@nylorun/runtime 0.15.1-beta → 0.16.0-beta

package/dist/tenant/sessions.js

@@ -12,6 +12,8 @@ import { resolveSandbox } from "../sandbox/resolve.js";
 import { withSandboxCapability } from "../sandbox/session-sandbox.js";
 import { declaredSandboxes, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
 import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
+import { checkPlacement, requirePods } from "../sandbox/placement.js";
+import { attachSandbox, recordAttachment } from "./sandboxes.js";
 import { sandboxLookup, } from "./context.js";
 import { fail } from "./http.js";
 /** A session's creation identity: everything but the request id and vault attachments. */
@@ -133,7 +135,14 @@ export async function putSession(ctx, id, body, access, options = {}) {
         }
         const definition = (await t.get("definitions", body.agentId)) ??
             fail(404, "Definition not found");
-        const sandbox = await sessionSandbox(t, body, definition, { opaque });
+        const sandbox = await sessionSandbox(t, body, definition, {
+            opaque,
+            ...(options.sandboxGrants === undefined ? {} : { grants: options.sandboxGrants }),
+        });
+        // Placement (D38): where this session's harness may run, decided now and kept.
+        checkPlacement(await readSandboxConfig(t), sandbox.kind);
+        if (sandbox.kind === "pod")
+            await requirePods(ctx.pods, `Sandbox ${sandbox.sandboxId}`);
         const created = {
             id,
             agentId: body.agentId,
@@ -151,23 +160,40 @@ export async function putSession(ctx, id, body, access, options = {}) {
             ...(sandbox.sandboxOwnerId !== undefined
                 ? { sandboxOwnerId: sandbox.sandboxOwnerId }
                 : {}),
+            ...(sandbox.sandboxId !== undefined ? { sandboxId: sandbox.sandboxId } : {}),
             ...(sandbox.spec !== undefined
                 ? { sandbox: sandbox.spec, sandboxSource: sandbox.source }
                 : {}),
         };
         await t.put("sessions", id, created);
         await ctx.vault.recordAttachment(t, id, vaultIds);
+        if (sandbox.sandboxId !== undefined)
+            await recordAttachment(t, id, sandbox.sandboxId);
         return created;
     });
 }
 function isShare(value) {
     return typeof value === "object" && value !== null && "session" in value;
 }
+function isAttach(value) {
+    return typeof value === "object" && value !== null && "id" in value;
+}
 /** Decide a new session's sandbox and, for an agent, the manifest that carries its tools. */
 async function sessionSandbox(t, body, definition, options) {
     const request = body.sandbox;
     const declared = sandboxSpecOf(definition.manifest) !== undefined;
+    if (isAttach(request)) {
+        if (declared)
+            fail(400, `'${body.agentId}' declares its own sandbox with .sandbox(). Remove it from the agent to attach a sandbox.`);
+        const sandbox = await attachSandbox(t, request.id, options.grants);
+        // A pod's storage and lifecycle are the resource's, not the agent's sandbox manifest.
+        const { storage: _storage, lifecycle: _lifecycle, ...spec } = sandbox.spec;
+        return { ...(await pin(definition, spec, "sandbox")), sandboxId: sandbox.id, kind: sandbox.kind };
+    }
     if (isShare(request)) {
+        const owner = await t.get("sessions", request.session);
+        if (owner?.sandboxId !== undefined && (!options.opaque || owner.ownerUserId === body.ownerUserId))
+            fail(400, `Session ${request.session} is attached to sandbox ${owner.sandboxId}: open this session with sandbox: { id: "${owner.sandboxId}" }.`);
         const lookup = await sandboxLookup(t, request.session);
         const sandboxOwnerId = validateSandboxAttach(body, definition.manifest, lookup, {
             opaque: options.opaque,
@@ -240,6 +266,7 @@ export async function sessionView(t, s) {
         vaultIds: s.vaultIds ?? [],
         credentialSelections: s.credentialSelections ?? [],
         sandboxOwnerId: s.sandboxOwnerId ?? null,
+        ...(s.sandboxId === undefined ? {} : { sandboxId: s.sandboxId }),
         sandbox: s.sandbox ?? null,
         ...(s.sandboxSource ? { sandboxSource: s.sandboxSource } : {}),
         mcpSnapshot: s.mcpSnapshot ?? null,

