@arnilo/prism 0.0.12 → 0.0.13

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.0.13] - 2026-07-24
+
+### Added
+
+- Enterprise identity (`Principal` / `AgentIdentity`), optional `@arnilo/prism-policy`, `@arnilo/prism-model-router`, enterprise cloud providers (Azure/Bedrock/Vertex), server deployment seams, persistence schema v5 lifecycle hooks, and `@arnilo/prism-work-tools` (M365 + GWS).
+
+### Changed
+
+- Versioned all **41** first-party manifests and exact internal ranges to `0.0.13`; Phase 8 optional packages enroll in `@arnilo/prism-all` only.
+- Network-free enterprise evidence: `scripts/benchmark-0.0.13.mjs`.
+
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 

package/dist/agents.js

@@ -17,6 +17,7 @@ import { createToolRegistry, dispatchToolCall } from "./tools.js";
 import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions } from "./agent-run-state.js";
 import { resolveActiveSkills } from "./skills.js";
+import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity, } from "./identity.js";
 export function createAgent(config) {
     return {
         config,
@@ -154,6 +155,7 @@ class RuntimeAgentSession {
     activeProvider;
     activeLedger;
     activeOwnership;
+    activeIdentity;
     activeIdempotencyKey;
     activeGuardrails;
     activeMetadata;
@@ -261,6 +263,9 @@ class RuntimeAgentSession {
         this.activeRedactor = options.redactor ?? this.agent.config.redactor;
         this.activeLedger = options.runLedger ?? this.agent.config.runLedger;
         this.activeOwnership = options.ownership ?? this.agent.config.ownership;
+        this.activeIdentity = resolveRunIdentity(options.identity, this.agent.config.identity, this.activeOwnership);
+        if (this.activeIdentity && !this.activeOwnership)
+            this.activeOwnership = ownershipFromIdentity(this.activeIdentity);
         this.activeIdempotencyKey = options.idempotencyKey ?? this.agent.config.idempotencyKey;
         this.activeGuardrails = mergeGuardrails(this.agent.config.guardrails, options.guardrails);
         this.activeDurable = resumed ?? (durableOptions ? { options: durableOptions, version: 0 } : undefined);
@@ -272,7 +277,12 @@ class RuntimeAgentSession {
         let runStatus = "succeeded";
         const runUsage = createUsageAccumulator();
         let usage;
-        const metadata = { ...this.agent.config.metadata, ...this.metadata, ...options.metadata };
+        const metadata = {
+            ...this.agent.config.metadata,
+            ...this.metadata,
+            ...options.metadata,
+            ...(this.activeIdentity ? identityTelemetryAttributes(this.activeIdentity) : {}),
+        };
         this.activeMetadata = metadata;
         const limits = new RunLimitTracker(resolvedLimits, {
             onExceeded: (breach) => {
@@ -434,7 +444,14 @@ class RuntimeAgentSession {
                 dispatchToolCall: (call) => dispatchToolCall({
                     call,
                     registry,
-                    context: { sessionId: this.id, runId, toolCallId: call.id, signal: controller.signal, metadata },
+                    context: {
+                        sessionId: this.id,
+                        runId,
+                        toolCallId: call.id,
+                        signal: controller.signal,
+                        metadata,
+                        identity: this.activeIdentity,
+                    },
                     middleware: this.agent.config.middleware,
                     emit: (event) => this.emit(event),
                     permission: this.agent.config.permission,
@@ -442,6 +459,7 @@ class RuntimeAgentSession {
                     redactor: this.activeRedactor,
                     ledger: this.activeLedger,
                     ownership: this.activeOwnership,
+                    identity: this.activeIdentity,
                     guardrails: this.activeGuardrails,
                     limitTracker: limits,
                     beforeExecute: async (mediatedCall) => {
@@ -577,6 +595,7 @@ class RuntimeAgentSession {
             finally {
                 this.activeLedger = undefined;
                 this.activeOwnership = undefined;
+                this.activeIdentity = undefined;
                 this.activeIdempotencyKey = undefined;
                 this.activeGuardrails = undefined;
                 this.activeMetadata = undefined;

