@arnilo/prism 0.0.12 → 0.0.14

package/dist/devices.js

@@ -0,0 +1,138 @@
+import { redactSecrets } from "./redaction.js";
+/** Audio / screenshot / stream chunk: 1 MiB default / 8 MiB hard. */
+export const DEFAULT_DEVICE_MAX_CHUNK_BYTES = 1 * 1024 * 1024;
+export const HARD_DEVICE_MAX_CHUNK_BYTES = 8 * 1024 * 1024;
+/** Concurrent device sessions per identity: 1 default / 4 hard. */
+export const DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS = 1;
+export const HARD_DEVICE_MAX_CONCURRENT_SESSIONS = 4;
+export class DevicePolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "DevicePolicyError";
+    }
+}
+function validateCap(name, value, def, hard) {
+    const resolved = value ?? def;
+    if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > hard) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", `${name} must be a positive safe integer at most ${hard}`);
+    }
+    return resolved;
+}
+export function resolveDevicePolicy(adapter, options = {}) {
+    if (!adapter || (adapter.kind !== "voice" && adapter.kind !== "desktop-control")) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "device kind must be 'voice' or 'desktop-control'");
+    }
+    return {
+        kind: adapter.kind,
+        // Deny-by-default: anything but an explicit `true` resolves to disabled.
+        enabled: adapter.enabled === true,
+        // Approval is required unless the host explicitly opts out (it should not).
+        requireApproval: adapter.requireApproval !== false,
+        maxChunkBytes: validateCap("maxChunkBytes", options.maxChunkBytes ?? adapter.limits?.maxChunkBytes, DEFAULT_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CHUNK_BYTES),
+        maxConcurrentSessions: validateCap("maxConcurrentSessions", options.maxConcurrentSessions ?? adapter.limits?.maxConcurrentSessions, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, HARD_DEVICE_MAX_CONCURRENT_SESSIONS),
+        ...(adapter.sandbox ? { sandbox: adapter.sandbox } : {}),
+        ...(adapter.network ? { network: adapter.network } : {}),
+        ...(options.runLimits ? { runLimits: options.runLimits } : {}),
+    };
+}
+/**
+ * Fail-closed admission gate. Denies unless the device is explicitly enabled,
+ * sandboxed, approved (when required), under the concurrent-session budget, and
+ * bound to shared run accounting. Side effects never replay after reconnect:
+ * hosts must re-admit on every resume.
+ */
+export function assertDeviceAdmit(policy, request) {
+    if (!policy.enabled) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_DISABLED", `${policy.kind} device is disabled by default`);
+    }
+    if (!policy.sandbox) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_DISABLED", `${policy.kind} device requires an explicit sandbox`);
+    }
+    if (policy.requireApproval && !request.approved) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_APPROVAL", `${policy.kind} device side effect requires approval`);
+    }
+    if (!Number.isSafeInteger(request.activeSessions) || request.activeSessions < 0) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "activeSessions must be a non-negative safe integer");
+    }
+    if (request.activeSessions >= policy.maxConcurrentSessions) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_SESSIONS", `concurrent ${policy.kind} sessions capped at ${policy.maxConcurrentSessions}`);
+    }
+    if (!policy.runLimits) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_RUN_LIMITS", `${policy.kind} device must consume shared RunLimits`);
+    }
+}
+/** Stream bound: oversize audio/screenshot/stream chunks are dropped with a marker, never forwarded. */
+export function acceptDeviceChunk(policy, bytes) {
+    if (!Number.isSafeInteger(bytes) || bytes < 0) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "chunk bytes must be a non-negative safe integer");
+    }
+    if (bytes > policy.maxChunkBytes) {
+        return { accepted: false, bytes, marker: "dropped_oversize" };
+    }
+    return { accepted: true, bytes };
+}
+/** Telemetry must be metadata-safe: apply the host redactor before any emit/persist. */
+export function redactDeviceTelemetry(redactor, telemetry) {
+    return redactor ? redactor.redact(telemetry) : telemetry;
+}
+/**
+ * Conformance pair for future voice / desktop-control adapters. Runs the
+ * deny-by-default fixtures (denial, approval, stream bounds, session budget,
+ * run accounting, redaction) against a resolved policy and throws on any
+ * regression. Tested in 0.0.14 via fixtures only.
