` instead of
+ * calling methods on the composition root. It carries the stores and services and the
+ * in-process work and live-stream state.
+ *
+ * Business code changes state only inside `ctx.store.tx(async (t) => …)` and follows the
+ * seam rules: events through `t.event(...)` (the relay appends them to Durable Streams after
+ * commit), executor wakes through `t.signalWork()`, and advances through
+ * `t.afterCommit(() => ctx.wake(id, { reason, dedupeKey }))`. It never publishes or notifies
+ * itself; `runtime.ts` wires the streams with `wireStreams()`. No external I/O runs inside a
+ * tx.
+ *
+ * `wake` goes to `DurableExecution.wake`, which calls the Tenant's `advance` (`advance.ts`)
+ * under ownership (§10.6); `abortLocal` aborts an advance running on this process.
+ */
+import type { TenantEnvelope } from "@nylorun/core/contracts";
+import type { DurableCheckpoint, FlowCheckpoint } from "@nylorun/harness/run";
+import type { AgentManifest, JsonValue } from "@nylorun/core/define";
+import type { CredentialSelection } from "@nylorun/core/contracts";
+import type { SessionStore, Tx } from "../store/types.js";
+import type { ExecutorRecord, ExecutorRegistry } from "../core/executors.js";
+import type { FlowLimits } from "../core/limits.js";
+import type { ModelProvider } from "../core/provider.js";
+import type { VaultService } from "../vault/service.js";
+import type { McpPool } from "../mcp/pool.js";
+import type { McpDiagnostic, McpSnapshot } from "../mcp/snapshot.js";
+import type { SandboxManager } from "../sandbox/manager.js";
+import type { TenantConfig } from "./types.js";
+import type { LiveHub } from "./live.js";
+import type { StuckInvocation, Wake } from "../execution/types.js";
+import type { WorkState } from "./scheduler.js";
+export interface Session {
+    id: string;
+    agentId: string;
+    ownerUserId: string;
+    /** Session pin — the manifest the session was created with. */
+    manifest: any;
+    manifestHash: string;
+    /** Validated turn-manifest variants, keyed by hash (loops.md §4.2). */
+    variants?: Record<string, AgentManifest>;
+    implementationVersion: string;
+    info?: any;
+    status: string;
+    activeTurnId: string | null;
+    checkpoint?: DurableCheckpoint | FlowCheckpoint;
+    state?: any;
+    turnStartState?: any;
+    waits?: unknown;
+    error?: string;
+    /** Last completed turn output (for linked agent → workflow settle). */
+    lastOutput?: JsonValue;
+    /**
+     * The last turn that ended (completed, failed or cancelled): the turn `status`, `lastOutput`
+     * and `error` describe while no turn is active. A linked `agent` effect settles only from the
+     * turn it started (`linkedTurnEnd` in `core/flow-host.ts`).
+     */
+    lastTurnId?: string;
+    creation: unknown;
+    vaultIds?: readonly string[];
+    credentialSelections?: readonly CredentialSelection[];
+    pluginRoots?: Readonly<Record<string, string>>;
+    mcpSnapshot?: McpSnapshot;
+    mcpDiagnostics?: readonly McpDiagnostic[];
+    /** Session id that keys the shared sandbox; absent means this session owns it. */
+    sandboxOwnerId?: string;
+    /**
+     * The incarnation naming this session's event stream (`sessions/<id>/<incarnation>`), set at
+     * creation and never changed. Absent only on sessions created before incarnations.
+     */
+    streamIncarnation?: string;
+}
+export type AuthScope = {
+    kind: "application";
+    principalId: string;
+} | {
+    kind: "executor";
+    executor: ExecutorRecord;
+};
+export interface TenantContext {
+    readonly config: TenantConfig;
+    readonly envelope: TenantEnvelope;
+    readonly store: SessionStore;
+    readonly vault: VaultService;
+    readonly registry: ExecutorRegistry;
+    readonly mcp: McpPool;
+    readonly sandbox: SandboxManager;
+    readonly flowLimits: FlowLimits;
+    readonly modelProvider: ModelProvider;
+    /** True when the model comes from the Tenant vault selection (pi-ai adapter). */
+    readonly useVaultModel: boolean;
+    /** Set by drain/close; reset clears it again. Stops new advances. */
+    closing: boolean;
+    /** Set once close has finished releasing resources. */
+    closed: boolean;
+    /** Advances running on this process, for `abortLocal`, drain and close. */
+    readonly work: WorkState;
+    /** Live delivery over Durable Streams: session feeds, executor streams, the streams wiring. */
+    readonly live: LiveHub;
+    /** The Worker id this process writes as session `owner` (§10.6). */
+    readonly workerId: string;
+    /** How long an advance's ownership lease lasts; the heartbeat renews it. */
+    readonly ownerLeaseMs: number;
+    /**
+     * Seam: request an advance of a session (`DurableExecution.wake`). Call it from
+     * `t.afterCommit`, never inside a tx. Dropped while the Tenant is closing; the sweep
+     * re-wakes anything left runnable.
+     */
+    wake(sessionId: string, wake: Wake): Promise<void>;
+    /** Seam: abort the advance of a session running in this process, if any. */
+    abortLocal(sessionId: string): void;
+    /** This Tenant's execution invocations that need an operator, for Tenant status. */
+    readonly stuckInvocations?: () => Promise<StuckInvocation[]>;
+    /** Callbacks the Tenant sweep runs after its own steps (`sweep.ts`). */
+    readonly sweepHooks: ReadonlySet<() => Promise<void>>;
+    /** Adds a sweep callback (the outbox drain, Wave 2 / Y). Returns a function that removes it. */
+    onSweep(hook: () => Promise<void>): () => void;
+}
+/** The session, or a 404. Reads without locking. */
+export declare function sessionOf(t: Tx, id: string): Promise<Session>;
+/** Locks the session for the rest of the transaction and returns it, or a 404. */
+export declare function lockedSession(t: Tx, id: string): Promise<Session>;
+/** An advance's hold on its session (§10.6): every write the advance makes presents `epoch`. */
+export interface Lease {
+    readonly sessionId: string;
+    readonly owner: string;
+    readonly epoch: number;
+}
+/**
+ * Locks `id` for the advance holding `lease`. The advance's own session is epoch-checked: a
+ * mismatch (or a deleted session) throws `ownership.lost` before anything is written. Any
+ * other session is only locked (or a 404).
+ */
+export declare function ownedSession(t: Tx, lease: Lease, id: string): Promise<Session>;
+/** The session read in its own transaction, or a 404. */
+export declare function loadSession(ctx: TenantContext, id: string): Promise<Session>;
+/**
+ * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for
+ * the sandbox-sharing helpers, which walk that chain synchronously.
+ */
+export declare function sandboxLookup(t: Tx, start: string | undefined): Promise<(id: string) => Session | undefined>;