package/dist/contracts.d.ts

@@ -287,6 +287,8 @@ export interface RunOptions {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity; when set, must project onto `ownership` without widening. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly validate?: ToolValidator;
     readonly activeSkills?: readonly string[];
@@ -352,6 +354,8 @@ export interface AgentConfig {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity default for sessions created from this agent. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly compaction?: false | CompactionOptions;
     readonly retry?: false | RetryOptions;
@@ -369,7 +373,7 @@ export interface AgentConfig {
     readonly secure?: true;
 }
 /** Opt-in fail-closed composition over the normal explicit AgentConfig API. */
-export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "limits" | "runState" | "secure"> {
+export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "identity" | "limits" | "runState" | "secure"> {
     readonly id: string;
     readonly tools: readonly ToolDefinition[];
     readonly toolArgumentValidator: import("./tools.js").ToolArgumentValidator;
@@ -377,6 +381,8 @@ export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validat
     readonly permission: PermissionPolicy;
     readonly trust: TrustPolicy;
     readonly ownership: OwnershipScope;
+    /** Optional host-verified identity; when set must match `ownership`. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly limits: RunLimits;
     readonly definitionRevision: string;
     readonly runState: Omit<AgentRunStateOptions, "definitionRevision" | "interruptBeforeTool">;
@@ -750,6 +756,8 @@ export interface ToolExecutionContext {
     readonly toolCallId: string;
     readonly signal?: AbortSignal;
     readonly metadata?: Readonly<Record<string, unknown>>;
+    /** Host-verified identity for this tool invocation, when enterprise identity is active. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     progress?(progress?: unknown, metadata?: Readonly<Record<string, unknown>>): void | Promise<void>;
 }
 export interface ToolResult {
@@ -900,6 +908,9 @@ export interface ExtensionEvent {
 export interface Extension {
     readonly name: string;
     setup(api: ExtensionAPI): void | Promise<void>;
+    /** Host-attested signature/digest for `ExtensionLoadPolicy.verifySignature`. */
+    readonly signature?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface ProviderPackage {
     readonly name: string;
@@ -1605,6 +1616,11 @@ export interface ProductionPersistenceStore {
     /** DB-friendly branch read (mirrors `SessionStore.readBranchPath`): one ancestor-chain
      *  query instead of `queryEntries({ sessionId })` + in-memory walk. Optional. */
     readBranchPath?(query: SessionBranchRead): Promise<PersistencePage<SessionEntry>>;
+    /**
+     * Optional Phase 8 retention / legal-hold / export / tenant-quota lifecycle.
+     * Prefer attaching `createMemoryPersistenceLifecycle()` or adapter-native methods.
+     */
+    readonly lifecycle?: import("./persistence-lifecycle.js").PersistenceLifecycleStore;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface CompactionStrategy {
@@ -1796,3 +1812,11 @@ export interface ArtifactParseResult<T> {
 export type ArtifactParser<T> = (text: string, ctx: ArtifactContext) => ArtifactParseResult<T> | Promise<ArtifactParseResult<T>>;
 export type ArtifactValidator<T> = (value: T, ctx: ArtifactContext) => ArtifactValidation | Promise<ArtifactValidation>;
 export type ArtifactRepairer<T> = (value: T | undefined, failure: ArtifactValidation, ctx: ArtifactContext) => AgentInput | Promise<AgentInput>;
+/** Alias re-exports so `dist/contracts.d.ts` exposes implementer contract names. */
+export type AgentIdentity = import("./identity.js").AgentIdentity;
+export type Principal = import("./identity.js").Principal;
+export type IdentityVerifier = import("./identity.js").IdentityVerifier;
+export type PersistenceLifecycleStore = import("./persistence-lifecycle.js").PersistenceLifecycleStore;
+export type LegalHoldRecord = import("./persistence-lifecycle.js").LegalHoldRecord;
+export type TenantQuota = import("./persistence-lifecycle.js").TenantQuota;
+export type PersistenceResourceKind = import("./persistence-lifecycle.js").PersistenceResourceKind;

