@arnilo/prism 0.0.11 → 0.0.13

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.0.13] - 2026-07-24
+
+### Added
+
+- Enterprise identity (`Principal` / `AgentIdentity`), optional `@arnilo/prism-policy`, `@arnilo/prism-model-router`, enterprise cloud providers (Azure/Bedrock/Vertex), server deployment seams, persistence schema v5 lifecycle hooks, and `@arnilo/prism-work-tools` (M365 + GWS).
+
+### Changed
+
+- Versioned all **41** first-party manifests and exact internal ranges to `0.0.13`; Phase 8 optional packages enroll in `@arnilo/prism-all` only.
+- Network-free enterprise evidence: `scripts/benchmark-0.0.13.mjs`.
+
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
@@ -7,6 +18,19 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.0.12] - 2026-07-22
+
+### Added
+
+- Optional `@arnilo/prism-ag-ui` package with bounded AG-UI mapper/authorized handler/replay and stable `./acp` sibling, built over shared durable resume streams.
+- `createCodingCompactionStrategy()` preset for bounded coding-session handoff.
+
+### Changed
+
+- Versioned all 35 first-party manifests and exact internal ranges to `0.0.12`; `@arnilo/prism-all` includes AG-UI while `@arnilo/prism-code` and `@arnilo/prism-sdk` remain free of UI protocol dependencies.
+- Added network-free interoperability/compaction evidence: `scripts/benchmark-0.0.12.mjs`.
+
+
 ## [0.0.11] - 2026-07-22
 
 ### Added

package/dist/agent-run-lifecycle.d.ts

@@ -1,4 +1,4 @@
-import type { Agent, AgentRunRef, AgentRunResult, AgentRunResume, AgentRunStatusResult, OwnershipScope } from "./contracts.js";
+import type { Agent, AgentEvent, AgentRunRef, AgentRunResult, AgentRunResume, AgentRunStatusResult, OwnershipScope, SubscribeOptions } from "./contracts.js";
 import type { CheckpointStore } from "./contracts.js";
 export interface AgentRunLifecycleAgent {
     readonly agent: Agent;
@@ -20,9 +20,13 @@ export interface AgentRunLifecycleRequest {
     /** Adapter-selected capability; stored runs for another agent are non-enumerable. */
     readonly agentId?: string;
 }
+/** Bounded live-event options for a durable lifecycle resume. */
+export interface AgentRunLifecycleStreamRequest extends AgentRunLifecycleRequest, SubscribeOptions {
+}
 export interface AgentRunLifecycle {
     status(ref: AgentRunRef, options?: AgentRunLifecycleRequest): Promise<AgentRunStatusResult>;
     resume(ref: AgentRunRef, resume: AgentRunResume, options?: AgentRunLifecycleRequest): Promise<AgentRunResult>;
+    resumeStream(ref: AgentRunRef, resume: AgentRunResume, options?: AgentRunLifecycleStreamRequest): AsyncIterable<AgentEvent>;
 }
 /** Host capability for durable agent status/resume. Adapters supply authorized ownership only. */
 export declare function createAgentRunLifecycle(options: AgentRunLifecycleOptions): AgentRunLifecycle;

