@nylorun/runtime 0.47.1-beta → 0.48.0-beta

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.48.0-beta
+
+### Minor Changes
+
+- 6b49200: A2A `SendMessage` takes `message.metadata.delivery: "steer"` (Host feature `a2a-steer`, ADR-140), a session message's steer (D85): to a busy context the message waits marked `steer`, and the running turn takes it before its next step, so its task becomes that turn's. To an idle context it starts a turn; to a workflow's, or a turn past its last step, it is an ordinary queued message. The task answered to a steer carries `metadata.delivery`: `steered`, or `queued` when the message started a turn or waits unmarked; callers that don't ask for steer get the same answer as before. `createA2aClient`'s `send` takes `delivery: "steer"`, and `readDelivery(task)` reads what applied.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Pin harness to the tested release.
+- Updated dependencies [6b49200]
+- Updated dependencies
+  - @nylorun/core@0.42.0-beta
+  - @nylorun/harness@0.36.2-beta
+
 ## 0.47.1-beta
 
 ### Patch Changes

package/dist/api/a2a/endpoint.js

@@ -72,7 +72,7 @@ export function a2aRoutes(api) {
         path: "/v1/a2a/agents/{agentId}",
         tags: TAGS,
         summary: "Call an agent over A2A",
-        description: "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead. A queued task never waits for good (Host feature `queue-recovery`): when its Agent refuses its turn's start (a disk copy, a lost pod), the start is tried again until the Runtime limit `queuedStartMs` (15 minutes by default), and then, or at once for a refusal no retry changes, the task is `TASK_STATE_FAILED` with a status message saying why; `CancelTask` on a queued task takes it out of the queue, a task running in the context or not, and answers `TASK_STATE_CANCELED`. Both are pushed. `message.metadata.removeTools` (Host feature `remove-tools`) names the tools a new message's turn may not use, as a session message's `removeTools`. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
+        description: "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead, and `\"steer\"` (Host feature `a2a-steer`) steers it into the running turn, as a session message's `delivery: \"steer\"`: the turn takes it before its next step and the task is that turn's; to an idle context, a workflow's, or a turn past its last step it is an ordinary message. The task answered to a steer carries `metadata.delivery`: `steered`, or `queued` when it started a turn or waits as a queued message. A queued task never waits for good (Host feature `queue-recovery`): when its Agent refuses its turn's start (a disk copy, a lost pod), the start is tried again until the Runtime limit `queuedStartMs` (15 minutes by default), and then, or at once for a refusal no retry changes, the task is `TASK_STATE_FAILED` with a status message saying why; `CancelTask` on a queued task takes it out of the queue, a task running in the context or not, and answers `TASK_STATE_CANCELED`. Both are pushed. `message.metadata.removeTools` (Host feature `remove-tools`) names the tools a new message's turn may not use, as a session message's `removeTools`. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
         externalDocs: A2A_SPECIFICATION,
         request: {
             params: agentId,

package/dist/api/a2a/protocol.d.ts

@@ -205,8 +205,12 @@ export type MessageInput = {
         text: string;
     } | RawFile | UrlFile)[];
 };
-/** What a message to a busy context does (profile v2 §1): queued, or refused with `CONTEXT_BUSY`. */
-export type Delivery = "queue" | "reject";
+/**
+ * What a message to a busy context does (profile v2 §1): queued, refused with `CONTEXT_BUSY`, or
+ * steered into the running turn before its next step (Host feature `a2a-steer`, ADR-140), as a
+ * session message's `delivery: "steer"` (D85).
+ */
+export type Delivery = "queue" | "reject" | "steer";
 /** A caller's answer to an open interaction (`interactions/v1` on the reply message). */
 export type InteractionAnswer = {
     interactionId: string;

package/dist/api/a2a/protocol.js

@@ -234,13 +234,13 @@ function parseRemoveTools(metadata) {
         return a2aFail("invalidParams", "message.metadata.removeTools must be at most 256 tool names of 1 to 256 characters", {}, "message.metadata.removeTools");
     return value;
 }
-/** `metadata.delivery`: `queue` (the default) or `reject`. */
+/** `metadata.delivery`: `queue` (the default), `reject` or `steer`. */
 function parseDelivery(metadata) {
     const delivery = metadata.delivery;
     if (delivery === undefined || delivery === null)
         return "queue";
-    if (delivery !== "queue" && delivery !== "reject")
-        return a2aFail("invalidParams", 'message.metadata.delivery must be "queue" or "reject"', {}, "message.metadata.delivery");
+    if (delivery !== "queue" && delivery !== "reject" && delivery !== "steer")
+        return a2aFail("invalidParams", 'message.metadata.delivery must be "queue", "reject" or "steer"', {}, "message.metadata.delivery");
     return delivery;
 }
 /** The answer under `interactions/v1`, when the message carries one. */

