@nylorun/runtime 0.23.0-beta → 0.25.0-beta

package/dist/artifacts/folders.d.ts

@@ -7,11 +7,14 @@ export declare function contentKey(sha256: string): string;
 export declare function sha256Hex(bytes: Uint8Array): string;
 /** Entries in manifest order: by path, comparing UTF-16 code units. */
 export declare function sortEntries(entries: readonly FolderEntry[]): FolderEntry[];
-/** The manifest's bytes, as stored: deterministic for the same entries. */
-export declare function encodeManifest(entries: readonly FolderEntry[]): Uint8Array;
+/**
+ * The manifest's bytes, as stored: deterministic for the same entries. A v1 manifest keeps each
+ * file's path, size, hash and type; a v2 one (a disk version, R2d step 3) every field.
+ */
+export declare function encodeManifest(entries: readonly FolderEntry[], format?: FolderManifest["format"]): Uint8Array;
 /** A folder version's manifest, read from the Object store. */
 export declare function readManifest(blobs: BlobStore, version: ArtifactVersionRow): Promise<FolderManifest>;
-/** The entry at `path`, or the 404 of a missing file. */
+/** The file at `path` (not a v2 link or directory), or the 404 of a missing file. */
 export declare function entryAt(manifest: FolderManifest, path: string): FolderEntry;
 /** What changed from `from` (absent: nothing) to `to`. */
 export declare function diffManifests(artifactId: string, from: {

package/dist/artifacts/folders.js

@@ -34,16 +34,16 @@ export function sha256Hex(bytes) {
 export function sortEntries(entries) {
     return [...entries].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
-/** The manifest's bytes, as stored: deterministic for the same entries. */
-export function encodeManifest(entries) {
+/**
+ * The manifest's bytes, as stored: deterministic for the same entries. A v1 manifest keeps each
+ * file's path, size, hash and type; a v2 one (a disk version, R2d step 3) every field.
+ */
+export function encodeManifest(entries, format = FOLDER_MANIFEST_FORMAT) {
     const manifest = {
-        format: FOLDER_MANIFEST_FORMAT,
-        entries: sortEntries(entries).map(({ path, size, sha256, contentType }) => ({
-            path,
-            size,
-            sha256,
-            contentType,
-        })),
+        format,
+        entries: sortEntries(entries).map((entry) => format === FOLDER_MANIFEST_FORMAT
+            ? { path: entry.path, size: entry.size, sha256: entry.sha256, contentType: entry.contentType }
+            : { ...entry }),
     };
     return new TextEncoder().encode(JSON.stringify(manifest));
 }
@@ -57,9 +57,9 @@ export async function readManifest(blobs, version) {
         throw new Error(`The manifest of ${version.artifactId} v${version.version} is malformed`);
     return parsed.data;
 }
-/** The entry at `path`, or the 404 of a missing file. */
+/** The file at `path` (not a v2 link or directory), or the 404 of a missing file. */
 export function entryAt(manifest, path) {
-    return (manifest.entries.find((entry) => entry.path === path) ??
+    return (manifest.entries.find((entry) => entry.path === path && entry.type === undefined) ??
         fail(404, `No file ${path} in this folder version`));
 }
 /** What changed from `from` (absent: nothing) to `to`. */
@@ -72,7 +72,11 @@ export function diffManifests(artifactId, from, to) {
         const prior = before.get(entry.path);
         if (!prior)
             added.push(entry);
-        else if (prior.sha256 !== entry.sha256 || prior.contentType !== entry.contentType)
+        else if (prior.sha256 !== entry.sha256 ||
+            prior.contentType !== entry.contentType ||
+            prior.type !== entry.type ||
+            prior.target !== entry.target ||
+            prior.mode !== entry.mode)
             changed.push({ path: entry.path, from: prior, to: entry });
     }
     const removed = (from?.manifest.entries ?? []).filter((entry) => !after.has(entry.path));
@@ -182,6 +186,7 @@ export async function commitFolderVersion(ctx, input) {
                     labelsJson: null,
                     createdAt,
                     updatedAt: createdAt,
+                    environmentId: null,
                 };
                 await t.insertArtifact(row, version);
             }

