@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/streams/types.js

@@ -1,24 +1,18 @@
 /**
- * The Durable Streams seam (architecture §12.4).
+ * The Durable Streams seam (Durable Streams §8).
  *
- * Durable Streams tell everyone else what the Session Store recorded. Each
- * Tenant has one S2 basin; inside it:
+ * Durable Streams deliver what the record holds. Each Tenant has one S2 basin per basin
+ * generation (`streams/basin.ts`); inside it:
  *
  * | Stream | Contents | Written by | Read by |
  * | --- | --- | --- | --- |
- * | `sessions/<sessionId>/<incarnation>` | every `LiveEvent` of one incarnation of the session, in sequence | the relay, from the outbox | history and session SSE |
- * | `tenant/work` | `work_available` signals | API nodes and Workers after committing pending Actions | executor SSE on every API node |
- * | `tenant/control` | `session.cancel` and `sessions.reset` signals | API nodes | every process with the Tenant open |
+ * | `sessions/<sessionId>` | every event of the session, in sequence | the stream relay, from the record | history and session SSE |
+ * | `tenant/control` | `session.cancel`, `sessions.reset` and `subject.revoked` signals | API nodes | every process with the Tenant open |
  *
- * **Incarnations.** A session's stream name carries an incarnation, a random
- * id stored on the session document when the session is created
- * (`streamIncarnation`, see `streamOfSession`). A session deleted by a reset
- * and created again with the same id gets a new incarnation, so a new stream
- * starting at sequence 0: nothing ever deletes and re-creates the same stream.
- * Abandoned streams are deleted best effort afterwards
- * (`collectSessionStreams` in `tenant/streams.ts`). The cursor stays
- * `base64url("<sessionId>:<seq>")`; readers resolve the incarnation from the
- * session.
+ * **Basin generations.** A session id is unique within its Tenant's basin generation. A
+ * Tenant reset, the only path that frees ids, moves the Tenant to the next generation, so
+ * a session created again with the same id starts in an empty basin at sequence 0; the old
+ * basin is deleted afterwards. The cursor is `base64url("<sessionId>:<seq>")`.
  *
  * S2 is the supported implementation (`adapters/streams/s2.ts`, the only file
  * importing the S2 SDK); `streams/memory.ts` is the in-memory fake.
@@ -31,56 +25,27 @@
  * - **Conditional appends.** With `matchSeq`, a batch is appended only when the
  *   tail equals `matchSeq`; otherwise nothing is written and the result is a
  *   `SeqMismatch` carrying the current tail. The relay appends a session
- *   stream with `matchSeq` set to the outbox row's sequence, so a retried
+ *   stream with `matchSeq` set to the record row's sequence, so a retried
  *   append after an unacknowledged success is detected and never duplicated.
  * - **Batches are atomic.** A batch is appended entirely or not at all.
  * - **Reads resume.** `read` from `fromSeq` yields every record with
  *   `seq >= fromSeq` in order, with no gap between history and the live tail.
- * - **Tenant scope.** `ensureTenant` creates the Tenant's basin (idempotent)
- *   and must run before appends; streams are created on first append.
- *   `deleteTenant` removes the basin and every stream in it.
+ * - **Tenant scope.** Methods take a Tenant id, or a basin key from `basinOf`
+ *   for a later generation. `ensureTenant` creates the basin (idempotent) and
+ *   must run before appends; streams are created on first append or read.
+ *   `deleteTenant` removes the basin and every stream in it (with
+ *   `allGenerations`, every generation's basin of the Tenant).
  * - **Records are JSON.** Bodies are JSON-serializable values; implementations
  *   encode them as they need.
  */
-import { randomBytes } from "node:crypto";
 // ---------------------------------------------------------------------------
 // Stream names and signal records
 export const SESSION_STREAM_PREFIX = "sessions/";
-/** `work_available` signals for executor connections. */
-export const WORK_STREAM = "tenant/work";
 /** `session.cancel` and `sessions.reset` signals for every process with the Tenant open. */
 export const CONTROL_STREAM = "tenant/control";
-/**
- * The incarnation of a session document written before incarnations existed.
- * Random incarnations are 12 characters, so never this.
