@arnilo/prism 0.0.12 → 0.0.14

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.0.14] - 2026-07-26
+
+### Added
+
+- Phase 9 personal/work-agent surfaces: durable conversation service (`createConversationService`), durable artifact service with review/approval/authorized delivery (`createArtifactService`), memory consent + lifecycle (`setConsent`/`correct`/`forget`/`applyRetention`), AG-UI co-work events (`mapCoWork` + ACP parity), scoped M365/GWS OAuth connectors (`revokeOAuthCredential`, `createOAuthWorkTokenProvider`), a browser verified-state checkpoint ledger, and a deny-by-default device adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`).
+- New optional provider packages `@arnilo/prism-provider-alibaba` (Model Studio / DashScope + Coding Plan) and `@arnilo/prism-provider-ollama` (cloud/local), both with dynamic model discovery; enrolled via `@arnilo/prism-providers`.
+
+### Changed
+
+- Versioned all **43** first-party manifests and exact internal ranges to `0.0.14` (41 → 43; only the two provider packages are new).
+- Network-free Phase 9 evidence: `scripts/benchmark-0.0.14.mjs`.
+
+## [0.0.13] - 2026-07-24
+
+### Added
+
+- Enterprise identity (`Principal` / `AgentIdentity`), optional `@arnilo/prism-policy`, `@arnilo/prism-model-router`, enterprise cloud providers (Azure/Bedrock/Vertex), server deployment seams, persistence schema v5 lifecycle hooks, and `@arnilo/prism-work-tools` (M365 + GWS).
+
+### Changed
+
+- Versioned all **41** first-party manifests and exact internal ranges to `0.0.13`; Phase 8 optional packages enroll in `@arnilo/prism-all` only.
+- Network-free enterprise evidence: `scripts/benchmark-0.0.13.mjs`.
+
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 

package/README.md

@@ -17,7 +17,7 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: six provider adapters, two compaction strategies,
+- **First-party packages**: fourteen provider adapters, two compaction strategies,
   coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
   encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
@@ -34,6 +34,10 @@ packages. Prism defines contracts, not apps.
 - **Config, settings, security**: layered config merge, settings providers,
   credential resolvers, trust/permission policies, and secret redaction.
 - **CLI/RPC/server**: `prism --mode print|json|rpc`, `prism init`, optional framework-free authorized Web agent/workflow routes, and explicit MCP server exposure.
+- **Co-work contracts (0.0.14)**: conversation thread and artifact/review types, a
+  deny-by-default device-adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`),
+  and OAuth refresh/revoke helpers; services ship in `@arnilo/prism-server` and
+  `@arnilo/prism-credentials-node`.
 
 ## Install
 
@@ -150,6 +154,8 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-zai` | ZAI GLM provider |
 | `@arnilo/prism-provider-kimi` | Kimi For Coding provider |
 | `@arnilo/prism-provider-neuralwatt` | NeuralWatt provider with implicit vLLM prefix caching |
+| `@arnilo/prism-provider-alibaba` | Alibaba Cloud (Model Studio / DashScope + Coding Plan) provider with dynamic discovery and explicit/implicit caching |
+| `@arnilo/prism-provider-ollama` | Ollama Cloud / local provider with dynamic discovery and implicit-only caching |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
 | `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
@@ -163,7 +169,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
 | `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases/owned run feedback |
-| `@arnilo/prism-providers` | family: all 7 provider adapters, including AI SDK interoperability |
+| `@arnilo/prism-providers` | family: all 11 provider adapters, including AI SDK interoperability |
 | `@arnilo/prism-compaction` | family: both compaction strategies |
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |

package/dist/agents.js

@@ -17,6 +17,7 @@ import { createToolRegistry, dispatchToolCall } from "./tools.js";
 import { RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 import { agentFingerprint, initialAgentRunState, loadAgentRunState, publicState, saveAgentRunState, validateRunStateOptions } from "./agent-run-state.js";
 import { resolveActiveSkills } from "./skills.js";
+import { identityTelemetryAttributes, ownershipFromIdentity, resolveRunIdentity, } from "./identity.js";
 export function createAgent(config) {
     return {
         config,
@@ -154,6 +155,7 @@ class RuntimeAgentSession {
     activeProvider;
     activeLedger;
     activeOwnership;
+    activeIdentity;
     activeIdempotencyKey;
     activeGuardrails;
     activeMetadata;
@@ -261,6 +263,9 @@ class RuntimeAgentSession {
         this.activeRedactor = options.redactor ?? this.agent.config.redactor;
         this.activeLedger = options.runLedger ?? this.agent.config.runLedger;
         this.activeOwnership = options.ownership ?? this.agent.config.ownership;
+        this.activeIdentity = resolveRunIdentity(options.identity, this.agent.config.identity, this.activeOwnership);
+        if (this.activeIdentity && !this.activeOwnership)
+            this.activeOwnership = ownershipFromIdentity(this.activeIdentity);
         this.activeIdempotencyKey = options.idempotencyKey ?? this.agent.config.idempotencyKey;
         this.activeGuardrails = mergeGuardrails(this.agent.config.guardrails, options.guardrails);
         this.activeDurable = resumed ?? (durableOptions ? { options: durableOptions, version: 0 } : undefined);
@@ -272,7 +277,12 @@ class RuntimeAgentSession {
         let runStatus = "succeeded";
         const runUsage = createUsageAccumulator();
         let usage;
-        const metadata = { ...this.agent.config.metadata, ...this.metadata, ...options.metadata };
+        const metadata = {
+            ...this.agent.config.metadata,
+            ...this.metadata,
+            ...options.metadata,
+            ...(this.activeIdentity ? identityTelemetryAttributes(this.activeIdentity) : {}),
+        };
         this.activeMetadata = metadata;
         const limits = new RunLimitTracker(resolvedLimits, {
             onExceeded: (breach) => {
@@ -434,7 +444,14 @@ class RuntimeAgentSession {
                 dispatchToolCall: (call) => dispatchToolCall({
                     call,
                     registry,
-                    context: { sessionId: this.id, runId, toolCallId: call.id, signal: controller.signal, metadata },
+                    context: {
+                        sessionId: this.id,
+                        runId,
+                        toolCallId: call.id,
+                        signal: controller.signal,
+                        metadata,
+                        identity: this.activeIdentity,
+                    },
                     middleware: this.agent.config.middleware,
                     emit: (event) => this.emit(event),
                     permission: this.agent.config.permission,
@@ -442,6 +459,7 @@ class RuntimeAgentSession {
                     redactor: this.activeRedactor,
                     ledger: this.activeLedger,
                     ownership: this.activeOwnership,
+                    identity: this.activeIdentity,
                     guardrails: this.activeGuardrails,
                     limitTracker: limits,
                     beforeExecute: async (mediatedCall) => {
@@ -577,6 +595,7 @@ class RuntimeAgentSession {
             finally {
                 this.activeLedger = undefined;
                 this.activeOwnership = undefined;
+                this.activeIdentity = undefined;
                 this.activeIdempotencyKey = undefined;
                 this.activeGuardrails = undefined;
                 this.activeMetadata = undefined;