package/dist/api/a2a/routes.js

@@ -18,10 +18,13 @@
  * - A message to a busy context is **queued** (`delivery: "queue"`, protocol 17) and answered
  *   with the task that will take it: `SUBMITTED`, its id the queued message's own until a turn
  *   takes it, then that turn's state. `metadata.delivery: "reject"` keeps v1's
- *   `UnsupportedOperationError` (reason `CONTEXT_BUSY`). A queued task never waits for good (Host
- *   feature `queue-recovery`): one whose turn the Agent refused to start for longer than the
- *   Runtime limit `queuedStartMs`, or for good, is `FAILED`; `CancelTask` takes one out of the
- *   queue as `CANCELED`. Both are pushed.
+ *   `UnsupportedOperationError` (reason `CONTEXT_BUSY`). `metadata.delivery: "steer"` (Host
+ *   feature `a2a-steer`, ADR-140) is a session message's steer (D85): the running turn takes the
+ *   message before its next step, and its task is then that turn's; the task's `metadata.delivery`
+ *   answers `steered`, or `queued` when it started a turn or waits as a queued message. A queued
+ *   task never waits for good (Host feature `queue-recovery`): one whose turn the Agent refused to
+ *   start for longer than the Runtime limit `queuedStartMs`, or for good, is `FAILED`;
+ *   `CancelTask` takes one out of the queue as `CANCELED`. Both are pushed.
  * - An open interaction shows on the status message under `interactions/v1`; the caller answers
  *   on the same task with `{ interactionId, approved }` (the Runtime's `approve`, recorded with
  *   the caller as `approvedBy`) or `{ interactionId, value }` (`respond`). Text never approves.
@@ -267,12 +270,19 @@ async function ownedTask(caller, taskId, historyLength) {
 async function run(caller, sessionId, input, 
 /** The error for a `409` conflict: the session is busy or no longer waiting. */
 conflict, 
-/** What a message to a busy session does: queued (profile v2), or `409`. */
+/**
+ * What a message to a busy session does: queued (profile v2), steered into its running turn
+ * (`a2a-steer`, D85; queued when no turn may take it), or `409`.
+ */
 delivery = "reject") {
     try {
         const accepted = (await command(caller.ctx, sessionId, SessionCommandSchema.parse(input), caller.scope, { ...(caller.trace ? { trace: caller.trace } : {}), delivery }));
         return accepted.status === "queued"
-            ? { queuedMessageId: accepted.queuedMessageId, cursor: accepted.cursor }
+            ? {
+                queuedMessageId: accepted.queuedMessageId,
+                cursor: accepted.cursor,
+                ...(accepted.delivery ? { delivery: accepted.delivery } : {}),
+            }
             : { turnId: accepted.turnId, cursor: accepted.cursor };
     }
     catch (error) {
@@ -371,6 +381,17 @@ async function sendMessage(caller, params, signal) {
     else
         await settled(caller.ctx, sessionId, accepted, signal);
     const { task } = await ownedTask(caller, taskId, send.historyLength);
+    // A new message that asked to steer (`a2a-steer`, ADR-140) is told what applied: `steered`
+    // when it waited marked `steer` behind a running turn, which takes it before its next step
+    // (D85); `queued` when it started a turn, or waits as an ordinary queued message (a workflow).
+    // A steer the turn doesn't take after all (past its last step) starts the next turn.
+    if (send.delivery === "steer" && send.taskId === undefined)
+        return {
+            task: {
+                ...task,
+                metadata: { ...task.metadata, delivery: accepted.delivery === "steer" ? "steered" : "queued" },
+            },
+        };
     return { task };
 }
 /** The trace id of a turn this request started: its `traceparent`'s, else the Runtime's own. */

package/dist/management-openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Management API",
-    "version": "0.47.1-beta",
+    "version": "0.48.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -45,7 +45,8 @@
         "remove-tools",
         "agent-triggers",
         "steer",
-        "queue-recovery"
+        "queue-recovery",
+        "a2a-steer"
       ]
     },
     "description": "For operators: the Tenant's models, vaults, signing keys, settings and application keys, at `/v1/tenant/*` on the Tenant's URL, through `@nylorun/admin`. Every operation takes a management key, acting as itself: never for a subject and never from a browser. Management keys are issued only on the Tenant's machine (`nylorun tenant keys put <id> --management`) or from `NYLORUN_MANAGEMENT_KEY_FILE`."