package/dist/artifacts/media-types.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Media types of file artifacts: what an upload may declare, what a name's extension implies,
+ * and which model input a file is (`modelInputOf`, protocol 12): text, an image, a PDF, an Office
+ * document, audio or video. A model reads a file only when its inputs include that one.
+ */
+import type { ModelInput } from "@nylorun/core/contracts";
 /** Images the model reads as images. */
 export declare const MODEL_IMAGE_TYPES: readonly string[];
 /** The largest image or text file a model call carries inline. */
@@ -13,3 +19,12 @@ export declare function isModelImage(contentType: string): boolean;
 export declare function isText(contentType: string): boolean;
 /** The usual extension of a media type, for a name the Runtime gives a file; undefined if none. */
 export declare function extensionFor(contentType: string): string | undefined;
+/** The model input a file of `contentType` is, or undefined for a type no model reads. */
+export declare function modelInputOf(contentType: string): ModelInput | undefined;
+/** An input, in a sentence: "PDFs", "Office documents"; "files of this type" for none. */
+export declare function inputLabel(input: ModelInput | undefined): string;
+/**
+ * Why a model that reads `inputs` cannot read a file of `contentType`, or undefined when it can.
+ * An image must also be PNG, JPEG, GIF or WebP.
+ */
+export declare function unreadableReason(contentType: string, inputs: readonly ModelInput[]): string | undefined;

package/dist/artifacts/media-types.js

@@ -1,7 +1,3 @@
-/**
- * Media types of file artifacts: what an upload may declare, what a name's extension implies,
- * and how the model reads a file (an image as an image, text as text, anything else refused).
- */
 import { DEFAULT_CONTENT_TYPE } from "../blob/index.js";
 const MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/;
 const BY_EXTENSION = {
@@ -12,6 +8,12 @@ const BY_EXTENSION = {
     webp: "image/webp",
     svg: "image/svg+xml",
     pdf: "application/pdf",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ppt: "application/vnd.ms-powerpoint",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
     txt: "text/plain",
     md: "text/markdown",
     csv: "text/csv",
@@ -83,3 +85,53 @@ export function extensionFor(contentType) {
     const type = essence(contentType);
     return Object.keys(BY_EXTENSION).find((extension) => BY_EXTENSION[extension] === type);
 }
+/** Word, Excel and PowerPoint documents, old and Open XML. */
+function isOffice(type) {
+    return (type === "application/msword" ||
+        type === "application/vnd.ms-excel" ||
+        type === "application/vnd.ms-powerpoint" ||
+        type.startsWith("application/vnd.openxmlformats-officedocument."));
+}
+/** The model input a file of `contentType` is, or undefined for a type no model reads. */
+export function modelInputOf(contentType) {
+    const type = essence(contentType);
+    if (isText(type))
+        return "text";
+    if (type.startsWith("image/"))
+        return "image";
+    if (type === "application/pdf")
+        return "pdf";
+    if (isOffice(type))
+        return "office";
+    if (type.startsWith("audio/"))
+        return "audio";
+    if (type.startsWith("video/"))
+        return "video";
+    return undefined;
+}
+const LABELS = {
+    text: "text files",
+    image: "images",
+    pdf: "PDFs",
+    office: "Office documents",
+    audio: "audio",
+    video: "video",
+};
+/** An input, in a sentence: "PDFs", "Office documents"; "files of this type" for none. */
+export function inputLabel(input) {
+    return input === undefined ? "files of this type" : LABELS[input];
+}
+/**
+ * Why a model that reads `inputs` cannot read a file of `contentType`, or undefined when it can.
+ * An image must also be PNG, JPEG, GIF or WebP.
+ */
+export function unreadableReason(contentType, inputs) {
+    const input = modelInputOf(contentType);
+    if (input === undefined)
+        return `no model reads ${essence(contentType)} files`;
+    if (!inputs.includes(input))
+        return `this model does not read ${LABELS[input]}`;
+    if (input === "image" && !isModelImage(contentType))
+        return "the model reads PNG, JPEG, GIF and WebP images only";
+    return undefined;
+}