+ */
+export function runDevicePolicyConformance(adapter, options = {}) {
+    const runLimits = options.runLimits ?? { maxTurns: 1 };
+    const expectThrow = (code, fn) => {
+        let threw = false;
+        try {
+            fn();
+        }
+        catch (error) {
+            threw = error instanceof DevicePolicyError && error.code === code;
+        }
+        if (!threw)
+            throw new DevicePolicyError(code, `conformance: expected ${code}`);
+    };
+    const passed = [];
+    // 1. Denial by default: a disabled adapter never admits.
+    const disabled = resolveDevicePolicy({ ...adapter, enabled: false }, { ...options, runLimits });
+    expectThrow("ERR_PRISM_DEVICE_DISABLED", () => assertDeviceAdmit(disabled, { approved: true, activeSessions: 0 }));
+    passed.push("denial-by-default");
+    // 2. Approval gate: enabled+sandboxed but unapproved denies; approved admits.
+    const enabled = resolveDevicePolicy({ ...adapter, enabled: true, requireApproval: true, sandbox: adapter.sandbox ?? "sandbox" }, { ...options, runLimits });
+    expectThrow("ERR_PRISM_DEVICE_APPROVAL", () => assertDeviceAdmit(enabled, { approved: false, activeSessions: 0 }));
+    assertDeviceAdmit(enabled, { approved: true, activeSessions: 0 });
+    passed.push("approval-gate");
+    // 3. Session budget: at/over the concurrent cap denies.
+    expectThrow("ERR_PRISM_DEVICE_SESSIONS", () => assertDeviceAdmit(enabled, { approved: true, activeSessions: enabled.maxConcurrentSessions }));
+    passed.push("session-budget");
+    // 4. Run accounting: no shared RunLimits denies.
+    const unaccounted = resolveDevicePolicy({ ...adapter, enabled: true, sandbox: "sandbox" }, { ...options, runLimits: undefined });
+    expectThrow("ERR_PRISM_DEVICE_RUN_LIMITS", () => assertDeviceAdmit(unaccounted, { approved: true, activeSessions: 0 }));
+    passed.push("run-accounting");
+    // 5. Stream bounds: oversize chunk dropped with marker; in-bound accepted.
+    const over = acceptDeviceChunk(enabled, enabled.maxChunkBytes + 1);
+    if (over.accepted || over.marker !== "dropped_oversize") {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "conformance: oversize chunk must be dropped");
+    }
+    if (!acceptDeviceChunk(enabled, enabled.maxChunkBytes).accepted) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "conformance: in-bound chunk must accept");
+    }
+    passed.push("stream-bounds");
+    // 6. Redaction: telemetry passes through the host redactor (secrets stripped), passthrough when absent.
+    const secret = "super-secret-device-token";
+    const redactor = { redact: (value) => redactSecrets(value, [secret]) };
+    const redacted = redactDeviceTelemetry(redactor, { note: `leak ${secret}` });
+    if (redacted.note.includes(secret)) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "conformance: telemetry secret must be redacted");
+    }
+    if (redactDeviceTelemetry(undefined, { note: "ok" }).note !== "ok") {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "conformance: telemetry must pass through without a redactor");
+    }
+    passed.push("redaction");
+    return { passed };
+}
+//# sourceMappingURL=devices.js.map

package/dist/extensions.d.ts

@@ -4,12 +4,23 @@ import { type MiddlewareRegistry } from "./middleware.js";
 import { type PermissionPolicy } from "./security.js";
 export type ExtensionEventHandler = (event: ExtensionEvent) => void | Promise<void>;
 export type ExtensionErrorPolicy = "event" | "throw";
+export interface ExtensionLoadPolicy {
+    /** When set, only listed extension names may load. */
+    readonly allowList?: readonly string[];
+    /**
+     * Host signature / attestation check. Return false or throw to deny.