package/dist/artifacts.d.ts

@@ -0,0 +1,78 @@
+import type { OwnershipScope } from "./contracts.js";
+/**
+ * Durable artifact co-work review types (Phase 9 / 0.0.14). Core exports types only;
+ * the service + delivery-link signer live in `@arnilo/prism-server`. Prism persists bounded
+ * metadata, revisions, approvals, and delivery references — never file bodies (hosts own blobs).
+ */
+/** Review state of an artifact's latest revision. */
+export type ArtifactApprovalState = "pending" | "approved" | "rejected";
+/** A resolved decision on one revision (pending is the absence of a decision). */
+export type ArtifactDecisionState = Exclude<ArtifactApprovalState, "pending">;
+/** Bounded citation / data-source reference. Host resolves the body; Prism stores the ref only. */
+export interface ArtifactCitation {
+    readonly uri: string;
+    readonly title?: string;
+    /** Data-source kind (e.g. "web", "database", "upload"); host-defined, bounded. */
+    readonly kind?: string;
+}
+/** One immutable revision of an artifact. `uri`/`hash` reference host-owned content. */
+export interface ArtifactRevision {
+    /** 1-based, monotonic within the artifact. */
+    readonly version: number;
+    /** Host-owned blob reference (redacted; never a local filesystem path). */
+    readonly uri: string;
+    readonly mime: string;
+    /** Host-computed content hash for integrity compare. */
+    readonly hash: string;
+    readonly changeNote?: string;
+    /** Run that produced this revision, if any. */
+    readonly producerRunId?: string;
+    readonly citations?: readonly ArtifactCitation[];
+    /** Preview metadata only; the host renders content. */
+    readonly preview?: Readonly<Record<string, unknown>>;
+    readonly createdAt: string;
+}
+/** A reviewer decision on a specific revision. */
+export interface ArtifactApproval {
+    readonly version: number;
+    readonly state: ArtifactDecisionState;
+    /** Redacted reviewer actor reference. */
+    readonly reviewer: string;
+    /** Change-request / rejection note. */
+    readonly note?: string;
+    readonly decidedAt: string;
+}
+/**
+ * Durable artifact record. Stored as a versioned checkpoint value; the checkpoint version
+ * is the CAS counter for concurrent reviewers, distinct from revision numbers.
+ */
+export interface ArtifactRecord extends OwnershipScope {
+    readonly id: string;
+    readonly threadId: string;
+    readonly title?: string;
+    readonly revisions: readonly ArtifactRevision[];
+    readonly approvals: readonly ArtifactApproval[];
+    /** Last approved revision; remains recoverable after a later rejection. */
+    readonly lastValidatedVersion?: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** Signed, expiring delivery authorization. Reauthorized per download; never a bearer secret. */
+export interface ArtifactDeliveryToken extends OwnershipScope {
+    readonly artifactId: string;
+    readonly threadId: string;
+    readonly version: number;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+/** Well-known checkpoint namespace for artifact records. */
+export declare const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export declare class ArtifactError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_ARTIFACT";
+    constructor(message: string, reason: string);
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export declare function artifactCheckpointKey(threadId: string, artifactId: string): string;
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export declare function artifactApprovalState(record: ArtifactRecord): ArtifactApprovalState;

package/dist/artifacts.js

@@ -0,0 +1,24 @@
+/** Well-known checkpoint namespace for artifact records. */
+export const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export class ArtifactError extends Error {
+    reason;
+    code = "ERR_PRISM_ARTIFACT";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ArtifactError";
+    }
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export function artifactCheckpointKey(threadId, artifactId) {
+    return `${threadId}:${artifactId}`;
+}
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export function artifactApprovalState(record) {
+    const latest = record.revisions[record.revisions.length - 1];
+    if (latest === undefined)
+        return "pending";
+    const decision = record.approvals.find((approval) => approval.version === latest.version);
+    return decision?.state ?? "pending";
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/contracts.d.ts

