@nylorun/runtime 0.16.0-beta → 0.19.0-beta

package/dist/tenant/runtime.js

@@ -5,6 +5,7 @@ import { tenantModelGate } from "../gates/in-process.js";
 import { createKekFile, readVaultKek } from "../vault/kek.js";
 import { SigningKeys } from "./signing-keys.js";
 import { VaultService } from "../vault/service.js";
+import { CredentialSources } from "../vault/sources.js";
 import { McpPool } from "../mcp/pool.js";
 import { SandboxManager } from "../sandbox/manager.js";
 import { storeSandboxRecords } from "../sandbox/records.js";
@@ -17,10 +18,10 @@ import { closeStreams, streamsStatus, wireStreams, } from "./streams.js";
 import { abortAll, abortLocal, createWorkState, drain, waitForIdle, } from "./scheduler.js";
 import { advance } from "./advance.js";
 import { sweep } from "./sweep.js";
-import { deliverAction } from "./delivery.js";
 import { TenantWorkers, WORKER_ID, } from "./worker.js";
 import { authorize } from "./effects.js";
 import { inProcessToolGate } from "../gates/tool-gate.js";
+import { guardedFetch } from "./outbound.js";
 import { inProcessKeys } from "../keys/keys.js";
 import { tenantApi } from "../api/http/app.js";
 import { createFsBlobStore } from "../blob/index.js";
@@ -31,6 +32,7 @@ import { localWorkspace, remoteWorkspace, withPodWorkspaces, } from "../harness-
 import { hostAuthority } from "../sandbox/join.js";
 import { reconcileSandbox } from "../sandbox/pods/reconcile.js";
 import { sandboxWorkspaceReader } from "../artifacts/workspace.js";
+import { readDefinitionFile } from "./definition-files.js";
 /** Default ownership lease of an advance; the heartbeat renews it every third. */
 const DEFAULT_OWNER_LEASE_MS = 30_000;
 function validateConfig(config) {
@@ -79,9 +81,7 @@ export class TenantRuntime {
         const paths = config.paths;
         mkdirSync(paths.root, { recursive: true });
         mkdirSync(paths.home, { recursive: true });
-        mkdirSync(paths.tmp, { recursive: true });
         mkdirSync(paths.sandboxes, { recursive: true });
-        mkdirSync(paths.pluginData, { recursive: true });
         mkdirSync(paths.logs, { recursive: true });
         const store = hooks.store;
         let wired;
@@ -119,11 +119,21 @@ export class TenantRuntime {
             const vault = new VaultService({
                 store: opened,
                 kek: ensureKek,
-                fetch: config.vaultFetch ?? globalThis.fetch,
+                // OAuth refresh and connect follow the Host's address policy (F9 C2).
+                fetch: config.vaultFetch ?? guardedFetch(config.delivery ?? {}),
+            });
+            const credentials = new CredentialSources({
+                vault,
+                ...(config.resolver ? { resolver: config.resolver } : {}),
             });
             // `ctx` is assigned below; these callbacks only run once the Tenant is open.
             let ctx;
-            const toolGate = hooks.toolGate ?? inProcessToolGate(config.delivery ?? {});
+            const toolGate = hooks.toolGate ??
+                inProcessToolGate(config.delivery ?? {}, {
+                    session: (sessionId) => opened.tx((t) => t.get("sessions", sessionId)),
+                    authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                    logger: config.logger,
+                });
             const signingKeys = new SigningKeys({ tenantId: config.tenantId, kek: ensureKek });
             const keys = hooks.keys ?? inProcessKeys({ store: opened, vault, signingKeys, kek: ensureKek });
             const harnessMode = hooks.harness ?? "memory";
@@ -133,9 +143,8 @@ export class TenantRuntime {
             // executors; otherwise the harness holds both (F6.2).
             const mcp = inProcess
                 ? new McpPool({
-                    pluginData: paths.pluginData,
-                    childEnv: config.childEnv,