package/dist/tenant/status.d.ts

@@ -1,8 +1,9 @@
-import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
+import type { HarnessStatus, SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
 import type { VaultService } from "../vault/service.js";
-import type { SandboxManager } from "../sandbox/manager.js";
+import type { WorkspacePort } from "../harness-api/workspace.js";
 import type { TenantConfig } from "./types.js";
+import type { TenantContext } from "./context.js";
 import type { TenantEnvelope } from "@nylorun/core/contracts";
 import type { StuckInvocation } from "../execution/types.js";
 import type { StreamsStatus } from "./streams.js";
@@ -12,7 +13,7 @@ export interface TenantStatusContext {
     config: TenantConfig;
     store: SessionStore;
     vault: VaultService;
-    sandbox: SandboxManager;
+    sandbox: Pick<WorkspacePort, "report">;
     closing: boolean;
     modelConfigured: boolean;
     /**
@@ -22,7 +23,11 @@ export interface TenantStatusContext {
     stuckInvocations?: () => Promise<StuckInvocation[]>;
     /** This Tenant's Durable Streams status (`streamsStatus` in `streams.ts`). */
     streamsStatus?: () => Promise<StreamsStatus>;
+    /** The Tenant's harnesses (F6.2). */
+    harness?: HarnessStatus;
 }
+/** The Tenant's harnesses, for its status and the Host's. */
+export declare function harnessStatusOf(ctx: Pick<TenantContext, "mcp" | "harness">): HarnessStatus;
 /** Build `TenantStatusSchema` with secrets redacted (A14). */
 export declare function buildTenantStatus(ctx: TenantStatusContext): Promise<TenantStatus>;
 /**

package/dist/tenant/status.js

@@ -1,5 +1,9 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
 import { SANDBOX_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
+/** The Tenant's harnesses, for its status and the Host's. */
+export function harnessStatusOf(ctx) {
+    return { mode: ctx.mcp ? "in-process" : "remote", ...ctx.harness.status() };
+}
 /** How long status waits for the execution to list stuck invocations. */
 const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
@@ -84,6 +88,7 @@ export async function buildTenantStatus(ctx) {
             backend: sandboxReport.backend,
             retained: counts.sandboxes,
         },
+        ...(ctx.harness ? { harness: ctx.harness } : {}),
         ...(execution ? { execution } : {}),
         ...(streams ? { streams } : {}),
     };

package/dist/tenant/streams.d.ts

@@ -17,6 +17,7 @@
  * - **Readers.** History and session SSE read the session's stream
  *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
  *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`,
+ *   passes an Action's outcome to a run held here for each `action.resolved` (F6.2),
  *   checks the session streams for each `sessions.reset`, and ends a subject's streams for
  *   each `subject.revoked`.
  *
@@ -78,6 +79,12 @@ export declare function wireStreams(ctx: TenantContext, options: WireStreamsOpti
  * effect), so failures are logged, never thrown.
  */
 export declare function signalSessionCancel(ctx: TenantContext, sessionId: string, turnId: string | null): void;
+/**
+ * Appends `action.resolved` for an Action whose outcome just committed, so a run held for it
+ * by a harness of another process goes on (F6.2). Call it from `t.afterCommit`. A lost signal
+ * costs the hold's time only: the segment then ends as waiting and resumes by replay.
+ */
+export declare function signalActionOutcome(ctx: TenantContext, sessionId: string, actionId: string): void;
 /**
  * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
  * every process with the Tenant open (`sessions.reset` on the old basin's control stream),