@@ -287,6 +287,8 @@ export interface RunOptions {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity; when set, must project onto `ownership` without widening. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly validate?: ToolValidator;
     readonly activeSkills?: readonly string[];
@@ -352,6 +354,8 @@ export interface AgentConfig {
     readonly redactor?: SecretRedactor;
     readonly runLedger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity default for sessions created from this agent. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly idempotencyKey?: string;
     readonly compaction?: false | CompactionOptions;
     readonly retry?: false | RetryOptions;
@@ -369,7 +373,7 @@ export interface AgentConfig {
     readonly secure?: true;
 }
 /** Opt-in fail-closed composition over the normal explicit AgentConfig API. */
-export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "limits" | "runState" | "secure"> {
+export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "identity" | "limits" | "runState" | "secure"> {
     readonly id: string;
     readonly tools: readonly ToolDefinition[];
     readonly toolArgumentValidator: import("./tools.js").ToolArgumentValidator;
@@ -377,6 +381,8 @@ export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validat
     readonly permission: PermissionPolicy;
     readonly trust: TrustPolicy;
     readonly ownership: OwnershipScope;
+    /** Optional host-verified identity; when set must match `ownership`. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     readonly limits: RunLimits;
     readonly definitionRevision: string;
     readonly runState: Omit<AgentRunStateOptions, "definitionRevision" | "interruptBeforeTool">;
@@ -750,6 +756,8 @@ export interface ToolExecutionContext {
     readonly toolCallId: string;
     readonly signal?: AbortSignal;
     readonly metadata?: Readonly<Record<string, unknown>>;
+    /** Host-verified identity for this tool invocation, when enterprise identity is active. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     progress?(progress?: unknown, metadata?: Readonly<Record<string, unknown>>): void | Promise<void>;
 }
 export interface ToolResult {
@@ -900,6 +908,9 @@ export interface ExtensionEvent {
 export interface Extension {
     readonly name: string;
     setup(api: ExtensionAPI): void | Promise<void>;
+    /** Host-attested signature/digest for `ExtensionLoadPolicy.verifySignature`. */
+    readonly signature?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface ProviderPackage {
     readonly name: string;
@@ -957,6 +968,8 @@ export interface OAuthProvider {
     readonly id: string;
     login(callbacks?: OAuthLoginCallbacks): Promise<OAuthCredentials> | OAuthCredentials;
     refresh?(credentials: OAuthCredentials): Promise<OAuthCredentials> | OAuthCredentials;
+    /** Best-effort upstream revocation; the store delete is what fails closed locally. */
+    revoke?(credentials: OAuthCredentials): Promise<void> | void;
     getCredential?(credentials: OAuthCredentials): Promise<Credential | undefined> | Credential | undefined;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
@@ -1482,16 +1495,21 @@ export interface MigrationRecord {
 }
 /** Query for sessions. */
 export interface SessionQuery extends PersistenceQuery, OwnershipScope {
+    readonly id?: string;
     readonly parentSessionId?: string;
     readonly agentDefinitionId?: string;
     readonly agentDefinitionVersion?: string;
     readonly retentionPolicyId?: string;
+    /** Match sessions whose `metadata` object contains this top-level key (e.g. conversation marker). */
+    readonly metadataKey?: string;
     readonly fromCreatedAt?: string;
     readonly toCreatedAt?: string;
     readonly fromUpdatedAt?: string;
     readonly toUpdatedAt?: string;
     readonly hasExpired?: boolean;
 }
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export declare function assertSessionMetadataKey(key: string): string;
 /** Query for session entries. */
 export interface SessionEntryQuery extends PersistenceQuery, OwnershipScope {
     readonly sessionId?: string;
@@ -1602,9 +1620,17 @@ export interface ProductionPersistenceStore {
     queryAgentDefinitions(query: AgentDefinitionQuery): Promise<PersistencePage<AgentDefinitionRecord>>;
     queryRetentionPolicies(query: RetentionPolicyQuery): Promise<PersistencePage<RetentionPolicy>>;
     queryMigrations(query: MigrationQuery): Promise<PersistencePage<MigrationRecord>>;
+    /** Optional session-record write capability (conversation threads, host-managed sessions).
+     *  Upserts by id; ownership columns are set on create, `metadata`/`updatedAt` on update. */
+    appendSession?(record: SessionRecord): Promise<void>;
     /** DB-friendly branch read (mirrors `SessionStore.readBranchPath`): one ancestor-chain
      *  query instead of `queryEntries({ sessionId })` + in-memory walk. Optional. */
     readBranchPath?(query: SessionBranchRead): Promise<PersistencePage<SessionEntry>>;
+    /**
+     * Optional Phase 8 retention / legal-hold / export / tenant-quota lifecycle.
+     * Prefer attaching `createMemoryPersistenceLifecycle()` or adapter-native methods.
+     */
+    readonly lifecycle?: import("./persistence-lifecycle.js").PersistenceLifecycleStore;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface CompactionStrategy {
@@ -1796,3 +1822,11 @@ export interface ArtifactParseResult<T> {
 export type ArtifactParser<T> = (text: string, ctx: ArtifactContext) => ArtifactParseResult<T> | Promise<ArtifactParseResult<T>>;
 export type ArtifactValidator<T> = (value: T, ctx: ArtifactContext) => ArtifactValidation | Promise<ArtifactValidation>;
 export type ArtifactRepairer<T> = (value: T | undefined, failure: ArtifactValidation, ctx: ArtifactContext) => AgentInput | Promise<AgentInput>;
+/** Alias re-exports so `dist/contracts.d.ts` exposes implementer contract names. */
+export type AgentIdentity = import("./identity.js").AgentIdentity;
+export type Principal = import("./identity.js").Principal;
+export type IdentityVerifier = import("./identity.js").IdentityVerifier;
+export type PersistenceLifecycleStore = import("./persistence-lifecycle.js").PersistenceLifecycleStore;
+export type LegalHoldRecord = import("./persistence-lifecycle.js").LegalHoldRecord;
+export type TenantQuota = import("./persistence-lifecycle.js").TenantQuota;
+export type PersistenceResourceKind = import("./persistence-lifecycle.js").PersistenceResourceKind;