- */
-export const LEGACY_INCARNATION = "0";
-/** A new session incarnation: 12 random base64url characters. */
-export function newStreamIncarnation() {
-    return randomBytes(9).toString("base64url");
-}
-/** The stream of one incarnation of a session: `sessions/<sessionId>/<incarnation>`. */
-export function sessionStream(sessionId, incarnation) {
+/** The stream of a session: `sessions/<sessionId>`. */
+export function sessionStream(sessionId) {
     if (!sessionId)
         throw new Error("sessionId is required");
-    if (!incarnation || incarnation.includes("/"))
-        throw new Error("incarnation must be non-empty and contain no '/'");
-    return `${SESSION_STREAM_PREFIX}${sessionId}/${incarnation}`;
-}
-/** The stream of a session as stored now. */
-export function streamOfSession(session) {
-    return sessionStream(session.id, session.streamIncarnation ?? LEGACY_INCARNATION);
-}
-/** The session id and incarnation of a session stream, or undefined for other streams. */
-export function parseSessionStream(stream) {
-    if (!stream.startsWith(SESSION_STREAM_PREFIX))
-        return undefined;
-    const rest = stream.slice(SESSION_STREAM_PREFIX.length);
-    const slash = rest.lastIndexOf("/");
-    if (slash <= 0 || slash === rest.length - 1)
-        return undefined;
-    return { sessionId: rest.slice(0, slash), incarnation: rest.slice(slash + 1) };
+    return `${SESSION_STREAM_PREFIX}${sessionId}`;
 }
-export const WORK_AVAILABLE = Object.freeze({
-    type: "work_available",
-});

package/dist/tenant/access-policy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The Tenant's access policy (Host feature `subject-tokens`): the roles subject tokens are
+ * minted for, what a publishable key grants alone (`anon`), and how long tokens live. One
+ * validated JSON document in the Tenant settings; a Tenant that never set one has no roles,
+ * so nothing can be minted.
+ *
+ * A token's permissions are resolved from the policy on every request, so editing a role
+ * changes outstanding tokens at their next request and removing one ends them.
+ */
+import { type AccessPolicy, type RoleLimits, type TokenScope } from "@nylorun/core/contracts";
+import type { Tx } from "../store/types.js";
+export declare const ACCESS_POLICY_SETTING = "access.policy";
+export declare function readPolicy(t: Tx): Promise<AccessPolicy>;
+export declare function writePolicy(t: Tx, policy: AccessPolicy): Promise<void>;
+/** What a token may do right now: its role narrowed by what the mint asked for. */
+export interface EffectiveAccess {
+    readonly role: string;
+    readonly scopes: ReadonlySet<TokenScope>;
+    readonly agents: ReadonlySet<string> | "*";
+    readonly limits?: RoleLimits;
+}
+/** Agents both lists allow; `"*"` allows every agent. */
+export declare function intersectAgents(a: readonly string[] | "*", b: readonly string[] | "*" | undefined): ReadonlySet<string> | "*";
+/**
+ * The role's permissions narrowed to `scopes` and `agents`, or undefined when the role no
+ * longer exists.
+ */
+export declare function resolveRole(policy: AccessPolicy, role: string, scopes: readonly TokenScope[], agents?: readonly string[]): EffectiveAccess | undefined;
+/** True when `agentId` is allowed by `agents`. */
+export declare function agentAllowed(agents: ReadonlySet<string> | "*", agentId: string): boolean;

package/dist/tenant/access-policy.js

@@ -0,0 +1,52 @@
+/**
+ * The Tenant's access policy (Host feature `subject-tokens`): the roles subject tokens are
+ * minted for, what a publishable key grants alone (`anon`), and how long tokens live. One
+ * validated JSON document in the Tenant settings; a Tenant that never set one has no roles,
+ * so nothing can be minted.
+ *
+ * A token's permissions are resolved from the policy on every request, so editing a role
+ * changes outstanding tokens at their next request and removing one ends them.
+ */
+import { AccessPolicySchema, DEFAULT_ACCESS_POLICY, } from "@nylorun/core/contracts";
+export const ACCESS_POLICY_SETTING = "access.policy";
+export async function readPolicy(t) {
+    const stored = await t.getSetting(ACCESS_POLICY_SETTING);
+    if (stored === undefined)
+        return DEFAULT_ACCESS_POLICY;
+    // Only `writePolicy` stores it, after validation.