package/dist/tenant/streams.js

@@ -1,5 +1,5 @@
 import { basinOf } from "../streams/basin.js";
-import { signalCancel, signalSessionsReset } from "../streams/control.js";
+import { signalActionResolved, signalCancel, signalSessionsReset } from "../streams/control.js";
 import { createStreamRelay, } from "../streams/relay/core.js";
 import { CONTROL_STREAM, } from "../streams/types.js";
 import { checkSessionStreams, currentBasin, endSubjectStreams, sleep, } from "./session-streams.js";
@@ -59,6 +59,10 @@ export async function wireStreams(ctx, options) {
         const signal = body;
         if (signal?.type === "session.cancel" && typeof signal.sessionId === "string")
             ctx.abortLocal(signal.sessionId, typeof signal.turnId === "string" ? signal.turnId : undefined);
+        else if (signal?.type === "action.resolved" &&
+            typeof signal.sessionId === "string" &&
+            typeof signal.actionId === "string")
+            void resolveHeld(ctx, signal.sessionId, signal.actionId).catch(report("held run resolution failed"));
         else if (signal?.type === "sessions.reset")
             void checkSessionStreams(ctx).catch(report("session stream check failed"));
         else if (signal?.type === "subject.revoked" &&
@@ -171,6 +175,25 @@ export function signalSessionCancel(ctx, sessionId, turnId) {
         message: messageOf(error),
     }));
 }
+/**
+ * Appends `action.resolved` for an Action whose outcome just committed, so a run held for it
+ * by a harness of another process goes on (F6.2). Call it from `t.afterCommit`. A lost signal
+ * costs the hold's time only: the segment then ends as waiting and resumes by replay.
+ */
+export function signalActionOutcome(ctx, sessionId, actionId) {
+    const streams = ctx.sessionStreams.wiring?.streams;
+    if (!streams)
+        return;
+    void signalActionResolved(streams, currentBasin(ctx), sessionId, actionId).catch((error) => ctx.config.logger.warn("action resolved signal failed", { sessionId, message: messageOf(error) }));
+}
+/** Passes an Action's recorded outcome to the run of `sessionId` held here, if any. */
+async function resolveHeld(ctx, sessionId, actionId) {
+    if (!ctx.harness.holds(sessionId))
+        return;
+    const effect = await ctx.store.tx((t) => t.get("effects", actionId));
+    if (effect?.status === "completed" && effect.outcome)
+        ctx.harness.resolved(sessionId, actionId, effect.outcome);
+}
 /**
  * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
  * every process with the Tenant open (`sessions.reset` on the old basin's control stream),