package/dist/contracts.js

@@ -128,4 +128,12 @@ export class SessionAppendConflictError extends Error {
 export function isSessionAppendConflict(error) {
     return error instanceof Error && error.code === SESSION_APPEND_CONFLICT_CODE;
 }
+const SESSION_METADATA_KEY_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export function assertSessionMetadataKey(key) {
+    if (typeof key !== "string" || !SESSION_METADATA_KEY_PATTERN.test(key)) {
+        throw new RangeError("metadataKey must match /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/");
+    }
+    return key;
+}
 //# sourceMappingURL=contracts.js.map

package/dist/conversations.d.ts

@@ -0,0 +1,50 @@
+import type { OwnershipScope, SessionRecord } from "./contracts.js";
+/** Conversation thread lifecycle state. Archive is soft; deletion goes through persistence lifecycle. */
+export type ConversationThreadState = "active" | "archived";
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export declare const CONVERSATION_METADATA_KEY = "prismConversation";
+export declare const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES: number;
+export declare const HARD_MAX_CONVERSATION_CURSOR_BYTES: number;
+export interface ConversationBranchRef {
+    readonly leafId: string;
+    readonly createdAt: string;
+}
+/**
+ * Durable user-scoped conversation thread. A thread is an ownership-scoped session
+ * branch plus metadata; content lives in session entries and the redacted event ledger.
+ */
+export interface ConversationThread extends OwnershipScope {
+    readonly id: string;
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    /** Branch leaves recorded by the conversation service; the entry tree remains the content source of truth. */
+    readonly branches: readonly ConversationBranchRef[];
+    /** Host-supplied create metadata; never credentials or raw transcripts. */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** Opaque thread-bound replay cursor; prevents replaying a cursor minted for another thread. */
+export interface ConversationReplayCursor {
+    readonly v: 1;
+    readonly threadId: string;
+    /** Opaque store keyset cursor; undefined means the start of the thread. */
+    readonly cursor?: string;
+}
+export declare class ConversationError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_CONVERSATION";
+    constructor(message: string, reason: string);
+}
+export declare function encodeConversationReplayCursor(cursor: ConversationReplayCursor): string;
+export declare function decodeConversationReplayCursor(encoded: string, expectedThreadId: string, maxBytes?: number): ConversationReplayCursor;
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export declare function conversationThreadFromRecord(record: SessionRecord): ConversationThread | undefined;
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export declare function conversationMarkerMetadata(marker: {
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly branches?: readonly ConversationBranchRef[];
+    readonly requestId?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}): Readonly<Record<string, unknown>>;

