@nylorun/runtime 0.27.0-beta → 0.29.0-beta

package/dist/tenant/context.js

@@ -1,5 +1,9 @@
-import { DEFAULT_HARNESS } from "@nylorun/core/contracts";
+import { DEFAULT_HARNESS, agentGranted } from "@nylorun/core/contracts";
 import { fail } from "./http.js";
+/** Whether `access` reaches sessions on Agent `agentId`. */
+export function reachesAgent(access, agentId) {
+    return access?.agents === undefined || agentGranted(access.agents, agentId);
+}
 /**
  * `access`, when set, limits the request to the owner's sessions of the allowed agents:
  * anything else is the same 404 as a missing session, so a subject cannot learn which session
@@ -9,7 +13,7 @@ function owned(session, access) {
     if (!session ||
         (access !== undefined &&
             (session.ownerUserId !== access.owner ||
-                (access.agents !== undefined && !access.agents.has(session.agentId)))))
+                !reachesAgent(access, session.agentId))))
         return fail(404, "Session not found");
     return session;
 }

package/dist/tenant/effects.js

@@ -161,23 +161,22 @@ export async function resolveNewFlowEffect(ctx, request, signal, lease) {
         if (exists)
             return;
         const definition = leafDefinition(workflow, body, request);
-        // The tree's Environment reaches every agent in it: its sandbox and its vault.
+        // The flow's Agent (Q6) reaches every agent in the tree: its sandbox and its vault. Each leaf
+        // session runs on it, with the flow's manifest version, and its leaf agent's loop manifest.
         const sandbox = workflow.sandbox;
         const created = {
             id: agentSessionId,
-            agentId: body.agentId,
+            agentId: workflow.agentId,
             ownerUserId: workflow.ownerUserId,
             manifest: definition.manifest,
             manifestHash: definition.manifestHash,
-            definitionHash: definition.manifestHash,
-            implementationVersion: definition.implementationVersion,
+            ...(workflow.definition === undefined ? {} : { definition: workflow.definition }),
             status: "idle",
             activeTurnId: null,
             creation: {
                 requestId: `flow-put-${request.effectId}`,
-                agentId: body.agentId,
+                agent: workflow.agentId,
                 ownerUserId: workflow.ownerUserId,
-                ...(workflow.environmentId === undefined ? {} : { environment: workflow.environmentId }),
             },
             flowRootId: workflow.flowRootId ?? workflow.id,
             ...(workflow.environmentId === undefined
@@ -262,11 +261,7 @@ function leafDefinition(workflow, body, request) {
         const flow = flowDelegateManifest(turnManifestOf(workflow), body.agentId);
         if (!flow)
             return fail(404, `Agent '${body.agentId}' is not a flow agent used as a tool`);
-        return {
-            manifest: flow,
-            manifestHash: hashManifest(flow),
-            implementationVersion: workflow.implementationVersion,
-        };
+        return { manifest: flow, manifestHash: hashManifest(flow) };
     }
     const leaf = isWorkflowManifest(workflow.manifest)
         ? embeddedAgent(workflow.manifest, body.flow ?? [], body.agentId)
@@ -274,9 +269,5 @@ function leafDefinition(workflow, body, request) {
     if (!leaf || isWorkflowManifest(leaf))
         return fail(404, `Agent '${body.agentId}' is not embedded in workflow '${workflow.manifest.id}'`);
     const manifest = leaf;
-    return {
-        manifest,
-        manifestHash: hashManifest(manifest),
-        implementationVersion: workflow.implementationVersion,
-    };
+    return { manifest, manifestHash: hashManifest(manifest) };
 }