package/dist/tenant/sweep.js

@@ -9,9 +9,10 @@
  * 2. **Orphaned sessions.** `running` or `runnable` sessions with no owner, or an owner whose
  *    lease expired, are woken with reason `recover`: a wake lost between commit and send, or
  *    a Worker that died mid-advance (the advance then takes over, §11.4).
- * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute this process no longer
- *    holds are marked stopped, and sandboxes whose session is gone are removed. Idle MCP
- *    connections are closed.
+ * 3. **Sandboxes.** Idle sandboxes are stopped, records of compute no longer held are marked
+ *    stopped, and sandboxes whose session or sandbox resource is gone are removed, by the
+ *    workspace capability (`harness-api/workspace.ts`: here, or in the harness that serves
+ *    workspaces). Idle MCP connections of the in-process harness are closed.
  * 4. **Hooks.** Callbacks registered with `ctx.onSweep`.
  * 5. **Deliveries.** Deliveries to Action endpoints whose deadline passed without an answer are
  *    lost (`delivery.ts` `loseAction`), and pending Actions of agents with an endpoint are sent
@@ -38,9 +39,12 @@ export async function sweep(ctx) {
             () => ctx.sandbox.sweep({
                 now: now.getTime(),
                 sessionExists: async (id) => !!(await ctx.store.tx((t) => t.get("sessions", id))),
+                sandboxExists: async (id) => (await ctx.store.tx((t) => t.sandboxResource(id))) !== undefined,
             }),
         ],
-        ["mcp", () => ctx.mcp.sweep()],
+        ["pods", () => reconcileStalePods(ctx, now)],
+        // A harness elsewhere closes its own idle MCP connections.
+        ["mcp", async () => ctx.mcp?.sweep()],
         ...[...ctx.sweepHooks].map((hook) => ["hook", hook]),
     ];
     let failure;
@@ -80,3 +84,32 @@ export async function wakeOrphanedSessions(ctx, now = new Date()) {
         await ctx.wake(id, { reason: "recover" });
     return ids;
 }
+/** A pod sandbox in a change this long without a reconcile gets one from the sweep. */
+const STALE_POD_MS = 60_000;
+/**
+ * Pod sandboxes (F7.2) whose change has not finished (creating, deleting, an old volume still
+ * to delete, an expiry not yet recorded), or that should run but whose engine is not connected,
+ * and whose row has not moved for a minute: a reconcile the `Sandbox` object lost (a send
+ * dropped while the Tenant closed) is sent again, and a pod or volume deleted outside the
+ * Runtime is found.
+ */
+async function reconcileStalePods(ctx, now) {
+    if (!ctx.pods)
+        return;
+    const stale = await ctx.store.tx(async (t) => (await t.listSandboxResources()).filter((row) => {
+        const pod = row.pod;
+        if (!pod || now.getTime() - Date.parse(row.updatedAt) < STALE_POD_MS)
+            return false;
+        const expiring = pod.expiresAt !== undefined && Date.parse(pod.expiresAt) <= now.getTime() && pod.observed !== "expired";
+        return (pod.desired === "deleted" ||
+            pod.retiring !== undefined ||
+            pod.observed === "creating" ||
+            pod.observed === "deleting" ||
+            expiring ||
+            (pod.desired === "suspended" && pod.observed !== "suspended") ||
+            // Running, but its engine is not connected: the pod may be gone, or its volume.
+            (pod.desired === "running" && pod.observed === "running" && !ctx.harness.hosting(row.id)));
+    }));
+    for (const row of stale)
+        await ctx.sandboxSignal(row.id, { kind: "reconcile" });
+}