package/dist/conversations.js

@@ -0,0 +1,97 @@
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export const CONVERSATION_METADATA_KEY = "prismConversation";
+export const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES = 4 * 1024;
+export const HARD_MAX_CONVERSATION_CURSOR_BYTES = 16 * 1024;
+export class ConversationError extends Error {
+    reason;
+    code = "ERR_PRISM_CONVERSATION";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ConversationError";
+    }
+}
+export function encodeConversationReplayCursor(cursor) {
+    return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+export function decodeConversationReplayCursor(encoded, expectedThreadId, maxBytes = DEFAULT_MAX_CONVERSATION_CURSOR_BYTES) {
+    if (typeof encoded !== "string" || encoded.length === 0) {
+        throw new ConversationError("Replay cursor is required", "invalid_cursor");
+    }
+    if (Buffer.byteLength(encoded, "utf8") > maxBytes) {
+        throw new ConversationError("Replay cursor exceeds byte limit", "cursor_too_large");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    const cursor = parsed;
+    if (cursor.v !== 1 || typeof cursor.threadId !== "string" || cursor.threadId.length === 0) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (cursor.threadId !== expectedThreadId) {
+        throw new ConversationError("Replay cursor belongs to another thread", "cursor_thread_mismatch");
+    }
+    if (cursor.cursor !== undefined && (typeof cursor.cursor !== "string" || cursor.cursor.length === 0)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    return {
+        v: 1,
+        threadId: cursor.threadId,
+        ...(cursor.cursor === undefined ? {} : { cursor: cursor.cursor }),
+    };
+}
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export function conversationThreadFromRecord(record) {
+    const marker = record.metadata?.[CONVERSATION_METADATA_KEY];
+    if (!marker || typeof marker !== "object" || Array.isArray(marker))
+        return undefined;
+    const value = marker;
+    const branches = [];
+    if (Array.isArray(value.branches)) {
+        for (const item of value.branches) {
+            if (item && typeof item === "object" &&
+                typeof item.leafId === "string" &&
+                typeof item.createdAt === "string") {
+                branches.push({
+                    leafId: item.leafId,
+                    createdAt: item.createdAt,
+                });
+            }
+        }
+    }
+    const metadata = value.metadata && typeof value.metadata === "object" && !Array.isArray(value.metadata)
+        ? value.metadata
+        : undefined;
+    return {
+        id: record.id,
+        ...(record.tenantId !== undefined ? { tenantId: record.tenantId } : {}),
+        ...(record.accountId !== undefined ? { accountId: record.accountId } : {}),
+        ...(record.userId !== undefined ? { userId: record.userId } : {}),
+        ...(typeof value.title === "string" && value.title.length > 0 ? { title: value.title } : {}),
+        state: value.state === "archived" ? "archived" : "active",
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        branches: Object.freeze(branches),
+        ...(metadata === undefined ? {} : { metadata }),
+    };
+}
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export function conversationMarkerMetadata(marker) {
+    return {
+        [CONVERSATION_METADATA_KEY]: {
+            ...(marker.title === undefined ? {} : { title: marker.title }),
+            state: marker.state,
+            ...(marker.branches === undefined || marker.branches.length === 0 ? {} : { branches: marker.branches }),
+            ...(marker.requestId === undefined ? {} : { requestId: marker.requestId }),
+            ...(marker.metadata === undefined ? {} : { metadata: marker.metadata }),
+        },
+    };
+}
+//# sourceMappingURL=conversations.js.map

package/dist/credentials.d.ts

@@ -19,4 +19,18 @@ export declare function refreshOAuthCredential(options: {
     readonly credentials: OAuthCredentials;
     readonly store?: OAuthCredentialStore;
 }): Promise<OAuthCredentials>;
+/** A credential store that can also remove entries (revocation fails closed on the delete). */
+export interface RevocableOAuthCredentialStore extends OAuthCredentialStore {
+    delete(provider: string, accountId?: string): Promise<boolean> | boolean;
+}
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export declare function revokeOAuthCredential(options: {
+    readonly provider: OAuthProvider;
+    readonly credentials: OAuthCredentials;
+    readonly store?: RevocableOAuthCredentialStore;
+}): Promise<void>;
 export declare function resolveCredentialValue(source: CredentialValueSource | undefined, request: CredentialRequest): Promise<string | undefined>;

package/dist/credentials.js

@@ -48,6 +48,15 @@ export async function refreshOAuthCredential(options) {
     await options.store?.set(options.provider.id, refreshed);
     return refreshed;
 }
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export async function revokeOAuthCredential(options) {
+    await options.provider.revoke?.(options.credentials);
+    await options.store?.delete(options.provider.id, options.credentials.accountId);
+}
 function credentialMapKey(name, provider) {
     return provider ? `${provider}:${name}` : name;
 }