package/dist/artifacts/parts.d.ts

@@ -5,7 +5,7 @@
  * The engine gets an opaque media part whose `reference` is `{ artifactId, version }`: model-gate
  * resolves it to bytes (`./files.ts`), and the transcript and the record never hold them.
  */
-import type { MessagePart } from "@nylorun/core/contracts";
+import type { MessagePart, ModelInput } from "@nylorun/core/contracts";
 import type { JsonObject, JsonValue } from "@nylorun/core/define";
 import type { Tx } from "../store/types.js";
 import { type ArtifactAccess } from "./service.js";
@@ -24,11 +24,20 @@ export interface FileReference {
     readonly version: number;
 }
 export declare function fileReferenceOf(value: JsonValue | undefined): FileReference | undefined;
+/** A file part the Tenant's model does not read (protocol 12, `attachment_unsupported`). */
+export interface RefusedPart {
+    readonly artifactId: string;
+    readonly name: string;
+    readonly mediaType: string;
+    readonly reason: string;
+}
 /**
  * The parts with each file pinned to a version: for the engine (`engine`) and for a workflow's
- * JSON input (`pinned`). Reads in the caller's transaction.
+ * JSON input (`pinned`). Reads in the caller's transaction. With `inputs`, what the Tenant's model
+ * reads, each file of a type it does not read is in `refused` (its type only: no size is checked).
  */
-export declare function resolveMessageParts(t: Tx, parts: readonly MessagePart[], sessionId: string, access: ArtifactAccess): Promise<{
+export declare function resolveMessageParts(t: Tx, parts: readonly MessagePart[], sessionId: string, access: ArtifactAccess, inputs?: readonly ModelInput[]): Promise<{
     engine: EnginePart[];
     pinned: MessagePart[];
+    refused: RefusedPart[];
 }>;

package/dist/artifacts/parts.js

@@ -1,4 +1,5 @@
 import { fail } from "../tenant/http.js";
+import { unreadableReason } from "./media-types.js";
 import { readableArtifact, versionOf } from "./service.js";
 export function fileReferenceOf(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -10,11 +11,13 @@ export function fileReferenceOf(value) {
 }
 /**
  * The parts with each file pinned to a version: for the engine (`engine`) and for a workflow's
- * JSON input (`pinned`). Reads in the caller's transaction.
+ * JSON input (`pinned`). Reads in the caller's transaction. With `inputs`, what the Tenant's model
+ * reads, each file of a type it does not read is in `refused` (its type only: no size is checked).
  */
-export async function resolveMessageParts(t, parts, sessionId, access) {
+export async function resolveMessageParts(t, parts, sessionId, access, inputs) {
     const engine = [];
     const pinned = [];
+    const refused = [];
     for (const part of parts) {
         if (part.type === "text") {
             engine.push({ type: "text", text: part.text });
@@ -27,12 +30,20 @@ export async function resolveMessageParts(t, parts, sessionId, access) {
         if (artifact.kind !== "file")
             fail(400, `Artifact ${artifact.id} is a folder; a file part names a file artifact`);
         const version = await versionOf(t, artifact, part.version);
+        const reason = inputs && unreadableReason(version.contentType, inputs);
+        if (reason)
+            refused.push({ artifactId: artifact.id, name: artifact.name, mediaType: version.contentType, reason });
         engine.push({
             type: "media",
             mediaType: version.contentType,
-            reference: { artifactId: artifact.id, version: version.version, name: artifact.name },
+            reference: {
+                artifactId: artifact.id,
+                version: version.version,
+                name: artifact.name,
+                size: version.size,
+            },
         });
         pinned.push({ type: "file", artifactId: artifact.id, version: version.version });
     }
-    return { engine, pinned };
+    return { engine, pinned, refused };
 }

package/dist/artifacts/service.d.ts

@@ -66,7 +66,8 @@ export declare function folderContent(ctx: TenantContext, id: string, version: n
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export declare function deleteArtifact(ctx: TenantContext, id: string, access: ArtifactAccess): Promise<{
     artifactId: string;