                     authorize: (sessionId, request) => authorize(ctx, sessionId, request),
+                    policy: config.delivery ?? {},
                     ...(toolGate.openMcp ? { openRemote: (server) => toolGate.openMcp(server) } : {}),
                 })
                 : undefined;
@@ -148,6 +157,12 @@ export class TenantRuntime {
                         defaultSandboxBackends({ root: paths.sandboxes }),
                     preference,
                     ephemeral,
+                    definitionFile: async (sha256) => {
+                        const bytes = await readDefinitionFile(blobs, sha256);
+                        if (!bytes)
+                            throw new Error(`The Object store has no bytes for ${sha256}`);
+                        return bytes;
+                    },
                     emit: async (sessionId, turnId, type, payload) => {
                         if (ctx.closed)
                             return;
@@ -222,8 +237,10 @@ export class TenantRuntime {
             ctx = {
                 config,
                 envelope,
+                reads: hooks.reads,
                 store: opened,
                 vault,
+                credentials,
                 ...(mcp ? { mcp } : {}),
                 sandbox,
                 flowLimits,
@@ -251,11 +268,6 @@ export class TenantRuntime {
                     await execution.wake(config.tenantId, sessionId, wake);
                 },
                 abortLocal: (sessionId, turnId) => abortLocal(ctx, sessionId, "cancel", turnId),
-                deliver: async (actionId) => {
-                    if (ctx.closing || ctx.closed)
-                        return;
-                    await execution.deliver(config.tenantId, actionId);
-                },
                 ...(hooks.pods ? { pods: hooks.pods } : {}),
                 sandboxSignal: async (sandboxId, signal) => {
                     if (ctx.closing || ctx.closed || !execution.sandbox)
@@ -295,7 +307,6 @@ export class TenantRuntime {
             // sessions a previous process left runnable or running (takeover handles the rest).
             const worker = {
                 advance: (sessionId, signal) => advance(ctx, sessionId, signal),
-                deliver: (actionId, signal) => deliverAction(ctx, actionId, signal),
                 sweep: () => sweep(ctx),
                 sandbox: (sandboxId, trigger) => reconcileSandbox(ctx, sandboxId, trigger),
             };
@@ -313,6 +324,7 @@ export class TenantRuntime {
             await detach?.().catch(() => undefined);
             await harness?.stop().catch(() => undefined);
             await wired?.close().catch(() => undefined);
+            await hooks.reads?.close().catch(() => undefined);
             await store.close().catch(() => undefined);
             throw error;
         }
@@ -329,8 +341,6 @@ export class TenantRuntime {
         return {
             ready: !this.ctx.closing && !this.ctx.closed,
             runningSessions: counts.runningSessions,
-            inFlightDeliveries: [...this.ctx.work.deliveries.values()].reduce((n, set) => n + set.size, 0),
-            pendingActions: counts.pendingActions,
             uncertainEffects: counts.uncertainEffects,
             harness: harnessStatusOf(this.ctx),
         };
@@ -359,6 +369,9 @@ export class TenantRuntime {
     attachHarness(channel, peer) {
         return this.ctx.harness.attach(channel, peer);
     }
+    harnessStatus() {
+        return harnessStatusOf(this.ctx);
+    }
     async close() {
         const ctx = this.ctx;
         ctx.closing = true;
@@ -389,6 +402,7 @@ export class TenantRuntime {
                     return closeStreams(ctx);
                 },
             ],
+            ["reads", () => ctx.reads?.close()],
             ["store", () => ctx.store.close()],
         ];
         let failure;