package/dist/agent-run-lifecycle.js

@@ -1,6 +1,6 @@
 import { AgentRunStateError } from "./contracts.js";
 import { loadAgentRunState, publicState } from "./agent-run-state.js";
-import { resumeAgentRun } from "./agents.js";
+import { resumeAgentRun, resumeAgentRunStream } from "./agents.js";
 function assertAgentId(actual, expected) {
     if (expected !== undefined && actual !== expected)
         throw new AgentRunStateError("Agent run capability mismatch");
@@ -28,6 +28,22 @@ export function createAgentRunLifecycle(options) {
                 definitionRevision: resolved.definitionRevision,
             });
         },
+        async *resumeStream(ref, resume, request = {}) {
+            request.signal?.throwIfAborted();
+            const { state } = await loadAgentRunState(options.checkpoints, ref, request.ownership);
+            assertAgentId(state.agentId, request.agentId);
+            const resolved = await options.resolveAgent({ agentId: state.agentId, ownership: request.ownership, signal: request.signal });
+            request.signal?.throwIfAborted();
+            yield* resumeAgentRunStream(resolved.agent, ref, resume, {
+                checkpoints: options.checkpoints,
+                ownership: request.ownership,
+                fencingToken: options.fencingToken,
+                definitionRevision: resolved.definitionRevision,
+                signal: request.signal,
+                maxQueuedEvents: request.maxQueuedEvents,
+                overflow: request.overflow,
+            });
+        },
     };
 }
 //# sourceMappingURL=agent-run-lifecycle.js.map

package/dist/agents.d.ts

@@ -1,7 +1,9 @@
-import type { Agent, AgentConfig, AgentRunResult, AgentRunResume, AgentRunResumeOptions, AgentRunRef, AgentSession, AgentSessionConfig } from "./contracts.js";
+import type { Agent, AgentConfig, AgentEvent, AgentRunResult, AgentRunResume, AgentRunResumeOptions, AgentRunResumeStreamOptions, AgentRunRef, AgentSession, AgentSessionConfig } from "./contracts.js";
 export declare function createAgent(config: AgentConfig): Agent;
 export declare function createAgentSession(config: AgentSessionConfig & {
     readonly agent: Agent;
 }): AgentSession;
 /** Resume a persisted built-in run. A claimed/dispatched tool is never replayed automatically. */
 export declare function resumeAgentRun(agent: Agent, ref: AgentRunRef, resume: AgentRunResume, options: AgentRunResumeOptions): Promise<AgentRunResult>;
+/** Subscribe before resuming one durable run. Early consumer return aborts that resumed execution. */
+export declare function resumeAgentRunStream(agent: Agent, ref: AgentRunRef, resume: AgentRunResume, options: AgentRunResumeStreamOptions): AsyncGenerator<AgentEvent>;