package/dist/extensions.d.ts

@@ -4,12 +4,23 @@ import { type MiddlewareRegistry } from "./middleware.js";
 import { type PermissionPolicy } from "./security.js";
 export type ExtensionEventHandler = (event: ExtensionEvent) => void | Promise<void>;
 export type ExtensionErrorPolicy = "event" | "throw";
+export interface ExtensionLoadPolicy {
+    /** When set, only listed extension names may load. */
+    readonly allowList?: readonly string[];
+    /**
+     * Host signature / attestation check. Return false or throw to deny.
+     * Unsigned extensions fail closed when this callback is provided.
+     */
+    readonly verifySignature?: (extension: Extension) => boolean | Promise<boolean>;
+}
 export interface ExtensionKernelOptions {
     readonly registries?: ContributionRegistries;
     readonly middleware?: MiddlewareRegistry;
     readonly errorPolicy?: ExtensionErrorPolicy;
     readonly secrets?: readonly (string | undefined)[];
     readonly permission?: PermissionPolicy;
+    /** Optional allow-list / signature policy evaluated before `setup`. */
+    readonly loadPolicy?: ExtensionLoadPolicy;
 }
 export interface ExtensionEventBus {
     on(type: ExtensionLifecycleEventName | string, handler: ExtensionEventHandler): () => void;

package/dist/extensions.js

@@ -120,6 +120,7 @@ export function createExtensionKernel(options = {}) {
             for (const extension of extensions) {
                 try {
                     await assertPermission(options.permission, { kind: "extension", action: "setup", target: extension.name });
+                    await assertExtensionLoadPolicy(options.loadPolicy, extension);
                     await extension.setup(api);
                 }
                 catch (error) {
@@ -131,4 +132,18 @@ export function createExtensionKernel(options = {}) {
         },
     };
 }
+async function assertExtensionLoadPolicy(policy, extension) {
+    if (!policy)
+        return;
+    if (policy.allowList && !policy.allowList.includes(extension.name)) {
+        throw new Error(`Extension "${extension.name}" is not allow-listed`);
+    }
+    if (policy.verifySignature) {
+        if (!extension.signature)
+            throw new Error(`Extension "${extension.name}" is unsigned`);
+        const ok = await policy.verifySignature(extension);
+        if (!ok)
+            throw new Error(`Extension "${extension.name}" failed signature verification`);
+    }
+}
 //# sourceMappingURL=extensions.js.map