package/dist/tenant/sandboxes.d.ts

@@ -7,9 +7,9 @@
  *   sandbox's id, kind, spec and labels, and the session body names the sandbox it is attached
  *   to (`Session.sandboxId`); deleting a session (a sessions reset) only detaches it.
  * - **Access.** An application key reaches every sandbox, and so does an application key acting
- *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A subject
- *   token reaches only the ids its `sbx` grants match, and changes them only with
- *   `sandboxes:write`; any other id is the 404 of a missing one.
+ *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A token
+ *   caller (a trusted issuer's token) reaches only the ids its grants match, and changes them
+ *   only with `sandboxes:write`; any other id is the 404 of a missing one.
  * - **Serial turns.** One turn at a time per sandbox: a session whose sandbox another attached
  *   session's turn holds is refused (`409 sandbox_busy`), as the session sandbox route is
  *   refused while its session's turn runs. Commands within the workspace keep queueing in the
@@ -30,8 +30,9 @@
  */
 import { type PutSandboxRequest, type SandboxView } from "@nylorun/core/contracts";
 import type { SandboxResource, Tx } from "../store/types.js";
-import type { AuthScope, Session, TenantContext } from "./context.js";
-/** The `sbx` grants that limit `scope`, or undefined when it reaches every sandbox. */
+import type { SandboxRouteDeps } from "../core/sandbox-routes.js";
+import { type AuthScope, type Session, type TenantContext } from "./context.js";
+/** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export declare function sandboxGrantsOf(scope: AuthScope): readonly string[] | undefined;
 /** A sandbox resource, unless it is gone or being deleted. */
 export declare function liveSandbox(t: Tx, id: string, options?: {
@@ -95,7 +96,7 @@ export declare function attachSandbox(t: Tx, id: string, grants: readonly string
 export declare function recordAttachment(t: Tx, sessionId: string, sandboxId: string): Promise<void>;
 /**
  * Checks a turn start on a session attached to a sandbox, in the command's transaction after
- * the session row lock: the sandbox still exists, a subject token's `sbx` grants reach it, and
+ * the session row lock: the sandbox still exists, a token caller's grants reach it, and
  * no other session attached to it has a turn running. Holds the sandbox row's lock until the
  * transaction ends, so two turn starts on one sandbox are decided one after the other.
  *
@@ -117,3 +118,5 @@ export declare function touchPodSandbox(ctx: TenantContext, id: string): Promise
  * timer is set). Best effort.
  */
 export declare function rearmPodTimers(ctx: TenantContext): Promise<void>;
+/** Session lookups for the sandbox route handlers (`core/sandbox-routes.ts`). */
+export declare function sandboxRouteDeps(ctx: TenantContext): SandboxRouteDeps;

package/dist/tenant/sandboxes.js

@@ -7,9 +7,9 @@
  *   sandbox's id, kind, spec and labels, and the session body names the sandbox it is attached
  *   to (`Session.sandboxId`); deleting a session (a sessions reset) only detaches it.
  * - **Access.** An application key reaches every sandbox, and so does an application key acting
- *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A subject
- *   token reaches only the ids its `sbx` grants match, and changes them only with
- *   `sandboxes:write`; any other id is the 404 of a missing one.
+ *   for a subject (`Nylorun-Subject`), which needs `sandboxes:write` to change one. A token
+ *   caller (a trusted issuer's token) reaches only the ids its grants match, and changes them
+ *   only with `sandboxes:write`; any other id is the 404 of a missing one.
  * - **Serial turns.** One turn at a time per sandbox: a session whose sandbox another attached
  *   session's turn holds is refused (`409 sandbox_busy`), as the session sandbox route is
  *   refused while its session's turn runs. Commands within the workspace keep queueing in the
@@ -37,8 +37,9 @@ import { podName } from "../sandbox/pods/name.js";
 import { expiresAtOf, podLifecycleConfig } from "../sandbox/pods/spec.js";
 import { requirePods } from "../sandbox/placement.js";
 import { parseSandboxDuration } from "@nylorun/core/define";
+import { sandboxLookup, sessionOf } from "./context.js";
 import { fail } from "./http.js";
-/** The `sbx` grants that limit `scope`, or undefined when it reaches every sandbox. */
+/** The sandbox grants that limit `scope`, or undefined when it reaches every sandbox. */
 export function sandboxGrantsOf(scope) {
     return scope.kind === "token" ? (scope.sandboxes ?? []) : undefined;
 }
@@ -435,7 +436,7 @@ export async function recordAttachment(t, sessionId, sandboxId) {
 }
 /**
  * Checks a turn start on a session attached to a sandbox, in the command's transaction after
- * the session row lock: the sandbox still exists, a subject token's `sbx` grants reach it, and
+ * the session row lock: the sandbox still exists, a token caller's grants reach it, and
  * no other session attached to it has a turn running. Holds the sandbox row's lock until the
  * transaction ends, so two turn starts on one sandbox are decided one after the other.
  *
@@ -549,3 +550,13 @@ export async function rearmPodTimers(ctx) {
         });
     }
 }
+/** Session lookups for the sandbox route handlers (`core/sandbox-routes.ts`). */
+export function sandboxRouteDeps(ctx) {
+    return {
+        sandbox: ctx.sandbox,
+        session: (id) => ctx.store.tx(async (t) => {
+            const session = await sessionOf(t, id);
+            return { session, lookup: await sandboxLookup(t, id) };
+        }),
+    };
+}