package/dist/artifacts/service.js

@@ -52,6 +52,7 @@ export function artifactView(row, versions) {
         name: row.name,
         contentType: row.contentType,
         ...(row.sessionId === null ? {} : { sessionId: row.sessionId }),
+        ...(row.environmentId === null ? {} : { environmentId: row.environmentId }),
         latestVersion: row.latestVersion,
         ...(row.labelsJson === null ? {} : { labels: JSON.parse(row.labelsJson) }),
         createdAt: row.createdAt,
@@ -194,6 +195,7 @@ export async function uploadArtifact(ctx, input, body, access, signal) {
                         : JSON.stringify(input.labels),
                     createdAt,
                     updatedAt: createdAt,
+                    environmentId: null,
                 };
                 version = {
                     artifactId,
@@ -278,11 +280,14 @@ export async function folderContent(ctx, id, version, access) {
 /**
  * Deletes the artifact and every version: its rows and, for a session's artifact, its
  * `artifact.deleted` event in one transaction, then its bytes. A folder's content-addressed
- * files go too, those no other version names, under the quota lock (`folders.ts`).
+ * files go too, those no other version names, under the quota lock (`folders.ts`). An
+ * Environment's disk artifact is refused: its own routes delete its versions.
  */
 export async function deleteArtifact(ctx, id, access) {
     const keys = await ctx.store.tx(async (t) => {
         const found = await readableArtifact(t, id, access);
+        if (found.environmentId !== null)
+            fail(409, `Artifact ${id} holds Environment ${found.environmentId}'s disk versions: delete them with DELETE /v1/environments/{id}/versions/{version}, or delete the Environment.`);
         if (found.sessionId !== null)
             await lockedSession(t, found.sessionId, access);
         if (found.kind === "folder")

package/dist/artifacts/workspace.d.ts

@@ -3,15 +3,15 @@
  * export its outputs as a folder artifact. Two calls, a listing and one file's bytes, both the
  * claim of whoever holds the workspace: the Runtime stores what it is given without observing it.
  *
- * One implementation, `sandboxWorkspaceReader`, over the workspace capability (F6.2,
+ * One implementation, `sandboxWorkspaceReader`, over the workspace feature (F6.2,
  * `harness-api/workspace.ts`): the in-process `SandboxManager`, or the harness that serves the
  * Tenant's workspaces (`workspace.read`). F6.2 reimplements it over the Harness API's `workspace.read`, and F7.2's pod
  * sandboxes are read through the same seam, so the export never knows which kind of sandbox it
  * reads.
  */
-import { type AgentManifest } from "@nylorun/core/define";
+import type { AgentManifest } from "@nylorun/core/define";
 import { type SandboxManager } from "../sandbox/manager.js";
-/** What the reader needs of a workspace: a `SandboxManager`, or the workspace capability. */
+/** What the reader needs of a workspace: a `SandboxManager`, or the workspace feature. */
 export type WorkspaceFiles = Pick<SandboxManager, "listFiles" | "readBytes">;
 /** Whose workspace to read: the session whose turn ended, resolved to the workspace it uses. */
 export interface WorkspaceSession {
@@ -22,8 +22,8 @@ export interface WorkspaceSession {
     /** The session that owns the workspace (one hop through `sandboxOwnerId`). */
     readonly ownerId: string;
     /** The sandbox resource the workspace belongs to, when the owner is attached to one. */
-    readonly sandboxId?: string;
-    /** The session's pinned manifest: its sandbox capability carries the sandbox's spec. */
+    readonly environmentId?: string;
+    /** The session's pinned manifest: its `runtime` block carries the sandbox's spec. */
     readonly manifest: AgentManifest;
 }
 /** One regular file under the listed directory. */