package/dist/tenant/identity-file.d.ts

@@ -15,9 +15,8 @@
  *     # Optional, with their defaults:
  *     subject: "{sub}"                           # scalar claims only
  *     scopes: { claim: scope }                   # or { fixed: [sessions:own, agents:read] }
- *     allowedScopes: [agents:read, sessions:own, environments:write]   # add studio to grant it
- *     agents: [support]                          # absent reaches every agent
- *     environments: ["{org_id}/*"]               # absent reaches no Environment
+ *     allowedScopes: [agents:read, sessions:own, agents:write]   # add studio to grant it
+ *     agents: ["{org_id}/*", support]            # Agent grants; absent reaches no Agent
  *     jwksFetch:                                 # how the JWKS is fetched and cached
  *       timeoutMs: 5000                          # one fetch
  *       maxBytes: 262144                         # the largest JWKS read
@@ -74,10 +73,11 @@ export interface TrustedIssuerConfig {
     };
     /** The scopes its tokens may carry; others are dropped. */
     readonly allowedScopes: readonly IssuerScope[];
-    /** The agents its tokens reach; absent reaches all. */
+    /**
+     * Agent grant templates (protocol 16; `agents` and `environments` before), such as `{org_id}/*`,
+     * `support` or `*`: what its tokens reach. Absent reaches no Agent.
+     */
     readonly agents?: readonly string[];
-    /** Environment grant templates, such as `{org_id}/*`; absent reaches no Environment. */
-    readonly environments?: readonly string[];
     /** How its JWKS is fetched; each setting left out is its default (`JWKS_FETCH_DEFAULTS`). */
     readonly jwksFetch?: Partial<JwksFetchSettings>;
 }

package/dist/tenant/identity-file.js

@@ -15,9 +15,8 @@
  *     # Optional, with their defaults:
  *     subject: "{sub}"                           # scalar claims only
  *     scopes: { claim: scope }                   # or { fixed: [sessions:own, agents:read] }
- *     allowedScopes: [agents:read, sessions:own, environments:write]   # add studio to grant it
- *     agents: [support]                          # absent reaches every agent
- *     environments: ["{org_id}/*"]               # absent reaches no Environment
+ *     allowedScopes: [agents:read, sessions:own, agents:write]   # add studio to grant it
+ *     agents: ["{org_id}/*", support]            # Agent grants; absent reaches no Agent
  *     jwksFetch:                                 # how the JWKS is fetched and cached
  *       timeoutMs: 5000                          # one fetch
  *       maxBytes: 262144                         # the largest JWKS read
@@ -29,7 +28,7 @@
 import { createPublicKey } from "node:crypto";
 import { parse as parseYaml } from "yaml";
 import { z } from "zod";
-import { ISSUER_SCOPES, isEnvironmentGrant, TIMER_MAX_MS, TOKEN_SCOPES, } from "@nylorun/core/contracts";
+import { ISSUER_SCOPES, isAgentGrant, TIMER_MAX_MS, TOKEN_SCOPES, } from "@nylorun/core/contracts";
 /** The JWT algorithms an issuer may sign with. */
 export const ISSUER_ALGORITHMS = ["RS256", "ES256", "EdDSA"];
 /** An entry's defaults: the `sub` claim, the RFC 9068 `scope` claim, every token scope but `studio`. */
@@ -135,11 +134,10 @@ const IssuerEntrySchema = z
     ], { error: "must be { claim: <name> } or { fixed: [<scope>, ...] }" })
         .default(DEFAULT_SCOPES),
     allowedScopes: z.array(IssuerScopeSchema).min(1).default([...DEFAULT_ALLOWED_SCOPES]),
-    agents: z.array(z.string().min(1)).optional(),
-    environments: z
-        .array(template("an Environment grant").refine(
+    agents: z
+        .array(template("an Agent grant").refine(
     // A rendered grant must be a grant: checked here with a sample value per claim.
-    (value) => isEnvironmentGrant(renderTemplate(value, () => "x")), "must render to an Environment id or a prefix ending in /*, as {org_id}/*"))
+    (value) => isAgentGrant(renderTemplate(value, () => "x")), "must render to *, an Agent id or a prefix ending in /*, as {org_id}/*"))
         .optional(),
     jwksFetch: z
         .object({
@@ -208,7 +206,12 @@ export function parseIdentityFile(text, source = "identity file", options = {})
             entry?.scopes,
         ]);
         if (scopesNamed.includes('"sandboxes:write"'))
-            return fail(`${where}: sandboxes:write: renamed environments:write in protocol 11`);
+            return fail(`${where}: sandboxes:write: renamed agents:write (environments:write in protocol 11)`);
+        // Protocol 16 renamed these: refused, never read as no grants.
+        if (entry && typeof entry === "object" && "environments" in entry)
+            return fail(`${where}: environments: Environments are Agents in protocol 16: move the grants to agents`);
+        if (scopesNamed.includes('"environments:write"'))
+            return fail(`${where}: environments:write: renamed agents:write in protocol 16`);
         const parsed = IssuerEntrySchema.safeParse(entry);
         if (!parsed.success)
             return fail(`${where}: ${issueText(parsed.error.issues)}`);
@@ -244,7 +247,6 @@ export function parseIdentityFile(text, source = "identity file", options = {})
             scopes: value.scopes,
             allowedScopes: [...new Set(value.allowedScopes)],
             ...(value.agents ? { agents: [...new Set(value.agents)] } : {}),
-            ...(value.environments ? { environments: value.environments } : {}),
         });
     });
     return issuers;