package/dist/agents.js

@@ -17,6 +17,7 @@ import { createToolRegistry, dispatchToolCall } from "./tools.js";
 import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions } from "./agent-run-state.js";
 import { resolveActiveSkills } from "./skills.js";
+import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity, } from "./identity.js";
 export function createAgent(config) {
     return {
         config,
@@ -30,6 +31,32 @@ export function createAgentSession(config) {
 }
 /** Resume a persisted built-in run. A claimed/dispatched tool is never replayed automatically. */
 export async function resumeAgentRun(agent, ref, resume, options) {
+    return executePreparedAgentRunResume(await prepareAgentRunResume(agent, ref, resume, options));
+}
+/** Subscribe before resuming one durable run. Early consumer return aborts that resumed execution. */
+export async function* resumeAgentRunStream(agent, ref, resume, options) {
+    throwIfAbortedSignal(options.signal);
+    const prepared = await prepareAgentRunResume(agent, ref, resume, options, options.signal);
+    const subscription = prepared.session.subscribe(options);
+    let settled = false;
+    const runPromise = executePreparedAgentRunResume(prepared, options.signal).finally(() => { settled = true; });
+    try {
+        for await (const event of subscription) {
+            if ("runId" in event && event.runId !== ref.runId)
+                continue;
+            yield event;
+        }
+        await runPromise;
+    }
+    finally {
+        if (!settled) {
+            prepared.session.abort(new Error("resume stream consumer closed"));
+            await runPromise.catch(() => undefined);
+        }
+    }
+}
+async function prepareAgentRunResume(agent, ref, resume, options, signal) {
+    throwIfAbortedSignal(signal);
     const { record, state } = await loadAgentRunState(options.checkpoints, ref, options.ownership);
     if (state.definitionRevision !== options.definitionRevision || state.agentId !== (agent.config.id ?? agent.config.name) || state.fingerprint !== agentFingerprint(agent, options.definitionRevision)) {
         throw new AgentRunStateError("Agent definition revision or fingerprint mismatch on resume");
@@ -37,7 +64,9 @@ export async function resumeAgentRun(agent, ref, resume, options) {
     if (record.version !== resume.expectedVersion || state.status !== "suspended") {
         throw new AgentRunStateError("Stale or non-suspended agent run resume");
     }
+    const session = new RuntimeAgentSession({ agent, id: state.sessionId, leafId: state.leafId });
     if (resume.decision === "deny") {
+        throwIfAbortedSignal(signal);
         const denied = await saveAgentRunState({
             checkpoints: options.checkpoints,
             state: { ...state, status: "denied" },
@@ -45,10 +74,23 @@ export async function resumeAgentRun(agent, ref, resume, options) {
             ownership: options.ownership,
             fencingToken: options.fencingToken,
         });
-        const session = new RuntimeAgentSession({ agent, id: state.sessionId, leafId: state.leafId });
-        await session.recordDurableDenial(state.runId, state.interruption, denied.record.version, options.ownership);
-        const runState = publicState(denied.state);
-        return { sessionId: state.sessionId, runId: state.runId, status: "denied", leafId: state.leafId, text: "", content: [], runState, interruption: state.interruption };
+        return {
+            kind: "deny",
+            session,
+            interruption: state.interruption,
+            version: denied.record.version,
+            ownership: options.ownership,
+            result: {
+                sessionId: state.sessionId,
+                runId: state.runId,
+                status: "denied",
+                leafId: state.leafId,
+                text: "",
+                content: [],
+                runState: publicState(denied.state),
+                interruption: state.interruption,
+            },
+        };
     }
     if (state.pending?.status === "dispatched")
         throw new AgentRunStateError("Ambiguous dispatched tool requires operator resolution");
@@ -56,6 +98,7 @@ export async function resumeAgentRun(agent, ref, resume, options) {
     if (configured && (configured.checkpoints !== options.checkpoints || configured.definitionRevision !== options.definitionRevision)) {
         throw new AgentRunStateError("Agent durable run-state configuration mismatch on resume");
     }
+    throwIfAbortedSignal(signal);
     const claimed = await saveAgentRunState({
         checkpoints: options.checkpoints,
         state: { ...state, status: "running", interruption: undefined },
@@ -63,13 +106,25 @@ export async function resumeAgentRun(agent, ref, resume, options) {
         ownership: options.ownership,
         fencingToken: options.fencingToken,
     });
-    const session = new RuntimeAgentSession({ agent, id: state.sessionId, leafId: state.leafId });
-    return session.resumeDurable(claimed.state, configured ?? {
-        checkpoints: options.checkpoints,
-        definitionRevision: options.definitionRevision,
-        interruptBeforeTool: state.interruptBeforeTool,
-        fencingToken: options.fencingToken,
-    }, options.ownership);
+    return {
+        kind: "approve",
+        session,
+        state: claimed.state,
+        ownership: options.ownership,
+        runState: configured ?? {
+            checkpoints: options.checkpoints,
+            definitionRevision: options.definitionRevision,