package/dist/artifacts/workspace.js

@@ -1,30 +1,18 @@
-/**
- * The `WorkspaceReader` seam (F8.2): how core reads a session's sandbox workspace at turn end, to
- * export its outputs as a folder artifact. Two calls, a listing and one file's bytes, both the
- * claim of whoever holds the workspace: the Runtime stores what it is given without observing it.
- *
- * One implementation, `sandboxWorkspaceReader`, over the workspace capability (F6.2,
- * `harness-api/workspace.ts`): the in-process `SandboxManager`, or the harness that serves the
- * Tenant's workspaces (`workspace.read`). F6.2 reimplements it over the Harness API's `workspace.read`, and F7.2's pod
- * sandboxes are read through the same seam, so the export never knows which kind of sandbox it
- * reads.
- */
-import { SANDBOX_CAPABILITY_ID, } from "@nylorun/core/define";
-import { sandboxCapabilityOf } from "../sandbox/manager.js";
+import { sandboxToolSpec } from "../sandbox/manager.js";
 import { SandboxFileTooLargeError } from "../sandbox/types.js";
 /** The reader over the workspaces, in each sandbox's queue of tool calls. */
 export function sandboxWorkspaceReader(sandbox) {
     const target = (session) => {
-        const capability = sandboxCapabilityOf(session.manifest, SANDBOX_CAPABILITY_ID, "read");
-        if (!capability)
+        const spec = sandboxToolSpec(session.manifest, "read");
+        if (!spec)
             return undefined;
         return {
-            capability,
+            spec,
             ref: {
                 id: session.ownerId,
                 activeTurnId: session.turnId,
                 manifest: session.manifest,
-                ...(session.sandboxId === undefined ? {} : { sandboxId: session.sandboxId }),
+                ...(session.environmentId === undefined ? {} : { environmentId: session.environmentId }),
             },
         };
     };
@@ -33,7 +21,7 @@ export function sandboxWorkspaceReader(sandbox) {
             const found = target(session);
             if (!found)
                 return undefined;
-            const listed = await sandbox.listFiles(found.ref, found.capability, dir, options.maxEntries, options.signal);
+            const listed = await sandbox.listFiles(found.ref, found.spec, dir, options.maxEntries, options.signal);
             if (listed.kind === "missing")
                 return undefined;
             if (listed.kind === "failed")
@@ -44,7 +32,7 @@ export function sandboxWorkspaceReader(sandbox) {
             const found = target(session);
             if (!found)
                 return undefined;
-            const read = await sandbox.readBytes(found.ref, found.capability, path, options.maxBytes, options.signal);
+            const read = await sandbox.readBytes(found.ref, found.spec, path, options.maxBytes, options.signal);
             if (read.kind === "read")
                 return read.bytes;
             if (read.kind === "missing")

package/dist/core/flow-host.d.ts

@@ -2,6 +2,7 @@ import type { EffectOutcome } from "@nylorun/core/contracts";
 import { type JsonValue, type WorkflowManifest } from "@nylorun/core/define";
 import type { HostEffect } from "@nylorun/harness/run";
 import type { EffectDoc, Tx } from "../store/types.js";
+import { type TurnTiming } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export declare function deriveSessionId(workflowSessionId: string, path: string, ...parts: string[]): string;
 /**
@@ -15,7 +16,7 @@ export declare function deriveAgentEffectSessionId(workflowSessionId: string, pa
     readonly context?: Record<string, unknown>;
 }): string;
 export declare function isWorkflowManifest(manifest: unknown): manifest is WorkflowManifest;
-/** Flow tool-node effect: `tool` with path/key and no agent capabilityId. */
+/** Flow tool-node effect: `tool` with path/key and no tool name (an agent's tool call names one). */
 export declare function isFlowToolEffect(request: HostEffect): boolean;
 export declare function isFlowEffect(request: HostEffect): boolean;
 /**
@@ -59,15 +60,13 @@ export type FlowHostSession = {
     status: string;
     activeTurnId: string | null;
     info?: any;
-    vaultIds?: readonly string[];
-    credentialSelections?: readonly unknown[];
     creation?: unknown;
     waits?: unknown;
     lastOutput?: JsonValue;
     /** The turn `status`, `lastOutput` and `error` describe, once it ended. */
     lastTurnId?: string;
     error?: string;
-};
+} & TurnTiming;
 /** How a linked agent turn ended. */
 export type LinkedTurnEnd = {
     readonly turnId: string;

package/dist/core/flow-host.js

@@ -50,6 +50,7 @@
  */
 import { createHash } from "node:crypto";
 import { isVerdict } from "@nylorun/core/define";
+import { resumeTurn } from "../tenant/turn-timing.js";
 /** Deterministic agent session id: derive(workflowSessionId, path, …parts). */
 export function deriveSessionId(workflowSessionId, path, ...parts) {
     const digest = createHash("sha256")
@@ -79,14 +80,14 @@ export function isWorkflowManifest(manifest) {
         typeof manifest === "object" &&
         manifest.kind === "workflow");
 }
-/** Flow tool-node effect: `tool` with path/key and no agent capabilityId. */
+/** Flow tool-node effect: `tool` with path/key and no tool name (an agent's tool call names one). */
 export function isFlowToolEffect(request) {
     return (request.kind === "tool" &&
         typeof request.path === "string" &&
         request.path.length > 0 &&
         typeof request.key === "string" &&
         request.key.length > 0 &&
-        request.capabilityId === undefined);
+        request.toolName === undefined);
 }
 export function isFlowEffect(request) {
     return request.kind === "agent" || isFlowToolEffect(request);
@@ -237,6 +238,8 @@ export async function wakeLinkedWorkflow(input) {
             }
             : { value: input.output ?? null };
     await settleAgentEffect({ t, effect, outcome });
+    // A workflow paused on its agents' interactions goes on (R7.1, `tenant/turn-timing.ts`).
+    resumeTurn(workflow);
     workflow.status = "runnable";
     await t.put("sessions", workflow.id, workflow);
     await t.wake(workflow.id, {