package/dist/tenant/tokens.js

@@ -9,7 +9,7 @@
  */
 import { randomUUID } from "node:crypto";
 import { errors, jwtVerify } from "jose";
-import { isSubject, SUBJECT_TOKEN_AUDIENCE, SUBJECT_TOKEN_TYPE, subjectTokenIssuer, TOKEN_SCOPES, TOKEN_TTL_MIN_SECONDS, } from "@nylorun/core/contracts";
+import { isSandboxGrant, isSubject, SUBJECT_TOKEN_AUDIENCE, SUBJECT_TOKEN_TYPE, subjectTokenIssuer, TOKEN_SANDBOX_GRANTS_MAX, TOKEN_SCOPES, TOKEN_TTL_MIN_SECONDS, } from "@nylorun/core/contracts";
 import { agentAllowed, readPolicy, resolveRole } from "./access-policy.js";
 import { fail, failOpaque, HttpError } from "./http.js";
 import { CLOCK_TOLERANCE_SECONDS, tokenKeyId } from "./jwt.js";
@@ -71,6 +71,7 @@ export async function mintToken(ctx, body) {
         role: body.role,
         scp: scopes.join(" "),
         ...(body.agents ? { agt: [...body.agents] } : {}),
+        ...(body.sandboxes?.length ? { sbx: [...new Set(body.sandboxes)] } : {}),
         epc: epoch,
     };
     // Signed by the keys service (F4.2): this process never holds the private key.
@@ -99,6 +100,7 @@ export async function mintToken(ctx, body) {
         role: body.role,
         scopes,
         agents: access.agents === "*" ? "*" : [...access.agents],
+        ...(claims.sbx ? { sandboxes: [...claims.sbx] } : {}),
         keyId: signer.id,
     };
 }
@@ -151,7 +153,11 @@ export async function verifySubjectToken(ctx, raw) {
         scopeNames.some((name) => !TOKEN_SCOPES.includes(name)) ||
         (claims.agt !== undefined &&
             (!Array.isArray(claims.agt) ||
-                claims.agt.some((agent) => typeof agent !== "string"))))
+                claims.agt.some((agent) => typeof agent !== "string"))) ||
+        (claims.sbx !== undefined &&
+            (!Array.isArray(claims.sbx) ||
+                claims.sbx.length > TOKEN_SANDBOX_GRANTS_MAX ||
+                claims.sbx.some((grant) => !isSandboxGrant(grant)))))
         return rejected(ctx, "token_claims");
     const epoch = await ctx.store.tx((t) => t.subjectEpoch(claims.sub));
     if (claims.epc !== epoch)
@@ -168,6 +174,7 @@ export async function verifySubjectToken(ctx, raw) {
         agents: access.agents,
         role: access.role,
         ...(access.limits ? { limits: access.limits } : {}),
+        ...(claims.sbx ? { sandboxes: claims.sbx } : {}),
         epoch,
         expiresAt: claims.exp * 1000,
         tokenId: claims.jti,

package/dist/tenant/types.d.ts

@@ -1,6 +1,9 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { HostAggregate, HostTenant, TenantEnvelope } from "@nylorun/core/contracts";
+import type { HarnessStatus, HostAggregate, HostTenant, TenantEnvelope } from "@nylorun/core/contracts";
+import type { HarnessChannel } from "@nylorun/core/harness-api";
 import type { FlowLimits } from "../core/limits.js";
+import type { HarnessPeer } from "../harness-api/server.js";
+import type { HostAuthority } from "../sandbox/join.js";
 import type { SessionStore } from "../store/types.js";
 import type { SandboxBackend } from "../sandbox/types.js";
 import type { TenantCause } from "./cause.js";
@@ -19,6 +22,8 @@ export interface TenantPaths {
     tmp: string;
     sandboxes: string;
     pluginData: string;
+    /** The `fs` BlobStore's directory, used when the Host has no Object store. */
+    blobs: string;
     logs: string;
     log: string;
 }
@@ -48,6 +53,12 @@ export interface TenantConfig {
         steps?: number;
         ms?: number;
     };
+    /**
+     * How long a run waits in its lease for a pending Action's outcome (F6.2): the turn goes on
+     * at once when the Action endpoint answers in time, and ends its segment as waiting (resumed
+     * by replay) otherwise. Default 5 minutes; 0 never waits.
+     */
+    actionHoldMs?: number;
     /** Retries and timeouts for model calls (Model Calls §5, §6). Defaults in `piModel`. */
     modelCall?: import("../gates/model-gate.js").ModelCallSettings;
     childEnv: Readonly<Record<string, string>>;
@@ -84,6 +95,8 @@ export interface TenantSummary {
     inFlightDeliveries: number;
     pendingActions: number;
     uncertainEffects: number;
+    /** The Tenant's harnesses (F6.2). */
+    harness?: HarnessStatus;
 }
 /**
  * The Node request and response behind a `Request`, for what still writes to Node directly
@@ -107,6 +120,10 @@ export interface TenantHandle {
     /** Stop scheduling; wait for or cancel active turns. */
     drain(activeWork: "drain" | "cancel", timeoutMs?: number): Promise<void>;
     close(): Promise<void>;
+    /** Serves a harness's Harness API channel until it closes. Returns a function that detaches it. */
+    attachHarness?(channel: HarnessChannel, peer: HarnessPeer): () => void;
+    /** The Tenant's side of a sandbox pod's join (F7.2); absent without sandbox pods. */
+    hostAuthority?(): HostAuthority | undefined;
 }
 /**
  * The Host's Tenant for a request: open, or unavailable. `cause` says why when opening it