+     * Unsigned extensions fail closed when this callback is provided.
+     */
+    readonly verifySignature?: (extension: Extension) => boolean | Promise<boolean>;
+}
 export interface ExtensionKernelOptions {
     readonly registries?: ContributionRegistries;
     readonly middleware?: MiddlewareRegistry;
     readonly errorPolicy?: ExtensionErrorPolicy;
     readonly secrets?: readonly (string | undefined)[];
     readonly permission?: PermissionPolicy;
+    /** Optional allow-list / signature policy evaluated before `setup`. */
+    readonly loadPolicy?: ExtensionLoadPolicy;
 }
 export interface ExtensionEventBus {
     on(type: ExtensionLifecycleEventName | string, handler: ExtensionEventHandler): () => void;

package/dist/extensions.js

@@ -120,6 +120,7 @@ export function createExtensionKernel(options = {}) {
             for (const extension of extensions) {
                 try {
                     await assertPermission(options.permission, { kind: "extension", action: "setup", target: extension.name });
+                    await assertExtensionLoadPolicy(options.loadPolicy, extension);
                     await extension.setup(api);
                 }
                 catch (error) {
@@ -131,4 +132,18 @@ export function createExtensionKernel(options = {}) {
         },
     };
 }
+async function assertExtensionLoadPolicy(policy, extension) {
+    if (!policy)
+        return;
+    if (policy.allowList && !policy.allowList.includes(extension.name)) {
+        throw new Error(`Extension "${extension.name}" is not allow-listed`);
+    }
+    if (policy.verifySignature) {
+        if (!extension.signature)
+            throw new Error(`Extension "${extension.name}" is unsigned`);
+        const ok = await policy.verifySignature(extension);
+        if (!ok)
+            throw new Error(`Extension "${extension.name}" failed signature verification`);
+    }
+}
 //# sourceMappingURL=extensions.js.map

package/dist/identity.d.ts

@@ -0,0 +1,92 @@
+import type { OwnershipScope } from "./contracts.js";
+/** Host-authenticated actor (user, service, or agent principal). */
+export interface Principal {
+    readonly kind: "user" | "service" | "agent" | string;
+    readonly id: string;
+    readonly displayName?: string;
+}
+/**
+ * Host-verified identity context. Projects onto {@link OwnershipScope}.
+ * `verified: true` marks host-verifier output; trust boundaries must obtain this
+ * via {@link IdentityVerifier}, never by accepting caller-asserted claims alone.
+ */
+export interface AgentIdentity {
+    readonly tenantId: string;
+    readonly accountId?: string;
+    readonly userId?: string;
+    /** Acting principal for this run/tool/delegation. */
+    readonly principal: Principal;
+    /** Human sponsor accountable for the agent lifecycle (Entra-style). */
+    readonly sponsor?: Principal;
+    /** Resource owner when distinct from sponsor. */
+    readonly owner?: Principal;
+    /** Parent principal when this identity is a narrowed delegation. */
+    readonly delegatedFrom?: Principal;
+    readonly scopes: readonly string[];
+    /** Late-bound credential resolver keys — never secret material. */
+    readonly credentialRefs?: readonly string[];
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+    readonly revokedAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly verified: true;
+}
+export interface IdentityVerifier {
+    verify(input: unknown): AgentIdentity | Promise<AgentIdentity>;
+}
+export interface AssertIdentityActiveOptions {
+    readonly now?: number;
+    /** When set, identity.tenantId must equal this value. */
+    readonly expectedTenantId?: string;
+    readonly limits?: IdentityLimits;
+}
+export interface NarrowIdentityOptions {
+    readonly scopes: readonly string[];
+    readonly principal?: Principal;
+    readonly credentialRefs?: readonly string[];
+    readonly expiresAt?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly limits?: IdentityLimits;
+}
+export interface IdentityLimits {
+    readonly maxScopes?: number;
+    readonly maxScopeBytes?: number;
+    readonly maxMetadataBytes?: number;
+    readonly maxCredentialRefBytes?: number;
+    readonly maxPrincipalIdBytes?: number;
+}
+export interface ResolvedIdentityLimits {
+    readonly maxScopes: number;
+    readonly maxScopeBytes: number;
+    readonly maxMetadataBytes: number;
+    readonly maxCredentialRefBytes: number;
+    readonly maxPrincipalIdBytes: number;
+}
+export declare const DEFAULT_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare const HARD_IDENTITY_LIMITS: ResolvedIdentityLimits;
+export declare class IdentityError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_IDENTITY";
+    constructor(message: string, reason: string);
+}
+export declare function resolveIdentityLimits(input?: IdentityLimits): ResolvedIdentityLimits;
+/** Project verified identity onto ownership scope fields used by persistence/server. */
+export declare function ownershipFromIdentity(identity: AgentIdentity): OwnershipScope;
+/**
+ * Fail closed on shape/limits/expiry/revocation/tenant mismatch.