package/dist/tenant/scheduler.d.ts

@@ -5,14 +5,10 @@ export interface WorkState {
     readonly running: Map<string, AbortController>;
     /** The turn each running advance belongs to, by session id (`null`: none). */
     readonly runningTurns: Map<string, string | null>;
-    /** Deliveries to Action endpoints in flight on this process, by their Action's session id. */
-    readonly deliveries: Map<string, Set<AbortController>>;
-    /** When each Action last reported a failed delivery (`action.delivery_failed` throttling). */
-    readonly deliveryNotices: Map<string, number>;
 }
 export declare function createWorkState(): WorkState;
 /**
- * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
+ * Abort the advance of `id` if it runs on this process.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */

package/dist/tenant/scheduler.js

@@ -13,7 +13,7 @@ import { randomUUID } from "node:crypto";
 import { command } from "./commands.js";
 import { AdvanceAbort } from "./worker.js";
 export function createWorkState() {
-    return { running: new Map(), runningTurns: new Map(), deliveries: new Map(), deliveryNotices: new Map() };
+    return { running: new Map(), runningTurns: new Map() };
 }
 const MESSAGES = {
     cancel: "Turn cancelled",
@@ -26,7 +26,7 @@ function abortWith(controller, kind) {
         controller.abort(new AdvanceAbort(kind, MESSAGES[kind]));
 }
 /**
- * Abort the advance of `id` if it runs on this process, and its deliveries to Action endpoints.
+ * Abort the advance of `id` if it runs on this process.
  * Cancel calls it after committing `cancelled`, and so does the control stream for cancels made
  * elsewhere. With `turnId`, an advance of another turn keeps running: the signal came late.
  */
@@ -34,9 +34,6 @@ export function abortLocal(ctx, id, kind = "cancel", turnId) {
     const controller = ctx.work.running.get(id);
     if (controller && (turnId === undefined || ctx.work.runningTurns.get(id) === turnId))
         abortWith(controller, kind);
-    // A cancel also closes the session's deliveries, which aborts the tools' `ctx.signal`.
-    for (const delivery of ctx.work.deliveries.get(id) ?? [])
-        abortWith(delivery, kind);
 }
 /** Reset: abort every advance running on this process; their sessions are being cleared. */
 export function clearWork(ctx) {

package/dist/tenant/session-streams.d.ts

@@ -20,23 +20,24 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { LiveEvent } from "@nylorun/core/contracts";
-import type { TenantContext } from "./context.js";
+import type { AuthScope, TenantContext } from "./context.js";
 import type { StreamsWiring } from "./streams.js";
-/** Why the Runtime ended a stream a subject token opened. */
-export type StreamEndReason = "token_expired" | "revoked";
+/** Why the Runtime ended a stream a token opened. */
+export type StreamEndReason = "token_expired";
 /** Where an observer's events go: an SSE response, or an in-process reader. */
 export interface ObserverSink {
     write(event: LiveEvent): void;
     /** Ends the stream; with a reason, the client is told why before it ends. */
     end(reason?: StreamEndReason): void;
 }
-/** The subject token a stream was opened with: it ends at expiry or revocation. */
+/** The token a stream was opened with (a trusted issuer's): the stream ends at its expiry. */
 export interface StreamHolder {
     readonly subject: string;
-    readonly epoch: number;
     /** Epoch ms when the token expires. */
     readonly expiresAt: number;
 }
+/** The holder a stream opened with `scope` records: token callers only. */
+export declare function streamHolderOf(scope: AuthScope): StreamHolder | undefined;
 /** One client of a session: the next sequence it needs. */
 interface Observer {
     readonly sink: ObserverSink;
@@ -78,9 +79,10 @@ export declare function currentBasin(ctx: TenantContext): string;
  * read starts. The cursor returned is the last record read (the request's cursor when none
  * was), whatever the `agent` filter kept.
  */
-export declare function readHistory(ctx: TenantContext, sessionId: string, cursor: string | undefined, agent: string | undefined): Promise<{
+export declare function readHistory(ctx: TenantContext, sessionId: string, cursor: string | undefined, agent: string | undefined, limit?: number): Promise<{
     items: LiveEvent[];
     cursor: string | null;
+    tail?: boolean;
 }>;
 /**
  * `GET /v1/sessions/:id/events`: joins the session's shared read at the client's cursor and
@@ -114,11 +116,6 @@ export declare function served(event: LiveEvent): boolean;
  * the Tenant end too.
  */
 export declare function checkSessionStreams(ctx: TenantContext): Promise<void>;
-/**
- * Ends the streams of `subject` opened with a token older than `epoch` (a revocation), on
- * this process. Other processes do the same on the `subject.revoked` signal.
- */
-export declare function endSubjectStreams(hub: SessionStreams, subject: string, epoch: number): void;
 /** Reset or close: end every session observer and stop every shared read. */
 export declare function clearObservers(hub: SessionStreams): void;
 /** Close: end every session observer. */