+    return AccessPolicySchema.parse(JSON.parse(stored));
+}
+export async function writePolicy(t, policy) {
+    await t.putSetting(ACCESS_POLICY_SETTING, JSON.stringify(AccessPolicySchema.parse(policy)));
+}
+/** Agents both lists allow; `"*"` allows every agent. */
+export function intersectAgents(a, b) {
+    if (b === undefined || b === "*")
+        return a === "*" ? "*" : new Set(a);
+    if (a === "*")
+        return new Set(b);
+    const allowed = new Set(a);
+    return new Set(b.filter((agent) => allowed.has(agent)));
+}
+/**
+ * The role's permissions narrowed to `scopes` and `agents`, or undefined when the role no
+ * longer exists.
+ */
+export function resolveRole(policy, role, scopes, agents) {
+    const entry = Object.hasOwn(policy.roles, role)
+        ? policy.roles[role]
+        : undefined;
+    if (!entry)
+        return undefined;
+    const allowed = new Set(entry.scopes);
+    return {
+        role,
+        scopes: new Set(scopes.filter((scope) => allowed.has(scope))),
+        agents: intersectAgents(entry.agents, agents),
+        ...(entry.limits ? { limits: entry.limits } : {}),
+    };
+}
+/** True when `agentId` is allowed by `agents`. */
+export function agentAllowed(agents, agentId) {
+    return agents === "*" || agents.has(agentId);
+}

package/dist/tenant/actions.d.ts

@@ -1,153 +1,14 @@
-import type { IncomingMessage } from "node:http";
-import { type RegisterExecutorsRequestSchema } from "@nylorun/core/contracts";
-import { type ExecutorRecord } from "../core/executors.js";
 import { type SandboxRouteDeps } from "../core/sandbox-routes.js";
-import { type AuthScope, type TenantContext } from "./context.js";
-type RegisterExecutorsRequest = ReturnType<typeof RegisterExecutorsRequestSchema.parse>;
+import { type TenantContext } from "./context.js";
+import type { DeliveryScope } from "./delivery-token.js";
 /** Session and Action lookups for the sandbox route handlers. */
 export declare function sandboxRouteDeps(ctx: TenantContext): SandboxRouteDeps;
-/** `GET /v1/actions`: the pending Actions of the executor's agent. */
-export declare function listPendingActions(ctx: TenantContext, executor: ExecutorRecord): Promise<{
-    actions: ({
-        actionId: string;
-        sessionId: string;
-        turnId: string;
-        agentId: string;
-        manifestHash: string;
-        implementationVersion: string;
-        input: unknown;
-        context: Record<string, unknown>;
-        status: "cancelled" | "claimed" | "completed" | "pending" | "uncertain";
-        generation: number;
-        claimId: string | null;
-        leaseExpiresAt: string | null;
-        agent?: {
-            id: string;
-            path: string;
-            delegationId?: string | undefined;
-        } | undefined;
-        kind: "tool";
-        capabilityId: string;
-        toolName: string;
-        inputSchema?: Record<string, unknown> | undefined;
-        outputSchema?: Record<string, unknown> | undefined;
-    } | {
-        actionId: string;
-        sessionId: string;
-        turnId: string;
-        agentId: string;
-        manifestHash: string;
-        implementationVersion: string;
-        input: unknown;
-        context: Record<string, unknown>;
-        status: "cancelled" | "claimed" | "completed" | "pending" | "uncertain";
-        generation: number;
-        claimId: string | null;
-        leaseExpiresAt: string | null;
-        agent?: {
-            id: string;
-            path: string;
-            delegationId?: string | undefined;
-        } | undefined;
-        kind: "tool";
-        path: string;
-        key: string;
-        inputSchema?: Record<string, unknown> | undefined;
-        outputSchema?: Record<string, unknown> | undefined;
-    } | {
-        actionId: string;
-        sessionId: string;
-        turnId: string;
-        agentId: string;
-        manifestHash: string;
-        implementationVersion: string;
-        input: unknown;
-        context: Record<string, unknown>;
-        status: "cancelled" | "claimed" | "completed" | "pending" | "uncertain";