package/dist/identity.d.ts

@@ -0,0 +1,92 @@
+import type { OwnershipScope } from "./contracts.js";
+/** Host-authenticated actor (user, service, or agent principal). */
+export interface Principal {
+    readonly kind: "user" | "service" | "agent" | string;
+    readonly id: string;
+    readonly displayName?: string;
+}
+/**
+ * Host-verified identity context. Projects onto {@link OwnershipScope}.
+ * `verified: true` marks host-verifier output; trust boundaries must obtain this
+ * via {@link IdentityVerifier}, never by accepting caller-asserted claims alone.
+ */
+export interface AgentIdentity {
+    readonly tenantId: string;
+    readonly accountId?: string;
+    readonly userId?: string;
+    /** Acting principal for this run/tool/delegation. */
+    readonly principal: Principal;
+    /** Human sponsor accountable for the agent lifecycle (Entra-style). */
+    readonly sponsor?: Principal;
+    /** Resource owner when distinct from sponsor. */
+    readonly owner?: Principal;
+    /** Parent principal when this identity is a narrowed delegation. */
+    readonly delegatedFrom?: Principal;
+    readonly scopes: readonly string[];
+    /** Late-bound credential resolver keys — never secret material. */
+    readonly credentialRefs?: readonly string[];
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+    readonly revokedAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly verified: true;
+}
+export interface IdentityVerifier {
+    verify(input: unknown): AgentIdentity | Promise<AgentIdentity>;
+}
+export interface AssertIdentityActiveOptions {
+    readonly now?: number;
+    /** When set, identity.tenantId must equal this value. */
+    readonly expectedTenantId?: string;
+    readonly limits?: IdentityLimits;
+}
+export interface NarrowIdentityOptions {
+    readonly scopes: readonly string[];
+    readonly principal?: Principal;
+    readonly credentialRefs?: readonly string[];
+    readonly expiresAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly limits?: IdentityLimits;
+}
+export interface IdentityLimits {
+    readonly maxScopes?: number;
+    readonly maxScopeBytes?: number;
+    readonly maxMetadataBytes?: number;
+    readonly maxCredentialRefBytes?: number;
+    readonly maxPrincipalIdBytes?: number;
+}
+export interface ResolvedIdentityLimits {
+    readonly maxScopes: number;
+    readonly maxScopeBytes: number;
+    readonly maxMetadataBytes: number;
+    readonly maxCredentialRefBytes: number;
+    readonly maxPrincipalIdBytes: number;
+}
+export declare const DEFAULT_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare const HARD_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare class IdentityError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_IDENTITY";
+    constructor(message: string, reason: string);
+}
+export declare function resolveIdentityLimits(input?: IdentityLimits): ResolvedIdentityLimits;
+/** Project verified identity onto ownership scope fields used by persistence/server. */
+export declare function ownershipFromIdentity(identity: AgentIdentity): OwnershipScope;
+/**
+ * Fail closed on shape/limits/expiry/revocation/tenant mismatch.
+ * Sync and network-free — host {@link IdentityVerifier} owns remote checks.
+ */
+export declare function assertIdentityActive(identity: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Delegation may only narrow scopes; tenant and ownership ids stay immutable. */
+export declare function narrowIdentity(parent: AgentIdentity, options: NarrowIdentityOptions): AgentIdentity;
+/** Refuse ownership that widens or conflicts with a verified identity. */
+export declare function assertIdentityMatchesOwnership(identity: AgentIdentity, ownership?: OwnershipScope): void;
+/**
+ * Propagation check: child must share tenant, not widen scopes, and remain active.
+ * Used by supervisor/A2A/MCP/server when forwarding identity across a boundary.
+ */
+export declare function assertIdentityPropagation(parent: AgentIdentity, child: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Redacted identity refs safe for telemetry/ledger metadata (no secrets, no raw JWT). */
+export declare function identityTelemetryAttributes(identity: AgentIdentity): Readonly<Record<string, string>>;
+/** Resolve run identity: explicit option wins; otherwise agent default. Assert when present. */
+export declare function resolveRunIdentity(runIdentity: AgentIdentity | undefined, agentIdentity: AgentIdentity | undefined, ownership: OwnershipScope | undefined, options?: AssertIdentityActiveOptions): AgentIdentity | undefined;