package/dist/core/provider.d.ts

@@ -9,7 +9,8 @@ export declare function gatewayModel(options: {
     model: string;
 }): ModelProvider;
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export declare function toolFixtureModel(): ModelProvider;

package/dist/core/provider.js

@@ -1,3 +1,4 @@
+import { fixtureAnswer } from "../gates/fixture-model.js";
 export function scriptedModel(output = "Scripted development response") {
     return async () => ({ output: [{ type: "text", text: output }] });
 }
@@ -23,43 +24,10 @@ export function gatewayModel(options) {
     };
 }
 /**
- * Deterministic release fixture; still uses the real engine. With a `lookup_order` tool it looks
- * up the demo order through it once; without one it answers in text.
+ * The fixture model as a provider (`model: {kind: "fixture"}` in the Runtime's config). The Tenant
+ * setting `model.fixture` is answered by the Model Gate instead (R4.3); both answer the same way
+ * (`gates/fixture-model.ts`).
  */
 export function toolFixtureModel() {
-    return async (effect) => {
-        const call = effect.input;
-        const last = call.prompt.at(-1);
-        if (last?.kind === "tool-result")
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `Order lookup complete: ${last.content.map((part) => (part.type === "text" ? part.text : JSON.stringify(part))).join(" ")}`,
-                    },
-                ],
-            };
-        const users = call.prompt.filter((p) => p.kind === "message" && p.role === "user");
-        if (users.length > 1)
-            return {
-                output: [
-                    {
-                        type: "text",
-                        text: `I remember: ${users[0].content.map((part) => (part.type === "text" ? part.text : "")).join(" ")}`,
-                    },
-                ],
-            };
-        if (!call.tools.some((tool) => tool.name === "lookup_order"))
-            return { output: [{ type: "text", text: "Hello from the fixture model." }] };
-        return {
-            output: [
-                {
-                    type: "tool-call",
-                    id: "fixture_lookup",
-                    name: "lookup_order",
-                    args: { orderId: "demo-123" },
-                },
-            ],
-        };
-    };
+    return async (effect, signal) => fixtureAnswer(effect.input, signal);
 }

package/dist/core/sandbox-routes.d.ts

@@ -9,32 +9,13 @@ export type SandboxRouteSession = SessionSandboxRef & {
     readonly activeTurnId: string | null;
     readonly status: string;
 };
-/** A session together with a synchronous lookup over its sandbox owner chain. */
-export type SandboxRouteRead = {
-    readonly session: SandboxRouteSession;
-    readonly lookup: (id: string) => SessionSandboxRef | undefined;
-};
 export type SandboxRouteDeps = {
     readonly sandbox: Pick<WorkspacePort, "run">;
-    /** The session (rejects when missing) and its owner chain, read in one transaction. */
-    readonly session: (id: string) => Promise<SandboxRouteRead>;
+    /** The session; rejects when it is missing. */
+    readonly session: (id: string) => Promise<SandboxRouteSession>;
 };
 /**
  * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
  * Refused while the session has an active agent turn.
  */
 export declare function handleSessionSandboxTool(deps: SandboxRouteDeps, sessionId: string, toolName: string, body: unknown, signal: AbortSignal): Promise<SandboxToolOutcome>;
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export declare function validateSandboxAttach(body: {
-    ownerUserId: string;
-    sandbox?: unknown;
-}, newManifest: SessionSandboxRef["manifest"], lookup: (id: string) => SessionSandboxRef | undefined, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options?: {
-    opaque?: boolean;
-    inherit?: boolean;
-}): string | undefined;