package/dist/tenant/worker.d.ts

@@ -1,4 +1,6 @@
-import type { AdvanceResult, DeliverResult, DurableExecution, StuckInvocation, WorkerHandlers } from "../execution/types.js";
+import type { AbortReason } from "@nylorun/core/harness-api";
+import { RunAbort } from "@nylorun/harness/api";
+import type { AdvanceResult, DeliverResult, SandboxResult, SandboxTrigger, DurableExecution, StuckInvocation, WorkerHandlers } from "../execution/types.js";
 import type { Logger } from "./types.js";
 /** This process's Worker id: the `owner` it writes on the sessions it advances (§10.6). */
 export declare const WORKER_ID: string;
@@ -11,10 +13,12 @@ export declare const DEFAULT_ADVANCE_DEADLINE_MS: number;
 /** Default time an aborted advance has to settle before it is abandoned. */
 export declare const DEFAULT_ADVANCE_GRACE_MS = 30000;
 /** Why an advance's signal aborted (see "Abort reasons" above). */
-export type AdvanceAbortKind = "cancel" | "shutdown" | "deadline" | "ownership.lost";
-/** The abort reason of an advance. */
-export declare class AdvanceAbort extends Error {
-    readonly kind: AdvanceAbortKind;
+export type AdvanceAbortKind = AbortReason;
+/**
+ * The abort reason of an advance. A harness run's reason (`RunAbort`) has the same kinds, so the
+ * executors read either one.
+ */
+export declare class AdvanceAbort extends RunAbort {
     readonly name: string;
     constructor(kind: AdvanceAbortKind, message: string, options?: {
         cause?: unknown;
@@ -40,6 +44,8 @@ export interface TenantWorker {
     sweep(): Promise<void>;
     /** Delivers one Action to its endpoint. Only infrastructure errors throw. */
     deliver?(actionId: string, signal: AbortSignal): Promise<DeliverResult>;
+    /** Reconciles one pod sandbox (F7.2). Only infrastructure errors throw. */
+    sandbox?(sandboxId: string, trigger: SandboxTrigger, signal: AbortSignal): Promise<SandboxResult>;
 }
 export interface TenantWorkersOptions {
     /** Finds or opens a Tenant that is not registered on this process. */