-        generation: number;
-        claimId: string | null;
-        leaseExpiresAt: string | null;
-        agent?: {
-            id: string;
-            path: string;
-            delegationId?: string | undefined;
-        } | undefined;
-        kind: "hook";
-        hook: {
-            at: "after" | "before";
-            scope: "step" | "turn";
-            capabilityIds: string[];
-        };
-    } | {
-        actionId: string;
-        sessionId: string;
-        turnId: string;
-        agentId: string;
-        manifestHash: string;
-        implementationVersion: string;
-        input: unknown;
-        context: Record<string, unknown>;
-        status: "cancelled" | "claimed" | "completed" | "pending" | "uncertain";
-        generation: number;
-        claimId: string | null;
-        leaseExpiresAt: string | null;
-        agent?: {
-            id: string;
-            path: string;
-            delegationId?: string | undefined;
-        } | undefined;
-        kind: "fn";
-        path: string;
-        key: string;
-    } | {
-        actionId: string;
-        sessionId: string;
-        turnId: string;
-        agentId: string;
-        manifestHash: string;
-        implementationVersion: string;
-        input: unknown;
-        context: Record<string, unknown>;
-        status: "cancelled" | "claimed" | "completed" | "pending" | "uncertain";
-        generation: number;
-        claimId: string | null;
-        leaseExpiresAt: string | null;
-        agent?: {
-            id: string;
-            path: string;
-            delegationId?: string | undefined;
-        } | undefined;
-        kind: "verify";
-        path: string;
-        key: string;
-    })[];
+/** `POST /v1/actions/:id/sandbox/:tool`: a sandbox tool call for the Action being delivered. */
+export declare function actionSandboxTool(ctx: TenantContext, scope: DeliveryScope, actionId: string, toolName: string, body: () => Promise<unknown>, signal: AbortSignal): Promise<{
+    kind: "completed";
+    output: unknown;
+} | {
+    kind: "failed";
+    code: string;
+    message: string;
 }>;
-/** `POST /v1/actions/:id/sandbox/:tool`: a claim-scoped sandbox tool call. */
-export declare function actionSandboxTool(ctx: TenantContext, scope: AuthScope, actionId: string, toolName: string, request: IncomingMessage): Promise<import("../sandbox/tools.js").SandboxToolOutcome>;
-/** `POST /v1/actions/:id/claim` and `/heartbeat`; anything else under the Action is a 404. */
-export declare function updateAction(ctx: TenantContext, scope: AuthScope, actionId: string, method: string | undefined, operation: string | undefined, body: unknown): Promise<unknown>;
-/** `GET /v1/executors`. */
-export declare function listExecutors(ctx: TenantContext): {
-    executors: {
-        agentId: string;
-        implementationVersion: string;
-        manifestHash?: string | undefined;
-        connected: boolean;
-        updatedAt: string;
-    }[];
-};
-/** `PUT /v1/executors`: persist the batch, then update the registry and end rotated streams. */
-export declare function registerExecutors(ctx: TenantContext, principalId: string, body: RegisterExecutorsRequest): Promise<{
-    executors: {
-        agentId: string;
-        implementationVersion: string;
-        rotated: boolean;
-        replacedBy?: "different-credential" | undefined;
-    }[];
-}>;
-/** `DELETE /v1/executors/:agentId`: forget the executor and end its streams. */
-export declare function deleteExecutor(ctx: TenantContext, agentId: string): Promise<{
-    agentId: string;
-    deleted: boolean;
-}>;
-export {};

package/dist/tenant/actions.js

@@ -1,21 +1,7 @@
-/**
- * The Action service and the executor registry: discover pending Actions, claim, heartbeat,
- * claim-scoped sandbox tool calls, and executor registration, listing and removal.
- *
- * A claim or heartbeat locks the Action's session and commits in one transaction; the
- * registry is updated only after the executors table commits.
- *
- * Later waves: Wave 2 / Y reads the executor `connected` flag from the work stream instead
- * of `executorStreams`.