package/dist/core/sandbox-routes.js

@@ -1,9 +1,9 @@
 /**
- * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`)
- * and the sandbox attach check of `PUT /v1/sessions/:id`.
+ * HTTP handlers for the session-scoped sandbox tool route (`POST /v1/sessions/:id/sandbox/:tool`):
+ * a tool run in the sandbox of the session's Environment.
  */
 import { isSandboxToolName, } from "@nylorun/core/define";
-import { capabilityForSandbox, owningSandboxSessionId, sandboxSpecOf, sandboxWorkspaceOf, sandboxSpecsEqual, sessionSandboxSpec, } from "../sandbox/share.js";
+import { sandboxWorkspaceOf, sessionSandboxSpec, } from "../sandbox/share.js";
 export class SandboxRouteError extends Error {
     status;
     constructor(status, message) {
@@ -12,10 +12,8 @@ export class SandboxRouteError extends Error {
         this.name = "SandboxRouteError";
     }
 }
-function resolveSpec(session, lookup) {
-    const ownerId = owningSandboxSessionId(session, lookup);
-    const owner = ownerId === session.id ? session : lookup(ownerId) ?? session;
-    const spec = sessionSandboxSpec(owner) ?? sessionSandboxSpec(session);
+function resolveSpec(session) {
+    const spec = sessionSandboxSpec(session);
     if (!spec)
         throw new SandboxRouteError(404, "Session has no sandbox");
     return spec;
@@ -34,16 +32,16 @@ function toolInput(body) {
     const { requestId: _r, ...input } = record;
     return input;
 }
-async function runTool(deps, { session, lookup }, tool, input, signal) {
-    const spec = resolveSpec(session, lookup);
-    const workspace = sandboxWorkspaceOf(session, lookup);
+async function runTool(deps, session, tool, input, signal) {
+    const spec = resolveSpec(session);
+    const workspace = sandboxWorkspaceOf(session);
     const ref = {
         id: workspace.ownerId,
         activeTurnId: session.activeTurnId,
         manifest: session.manifest,
-        ...(workspace.sandboxId === undefined ? {} : { sandboxId: workspace.sandboxId }),
+        ...(workspace.environmentId === undefined ? {} : { environmentId: workspace.environmentId }),
     };
-    return deps.sandbox.run(ref, capabilityForSandbox(spec), tool, input, signal);
+    return deps.sandbox.run(ref, spec, tool, input, signal);
 }
 /**
  * `POST /v1/sessions/:id/sandbox/:tool` — application principal.
@@ -51,39 +49,8 @@ async function runTool(deps, { session, lookup }, tool, input, signal) {
  */
 export async function handleSessionSandboxTool(deps, sessionId, toolName, body, signal) {
     const read = await deps.session(sessionId);
-    if (read.session.activeTurnId)
+    if (read.activeTurnId)
         throw new SandboxRouteError(409, "Sandbox is unavailable while the session has an active agent turn");
     const tool = parseTool(toolName);
     return runTool(deps, read, tool, toolInput(body), signal);
 }
-/**
- * Validate PutSession.sandbox attach: same owner, and a sandbox to share. A session whose
- * definition declares a sandbox must declare the owner's spec; one whose definition declares
- * none inherits it (`inherit`).
- */
-export function validateSandboxAttach(body, newManifest, lookup, 
-/** Acting for a subject: another owner's session is the 404 of a missing one. */
-options = {}) {
-    const request = body.sandbox;
-    const share = typeof request === "object" && request !== null && "session" in request
-        ? String(request.session)
-        : undefined;
-    if (!share)
-        return undefined;
-    const owner = lookup(share);
-    if (!owner || (options.opaque && owner.ownerUserId !== body.ownerUserId))
-        throw new SandboxRouteError(404, "Sandbox session not found");
-    if (owner.ownerUserId !== body.ownerUserId)
-        throw new SandboxRouteError(403, "Sandbox session must belong to the same owner");
-    const ownerSpec = sessionSandboxSpec(owner);
-    if (!ownerSpec)
-        throw new SandboxRouteError(400, "Target session has no sandbox to share");
-    if (options.inherit)
-        return owningSandboxSessionId(owner, lookup);
-    const newSpec = sandboxSpecOf(newManifest);
-    if (!newSpec)
-        throw new SandboxRouteError(400, "Session must declare a sandbox identical to the shared session");
-    if (!sandboxSpecsEqual(ownerSpec, newSpec))
-        throw new SandboxRouteError(409, "Sandbox specs must be identical to share a sandbox");
-    return owningSandboxSessionId(owner, lookup);
-}