package/dist/tenant/issuers.js

@@ -299,7 +299,7 @@ export async function verifyIssuerToken(ctx, issuer, raw, resourceMetadata) {
     const subject = renderTemplate(config.subject, (claim) => scalarClaim(payload, claim));
     if (subject === undefined || !isSubject(subject) || RESERVED.has(subject))
         return rejected("issuer_token_subject");
-    const environments = config.environments?.flatMap((grant) => {
+    const agents = (config.agents ?? []).flatMap((grant) => {
         const rendered = renderTemplate(grant, (claim) => {
             const value = scalarClaim(payload, claim);
             return value !== undefined && GRANT_SEGMENT.test(value) ? value : undefined;
@@ -316,8 +316,8 @@ export async function verifyIssuerToken(ctx, issuer, raw, resourceMetadata) {
         issuer: config.name,
         subject,
         scopes: scopesOf(config, payload),
-        agents: config.agents ? new Set(config.agents) : "*",
-        environments: [...new Set(environments ?? [])],
+        // `*` reaches every Agent; no grant reaches none.
+        agents: agents.includes("*") ? "*" : [...new Set(agents)],
         expiresAt: payload.exp * 1000,
         tokenId: jti,
         ...(verdict.kid !== undefined ? { keyId: verdict.kid } : {}),

package/dist/tenant/limits.d.ts

@@ -78,9 +78,6 @@ export declare function budgetIssues(budgets: readonly unknown[], limits: Runtim
  * Why an agent's `requires` does not fit: more secrets than an Environment's manifest may declare
  * slots for (the Runtime limit `environmentSecretSlots`).
  */
-export declare function requiresIssues(requires: {
-    readonly secrets?: readonly string[];
-} | undefined, limits: RuntimeLimits): string[];
 /**
  * Why a manifest (inline, or saved) does not fit the Tenant's Runtime limits: its description,
  * its setup commands, their lengths and timeouts, its input file entries and the files of each,

package/dist/tenant/limits.js

@@ -137,9 +137,6 @@ export function budgetIssues(budgets, limits) {
  * Why an agent's `requires` does not fit: more secrets than an Environment's manifest may declare
  * slots for (the Runtime limit `environmentSecretSlots`).
  */
-export function requiresIssues(requires, limits) {
-    return more("requires.secrets", requires?.secrets?.length ?? 0, "environmentSecretSlots", limits);
-}
 /**
  * Why a manifest (inline, or saved) does not fit the Tenant's Runtime limits: its description,
  * its setup commands, their lengths and timeouts, its input file entries and the files of each,