package/dist/identity.js

@@ -0,0 +1,257 @@
+export const DEFAULT_IDENTITY_LIMITS = {
+    maxScopes: 64,
+    maxScopeBytes: 128,
+    maxMetadataBytes: 4 * 1024,
+    maxCredentialRefBytes: 256,
+    maxPrincipalIdBytes: 256,
+};
+export const HARD_IDENTITY_LIMITS = {
+    maxScopes: 256,
+    maxScopeBytes: 512,
+    maxMetadataBytes: 16 * 1024,
+    maxCredentialRefBytes: 2 * 1024,
+    maxPrincipalIdBytes: 2 * 1024,
+};
+export class IdentityError extends Error {
+    reason;
+    code = "ERR_PRISM_IDENTITY";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "IdentityError";
+    }
+}
+export function resolveIdentityLimits(input = {}) {
+    return {
+        maxScopes: bound("maxScopes", input.maxScopes, DEFAULT_IDENTITY_LIMITS.maxScopes, HARD_IDENTITY_LIMITS.maxScopes),
+        maxScopeBytes: bound("maxScopeBytes", input.maxScopeBytes, DEFAULT_IDENTITY_LIMITS.maxScopeBytes, HARD_IDENTITY_LIMITS.maxScopeBytes),
+        maxMetadataBytes: bound("maxMetadataBytes", input.maxMetadataBytes, DEFAULT_IDENTITY_LIMITS.maxMetadataBytes, HARD_IDENTITY_LIMITS.maxMetadataBytes),
+        maxCredentialRefBytes: bound("maxCredentialRefBytes", input.maxCredentialRefBytes, DEFAULT_IDENTITY_LIMITS.maxCredentialRefBytes, HARD_IDENTITY_LIMITS.maxCredentialRefBytes),
+        maxPrincipalIdBytes: bound("maxPrincipalIdBytes", input.maxPrincipalIdBytes, DEFAULT_IDENTITY_LIMITS.maxPrincipalIdBytes, HARD_IDENTITY_LIMITS.maxPrincipalIdBytes),
+    };
+}
+/** Project verified identity onto ownership scope fields used by persistence/server. */
+export function ownershipFromIdentity(identity) {
+    return {
+        tenantId: identity.tenantId,
+        ...(identity.accountId !== undefined ? { accountId: identity.accountId } : {}),
+        ...(identity.userId !== undefined ? { userId: identity.userId } : {}),
+    };
+}
+/**
+ * Fail closed on shape/limits/expiry/revocation/tenant mismatch.
+ * Sync and network-free — host {@link IdentityVerifier} owns remote checks.
+ */
+export function assertIdentityActive(identity, options = {}) {
+    const limits = resolveIdentityLimits(options.limits);
+    assertIdentityShape(identity, limits);
+    if (identity.verified !== true)
+        throw new IdentityError("Identity is not host-verified", "unverified");
+    if (options.expectedTenantId !== undefined && identity.tenantId !== options.expectedTenantId) {
+        throw new IdentityError("Identity tenant mismatch", "wrong_tenant");
+    }
+    const now = options.now ?? Date.now();
+    if (identity.revokedAt !== undefined) {
+        const revokedAt = Date.parse(identity.revokedAt);
+        if (!Number.isFinite(revokedAt))
+            throw new IdentityError("Identity revokedAt is invalid", "invalid_revoked_at");
+        if (revokedAt <= now)
+            throw new IdentityError("Identity has been revoked", "revoked");
+    }
+    if (identity.expiresAt !== undefined) {
+        const expiresAt = Date.parse(identity.expiresAt);
+        if (!Number.isFinite(expiresAt))
+            throw new IdentityError("Identity expiresAt is invalid", "invalid_expires_at");
+        if (expiresAt <= now)
+            throw new IdentityError("Identity has expired", "expired");
+    }
+    const issuedAt = Date.parse(identity.issuedAt);
+    if (!Number.isFinite(issuedAt))
+        throw new IdentityError("Identity issuedAt is invalid", "invalid_issued_at");
+    if (issuedAt > now + 60_000)
+        throw new IdentityError("Identity issuedAt is in the future", "invalid_issued_at");
+}
+/** Delegation may only narrow scopes; tenant and ownership ids stay immutable. */
+export function narrowIdentity(parent, options) {
+    assertIdentityActive(parent, { limits: options.limits });
+    const limits = resolveIdentityLimits(options.limits);
+    if (options.scopes.length === 0)
+        throw new IdentityError("Delegated scopes must be non-empty", "empty_scopes");
+    const parentScopes = new Set(parent.scopes);
+    for (const scope of options.scopes) {
+        if (!parentScopes.has(scope))
+            throw new IdentityError(`Delegation widens scope: ${scope}`, "scope_widen");
+    }
+    if (options.expiresAt !== undefined) {
+        const childExp = Date.parse(options.expiresAt);
+        if (!Number.isFinite(childExp))
+            throw new IdentityError("Delegated expiresAt is invalid", "invalid_expires_at");