package/dist/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.2.0",
   "info": {
     "title": "Nylorun Runtime API",
-    "version": "0.47.1-beta",
+    "version": "0.48.0-beta",
     "x-nylorun-protocol": {
       "min": 16,
       "max": 18,
@@ -45,7 +45,8 @@
         "remove-tools",
         "agent-triggers",
         "steer",
-        "queue-recovery"
+        "queue-recovery",
+        "a2a-steer"
       ]
     },
     "description": "For developers: agent manifests, Agents, sessions (with AG-UI and A2A) and artifacts, through `@nylorun/agents`. Every Tenant serves it on its one URL, beside the Management API (`/openapi/management.json`). Every request sends `Nylorun-Protocol`. Who may call each operation is its `security` and its `x-nylorun-credentials` and `x-nylorun-scopes` (the subject scopes that reach it) fields: an application key (servers) or a trusted issuer's token (browsers and apps)."
@@ -37353,7 +37354,7 @@
           "A2A"
         ],
         "summary": "Call an agent over A2A",
-        "description": "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead. A queued task never waits for good (Host feature `queue-recovery`): when its Agent refuses its turn's start (a disk copy, a lost pod), the start is tried again until the Runtime limit `queuedStartMs` (15 minutes by default), and then, or at once for a refusal no retry changes, the task is `TASK_STATE_FAILED` with a status message saying why; `CancelTask` on a queued task takes it out of the queue, a task running in the context or not, and answers `TASK_STATE_CANCELED`. Both are pushed. `message.metadata.removeTools` (Host feature `remove-tools`) names the tools a new message's turn may not use, as a session message's `removeTools`. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
+        "description": "A2A 1.0 JSON-RPC, for a subject, under the Nylorun profile v2 (Host feature `a2a-profile-v2`). `SendMessage` blocks up to the Runtime limit `a2aWaitMs` (5 minutes by default; then the task is answered still `WORKING`) unless `returnImmediately`; `GetTask` (with `historyLength`), `CancelTask` and `ListTasks`; and the four push notification config methods, plus `configuration.taskPushNotificationConfig` in `SendMessage`: each update is POSTed as one `StreamResponse`, signed with Standard Webhooks (`webhook-id`, `webhook-timestamp`, `webhook-signature` with the Runtime's `a2a.push.secret`) and `X-A2A-Notification-Token`, at least once, retried for up to 24 hours, to hosts the Runtime allows (`a2a.push.allowHosts` for private ones). A message to a busy context is queued and answered with the task that will take it (`TASK_STATE_SUBMITTED`); `message.metadata.delivery: \"reject\"` asks for `UnsupportedOperationError` (reason `CONTEXT_BUSY`) instead, and `\"steer\"` (Host feature `a2a-steer`) steers it into the running turn, as a session message's `delivery: \"steer\"`: the turn takes it before its next step and the task is that turn's; to an idle context, a workflow's, or a turn past its last step it is an ordinary message. The task answered to a steer carries `metadata.delivery`: `steered`, or `queued` when it started a turn or waits as a queued message. A queued task never waits for good (Host feature `queue-recovery`): when its Agent refuses its turn's start (a disk copy, a lost pod), the start is tried again until the Runtime limit `queuedStartMs` (15 minutes by default), and then, or at once for a refusal no retry changes, the task is `TASK_STATE_FAILED` with a status message saying why; `CancelTask` on a queued task takes it out of the queue, a task running in the context or not, and answers `TASK_STATE_CANCELED`. Both are pushed. `message.metadata.removeTools` (Host feature `remove-tools`) names the tools a new message's turn may not use, as a session message's `removeTools`. A message is text, one data part, or text with `raw` files (stored as artifacts of the context's session) and `url` files (fetched by the Runtime), each at most the Runtime limit `inlineFileBytes` (20 MiB by default). An approval, question or connection the task waits for (`AUTH_REQUIRED` or `INPUT_REQUIRED`) is shown under `interactions/v1` and answered on the same task with `{ interactionId, approved }` or `{ interactionId, value }` under that URI in the message's `metadata`; text never approves. Artifacts carry the turn's output and the files it wrote, as `url` parts at `/v1/a2a/files/…` with `files/v1`; the task's metadata carries `progress/v1`, `telemetry/v1` and `effects/v1`. Extension data is answered only for the extensions activated with `A2A-Extensions`. A context is one session per subject, agent and `contextId`; a task is one turn. JSON-RPC errors are answered with 200; limits, scopes and unavailable streams stay HTTP errors. Not served: streaming, `GetExtendedAgentCard`.",
         "externalDocs": {
           "description": "The A2A specification",
           "url": "https://a2a-protocol.org/latest/specification/"

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.47.1-beta";
+export declare const RUNTIME_VERSION = "0.48.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/server/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.47.1-beta";
+export const RUNTIME_VERSION = "0.48.0-beta";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.47.1-beta",
+  "version": "0.48.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
@@ -65,8 +65,8 @@
     "@hono/node-server": "^2.1.5",
     "@hono/zod-openapi": "^1.6.3",
     "@modelcontextprotocol/sdk": "^1.32.1",
-    "@nylorun/core": "0.41.0-beta",
-    "@nylorun/harness": "0.36.1-beta",
+    "@nylorun/core": "0.42.0-beta",
+    "@nylorun/harness": "0.36.2-beta",
     "@restatedev/restate-sdk": "1.17.3",
     "@restatedev/restate-sdk-clients": "1.17.3",
     "@s2-dev/streamstore": "0.28.0",