+ * Sync and network-free — host {@link IdentityVerifier} owns remote checks.
+ */
+export declare function assertIdentityActive(identity: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Delegation may only narrow scopes; tenant and ownership ids stay immutable. */
+export declare function narrowIdentity(parent: AgentIdentity, options: NarrowIdentityOptions): AgentIdentity;
+/** Refuse ownership that widens or conflicts with a verified identity. */
+export declare function assertIdentityMatchesOwnership(identity: AgentIdentity, ownership?: OwnershipScope): void;
+/**
+ * Propagation check: child must share tenant, not widen scopes, and remain active.
+ * Used by supervisor/A2A/MCP/server when forwarding identity across a boundary.
+ */
+export declare function assertIdentityPropagation(parent: AgentIdentity, child: AgentIdentity, options?: AssertIdentityActiveOptions): void;
+/** Redacted identity refs safe for telemetry/ledger metadata (no secrets, no raw JWT). */
+export declare function identityTelemetryAttributes(identity: AgentIdentity): Readonly<Record<string, string>>;
+/** Resolve run identity: explicit option wins; otherwise agent default. Assert when present. */
+export declare function resolveRunIdentity(runIdentity: AgentIdentity | undefined, agentIdentity: AgentIdentity | undefined, ownership: OwnershipScope | undefined, options?: AssertIdentityActiveOptions): AgentIdentity | undefined;

package/dist/identity.js

@@ -0,0 +1,257 @@
+export const DEFAULT_IDENTITY_LIMITS = {
+    maxScopes: 64,
+    maxScopeBytes: 128,
+    maxMetadataBytes: 4 * 1024,
+    maxCredentialRefBytes: 256,
+    maxPrincipalIdBytes: 256,
+};
+export const HARD_IDENTITY_LIMITS = {
+    maxScopes: 256,
+    maxScopeBytes: 512,
+    maxMetadataBytes: 16 * 1024,
+    maxCredentialRefBytes: 2 * 1024,
+    maxPrincipalIdBytes: 2 * 1024,
+};
+export class IdentityError extends Error {
+    reason;
+    code = "ERR_PRISM_IDENTITY";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "IdentityError";
+    }
+}
+export function resolveIdentityLimits(input = {}) {
+    return {
+        maxScopes: bound("maxScopes", input.maxScopes, DEFAULT_IDENTITY_LIMITS.maxScopes, HARD_IDENTITY_LIMITS.maxScopes),
+        maxScopeBytes: bound("maxScopeBytes", input.maxScopeBytes, DEFAULT_IDENTITY_LIMITS.maxScopeBytes, HARD_IDENTITY_LIMITS.maxScopeBytes),
+        maxMetadataBytes: bound("maxMetadataBytes", input.maxMetadataBytes, DEFAULT_IDENTITY_LIMITS.maxMetadataBytes, HARD_IDENTITY_LIMITS.maxMetadataBytes),
+        maxCredentialRefBytes: bound("maxCredentialRefBytes", input.maxCredentialRefBytes, DEFAULT_IDENTITY_LIMITS.maxCredentialRefBytes, HARD_IDENTITY_LIMITS.maxCredentialRefBytes),
+        maxPrincipalIdBytes: bound("maxPrincipalIdBytes", input.maxPrincipalIdBytes, DEFAULT_IDENTITY_LIMITS.maxPrincipalIdBytes, HARD_IDENTITY_LIMITS.maxPrincipalIdBytes),
+    };
+}
+/** Project verified identity onto ownership scope fields used by persistence/server. */
+export function ownershipFromIdentity(identity) {
+    return {
+        tenantId: identity.tenantId,
+        ...(identity.accountId !== undefined ? { accountId: identity.accountId } : {}),
+        ...(identity.userId !== undefined ? { userId: identity.userId } : {}),
+    };
+}
+/**
+ * Fail closed on shape/limits/expiry/revocation/tenant mismatch.