package/dist/tenant/session-streams.js

@@ -1,7 +1,34 @@
+/**
+ * Live delivery over Durable Streams (architecture §12.4, "Reading"): session history
+ * (`GET /v1/sessions/:id/items`) and session SSE (`GET /v1/sessions/:id/events`).
+ *
+ * - **Streams.** A session's events are in `sessions/<id>` in the Tenant's current basin
+ *   generation (`currentBasin`); cursors carry only the session id and sequence.
+ * - **History** reads the session's stream from the cursor up to the tail seen when the read
+ *   starts. The `agent` filter runs here, and the response cursor is the last record read. If
+ *   the streams fail, history answers `503`.
+ * - **SSE** shares one stream read per observed session in this process (a `SessionStream`)
+ *   among that session's observers. Each observer keeps the next sequence it needs and skips
+ *   what it already has, so a client resuming from `Last-Event-ID` sees no gap and no
+ *   duplicate. An observer behind the feed restarts the shared read from its own position.
+ *   A feed follows one basin generation: it ends once its session is gone or the Tenant moved
+ *   to a new generation (a reset, possibly on another node), checked when a client joins, when
+ *   its read fails, on a `sessions.reset` signal, and periodically (`checkSessionStreams`).
+ *
+ * Business code never writes here: events reach streams only through the stream relay, from
+ * the record, after commit.
+ */
+import { historyCursor, historyResume } from "../reads/cursor.js";
 import { decodeCursor, encodeCursor } from "../record/index.js";
 import { basinOf } from "../streams/basin.js";
 import { sessionStream, } from "../streams/types.js";
 import { fail } from "./http.js";
+/** The holder a stream opened with `scope` records: token callers only. */
+export function streamHolderOf(scope) {
+    if (scope.kind !== "token")
+        return undefined;
+    return { subject: scope.subject, expiresAt: scope.expiresAt };
+}
 export function createSessionStreams() {
     return { wiring: undefined, generation: 0, sessions: new Map() };
 }
@@ -79,17 +106,27 @@ function streamsOf(ctx) {
  * read starts. The cursor returned is the last record read (the request's cursor when none
  * was), whatever the `agent` filter kept.
  */
-export async function readHistory(ctx, sessionId, cursor, agent) {
-    const from = startSeq(sessionId, cursor);
+export async function readHistory(ctx, sessionId, cursor, agent, limit) {
+    const codec = limit === undefined ? undefined : historyCursor(ctx.config.tenantId, sessionId, agent);
+    const from = startSeq(sessionId, codec ? codec.decode(cursor) : historyResume(ctx.config.tenantId, sessionId, cursor));
     const streams = streamsOf(ctx);
     const ref = (await currentStream(ctx, sessionId)) ?? fail(404, "Session not found");
     const items = [];
     let last;
+    let atTail = true;
+    let examined = 0;
     try {
+        const tail = limit === undefined ? undefined : await streams.tail(ref.basin, ref.stream);
         for await (const record of streams.read(ref.basin, ref.stream, from, { follow: false })) {
+            if (tail !== undefined && record.seq >= tail)
+                break;
             last = record.seq;
             if (served(record.body) && (agent === undefined || belongsTo(record.body, agent)))
                 items.push(record.body);
+            if (limit !== undefined && ++examined >= limit) {
+                atTail = last >= tail - 1;
+                break;
+            }
         }
     }
     catch (error) {
@@ -101,7 +138,10 @@ export async function readHistory(ctx, sessionId, cursor, agent) {
     }
     return {
         items,
-        cursor: last !== undefined ? encodeCursor(sessionId, last) : cursor ?? null,
+        ...(limit === undefined ? {} : { tail: atTail }),
+        cursor: last !== undefined
+            ? (codec ? codec.encode(encodeCursor(sessionId, last)) : encodeCursor(sessionId, last))
+            : cursor ?? null,
     };
 }
 /**
@@ -111,7 +151,7 @@ export async function readHistory(ctx, sessionId, cursor, agent) {
 export async function streamSessionEvents(ctx, request, response, sessionId, cursor, holder) {
     const observer = {
         sink: sseSink(response),
-        next: startSeq(sessionId, cursor),
+        next: startSeq(sessionId, historyResume(ctx.config.tenantId, sessionId, cursor)),
         ...(holder ? { holder } : {}),
     };
     const joined = await join(ctx, sessionId, observer);
@@ -156,7 +196,7 @@ export async function* observeSession(ctx, sessionId, cursor, options) {
                 notify();
             },
         },
-        next: startSeq(sessionId, cursor),
+        next: startSeq(sessionId, historyResume(ctx.config.tenantId, sessionId, cursor)),
         ...(options.holder ? { holder: options.holder } : {}),
     };
     const joined = await join(ctx, sessionId, observer);
@@ -233,7 +273,7 @@ async function join(ctx, sessionId, observer) {
     feed.observers.add(observer);
     return feed;
 }
-/** Ends one observer early (its token expired or was revoked). */
+/** Ends one observer early (its token expired). */
 function endObserver(hub, feed, observer, reason) {
     if (!feed.observers.has(observer))
         return;
@@ -328,24 +368,12 @@ async function stillCurrent(ctx, feed) {
  */
 export async function checkSessionStreams(ctx) {
     const feeds = [...ctx.sessionStreams.sessions.values()];
-    // Also a backstop for lost `subject.revoked` signals: the holders' current epochs.
-    const subjects = new Set();
-    for (const feed of feeds)
-        for (const observer of feed.observers)
-            if (observer.holder)
-                subjects.add(observer.holder.subject);
-    const { exists, epochs, generation } = await ctx.store.tx(async (t) => {
+    const { exists, generation } = await ctx.store.tx(async (t) => {
         const exists = new Set();
         for (const feed of feeds)
             if (await t.get("sessions", feed.sessionId))
                 exists.add(feed.sessionId);
-        return {
-            exists,
-            generation: (await t.basinGenerations()).current,
-            epochs: subjects.size === 0
-                ? new Map()
-                : await t.subjectEpochs([...subjects]),
-        };
+        return { exists, generation: (await t.basinGenerations()).current };
     });
     if (generation !== ctx.sessionStreams.generation)
         ctx.sessionStreams.wiring?.moveTo(generation);
@@ -355,18 +383,6 @@ export async function checkSessionStreams(ctx) {
                 ? { basin: currentBasin(ctx), stream: sessionStream(feed.sessionId) }
                 : undefined))
             endFeed(ctx.sessionStreams, feed);
-    for (const [subject, epoch] of epochs)
-        endSubjectStreams(ctx.sessionStreams, subject, epoch);
-}
-/**
- * Ends the streams of `subject` opened with a token older than `epoch` (a revocation), on
- * this process. Other processes do the same on the `subject.revoked` signal.
- */
-export function endSubjectStreams(hub, subject, epoch) {
-    for (const feed of [...hub.sessions.values()])
-        for (const observer of [...feed.observers])
-            if (observer.holder?.subject === subject && observer.holder.epoch < epoch)
-                endObserver(hub, feed, observer, "revoked");
 }
 function endFeed(hub, feed) {
     feed.read.abort();