package/dist/tenant/worker.js

@@ -51,6 +51,7 @@
  */
 import { hostname } from "node:os";
 import { randomBytes } from "node:crypto";
+import { RunAbort } from "@nylorun/harness/api";
 /** This process's Worker id: the `owner` it writes on the sessions it advances (§10.6). */
 export const WORKER_ID = `worker-${hostname()}-${process.pid}-${randomBytes(4).toString("hex")}`;
 /**
@@ -61,13 +62,14 @@ export const WORKER_ID = `worker-${hostname()}-${process.pid}-${randomBytes(4).t
 export const DEFAULT_ADVANCE_DEADLINE_MS = 50 * 60_000;
 /** Default time an aborted advance has to settle before it is abandoned. */
 export const DEFAULT_ADVANCE_GRACE_MS = 30_000;
-/** The abort reason of an advance. */
-export class AdvanceAbort extends Error {
-    kind;
+/**
+ * The abort reason of an advance. A harness run's reason (`RunAbort`) has the same kinds, so the
+ * executors read either one.
+ */
+export class AdvanceAbort extends RunAbort {
     name = "AdvanceAbort";
     constructor(kind, message, options) {
-        super(message, options);
-        this.kind = kind;
+        super(kind, message, options);
     }
 }
 /** The abort reason of an advance that ran past its deadline. */
@@ -87,7 +89,7 @@ export class AdvanceDeadlineError extends AdvanceAbort {
 export function abortKind(signal) {
     if (!signal.aborted)
         return undefined;
-    return signal.reason instanceof AdvanceAbort ? signal.reason.kind : "shutdown";
+    return signal.reason instanceof RunAbort ? signal.reason.kind : "shutdown";
 }
 /** The execution's abort reason as a `shutdown`, keeping its message. */
 function shutdownOf(reason) {
@@ -138,6 +140,10 @@ export class TenantWorkers {
             const worker = await this.find(tenantId);
             return worker?.deliver ? worker.deliver(actionId, signal) : DONE;
         },
+        sandbox: async (tenantId, sandboxId, trigger, signal) => {
+            const worker = await this.find(tenantId);
+            return worker?.sandbox ? worker.sandbox(sandboxId, trigger, signal) : {};
+        },
     };
     /** Runs one advance under the deadline and the grace period (see the module comment). */
     async bounded(tenantId, sessionId, worker, signal) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.15.1-beta";
+export declare const RUNTIME_VERSION = "0.16.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.15.1-beta";
+export const RUNTIME_VERSION = "0.16.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.15.1-beta",
+  "version": "0.16.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -59,16 +59,17 @@
     "db:studio": "drizzle-kit studio"
   },
   "dependencies": {
-    "@ag-ui/core": "~1.0.0",
+    "@ag-ui/core": "~1.0.1",
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@earendil-works/pi-ai": "0.99.1",
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "@hono/zod-openapi": "^1.6.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@nylorun/core": "0.11.0-beta",
-    "@nylorun/harness": "0.21.2-beta",
-    "@restatedev/restate-sdk": "1.16.9",
-    "@s2-dev/streamstore": "0.27.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
+    "@nylorun/core": "0.12.0-beta",
+    "@nylorun/harness": "0.22.0-beta",
+    "@restatedev/restate-sdk": "1.17.2",
+    "@s2-dev/streamstore": "0.28.0",
+    "aws4fetch": "1.0.20",
     "drizzle-orm": "^0.45.3",
     "hono": "^4.13.12",
     "jose": "^6.2.12",
@@ -76,17 +77,19 @@
     "pg": "8.23.1",
     "pg-logical-replication": "2.5.0",
     "postgres": "^3.4.9",
+    "ws": "^8.22.0",
     "zod": "^4.6.5"
   },
   "devDependencies": {
     "@a2a-js/sdk": "~1.3.0",
-    "@ag-ui/client": "1.0.0",
+    "@ag-ui/client": "1.0.1",
     "@scalar/openapi-parser": "^0.29.9",
     "@types/node": "^26.5.0",
     "@types/pg": "^8.23.1",
+    "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
     "drizzle-kit": "^0.31.11",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.2"
   }
 }

package/dist/adapters/media.d.ts

@@ -1,24 +0,0 @@
-import { type MediaAsset, type MediaReference } from "../media.js";
-export * from "../media.js";
-/** Explicit local asset store; agents receive only opaque references. */
-export declare class MediaStore {
-    private readonly root;
-    constructor(root: string);
-    saveInput(agentId: string, sessionId: string, mediaType: string, base64: string): Promise<MediaAsset>;
-    saveGenerated(agentId: string, sessionId: string, mediaType: string, bytes: Uint8Array): Promise<MediaAsset>;
-    dataUrl(reference: MediaReference, sessionId: string): Promise<{
-        readonly asset: MediaAsset;
-        readonly url: string;
-    } | undefined>;
-    latestInput(agentId: string, sessionId: string): Promise<MediaAsset | undefined>;
-    read(agentId: string, sessionId: string, assetId: string): Promise<{
-        asset: MediaAsset;
-        bytes: Uint8Array;
-    } | undefined>;
-    private save;
-    private readMetadata;
-    private directory;
-}
-export declare function localMedia(options: {
-    root: string;
-}): MediaStore;