- */
-import { randomUUID } from "node:crypto";
-import { ActionClaimRequestSchema, ActionHeartbeatRequestSchema, } from "@nylorun/core/contracts";
-import { assertExecutorCredential, hashToken, } from "../core/executors.js";
 import { SandboxRouteError, handleActionSandboxTool, } from "../core/sandbox-routes.js";
-import { lockedSession, sandboxLookup, sessionOf, } from "./context.js";
-import { fail, readBody, requestAborted } from "./http.js";
 import { scoped } from "./auth.js";
-import { endExecutorStreams, executorConnected } from "./live.js";
+import { sandboxLookup, sessionOf } from "./context.js";
+import { fail } from "./http.js";
 /** Session and Action lookups for the sandbox route handlers. */
 export function sandboxRouteDeps(ctx) {
     return {
@@ -27,19 +13,13 @@ export function sandboxRouteDeps(ctx) {
         getAction: (id) => ctx.store.tx((t) => t.get("actions", id)),
     };
 }
-/** `GET /v1/actions`: the pending Actions of the executor's agent. */
-export async function listPendingActions(ctx, executor) {
-    return {
-        actions: await ctx.store.tx((t) => t.pendingActions(executor.agentId)),
-    };
-}
-/** `POST /v1/actions/:id/sandbox/:tool`: a claim-scoped sandbox tool call. */
-export async function actionSandboxTool(ctx, scope, actionId, toolName, request) {
+/** `POST /v1/actions/:id/sandbox/:tool`: a sandbox tool call for the Action being delivered. */
+export async function actionSandboxTool(ctx, scope, actionId, toolName, body, signal) {
     const action = (await ctx.store.tx((t) => t.get("actions", actionId))) ??
         fail(404, "Action not found");
     scoped(scope, action);
     try {
-        return await handleActionSandboxTool(sandboxRouteDeps(ctx), actionId, toolName, await readBody(request), requestAborted(request));
+        return await handleActionSandboxTool(sandboxRouteDeps(ctx), actionId, toolName, await body(), signal, { generation: scope.generation });
     }
     catch (error) {
         if (error instanceof SandboxRouteError)
@@ -47,145 +27,3 @@ export async function actionSandboxTool(ctx, scope, actionId, toolName, request)
         throw error;
     }
 }
-/** `POST /v1/actions/:id/claim` and `/heartbeat`; anything else under the Action is a 404. */
-export function updateAction(ctx, scope, actionId, method, operation, body) {
-    return ctx.store.tx(async (t) => {
-        const found = (await t.get("actions", actionId)) ??
-            fail(404, "Action not found");
-        scoped(scope, found);
-        const s = await lockedSession(t, found.sessionId);
-        // Read again under the session lock.
-        const action = (await t.get("actions", actionId)) ??
-            fail(404, "Action not found");
-        if (method === "POST" && operation === "claim") {
-            ActionClaimRequestSchema.parse(body);
-            if (action.status !== "pending" ||
-                s.status === "cancelled" ||
-                s.activeTurnId !== action.turnId)
-                fail(409, "Action unavailable");
-            action.status = "claimed";
-            action.generation++;
-            action.claimId = randomUUID();
-            action.leaseExpiresAt = new Date(Date.now() + (ctx.config.leaseMs ?? 30000)).toISOString();
-            await t.put("actions", actionId, action);
-            await t.event(action.sessionId, action.turnId, "action.claimed", {
-                actionId,
-                generation: action.generation,
-                ...(action.agent ? { agent: action.agent } : {}),
-            });
-            return {
-                action,
-                claimId: action.claimId,
-                generation: action.generation,
-                leaseExpiresAt: action.leaseExpiresAt,
-            };
-        }
-        if (method === "POST" && operation === "heartbeat") {
-            const beat = ActionHeartbeatRequestSchema.parse(body);
-            if (s.activeTurnId !== action.turnId ||
-                action.status !== "claimed" ||
-                action.claimId !== beat.claimId ||
-                action.generation !== beat.generation ||
-                Date.parse(action.leaseExpiresAt) <= Date.now())
-                fail(409, "Stale or expired claim");
-            action.leaseExpiresAt = new Date(Date.now() + (ctx.config.leaseMs ?? 30000)).toISOString();
-            await t.put("actions", actionId, action);
-            return { leaseExpiresAt: action.leaseExpiresAt };
-        }
-        return fail(404, "Route not found");
-    });
-}
-/** `GET /v1/executors`. */
-export function listExecutors(ctx) {
-    return {
-        executors: ctx.registry.list().map((e) => ({
-            agentId: e.agentId,
-            implementationVersion: e.implementationVersion,
-            ...(e.manifestHash === undefined ? {} : { manifestHash: e.manifestHash }),
-            connected: executorConnected(ctx.live, e.tokenHash),
-            updatedAt: e.updatedAt,
-        })),
-    };
-}
-/** `PUT /v1/executors`: persist the batch, then update the registry and end rotated streams. */
-export async function registerExecutors(ctx, principalId, body) {
-    const { store, registry } = ctx;
-    // Credential rules are shared with startup validation, which throws plainly; on the
-    // wire a rejected registration is a bad request, not a server fault.