package/dist/tenant/memories.d.ts

@@ -0,0 +1,38 @@
+/**
+ * An Agent's memories over the Runtime API (track T5, D72), shaped like Anthropic's memory stores:
+ * list and read them, write one whole (create or replace, with an optional `content_sha256`
+ * precondition), delete one or a folder, and read the versions every change leaves. Writes go
+ * through the memory service (`memory/service.ts`), as a model's do, so the same paths, limits
+ * and versions hold; the actor is the caller (`human:<subject>`, else `application`).
+ */
+import { type Memory, type MemoryList, type MemoryVersionDetail, type MemoryVersionPage, type PutMemoryRequest } from "@nylorun/core/contracts";
+import type { AuthScope, TenantContext } from "./context.js";
+/** Who an API write names: the person a request acts for, else the application. */
+export declare function memoryActorOf(scope: AuthScope): string;
+/** `GET /v1/agents/{id}/memories`: the Agent's memories by path, under `pathPrefix` when given. */
+export declare function listMemories(ctx: TenantContext, agentId: string, options: {
+    pathPrefix?: string;
+    cursor?: string;
+    limit: number;
+}): Promise<MemoryList>;
+/** `GET /v1/agents/{id}/memories/{path}`: one memory with its content. */
+export declare function readMemory(ctx: TenantContext, agentId: string, rawPath: string): Promise<Memory>;
+/**
+ * `PUT /v1/agents/{id}/memories/{path}`: writes the memory whole, as the tool's `create` does. With
+ * `contentSha256` the write applies only while the memory still has that content (`""`: only while
+ * no memory has the path); otherwise `409 memory_conflict` with the current memory.
+ */
+export declare function putMemoryContent(ctx: TenantContext, agentId: string, rawPath: string, body: PutMemoryRequest, scope: AuthScope): Promise<Memory>;
+/** `DELETE /v1/agents/{id}/memories/{path}`: deletes a memory, or every memory in a folder. */
+export declare function deleteMemoryPath(ctx: TenantContext, agentId: string, rawPath: string, scope: AuthScope): Promise<{
+    path: string;
+    deleted: number;
+}>;
+/** `GET /v1/agents/{id}/memory_versions`: versions, newest first; `path` keeps one path's. */
+export declare function listMemoryVersions(ctx: TenantContext, agentId: string, options: {
+    path?: string;
+    cursor?: string;
+    limit: number;
+}): Promise<MemoryVersionPage>;
+/** `GET /v1/agents/{id}/memory_versions/{versionId}`: one version with the content it left. */
+export declare function readMemoryVersion(ctx: TenantContext, agentId: string, versionId: string): Promise<MemoryVersionDetail>;