+            interruptBeforeTool: state.interruptBeforeTool,
+            fencingToken: options.fencingToken,
+        },
+    };
+}
+async function executePreparedAgentRunResume(prepared, signal) {
+    if (prepared.kind === "deny") {
+        await prepared.session.recordDurableDenial(prepared.result.runId, prepared.interruption, prepared.version, prepared.ownership);
+        return prepared.result;
+    }
+    return prepared.session.resumeDurable(prepared.state, prepared.runState, prepared.ownership, signal);
 }
 class AgentRunSuspended extends Error {
     state;
@@ -100,6 +155,7 @@ class RuntimeAgentSession {
     activeProvider;
     activeLedger;
     activeOwnership;
+    activeIdentity;
     activeIdempotencyKey;
     activeGuardrails;
     activeMetadata;
@@ -154,18 +210,23 @@ class RuntimeAgentSession {
                 this.pendingSoftInterrupt = true;
         }
     }
-    async resumeDurable(state, runState, ownership) {
-        return this.runInternal(state.input ?? [], { runState, ownership }, state.runId, { options: runState, state, version: state.version });
+    async resumeDurable(state, runState, ownership, signal) {
+        return this.runInternal(state.input ?? [], { runState, ownership, signal }, state.runId, { options: runState, state, version: state.version });
     }
     async recordDurableDenial(runId, interruption, version, ownership) {
         this.activeLedger = this.agent.config.runLedger;
         this.activeOwnership = ownership ?? this.agent.config.ownership;
         this.activeRedactor = this.agent.config.redactor;
-        this.emit({ type: "agent_denied", sessionId: this.id, runId, interruption, version });
-        await this.drainLedger();
-        this.activeLedger = undefined;
-        this.activeOwnership = undefined;
-        this.activeRedactor = undefined;
+        try {
+            this.emit({ type: "agent_denied", sessionId: this.id, runId, interruption, version });
+            await this.drainLedger();
+        }
+        finally {
+            this.activeLedger = undefined;
+            this.activeOwnership = undefined;
+            this.activeRedactor = undefined;
+            this.closeSubscribers();
+        }
     }
     async runInternal(input, options, runId, resumed) {
         if (this.agent.config.secure && (options.redactor !== undefined || options.ownership !== undefined || options.validate !== undefined || options.runState !== undefined)) {
@@ -202,6 +263,9 @@ class RuntimeAgentSession {
         this.activeRedactor = options.redactor ?? this.agent.config.redactor;
         this.activeLedger = options.runLedger ?? this.agent.config.runLedger;
         this.activeOwnership = options.ownership ?? this.agent.config.ownership;
+        this.activeIdentity = resolveRunIdentity(options.identity, this.agent.config.identity, this.activeOwnership);
+        if (this.activeIdentity && !this.activeOwnership)
+            this.activeOwnership = ownershipFromIdentity(this.activeIdentity);
         this.activeIdempotencyKey = options.idempotencyKey ?? this.agent.config.idempotencyKey;
         this.activeGuardrails = mergeGuardrails(this.agent.config.guardrails, options.guardrails);
         this.activeDurable = resumed ?? (durableOptions ? { options: durableOptions, version: 0 } : undefined);
@@ -213,7 +277,12 @@ class RuntimeAgentSession {
         let runStatus = "succeeded";
         const runUsage = createUsageAccumulator();
         let usage;
-        const metadata = { ...this.agent.config.metadata, ...this.metadata, ...options.metadata };
+        const metadata = {
+            ...this.agent.config.metadata,
+            ...this.metadata,
+            ...options.metadata,
+            ...(this.activeIdentity ? identityTelemetryAttributes(this.activeIdentity) : {}),
+        };
         this.activeMetadata = metadata;
         const limits = new RunLimitTracker(resolvedLimits, {
             onExceeded: (breach) => {
@@ -375,7 +444,14 @@ class RuntimeAgentSession {
                 dispatchToolCall: (call) => dispatchToolCall({
                     call,
                     registry,
-                    context: { sessionId: this.id, runId, toolCallId: call.id, signal: controller.signal, metadata },
+                    context: {
+                        sessionId: this.id,
+                        runId,
+                        toolCallId: call.id,
+                        signal: controller.signal,
+                        metadata,
+                        identity: this.activeIdentity,
+                    },
                     middleware: this.agent.config.middleware,
                     emit: (event) => this.emit(event),
                     permission: this.agent.config.permission,
@@ -383,6 +459,7 @@ class RuntimeAgentSession {
                     redactor: this.activeRedactor,
                     ledger: this.activeLedger,
                     ownership: this.activeOwnership,
+                    identity: this.activeIdentity,
                     guardrails: this.activeGuardrails,
                     limitTracker: limits,
                     beforeExecute: async (mediatedCall) => {
@@ -518,6 +595,7 @@ class RuntimeAgentSession {
             finally {
                 this.activeLedger = undefined;
                 this.activeOwnership = undefined;
+                this.activeIdentity = undefined;
                 this.activeIdempotencyKey = undefined;
                 this.activeGuardrails = undefined;
                 this.activeMetadata = undefined;