package/dist/tenant/session.d.ts

@@ -1,5 +1,11 @@
-import type { Action } from "@nylorun/core/contracts";
-import type { AgentManifest, JsonValue } from "@nylorun/core/define";
+/**
+ * Pure helpers over the session document: turn-manifest pins and variants, and state rebasing.
+ * No store access and no I/O. (The tools of an MCP snapshot
+ * live in `mcp/snapshot.ts`.)
+ *
+ * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
+ */
+import type { AgentManifest } from "@nylorun/core/define";
 import { type TurnManifestStore } from "../core/turn-manifest.js";
 import type { Session } from "./context.js";
 export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
@@ -7,43 +13,4 @@ export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
 export declare function variantStore(session: Session): TurnManifestStore;
 /** Manifest this turn's checkpoint is pinned to (session pin or a stored variant). */
 export declare function turnManifestOf(session: Session): AgentManifest;
-/** Wrap a linked agent turn so the Loop learns the turn's manifest (SD-I4 pin stays on session). */
-export declare function linkedAgentOutput(session: Session, output: JsonValue | undefined): JsonValue;
 export declare function rebaseSessionState(session: Session, turnHash: string): void;
-export declare function pinnedTool(manifest: AgentManifest, capabilityId?: string, toolName?: string): import("@nylorun/core/define").ToolManifest | undefined;
-/** What an action runs, for events: a tool name, or a hook point and its capabilities. */
-export declare function actionTarget(action: Action): {
-    hook: {
-        at: "after" | "before";
-        scope: "step" | "turn";
-        capabilityIds: string[];
-    };
-    agent?: {
-        id: string;
-        path: string;
-        delegationId?: string | undefined;
-    } | undefined;
-} | {
-    toolName: string;
-    agent?: {
-        id: string;
-        path: string;
-        delegationId?: string | undefined;
-    } | undefined;
-} | {
-    path: string;
-    key: string;
-    agent?: {
-        id: string;
-        path: string;
-        delegationId?: string | undefined;
-    } | {
-        id: string;
-        path: string;
-        delegationId?: string | undefined;
-    } | {
-        id: string;
-        path: string;
-        delegationId?: string | undefined;
-    } | undefined;
-};