+ * Sync and network-free — host {@link IdentityVerifier} owns remote checks.
+ */
+export function assertIdentityActive(identity, options = {}) {
+    const limits = resolveIdentityLimits(options.limits);
+    assertIdentityShape(identity, limits);
+    if (identity.verified !== true)
+        throw new IdentityError("Identity is not host-verified", "unverified");
+    if (options.expectedTenantId !== undefined && identity.tenantId !== options.expectedTenantId) {
+        throw new IdentityError("Identity tenant mismatch", "wrong_tenant");
+    }
+    const now = options.now ?? Date.now();
+    if (identity.revokedAt !== undefined) {
+        const revokedAt = Date.parse(identity.revokedAt);
+        if (!Number.isFinite(revokedAt))
+            throw new IdentityError("Identity revokedAt is invalid", "invalid_revoked_at");
+        if (revokedAt <= now)
+            throw new IdentityError("Identity has been revoked", "revoked");
+    }
+    if (identity.expiresAt !== undefined) {
+        const expiresAt = Date.parse(identity.expiresAt);
+        if (!Number.isFinite(expiresAt))
+            throw new IdentityError("Identity expiresAt is invalid", "invalid_expires_at");
+        if (expiresAt <= now)
+            throw new IdentityError("Identity has expired", "expired");
+    }
+    const issuedAt = Date.parse(identity.issuedAt);
+    if (!Number.isFinite(issuedAt))
+        throw new IdentityError("Identity issuedAt is invalid", "invalid_issued_at");
+    if (issuedAt > now + 60_000)
+        throw new IdentityError("Identity issuedAt is in the future", "invalid_issued_at");
+}
+/** Delegation may only narrow scopes; tenant and ownership ids stay immutable. */
+export function narrowIdentity(parent, options) {
+    assertIdentityActive(parent, { limits: options.limits });
+    const limits = resolveIdentityLimits(options.limits);
+    if (options.scopes.length === 0)
+        throw new IdentityError("Delegated scopes must be non-empty", "empty_scopes");
+    const parentScopes = new Set(parent.scopes);
+    for (const scope of options.scopes) {
+        if (!parentScopes.has(scope))
+            throw new IdentityError(`Delegation widens scope: ${scope}`, "scope_widen");
+    }
+    if (options.expiresAt !== undefined) {
+        const childExp = Date.parse(options.expiresAt);
+        if (!Number.isFinite(childExp))
+            throw new IdentityError("Delegated expiresAt is invalid", "invalid_expires_at");
+        if (parent.expiresAt !== undefined) {
+            const parentExp = Date.parse(parent.expiresAt);
+            if (Number.isFinite(parentExp) && childExp > parentExp) {
+                throw new IdentityError("Delegation cannot extend expiry", "expiry_widen");
+            }
+        }
+    }
+    const child = {
+        tenantId: parent.tenantId,
+        ...(parent.accountId !== undefined ? { accountId: parent.accountId } : {}),
+        ...(parent.userId !== undefined ? { userId: parent.userId } : {}),
+        principal: options.principal ?? parent.principal,
+        ...(parent.sponsor !== undefined ? { sponsor: parent.sponsor } : {}),
+        ...(parent.owner !== undefined ? { owner: parent.owner } : {}),
+        delegatedFrom: parent.principal,
+        scopes: Object.freeze([...options.scopes]),
+        credentialRefs: Object.freeze([...(options.credentialRefs ?? parent.credentialRefs ?? [])]),
+        issuedAt: parent.issuedAt,
+        ...(options.expiresAt !== undefined ? { expiresAt: options.expiresAt } : parent.expiresAt !== undefined ? { expiresAt: parent.expiresAt } : {}),
+        ...(parent.revokedAt !== undefined ? { revokedAt: parent.revokedAt } : {}),
+        ...(options.metadata !== undefined ? { metadata: options.metadata } : parent.metadata !== undefined ? { metadata: parent.metadata } : {}),
+        verified: true,
