@arnilo/prism-supervisor 0.0.12 → 0.0.14

package/CHANGELOG.md

@@ -1,4 +1,17 @@
 # Changelog
+
+## [0.0.14] - 2026-07-26
+
+### Changed
+
+- Released with exact 0.0.14 graph.
+
+## [0.0.13] - 2026-07-24
+
+### Changed
+
+- Released with exact 0.0.13 graph.
+
 ## [0.0.12] - 2026-07-22
 
 ### Changed

package/dist/a2a-server.js

@@ -1,3 +1,4 @@
+import { assertIdentityActive, assertIdentityMatchesOwnership } from "@arnilo/prism";
 import { createA2AAgentCard } from "./a2a-card.js";
 import { bounded, optionalCursor, parseA2AMessage, record, requireId, resolveA2ALimits, validateA2ATask } from "./a2a-parts.js";
 import { A2AError } from "./errors.js";
@@ -39,6 +40,15 @@ export function createA2AHandler(options) {
                 const authorization = await abortable(Promise.resolve(options.authorize({ request, method: rpc.method, signal: owned.signal })), owned.signal);
                 if (!authorization)
                     return errorResponse(403, "Forbidden", rpc.id);
+                if (authorization.identity) {
+                    try {
+                        assertIdentityActive(authorization.identity);
+                        assertIdentityMatchesOwnership(authorization.identity, authorization.ownership);
+                    }
+                    catch {
+                        return errorResponse(403, "Forbidden", rpc.id);
+                    }
+                }
                 if (rpc.method === "GetExtendedAgentCard")
                     return card.capabilities.extendedAgentCard ? json(rpc.id, card, limits, options) : rpcError(rpc.id, -32004, "Extended Agent Card unavailable");
                 if (rpc.method === "SendMessage" || rpc.method === "SendStreamingMessage") {
@@ -57,10 +67,17 @@ export function createA2AHandler(options) {
                     const input = message.parts.map((part) => part.text).join("\n");
                     const session = await abortable(Promise.resolve(options.exposure.sessionFactory(authorization)), owned.signal);
                     const taskId = `task-${crypto.randomUUID()}`, contextId = message.contextId ?? `context-${crypto.randomUUID()}`;
+                    const runOptions = {
+                        ownership: authorization.ownership,
+                        identity: authorization.identity,
+                        metadata: authorization.metadata,
+                        signal: owned.signal,
+                        redactor: options.redactor,
+                    };
                     if (rpc.method === "SendMessage")
-                        return json(rpc.id, { task: toTask(taskId, contextId, await abortable(session.run(input, { ownership: authorization.ownership, metadata: authorization.metadata, signal: owned.signal, redactor: options.redactor }), owned.signal), options) }, limits, options);
+                        return json(rpc.id, { task: toTask(taskId, contextId, await abortable(session.run(input, runOptions), owned.signal), options) }, limits, options);
                     transferred = true;
-                    const events = runEvents(taskId, contextId, () => session.run(input, { ownership: authorization.ownership, metadata: authorization.metadata, signal: owned.signal, redactor: options.redactor }), options);
+                    const events = runEvents(taskId, contextId, () => session.run(input, runOptions), options);
                     return streamResponse(rpc.id, events, owned, limits, options, () => { active -= 1; });
                 }
                 if (["GetTask", "ListTasks", "CancelTask", "SubscribeToTask"].includes(rpc.method)) {

package/dist/a2a-types.d.ts

@@ -1,4 +1,4 @@
-import type { AgentRunResult, AgentSession, OwnershipScope, SecretRedactor } from "@arnilo/prism";
+import type { AgentIdentity, AgentRunResult, AgentSession, OwnershipScope, SecretRedactor } from "@arnilo/prism";
 export declare const A2A_PROTOCOL_VERSION = "1.0";
 export interface A2AAgentInterface {
     readonly url: string;
@@ -132,6 +132,8 @@ export interface A2AJsonRpcResponse {
 }
 export interface A2AAuthorization {
     readonly ownership: OwnershipScope;
+    /** Host-verified identity; when set must project onto ownership without widening. */
+    readonly identity?: AgentIdentity;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export type A2AAuthorizer = (input: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-supervisor",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "description": "Bounded supervisor delegation and A2A 1.0 durable task, rich-part, reconnect, and push interoperability.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,7 +25,7 @@
     "pack:dry-run": "npm pack --dry-run"
   },
   "peerDependencies": {
-    "@arnilo/prism": "0.0.12"
+    "@arnilo/prism": "0.0.14"
   },
   "devDependencies": {
     "@arnilo/prism": "file:../.."