package/dist/tenant/memories.js

@@ -0,0 +1,119 @@
+/**
+ * An Agent's memories over the Runtime API (track T5, D72), shaped like Anthropic's memory stores:
+ * list and read them, write one whole (create or replace, with an optional `content_sha256`
+ * precondition), delete one or a folder, and read the versions every change leaves. Writes go
+ * through the memory service (`memory/service.ts`), as a model's do, so the same paths, limits
+ * and versions hold; the actor is the caller (`human:<subject>`, else `application`).
+ */
+import { memoryPathOf, } from "@nylorun/core/contracts";
+import { applyMemoryCommand, memorySummaryOf, memoryVersionDetailOf, memoryVersionOf, } from "../memory/service.js";
+import { liveEnvironment } from "./agents.js";
+import { fail } from "./http.js";
+import { readRuntimeLimits } from "./runtime-limits.js";
+/** Who an API write names: the person a request acts for, else the application. */
+export function memoryActorOf(scope) {
+    return scope.kind === "token" || scope.kind === "subject" ? `human:${scope.subject}` : "application";
+}
+async function agentOf(t, agentId) {
+    if (!(await liveEnvironment(t, agentId)))
+        fail(404, `Agent ${agentId} not found`, { code: "not_found" });
+}
+/** A path from a route: relative to `/memories` (as the route's segment), or absolute. */
+function routePath(raw, kind) {
+    const trimmed = raw.replace(/^\/+/, "");
+    const parsed = memoryPathOf(trimmed.startsWith("memories/") || trimmed === "memories" ? trimmed : `memories/${trimmed}`, kind);
+    return "error" in parsed ? fail(400, parsed.error, { code: "invalid_request" }) : parsed.path;
+}
+/** The HTTP answer to a refused write. */
+function refusal(result) {
+    switch (result.code) {
+        case "memory.not_found":
+            return fail(404, result.text, { code: "not_found" });
+        case "memory.limit":
+            return fail(409, result.text, { code: "limit_exceeded", details: { limit: "memoriesPerAgent" } });
+        case "memory.too_large":
+            return fail(413, result.text, { code: "limit_exceeded", details: { limit: "memoryBytes" } });
+        case "memory.exists":
+            return fail(409, result.text, { code: "memory_conflict" });
+        default:
+            return fail(400, result.text, { code: "invalid_request" });
+    }
+}
+/** `GET /v1/agents/{id}/memories`: the Agent's memories by path, under `pathPrefix` when given. */
+export async function listMemories(ctx, agentId, options) {
+    const folder = options.pathPrefix === undefined ? undefined : routePath(options.pathPrefix, "any");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const rows = await t.memories(agentId, {
+            ...(folder === undefined ? {} : { folder }),
+            ...(options.cursor === undefined ? {} : { after: options.cursor }),
+            limit: options.limit + 1,
+        });
+        const page = rows.slice(0, options.limit);
+        return { memories: page.map(memorySummaryOf), nextCursor: rows.length > options.limit ? page.at(-1).path : null };
+    });
+}
+/** `GET /v1/agents/{id}/memories/{path}`: one memory with its content. */
+export async function readMemory(ctx, agentId, rawPath) {
+    const path = routePath(rawPath, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const row = (await t.memory(agentId, path)) ?? fail(404, `The path ${path} does not exist`, { code: "not_found" });
+        return { ...memorySummaryOf(row), content: row.content };
+    });
+}
+/**
+ * `PUT /v1/agents/{id}/memories/{path}`: writes the memory whole, as the tool's `create` does. With
+ * `contentSha256` the write applies only while the memory still has that content (`""`: only while
+ * no memory has the path); otherwise `409 memory_conflict` with the current memory.
+ */
+export async function putMemoryContent(ctx, agentId, rawPath, body, scope) {
+    const path = routePath(rawPath, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const current = await t.memory(agentId, path, { lock: true });
+        if (body.contentSha256 !== undefined && body.contentSha256 !== (current?.contentSha256 ?? ""))
+            fail(409, `${path} has changed since that content_sha256: read it again and write on top of what it holds now.`, {
+                code: "memory_conflict",
+                details: { current: current ? { ...memorySummaryOf(current), content: current.content } : null },
+            });
+        const result = await applyMemoryCommand(t, agentId, { command: "create", path, fileText: body.content }, { actor: memoryActorOf(scope) }, await readRuntimeLimits(t));
+        if (!result.ok)
+            refusal(result);
+        const row = (await t.memory(agentId, path));
+        return { ...memorySummaryOf(row), content: row.content };
+    });
+}
+/** `DELETE /v1/agents/{id}/memories/{path}`: deletes a memory, or every memory in a folder. */
+export async function deleteMemoryPath(ctx, agentId, rawPath, scope) {
+    const path = routePath(rawPath, "any");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const result = await applyMemoryCommand(t, agentId, { command: "delete", path }, { actor: memoryActorOf(scope) }, await readRuntimeLimits(t));
+        if (!result.ok)
+            refusal(result);
+        return { path, deleted: result.changes.length };
+    });
+}
+/** `GET /v1/agents/{id}/memory_versions`: versions, newest first; `path` keeps one path's. */
+export async function listMemoryVersions(ctx, agentId, options) {
+    const path = options.path === undefined ? undefined : routePath(options.path, "file");
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const rows = await t.memoryVersions(agentId, {
+            ...(path === undefined ? {} : { path }),
+            ...(options.cursor === undefined ? {} : { before: options.cursor }),
+            limit: options.limit + 1,
+        });
+        const page = rows.slice(0, options.limit);
+        return { versions: page.map(memoryVersionOf), nextCursor: rows.length > options.limit ? page.at(-1).id : null };
+    });
+}
+/** `GET /v1/agents/{id}/memory_versions/{versionId}`: one version with the content it left. */
+export async function readMemoryVersion(ctx, agentId, versionId) {
+    return ctx.store.tx(async (t) => {
+        await agentOf(t, agentId);
+        const row = (await t.memoryVersion(agentId, versionId)) ?? fail(404, `Memory version ${versionId} not found`, { code: "not_found" });
+        return memoryVersionDetailOf(row);
+    });
+}

package/dist/tenant/reset.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { join } from "node:path";
-import { detachAllSessions } from "./environments.js";
+import { detachAllSessions } from "./agents.js";
 import { contentKey } from "../artifacts/folders.js";
 /**
  * Rename `dir` to a sibling, delete the sibling, recreate an empty `dir`.
@@ -38,7 +38,7 @@ function replaceDirectory(dir) {
  */
 export async function resetTenant(ctx, scope) {
     const clearSessions = scope === "sessions" || scope === "all";
-    const clearSandboxes = scope === "environments" || scope === "all";
+    const clearSandboxes = scope === "agents" || scope === "all";
     const clearAll = scope === "all";
     if (clearSandboxes) {
         await ctx.sandbox.removeAll();