+    };
+    assertIdentityActive(child, { limits: options.limits });
+    assertPrincipalBounds(child.principal, limits);
+    return child;
+}
+/** Refuse ownership that widens or conflicts with a verified identity. */
+export function assertIdentityMatchesOwnership(identity, ownership) {
+    assertIdentityActive(identity);
+    if (!ownership)
+        return;
+    if (ownership.tenantId !== undefined && ownership.tenantId !== identity.tenantId) {
+        throw new IdentityError("Ownership tenant conflicts with identity", "ownership_tenant");
+    }
+    if (ownership.accountId !== undefined) {
+        if (identity.accountId === undefined || ownership.accountId !== identity.accountId) {
+            throw new IdentityError("Ownership account conflicts with identity", "ownership_account");
+        }
+    }
+    if (ownership.userId !== undefined) {
+        if (identity.userId === undefined || ownership.userId !== identity.userId) {
+            throw new IdentityError("Ownership user conflicts with identity", "ownership_user");
+        }
+    }
+}
+/**
+ * Propagation check: child must share tenant, not widen scopes, and remain active.
+ * Used by supervisor/A2A/MCP/server when forwarding identity across a boundary.
+ */
+export function assertIdentityPropagation(parent, child, options = {}) {
+    assertIdentityActive(parent, options);
+    assertIdentityActive(child, options);
+    if (child.tenantId !== parent.tenantId)
+        throw new IdentityError("Propagated identity changed tenant", "tenant_widen");
+    if (parent.accountId !== undefined && child.accountId !== parent.accountId) {
+        throw new IdentityError("Propagated identity changed account", "account_widen");
+    }
+    if (parent.userId !== undefined && child.userId !== parent.userId) {
+        throw new IdentityError("Propagated identity changed user", "user_widen");
+    }
+    const parentScopes = new Set(parent.scopes);
+    for (const scope of child.scopes) {
+        if (!parentScopes.has(scope))
+            throw new IdentityError(`Propagated identity widens scope: ${scope}`, "scope_widen");
+    }
+}
+/** Redacted identity refs safe for telemetry/ledger metadata (no secrets, no raw JWT). */
+export function identityTelemetryAttributes(identity) {
+    assertIdentityActive(identity);
+    return {
+        "prism.identity.tenant_id": identity.tenantId,
+        "prism.identity.principal_kind": String(identity.principal.kind),
+        "prism.identity.principal_id": identity.principal.id,
+        "prism.identity.scope_count": String(identity.scopes.length),
+        ...(identity.accountId !== undefined ? { "prism.identity.account_id": identity.accountId } : {}),
+        ...(identity.userId !== undefined ? { "prism.identity.user_id": identity.userId } : {}),
+        ...(identity.sponsor !== undefined ? { "prism.identity.sponsor_id": identity.sponsor.id } : {}),
+        ...(identity.credentialRefs?.length ? { "prism.identity.credential_ref_count": String(identity.credentialRefs.length) } : {}),
+    };
+}
+/** Resolve run identity: explicit option wins; otherwise agent default. Assert when present. */
+export function resolveRunIdentity(runIdentity, agentIdentity, ownership, options = {}) {
+    const identity = runIdentity ?? agentIdentity;
+    if (!identity)
+        return undefined;
+    assertIdentityActive(identity, options);
+    assertIdentityMatchesOwnership(identity, ownership ?? ownershipFromIdentity(identity));
+    return identity;
+}
+function assertIdentityShape(identity, limits) {
+    if (typeof identity.tenantId !== "string" || identity.tenantId.length === 0) {
+        throw new IdentityError("Identity tenantId is required", "missing_tenant");
+    }
+    if (byteLength(identity.tenantId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity tenantId exceeds byte limit", "tenant_too_large");