package/dist/devices.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Device adapter contract (realtime voice / desktop OS control) — 0.0.14.
+ *
+ * Contracts + deny-by-default policy ONLY. No vendor voice or desktop-control
+ * implementation ships in 0.0.14 (demand-gated to 0.1.x). This module composes
+ * over the existing `PermissionPolicy` / `RunLimits` / redactor seams; it adds
+ * no second approval runtime and no device framework. Hosts implement
+ * `DeviceAdapter`, resolve a policy, and admit sessions through the fail-closed
+ * gate below. Conformance fixtures (denial/approval/stream-bounds/redaction)
+ * live in `runDevicePolicyConformance` for future vendor adapters to run.
+ */
+import type { RunLimits } from "./contracts.js";
+import { type SecretRedactor } from "./redaction.js";
+/** Audio / screenshot / stream chunk: 1 MiB default / 8 MiB hard. */
+export declare const DEFAULT_DEVICE_MAX_CHUNK_BYTES: number;
+export declare const HARD_DEVICE_MAX_CHUNK_BYTES: number;
+/** Concurrent device sessions per identity: 1 default / 4 hard. */
+export declare const DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS = 1;
+export declare const HARD_DEVICE_MAX_CONCURRENT_SESSIONS = 4;
+export type DeviceKind = "voice" | "desktop-control";
+export type DevicePolicyErrorCode = "ERR_PRISM_DEVICE_INPUT" | "ERR_PRISM_DEVICE_DISABLED" | "ERR_PRISM_DEVICE_APPROVAL" | "ERR_PRISM_DEVICE_SESSIONS" | "ERR_PRISM_DEVICE_CHUNK" | "ERR_PRISM_DEVICE_RUN_LIMITS";
+export declare class DevicePolicyError extends Error {
+    readonly code: DevicePolicyErrorCode;
+    constructor(code: DevicePolicyErrorCode, message: string);
+}
+export interface DeviceStreamLimits {
+    readonly maxChunkBytes?: number;
+    readonly maxConcurrentSessions?: number;
+}
+/**
+ * Host-declared device adapter. `enabled` is deny-by-default: a device is
+ * admitted only when the host explicitly sets it `true` AND supplies a sandbox
+ * AND (when `requireApproval`) explicit per-side-effect approval.
+ */
+export interface DeviceAdapter {
+    readonly kind: DeviceKind;
+    readonly enabled: boolean;
+    readonly requireApproval: boolean;
+    readonly limits?: DeviceStreamLimits;
+    /** Host-owned sandbox identifier; admission fails closed without it. */
+    readonly sandbox?: string;
+    /** Host-owned network/egress policy identifier. */
+    readonly network?: string;
+}
+export interface ResolvedDevicePolicy {
+    readonly kind: DeviceKind;
+    readonly enabled: boolean;
+    readonly requireApproval: boolean;
+    readonly maxChunkBytes: number;
+    readonly maxConcurrentSessions: number;
+    readonly sandbox?: string;
+    readonly network?: string;
+    /** Shared run accounting the device session must consume. */
+    readonly runLimits?: RunLimits;
+}
+export interface DevicePolicyOptions {
+    readonly maxChunkBytes?: number;
+    readonly maxConcurrentSessions?: number;
+    readonly runLimits?: RunLimits;
+}
+export declare function resolveDevicePolicy(adapter: DeviceAdapter, options?: DevicePolicyOptions): ResolvedDevicePolicy;
+export interface DeviceAdmitRequest {
+    /** Explicit host approval for this device side effect. */
+    readonly approved: boolean;
+    /** Currently active device sessions for this identity. */
+    readonly activeSessions: number;
+}
+/**
+ * Fail-closed admission gate. Denies unless the device is explicitly enabled,
+ * sandboxed, approved (when required), under the concurrent-session budget, and
+ * bound to shared run accounting. Side effects never replay after reconnect:
+ * hosts must re-admit on every resume.
+ */
+export declare function assertDeviceAdmit(policy: ResolvedDevicePolicy, request: DeviceAdmitRequest): void;
+export interface DeviceChunkResult {
+    readonly accepted: boolean;
+    readonly bytes: number;
+    /** Present when the chunk exceeded the stream bound and was dropped. */
+    readonly marker?: "dropped_oversize";
+}
+/** Stream bound: oversize audio/screenshot/stream chunks are dropped with a marker, never forwarded. */
+export declare function acceptDeviceChunk(policy: ResolvedDevicePolicy, bytes: number): DeviceChunkResult;
+/** Telemetry must be metadata-safe: apply the host redactor before any emit/persist. */
+export declare function redactDeviceTelemetry<T>(redactor: SecretRedactor | undefined, telemetry: T): T;
+export interface DeviceConformanceResult {
+    readonly passed: readonly string[];
+}
+/**
+ * Conformance pair for future voice / desktop-control adapters. Runs the
+ * deny-by-default fixtures (denial, approval, stream bounds, session budget,
+ * run accounting, redaction) against a resolved policy and throws on any
+ * regression. Tested in 0.0.14 via fixtures only.
+ */
+export declare function runDevicePolicyConformance(adapter: DeviceAdapter, options?: DevicePolicyOptions): DeviceConformanceResult;