-    const applicationHashes = await store.tx((t) => t.applicationTokenHashes());
-    try {
-        for (const executor of body.executors)
-            assertExecutorCredential(executor, applicationHashes);
-    }
-    catch (error) {
-        fail(400, error instanceof Error ? error.message : String(error));
-    }
-    if (new Set(body.executors.map((e) => e.agentId)).size !==
-        body.executors.length ||
-        new Set(body.executors.map((e) => e.token)).size !== body.executors.length)
-        fail(400, "Executor registrations must be unique per agent and token");
-    const updatedAt = new Date().toISOString();
-    const records = body.executors.map((executor) => ({
-        agentId: executor.agentId,
-        implementationVersion: executor.implementationVersion,
-        ...(executor.manifestHash === undefined
-            ? {}
-            : { manifestHash: executor.manifestHash }),
-        tokenHash: hashToken(executor.token),
-        persisted: true,
-        updatedAt,
-        principalId,
-    }));
-    for (const record of records) {
-        const collision = registry.find(record.tokenHash);
-        if (collision && collision.agentId !== record.agentId)
-            fail(409, "Executor tokens must be unique");
-        // A token hash may not appear in both principals and executors (D3).
-        if (applicationHashes.includes(record.tokenHash))
-            fail(400, "Executor tokens require independent credentials and an agent id");
-    }
-    // Persist the whole batch first; the in-memory registry must never run ahead of the store.
-    await store.tx(async (t) => {
-        for (const record of records)
-            await t.putExecutor({
-                agentId: record.agentId,
-                tokenHash: record.tokenHash,
-                implementationVersion: record.implementationVersion,
-                ...(record.manifestHash === undefined
-                    ? {}
-                    : { manifestHash: record.manifestHash }),
-                principalId: record.principalId,
-                updatedAt,
-            });
-    });
-    const results = records.map((record) => {
-        const previous = registry.get(record.agentId);
-        const { rotated, previousHash } = registry.upsert(record);
-        if (rotated && previousHash)
-            endExecutorStreams(ctx.live, previousHash);
-        const replacedByDifferent = previous?.principalId !== undefined &&
-            previous.principalId !== principalId;
-        if (replacedByDifferent)
-            ctx.config.logger.warn("executor registration replaced by different application credential", {
-                agentId: record.agentId,
-                previousPrincipalId: previous.principalId,
-            });
-        return {
-            agentId: record.agentId,
-            implementationVersion: record.implementationVersion,
-            rotated,
-            ...(replacedByDifferent
-                ? { replacedBy: "different-credential" }
-                : {}),
-        };
-    });
-    return { executors: results };
-}
-/** `DELETE /v1/executors/:agentId`: forget the executor and end its streams. */
-export async function deleteExecutor(ctx, agentId) {
-    const existing = ctx.registry.get(agentId) ?? fail(404, "Executor not found");
-    await ctx.store.tx((t) => t.deleteExecutor(agentId));
-    ctx.registry.remove(agentId);
-    endExecutorStreams(ctx.live, existing.tokenHash);
-    return { agentId, deleted: true };
-}

package/dist/tenant/advance.d.ts

@@ -8,8 +8,13 @@ import type { Session, TenantContext } from "./context.js";
 export declare function advance(ctx: TenantContext, id: string, signal: AbortSignal): Promise<AdvanceResult>;
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
- * owner's `invoking` effects become `uncertain` and are never invoked again. When one belongs
+ * owner's `invoking` effects become `uncertain` and are never invoked again, except model
+ * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
+ * G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
-export declare function takeOver(t: Tx, s: Session): Promise<string[]>;
+export declare function takeOver(t: Tx, s: Session, options?: {
+    recoversModelCalls?: boolean;
+    recoversMcpCalls?: boolean;
+}): Promise<string[]>;