+        if (parent.expiresAt !== undefined) {
+            const parentExp = Date.parse(parent.expiresAt);
+            if (Number.isFinite(parentExp) && childExp > parentExp) {
+                throw new IdentityError("Delegation cannot extend expiry", "expiry_widen");
+            }
+        }
+    }
+    const child = {
+        tenantId: parent.tenantId,
+        ...(parent.accountId !== undefined ? { accountId: parent.accountId } : {}),
+        ...(parent.userId !== undefined ? { userId: parent.userId } : {}),
+        principal: options.principal ?? parent.principal,
+        ...(parent.sponsor !== undefined ? { sponsor: parent.sponsor } : {}),
+        ...(parent.owner !== undefined ? { owner: parent.owner } : {}),
+        delegatedFrom: parent.principal,
+        scopes: Object.freeze([...options.scopes]),
+        credentialRefs: Object.freeze([...(options.credentialRefs ?? parent.credentialRefs ?? [])]),
+        issuedAt: parent.issuedAt,
+        ...(options.expiresAt !== undefined ? { expiresAt: options.expiresAt } : parent.expiresAt !== undefined ? { expiresAt: parent.expiresAt } : {}),
+        ...(parent.revokedAt !== undefined ? { revokedAt: parent.revokedAt } : {}),
+        ...(options.metadata !== undefined ? { metadata: options.metadata } : parent.metadata !== undefined ? { metadata: parent.metadata } : {}),
+        verified: true,
+    };
+    assertIdentityActive(child, { limits: options.limits });
+    assertPrincipalBounds(child.principal, limits);
+    return child;
+}
+/** Refuse ownership that widens or conflicts with a verified identity. */
+export function assertIdentityMatchesOwnership(identity, ownership) {
+    assertIdentityActive(identity);
+    if (!ownership)
+        return;
+    if (ownership.tenantId !== undefined && ownership.tenantId !== identity.tenantId) {
+        throw new IdentityError("Ownership tenant conflicts with identity", "ownership_tenant");
+    }
+    if (ownership.accountId !== undefined) {
+        if (identity.accountId === undefined || ownership.accountId !== identity.accountId) {
+            throw new IdentityError("Ownership account conflicts with identity", "ownership_account");
+        }
+    }
+    if (ownership.userId !== undefined) {
+        if (identity.userId === undefined || ownership.userId !== identity.userId) {
+            throw new IdentityError("Ownership user conflicts with identity", "ownership_user");
+        }
+    }
+}
+/**
+ * Propagation check: child must share tenant, not widen scopes, and remain active.
+ * Used by supervisor/A2A/MCP/server when forwarding identity across a boundary.
+ */
+export function assertIdentityPropagation(parent, child, options = {}) {
+    assertIdentityActive(parent, options);
+    assertIdentityActive(child, options);
+    if (child.tenantId !== parent.tenantId)
+        throw new IdentityError("Propagated identity changed tenant", "tenant_widen");
+    if (parent.accountId !== undefined && child.accountId !== parent.accountId) {
+        throw new IdentityError("Propagated identity changed account", "account_widen");
+    }
+    if (parent.userId !== undefined && child.userId !== parent.userId) {
+        throw new IdentityError("Propagated identity changed user", "user_widen");
+    }
+    const parentScopes = new Set(parent.scopes);
+    for (const scope of child.scopes) {
+        if (!parentScopes.has(scope))
+            throw new IdentityError(`Propagated identity widens scope: ${scope}`, "scope_widen");
+    }
+}
+/** Redacted identity refs safe for telemetry/ledger metadata (no secrets, no raw JWT). */
+export function identityTelemetryAttributes(identity) {
+    assertIdentityActive(identity);
+    return {
+        "prism.identity.tenant_id": identity.tenantId,
+        "prism.identity.principal_kind": String(identity.principal.kind),
+        "prism.identity.principal_id": identity.principal.id,
+        "prism.identity.scope_count": String(identity.scopes.length),
+        ...(identity.accountId !== undefined ? { "prism.identity.account_id": identity.accountId } : {}),
+        ...(identity.userId !== undefined ? { "prism.identity.user_id": identity.userId } : {}),
+        ...(identity.sponsor !== undefined ? { "prism.identity.sponsor_id": identity.sponsor.id } : {}),