package/dist/tenant/run-grants.d.ts

@@ -23,6 +23,12 @@ export interface RunGrants extends RunTokens {
 }
 export declare function createRunGrants(): RunGrants;
 type GrantContext = Pick<TenantContext, "keys" | "config" | "runGrants">;
+/** The root agent a session's run token names: its loop manifest's id (the agent manifest's name). */
+export declare function rootAgentOf(session: {
+    readonly manifest: {
+        readonly id: string;
+    };
+}): string;
 /** What a run token names of the session: its root agent and the turn the advance runs. */
 export interface RunOf {
     readonly agentId: string;

package/dist/tenant/run-grants.js

@@ -18,6 +18,10 @@ export function createRunGrants() {
         },
     };
 }
+/** The root agent a session's run token names: its loop manifest's id (the agent manifest's name). */
+export function rootAgentOf(session) {
+    return session.manifest.id;
+}
 /**
  * Mints and registers the run token of the advance that just took `lease`. Nothing when the
  * gates run in this process, or the session has no active turn (it makes no gate call).

package/dist/tenant/runtime.d.ts

@@ -81,7 +81,7 @@ export type TenantOpenHooks = {
     harnessTap?: MemoryPortsOptions["tap"];
     /**
      * Sandbox pods (F7.2): the sandboxes service (`NYLORUN_SANDBOXES_URL`) and the Runtime image
-     * pods copy the engine from. Without it, kind `pod` is `environment_unavailable`.
+     * pods copy the engine from. Without it, kind `pod` is `agent_unavailable`.
      */
     pods?: TenantPods;
     /** How the trace route makes spans (R7.5): the Host's `OTEL_*` resource and content opt-ins. */

package/dist/tenant/runtime.js

@@ -32,6 +32,7 @@ import { localWorkspace, remoteWorkspace, withPodWorkspaces, } from "../harness-
 import { hostAuthority } from "../sandbox/join.js";
 import { harnessOfToken } from "./harness-tokens.js";
 import { reconcileSandbox } from "../sandbox/pods/reconcile.js";
+import { fireTimer } from "./triggers.js";
 import { hostTuning } from "../tuning.js";
 function validateConfig(config) {
     for (const key of ["leaseMs", "ownerLeaseMs", "sweepIntervalMs"]) {
@@ -266,6 +267,12 @@ export class TenantRuntime {
                     await execution.sandbox?.(config.tenantId, sandboxId, signal);
                     return true;
                 },
+                timer: async (key, at) => {
+                    if (ctx.closing || ctx.closed)
+                        return false;
+                    await execution.timer(config.tenantId, key, at);
+                    return true;
+                },
                 send: (request) => request.kind === "wake"
                     ? ctx.wake(request.sessionId, request.wake)
                     : ctx.sandboxSignal(request.sandboxId, request.signal),
@@ -322,6 +329,7 @@ export class TenantRuntime {
                 advance: (sessionId, signal) => advance(ctx, sessionId, signal),
                 sweep: () => sweep(ctx),
                 sandbox: (sandboxId, trigger) => reconcileSandbox(ctx, sandboxId, trigger),
+                fire: (key) => fireTimer(ctx, key),
             };
             const unregister = workers.register(config.tenantId, worker);
             detach = async () => {