package/dist/tenant/context.js

@@ -0,0 +1,40 @@
+import { fail } from "./http.js";
+/** The session, or a 404. Reads without locking. */
+export async function sessionOf(t, id) {
+    return ((await t.get("sessions", id)) ??
+        fail(404, "Session not found"));
+}
+/** Locks the session for the rest of the transaction and returns it, or a 404. */
+export async function lockedSession(t, id) {
+    return ((await t.lockSession(id)) ?? fail(404, "Session not found"));
+}
+/**
+ * Locks `id` for the advance holding `lease`. The advance's own session is epoch-checked: a
+ * mismatch (or a deleted session) throws `ownership.lost` before anything is written. Any
+ * other session is only locked (or a 404).
+ */
+export async function ownedSession(t, lease, id) {
+    if (id === lease.sessionId)
+        return t.assertEpoch(id, lease.epoch);
+    return lockedSession(t, id);
+}
+/** The session read in its own transaction, or a 404. */
+export function loadSession(ctx, id) {
+    return ctx.store.tx((t) => sessionOf(t, id));
+}
+/**
+ * A synchronous lookup over `start` and every session its `sandboxOwnerId` chain names, for
+ * the sandbox-sharing helpers, which walk that chain synchronously.
+ */
+export async function sandboxLookup(t, start) {
+    const found = new Map();
+    let id = start;
+    while (id && !found.has(id)) {
+        const session = await t.get("sessions", id);
+        if (!session)
+            break;
+        found.set(id, session);
+        id = session.sandboxOwnerId;
+    }
+    return (sid) => found.get(sid);
+}

package/dist/tenant/effects.d.ts

@@ -0,0 +1,20 @@
+import type { EffectResolution, HostEffect } from "@nylorun/harness/run";
+import type { AuthorizeResult } from "../vault/service.js";
+import { type Lease, type TenantContext } from "./context.js";
+import type { ModelProvider } from "../core/provider.js";
+/** What one advance's segment decides for all its effects. */
+export interface SegmentOptions {
+    /** Overrides the Tenant's model (the fixture-model Tenant setting, `model-setting.ts`). */
+    model?: ModelProvider;
+}
+export declare function invokeModel(ctx: TenantContext, request: HostEffect, signal: AbortSignal, model?: ModelProvider): Promise<unknown>;
+export declare function resolveEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease, segment?: SegmentOptions): Promise<EffectResolution>;
+/** Journal and dispatch a new flow effect (agent / tool node / fn / verify). */
+export declare function resolveNewFlowEffect(ctx: TenantContext, request: HostEffect, signal: AbortSignal, lease: Lease): Promise<EffectResolution>;
+/** Discover the session's MCP tools once, or reconnect and refresh diagnostics. */
+export declare function prepareMcp(ctx: TenantContext, lease: Lease, signal: AbortSignal): Promise<void>;
+/** Vault authorization for an MCP server request made on behalf of a session. */
+export declare function authorize(ctx: TenantContext, sessionId: string, request: {
+    url: string;
+    serverName?: string;
+}): Promise<AuthorizeResult>;