package/dist/contracts.d.ts

@@ -287,6 +287,8 @@ export interface RunOptions {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity; when set, must project onto `ownership` without widening. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly validate?: ToolValidator;
     readonly activeSkills?: readonly string[];
@@ -352,6 +354,8 @@ export interface AgentConfig {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity default for sessions created from this agent. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly compaction?: false | CompactionOptions;
     readonly retry?: false | RetryOptions;
@@ -369,7 +373,7 @@ export interface AgentConfig {
     readonly secure?: true;
 }
 /** Opt-in fail-closed composition over the normal explicit AgentConfig API. */
-export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "limits" | "runState" | "secure"> {
+export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "identity" | "limits" | "runState" | "secure"> {
     readonly id: string;
     readonly tools: readonly ToolDefinition[];
     readonly toolArgumentValidator: import("./tools.js").ToolArgumentValidator;
@@ -377,6 +381,8 @@ export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validat
     readonly permission: PermissionPolicy;
     readonly trust: TrustPolicy;
     readonly ownership: OwnershipScope;
+    /** Optional host-verified identity; when set must match `ownership`. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly limits: RunLimits;
     readonly definitionRevision: string;
     readonly runState: Omit<AgentRunStateOptions, "definitionRevision" | "interruptBeforeTool">;
@@ -449,6 +455,10 @@ export interface AgentRunResumeOptions {
     readonly ownership?: OwnershipScope;
     readonly fencingToken?: number;
 }
+/** Bounded, abortable options for `resumeAgentRunStream()`. */
+export interface AgentRunResumeStreamOptions extends AgentRunResumeOptions, SubscribeOptions {
+    readonly signal?: AbortSignal;
+}
 export interface AgentRunRef {
     readonly runId: string;
     readonly sessionId?: string;
@@ -746,6 +756,8 @@ export interface ToolExecutionContext {
     readonly toolCallId: string;
     readonly signal?: AbortSignal;
     readonly metadata?: Readonly<Record<string, unknown>>;
+    /** Host-verified identity for this tool invocation, when enterprise identity is active. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     progress?(progress?: unknown, metadata?: Readonly<Record<string, unknown>>): void | Promise<void>;
 }
 export interface ToolResult {
@@ -896,6 +908,9 @@ export interface ExtensionEvent {
 export interface Extension {
     readonly name: string;
     setup(api: ExtensionAPI): void | Promise<void>;
+    /** Host-attested signature/digest for `ExtensionLoadPolicy.verifySignature`. */
+    readonly signature?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface ProviderPackage {
     readonly name: string;
@@ -1601,6 +1616,11 @@ export interface ProductionPersistenceStore {
     /** DB-friendly branch read (mirrors `SessionStore.readBranchPath`): one ancestor-chain
      *  query instead of `queryEntries({ sessionId })` + in-memory walk. Optional. */
     readBranchPath?(query: SessionBranchRead): Promise<PersistencePage<SessionEntry>>;
+    /**
+     * Optional Phase 8 retention / legal-hold / export / tenant-quota lifecycle.
+     * Prefer attaching `createMemoryPersistenceLifecycle()` or adapter-native methods.
+     */
+    readonly lifecycle?: import("./persistence-lifecycle.js").PersistenceLifecycleStore;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface CompactionStrategy {
@@ -1792,3 +1812,11 @@ export interface ArtifactParseResult<T> {
 export type ArtifactParser<T> = (text: string, ctx: ArtifactContext) => ArtifactParseResult<T> | Promise<ArtifactParseResult<T>>;
 export type ArtifactValidator<T> = (value: T, ctx: ArtifactContext) => ArtifactValidation | Promise<ArtifactValidation>;
 export type ArtifactRepairer<T> = (value: T | undefined, failure: ArtifactValidation, ctx: ArtifactContext) => AgentInput | Promise<AgentInput>;
+/** Alias re-exports so `dist/contracts.d.ts` exposes implementer contract names. */
+export type AgentIdentity = import("./identity.js").AgentIdentity;
+export type Principal = import("./identity.js").Principal;
+export type IdentityVerifier = import("./identity.js").IdentityVerifier;
+export type PersistenceLifecycleStore = import("./persistence-lifecycle.js").PersistenceLifecycleStore;
+export type LegalHoldRecord = import("./persistence-lifecycle.js").LegalHoldRecord;
+export type TenantQuota = import("./persistence-lifecycle.js").TenantQuota;
+export type PersistenceResourceKind = import("./persistence-lifecycle.js").PersistenceResourceKind;