package/dist/tenant/session.js

@@ -1,12 +1,3 @@
-/**
- * Pure helpers over the session document: turn-manifest pins and variants, state rebasing,
- * and the event target of an Action. No store access and no I/O. (The tools of an MCP snapshot
- * live in `mcp/snapshot.ts`.)
- *
- * Later waves: stable; the async store conversion (Wave 1 / A) does not change these.
- */
-import { agentTurnValue } from "@nylorun/harness/run";
-import { isWorkflowManifest } from "../core/flow-host.js";
 import { allowedManifestHashes, rebaseTurnState, } from "../core/turn-manifest.js";
 export { manifestFor, sessionToolsOf } from "../mcp/snapshot.js";
 /** Turn-manifest store backed by the session's `variants` map (no schema change). */
@@ -27,12 +18,6 @@ export function turnManifestOf(session) {
         return session.manifest;
     return session.variants?.[hash] ?? session.manifest;
 }
-/** Wrap a linked agent turn so the Loop learns the turn's manifest (SD-I4 pin stays on session). */
-export function linkedAgentOutput(session, output) {
-    if (isWorkflowManifest(session.manifest))
-        return output ?? null;
-    return agentTurnValue(output ?? null, turnManifestOf(session));
-}
 export function rebaseSessionState(session, turnHash) {
     const allowed = allowedManifestHashes({
         pinnedHash: session.manifestHash,
@@ -46,25 +31,3 @@ export function rebaseSessionState(session, turnHash) {
     if (next !== session.state)
         session.state = next;
 }
-export function pinnedTool(manifest, capabilityId, toolName) {
-    const capability = manifest.capabilities.find((item) => item.id === capabilityId);
-    return capability?.tools?.find((tool) => tool.name === toolName);
-}
-/** What an action runs, for events: a tool name, or a hook point and its capabilities. */
-export function actionTarget(action) {
-    if (action.kind === "hook")
-        return {
-            hook: action.hook,
-            ...(action.agent ? { agent: action.agent } : {}),
-        };
-    if (action.kind === "tool" && "toolName" in action)
-        return {
-            toolName: action.toolName,
-            ...(action.agent ? { agent: action.agent } : {}),
-        };
-    return {
-        path: action.path,
-        key: action.key,
-        ...(action.agent ? { agent: action.agent } : {}),
-    };
-}

package/dist/tenant/sessions.d.ts

@@ -15,7 +15,7 @@ export declare function listDefinitions(ctx: TenantContext): Promise<{
     }[];
 }>;
 /**
- * The agents a subject token or publishable key may see: id, name and description only, never
+ * The agents a token caller may see: id, name and description only, never
  * instructions, tools or MCP servers, and only the agents allowed.
  */
 export declare function listAgentsPublic(ctx: TenantContext, agents: ReadonlySet<string> | "*"): Promise<{
@@ -60,7 +60,7 @@ export declare function putSession(ctx: TenantContext, id: string, body: PutSess
      */
     createOnly?: boolean;
     /**
-     * The sandboxes the caller reaches (a subject token's `sbx`, `sandboxGrantsOf`); undefined
+     * The sandboxes the caller reaches (a token caller's grants, `sandboxGrantsOf`); undefined
      * reaches every one. `sandbox: { id }` must name one of them.
      */
     sandboxGrants?: readonly string[];