package/dist/adapters/media.js

@@ -1,111 +0,0 @@
-import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { IMAGE_MEDIA_TYPES, MAX_IMAGE_BYTES, decodeImageBase64, validateImageBytes, } from "../media.js";
-export * from "../media.js";
-/** Explicit local asset store; agents receive only opaque references. */
-export class MediaStore {
-    root;
-    constructor(root) {
-        this.root = root;
-    }
-    async saveInput(agentId, sessionId, mediaType, base64) {
-        const bytes = decodeImageBase64(mediaType, base64);
-        return this.save(agentId, sessionId, "input", mediaType, bytes);
-    }
-    async saveGenerated(agentId, sessionId, mediaType, bytes) {
-        validateImageBytes(mediaType, bytes);
-        return this.save(agentId, sessionId, "generated", mediaType, bytes);
-    }
-    async dataUrl(reference, sessionId) {
-        const stored = await this.read(reference.agentId, sessionId, reference.assetId);
-        if (!stored)
-            return undefined;
-        return Object.freeze({
-            asset: stored.asset,
-            url: `data:${stored.asset.mediaType};base64,${Buffer.from(stored.bytes).toString("base64")}`,
-        });
-    }
-    async latestInput(agentId, sessionId) {
-        const directory = this.directory(agentId, sessionId);
-        try {
-            const metadata = await Promise.all((await readdir(directory))
-                .filter((name) => name.endsWith(".json"))
-                .map(async (name) => this.readMetadata(directory, name)));
-            return metadata
-                .filter((entry) => entry?.kind === "input")
-                .sort((left, right) => right.createdAt - left.createdAt)[0];
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async read(agentId, sessionId, assetId) {
-        if (!safe(agentId) || !safe(sessionId) || !safe(assetId))
-            return undefined;
-        const directory = this.directory(agentId, sessionId);
-        const metadata = await this.readMetadata(directory, `${assetId}.json`);
-        if (!metadata)
-            return undefined;
-        try {
-            return {
-                asset: metadata,
-                bytes: await readFile(join(directory, `${assetId}.bin`)),
-            };
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async save(agentId, sessionId, kind, mediaType, bytes) {
-        if (!safe(agentId) || !safe(sessionId))
-            throw new Error("Invalid media asset scope.");
-        const directory = this.directory(agentId, sessionId);
-        const asset = {
-            id: randomUUID(),
-            mediaType,
-            bytes: bytes.byteLength,
-            kind,
-            createdAt: Date.now(),
-        };
-        await mkdir(directory, { recursive: true });
-        await writeFile(join(directory, `${asset.id}.bin`), bytes);
-        await writeFile(join(directory, `${asset.id}.json`), JSON.stringify(asset));
-        return omitCreatedAt(asset);
-    }
-    async readMetadata(directory, name) {
-        try {
-            const value = JSON.parse(await readFile(join(directory, name), "utf8"));
-            return validAsset(value) ? value : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    directory(agentId, sessionId) {
-        return join(this.root, agentId, sessionId);
-    }
-}
-/** Decode one canonical base64 image before it is persisted or sent to a provider. */
-function validAsset(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const asset = value;
-    return (typeof asset.id === "string" &&
-        safe(asset.id) &&
-        typeof asset.mediaType === "string" &&
-        IMAGE_MEDIA_TYPES.includes(asset.mediaType) &&
-        typeof asset.bytes === "number" &&
-        (asset.kind === "input" || asset.kind === "generated") &&
-        typeof asset.createdAt === "number");
-}
-function omitCreatedAt(asset) {
-    const { createdAt: _createdAt, ...result } = asset;
-    return Object.freeze(result);
-}
-function safe(value) {
-    return value !== "." && value !== ".." && /^[a-zA-Z0-9._-]+$/u.test(value);
-}
-export function localMedia(options) {
-    return new MediaStore(options.root);
-}