package/dist/extensions.d.ts

@@ -4,12 +4,23 @@ import { type MiddlewareRegistry } from "./middleware.js";
 import { type PermissionPolicy } from "./security.js";
 export type ExtensionEventHandler = (event: ExtensionEvent) => void | Promise<void>;
 export type ExtensionErrorPolicy = "event" | "throw";
+export interface ExtensionLoadPolicy {
+    /** When set, only listed extension names may load. */
+    readonly allowList?: readonly string[];
+    /**
+     * Host signature / attestation check. Return false or throw to deny.
+     * Unsigned extensions fail closed when this callback is provided.
+     */
+    readonly verifySignature?: (extension: Extension) => boolean | Promise<boolean>;
+}
 export interface ExtensionKernelOptions {
     readonly registries?: ContributionRegistries;
     readonly middleware?: MiddlewareRegistry;
     readonly errorPolicy?: ExtensionErrorPolicy;
     readonly secrets?: readonly (string | undefined)[];
     readonly permission?: PermissionPolicy;
+    /** Optional allow-list / signature policy evaluated before `setup`. */
+    readonly loadPolicy?: ExtensionLoadPolicy;
 }
 export interface ExtensionEventBus {
     on(type: ExtensionLifecycleEventName | string, handler: ExtensionEventHandler): () => void;

package/dist/extensions.js

@@ -120,6 +120,7 @@ export function createExtensionKernel(options = {}) {
             for (const extension of extensions) {
                 try {
                     await assertPermission(options.permission, { kind: "extension", action: "setup", target: extension.name });
+                    await assertExtensionLoadPolicy(options.loadPolicy, extension);
                     await extension.setup(api);
                 }
                 catch (error) {
@@ -131,4 +132,18 @@ export function createExtensionKernel(options = {}) {
         },
     };
 }
+async function assertExtensionLoadPolicy(policy, extension) {
+    if (!policy)
+        return;
+    if (policy.allowList && !policy.allowList.includes(extension.name)) {
+        throw new Error(`Extension "${extension.name}" is not allow-listed`);
+    }
+    if (policy.verifySignature) {
+        if (!extension.signature)
+            throw new Error(`Extension "${extension.name}" is unsigned`);
+        const ok = await policy.verifySignature(extension);
+        if (!ok)
+            throw new Error(`Extension "${extension.name}" failed signature verification`);
+    }
+}
 //# sourceMappingURL=extensions.js.map