package/dist/tenant/sessions.d.ts

@@ -1,42 +1,16 @@
 /**
- * Session and definition resources: `PUT/GET /v1/agents`, `PUT /v1/sessions/:id` (create, or
- * find an identical one), the session list and the session view. Reads use the store's typed
- * queries; `PUT /v1/sessions/:id` runs in one transaction with the Environment's checks.
+ * Session resources: `PUT /v1/sessions/:id` (create, or find an identical one), the session list
+ * and the session view. A session runs on one Agent (protocol 16) and pins the manifest version
+ * the Agent runs when it opens; each turn takes the version the Agent runs then
+ * (`agent-versions.ts`). Reads use the store's typed queries; `PUT /v1/sessions/:id` runs in
+ * one transaction with the Agent's checks.
  */
-import { type PutAgentRequest, type PutSessionRequest } from "@nylorun/core/contracts";
+import { type PutSessionRequest } from "@nylorun/core/contracts";
 import type { Tx } from "../store/types.js";
 import { type Session, type SessionAccess, type TenantContext } from "./context.js";
-export declare function listDefinitions(ctx: TenantContext): Promise<{
-    agents: {
-        agentId: any;
-        manifest: any;
-        manifestHash: string;
-        implementationVersion: string;
-    }[];
-}>;
-/**
- * The agents a token caller may see: id, name and description only, never
- * instructions, tools or MCP servers, and only the agents allowed.
- */
-export declare function listAgentsPublic(ctx: TenantContext, agents: ReadonlySet<string> | "*"): Promise<{
-    agents: {
-        agentId: string;
-        name?: any;
-        description?: any;
-    }[];
-}>;
-export declare function putDefinition(ctx: TenantContext, agentId: string, body: PutAgentRequest, options?: {
-    /** Run every check and save nothing (`?dryRun=true`, protocol 14). */
-    dryRun?: boolean;
-}): Promise<{
-    agentId: string;
-    manifestHash: string;
-    implementationVersion: string;
-    dryRun?: boolean | undefined;
-}>;
 /**
- * `access`, when the request acts for a person, limits the list to that person's sessions of
- * the agents they may use.
+ * `access`, when the request acts for a person, limits the list to that person's sessions on
+ * the Agents they may use.
  */
 export declare function listSessions(ctx: TenantContext, agentId: string | null, access?: SessionAccess): Promise<{
     sessions: {
@@ -48,26 +22,35 @@ export declare function listSessions(ctx: TenantContext, agentId: string | null,
     }[];
 }>;
 /**
- * Create a session from its definition, or find an identical one. `access`, when the request
- * acts for a subject, must be the session's owner: another owner's session id is the 404 of a
- * missing one (not the 409 of a mismatch), and so is an Environment whose owner guard names
- * another owner.
+ * Create a session on an Agent, or find an identical one. `access`, when the request acts for a
+ * subject, must be the session's owner: another owner's session id is the 404 of a missing one
+ * (not the 409 of a mismatch), and so is an Agent whose owner guard names another owner.
  *
- * The session's Environment is fixed for its life: its sandbox (kinds `virtual` and `pod`) is
- * the session's, with the spec of the Environment's applied recipe pinned now, and its vault
- * holds the session's credentials. Without one the session has no sandbox and no credentials.
+ * The session runs on its Agent for its life: the Agent's sandbox (kinds `virtual` and `pod`) is
+ * the session's, with the spec of what the Agent runs pinned now, and the Agent's vault holds the
+ * session's credentials. It pins the manifest version the Agent runs (`definition`), as the loop
+ * manifest that version's harness section makes, and the harness that section names (`pinOf`);
+ * a turn's first segment pins the version the Agent runs then (`repinTurn`).
  */
 export declare function putSession(ctx: TenantContext, id: string, body: PutSessionRequest, access?: SessionAccess, options?: {
     /**
      * Create the session if it is missing and otherwise leave it as it is (an AG-UI thread's
-     * session): an existing one must have the same owner and agent, or it is a 404.
+     * session): an existing one must have the same owner and Agent, or it is a 404.
      */
     createOnly?: boolean;
     /**
-     * The Environments the caller reaches (a token caller's grants, `environmentGrantsOf`);
-     * undefined reaches every one. `environment` must name one of them.
+     * The Agents the caller reaches (a token caller's grants, `agentGrantsOf`); undefined
+     * reaches every one. `agent` must name one of them.
      */
-    environmentGrants?: readonly string[];
+    agentGrants?: readonly string[];
+}): Promise<Session>;
+/**
+ * `putSession`'s work in transaction `t`: also how a trigger's first run opens the session it
+ * names (track T4), in the run's transaction.
+ */
+export declare function openSessionIn(ctx: TenantContext, t: Tx, id: string, body: PutSessionRequest, access?: SessionAccess, options?: {
+    createOnly?: boolean;
+    agentGrants?: readonly string[];
 }): Promise<Session>;
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export declare function sessionView(t: Tx, s: Session): Promise<unknown>;