+        ...(identity.credentialRefs?.length ? { "prism.identity.credential_ref_count": String(identity.credentialRefs.length) } : {}),
+    };
+}
+/** Resolve run identity: explicit option wins; otherwise agent default. Assert when present. */
+export function resolveRunIdentity(runIdentity, agentIdentity, ownership, options = {}) {
+    const identity = runIdentity ?? agentIdentity;
+    if (!identity)
+        return undefined;
+    assertIdentityActive(identity, options);
+    assertIdentityMatchesOwnership(identity, ownership ?? ownershipFromIdentity(identity));
+    return identity;
+}
+function assertIdentityShape(identity, limits) {
+    if (typeof identity.tenantId !== "string" || identity.tenantId.length === 0) {
+        throw new IdentityError("Identity tenantId is required", "missing_tenant");
+    }
+    if (byteLength(identity.tenantId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity tenantId exceeds byte limit", "tenant_too_large");
+    }
+    assertPrincipalBounds(identity.principal, limits);
+    if (identity.sponsor)
+        assertPrincipalBounds(identity.sponsor, limits);
+    if (identity.owner)
+        assertPrincipalBounds(identity.owner, limits);
+    if (identity.delegatedFrom)
+        assertPrincipalBounds(identity.delegatedFrom, limits);
+    if (!Array.isArray(identity.scopes) || identity.scopes.length === 0) {
+        throw new IdentityError("Identity scopes must be a non-empty array", "empty_scopes");
+    }
+    if (identity.scopes.length > limits.maxScopes) {
+        throw new IdentityError(`Identity exceeds maxScopes (${limits.maxScopes})`, "too_many_scopes");
+    }
+    for (const scope of identity.scopes) {
+        if (typeof scope !== "string" || scope.length === 0)
+            throw new IdentityError("Identity scope is invalid", "invalid_scope");
+        if (byteLength(scope) > limits.maxScopeBytes)
+            throw new IdentityError("Identity scope exceeds byte limit", "scope_too_large");
+    }
+    if (identity.credentialRefs) {
+        for (const ref of identity.credentialRefs) {
+            if (typeof ref !== "string" || ref.length === 0)
+                throw new IdentityError("Credential ref is invalid", "invalid_credential_ref");
+            if (byteLength(ref) > limits.maxCredentialRefBytes) {
+                throw new IdentityError("Credential ref exceeds byte limit", "credential_ref_too_large");
+            }
+        }
+    }
+    if (identity.metadata !== undefined) {
+        let encoded;
+        try {
+            encoded = JSON.stringify(identity.metadata);
+        }
+        catch {
+            throw new IdentityError("Identity metadata is not JSON-serializable", "invalid_metadata");
+        }
+        if (byteLength(encoded) > limits.maxMetadataBytes) {
+            throw new IdentityError("Identity metadata exceeds byte limit", "metadata_too_large");
+        }
+    }
+    if (identity.accountId !== undefined && byteLength(identity.accountId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity accountId exceeds byte limit", "account_too_large");
+    }
+    if (identity.userId !== undefined && byteLength(identity.userId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity userId exceeds byte limit", "user_too_large");
+    }
+}
+function assertPrincipalBounds(principal, limits) {
+    if (typeof principal.id !== "string" || principal.id.length === 0) {
+        throw new IdentityError("Principal id is required", "missing_principal");
+    }
+    if (byteLength(principal.id) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Principal id exceeds byte limit", "principal_too_large");
+    }
+    if (typeof principal.kind !== "string" || principal.kind.length === 0 || byteLength(principal.kind) > 64) {
+        throw new IdentityError("Principal kind is invalid", "invalid_principal_kind");
+    }
+    if (principal.displayName !== undefined && byteLength(principal.displayName) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Principal displayName exceeds byte limit", "display_name_too_large");
+    }
+}
+function bound(name, value, fallback, hard) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > hard) {
+        throw new RangeError(`${name} must be a positive safe integer no greater than ${hard}`);
+    }
+    return resolved;
+}
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+//# sourceMappingURL=identity.js.map