package/dist/identity.d.ts

@@ -0,0 +1,92 @@
+import type { OwnershipScope } from "./contracts.js";
+/** Host-authenticated actor (user, service, or agent principal). */
+export interface Principal {
+    readonly kind: "user" | "service" | "agent" | string;
+    readonly id: string;
+    readonly displayName?: string;
+}
+/**
+ * Host-verified identity context. Projects onto {@link OwnershipScope}.
+ * `verified: true` marks host-verifier output; trust boundaries must obtain this
+ * via {@link IdentityVerifier}, never by accepting caller-asserted claims alone.
+ */
+export interface AgentIdentity {
+    readonly tenantId: string;
+    readonly accountId?: string;
+    readonly userId?: string;
+    /** Acting principal for this run/tool/delegation. */
+    readonly principal: Principal;
+    /** Human sponsor accountable for the agent lifecycle (Entra-style). */
+    readonly sponsor?: Principal;
+    /** Resource owner when distinct from sponsor. */
+    readonly owner?: Principal;
+    /** Parent principal when this identity is a narrowed delegation. */
+    readonly delegatedFrom?: Principal;
+    readonly scopes: readonly string[];
+    /** Late-bound credential resolver keys — never secret material. */
+    readonly credentialRefs?: readonly string[];
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+    readonly revokedAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly verified: true;
+}
+export interface IdentityVerifier {
+    verify(input: unknown): AgentIdentity | Promise<AgentIdentity>;
+}
+export interface AssertIdentityActiveOptions {
+    readonly now?: number;
+    /** When set, identity.tenantId must equal this value. */
+    readonly expectedTenantId?: string;
+    readonly limits?: IdentityLimits;
+}
+export interface NarrowIdentityOptions {
+    readonly scopes: readonly string[];
+    readonly principal?: Principal;
+    readonly credentialRefs?: readonly string[];
+    readonly expiresAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly limits?: IdentityLimits;
+}
+export interface IdentityLimits {
+    readonly maxScopes?: number;
+    readonly maxScopeBytes?: number;
+    readonly maxMetadataBytes?: number;
+    readonly maxCredentialRefBytes?: number;
+    readonly maxPrincipalIdBytes?: number;
+}
+export interface ResolvedIdentityLimits {
+    readonly maxScopes: number;
+    readonly maxScopeBytes: number;
+    readonly maxMetadataBytes: number;
+    readonly maxCredentialRefBytes: number;
+    readonly maxPrincipalIdBytes: number;
+}
+export declare const DEFAULT_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare const HARD_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare class IdentityError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_IDENTITY";
+    constructor(message: string, reason: string);
+}
+export declare function resolveIdentityLimits(input?: IdentityLimits): ResolvedIdentityLimits;
+/** Project verified identity onto ownership scope fields used by persistence/server. */
+export declare function ownershipFromIdentity(identity: AgentIdentity): OwnershipScope;
+/**
+ * Fail closed on shape/limits/expiry/revocation/tenant mismatch.
+ * Sync and network-free — host {@link IdentityVerifier} owns remote checks.
+ */
+export declare function assertIdentityActive(identity: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Delegation may only narrow scopes; tenant and ownership ids stay immutable. */
+export declare function narrowIdentity(parent: AgentIdentity, options: NarrowIdentityOptions): AgentIdentity;
+/** Refuse ownership that widens or conflicts with a verified identity. */
+export declare function assertIdentityMatchesOwnership(identity: AgentIdentity, ownership?: OwnershipScope): void;
+/**
+ * Propagation check: child must share tenant, not widen scopes, and remain active.
+ * Used by supervisor/A2A/MCP/server when forwarding identity across a boundary.
+ */
+export declare function assertIdentityPropagation(parent: AgentIdentity, child: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Redacted identity refs safe for telemetry/ledger metadata (no secrets, no raw JWT). */
+export declare function identityTelemetryAttributes(identity: AgentIdentity): Readonly<Record<string, string>>;
+/** Resolve run identity: explicit option wins; otherwise agent default. Assert when present. */
+export declare function resolveRunIdentity(runIdentity: AgentIdentity | undefined, agentIdentity: AgentIdentity | undefined, ownership: OwnershipScope | undefined, options?: AssertIdentityActiveOptions): AgentIdentity | undefined;