package/dist/index.d.ts

@@ -14,6 +14,8 @@ export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export type { AgentRunLifecycle, AgentRunLifecycleAgent, AgentRunLifecycleOptions, AgentRunLifecycleRequest, AgentRunLifecycleStreamRequest } from "./agent-run-lifecycle.js";
 export type { MemoryCheckpointStoreOptions } from "./checkpoints.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
+export { createMemoryPersistenceLifecycle, isResourceHeld, PersistenceLifecycleError, DEFAULT_LIFECYCLE_PAGE_SIZE, HARD_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_MAX_HOLD_REASON_BYTES, } from "./persistence-lifecycle.js";
+export type { PersistenceResourceKind, LegalHoldRecord, PutLegalHoldInput, ReleaseLegalHoldInput, LegalHoldQuery, ApplyRetentionInput, ApplyRetentionResult, LegalHoldExportItem, ExportUnderHoldInput, TenantQuota, SetTenantQuotaInput, ConsumeTenantQuotaInput, PersistenceLifecycleStore, } from "./persistence-lifecycle.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
 export type { EventMultiplexer, EventMultiplexerOptions, EventOverflowInfo, EventOverflowPolicy } from "./event-multiplexer.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
@@ -30,7 +32,7 @@ export { createContributionRegistries, createContributionRegistry, registerDisco
 export type { ContributionRegistries, ContributionRegistriesOptions, ContributionRegistry, ContributionRegistryOptions } from "./contributions.js";
 export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, resolveCredentialValue } from "./credentials.js";
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
-export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, ExtensionKernel, ExtensionKernelOptions } from "./extensions.js";
+export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, ExtensionKernel, ExtensionKernelOptions, ExtensionLoadPolicy } from "./extensions.js";
 export type { CredentialRecord, CredentialValueSource, MemoryCredentialStore } from "./credentials.js";
 export { createModelRegistry } from "./models.js";
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
@@ -70,6 +72,8 @@ export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage
 export type { SecretRedactor } from "./redaction.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError } from "./security.js";
 export type { PermissionDecision, PermissionPolicy, PermissionRequest, TrustDecision, TrustPolicy, TrustRequest } from "./security.js";
+export { assertIdentityActive, assertIdentityMatchesOwnership, assertIdentityPropagation, DEFAULT_IDENTITY_LIMITS, HARD_IDENTITY_LIMITS, IdentityError, identityTelemetryAttributes, narrowIdentity, ownershipFromIdentity, resolveIdentityLimits, resolveRunIdentity, } from "./identity.js";
+export type { AgentIdentity, AssertIdentityActiveOptions, IdentityLimits, IdentityVerifier, NarrowIdentityOptions, Principal, ResolvedIdentityLimits, } from "./identity.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export type { ExecutionAction, ExecutionDecision, ExecutionPolicy, ExecutionRisk } from "./execution-policy.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
@@ -85,5 +89,5 @@ export type { DispatchToolCallOptions, ToolArgumentValidationError, ToolArgument
 export type { DuplicateRegistrationOptions, DuplicateRegistrationPolicy } from "./registry-options.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export declare const name = "prism";
-export declare const version = "0.0.12";
+export declare const version = "0.0.13";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -7,6 +7,7 @@ export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpoi
 export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, DEFAULT_MAX_AGENT_RUN_STATE_BYTES, HARD_MAX_AGENT_RUN_STATE_BYTES, agentFingerprint, loadAgentRunState } from "./agent-run-state.js";
 export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
+export { createMemoryPersistenceLifecycle, isResourceHeld, PersistenceLifecycleError, DEFAULT_LIFECYCLE_PAGE_SIZE, HARD_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_MAX_HOLD_REASON_BYTES, } from "./persistence-lifecycle.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
 export { resolveAgentDefinition } from "./agent-definitions.js";
@@ -38,6 +39,7 @@ export { providerContentDelta, providerDone, providerError, providerTextDelta, p
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry } from "./redaction.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError } from "./security.js";
+export { assertIdentityActive, assertIdentityMatchesOwnership, assertIdentityPropagation, DEFAULT_IDENTITY_LIMITS, HARD_IDENTITY_LIMITS, IdentityError, identityTelemetryAttributes, narrowIdentity, ownershipFromIdentity, resolveIdentityLimits, resolveRunIdentity, } from "./identity.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 export { resolveInstructionInjectors, runInstructionInjectors } from "./instruction-injection.js";
@@ -46,6 +48,6 @@ export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, run
 export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export const name = "prism";
-export const version = "0.0.12";
+export const version = "0.0.13";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map