+    }
+    assertPrincipalBounds(identity.principal, limits);
+    if (identity.sponsor)
+        assertPrincipalBounds(identity.sponsor, limits);
+    if (identity.owner)
+        assertPrincipalBounds(identity.owner, limits);
+    if (identity.delegatedFrom)
+        assertPrincipalBounds(identity.delegatedFrom, limits);
+    if (!Array.isArray(identity.scopes) || identity.scopes.length === 0) {
+        throw new IdentityError("Identity scopes must be a non-empty array", "empty_scopes");
+    }
+    if (identity.scopes.length > limits.maxScopes) {
+        throw new IdentityError(`Identity exceeds maxScopes (${limits.maxScopes})`, "too_many_scopes");
+    }
+    for (const scope of identity.scopes) {
+        if (typeof scope !== "string" || scope.length === 0)
+            throw new IdentityError("Identity scope is invalid", "invalid_scope");
+        if (byteLength(scope) > limits.maxScopeBytes)
+            throw new IdentityError("Identity scope exceeds byte limit", "scope_too_large");
+    }
+    if (identity.credentialRefs) {
+        for (const ref of identity.credentialRefs) {
+            if (typeof ref !== "string" || ref.length === 0)
+                throw new IdentityError("Credential ref is invalid", "invalid_credential_ref");
+            if (byteLength(ref) > limits.maxCredentialRefBytes) {
+                throw new IdentityError("Credential ref exceeds byte limit", "credential_ref_too_large");
+            }
+        }
+    }
+    if (identity.metadata !== undefined) {
+        let encoded;
+        try {
+            encoded = JSON.stringify(identity.metadata);
+        }
+        catch {
+            throw new IdentityError("Identity metadata is not JSON-serializable", "invalid_metadata");
+        }
+        if (byteLength(encoded) > limits.maxMetadataBytes) {
+            throw new IdentityError("Identity metadata exceeds byte limit", "metadata_too_large");
+        }
+    }
+    if (identity.accountId !== undefined && byteLength(identity.accountId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity accountId exceeds byte limit", "account_too_large");
+    }
+    if (identity.userId !== undefined && byteLength(identity.userId) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Identity userId exceeds byte limit", "user_too_large");
+    }
+}
+function assertPrincipalBounds(principal, limits) {
+    if (typeof principal.id !== "string" || principal.id.length === 0) {
+        throw new IdentityError("Principal id is required", "missing_principal");
+    }
+    if (byteLength(principal.id) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Principal id exceeds byte limit", "principal_too_large");
+    }
+    if (typeof principal.kind !== "string" || principal.kind.length === 0 || byteLength(principal.kind) > 64) {
+        throw new IdentityError("Principal kind is invalid", "invalid_principal_kind");
+    }
+    if (principal.displayName !== undefined && byteLength(principal.displayName) > limits.maxPrincipalIdBytes) {
+        throw new IdentityError("Principal displayName exceeds byte limit", "display_name_too_large");
+    }
+}
+function bound(name, value, fallback, hard) {
+    const resolved = value ?? fallback;
+    if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > hard) {
+        throw new RangeError(`${name} must be a positive safe integer no greater than ${hard}`);
+    }
+    return resolved;
+}
+function byteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+//# sourceMappingURL=identity.js.map

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export type * from "./contracts.js";
 export type { RunLimitCounters, RunLimitName, SecureAgentOptions } from "./contracts.js";
-export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SESSION_SEARCH_UNSUPPORTED_CODE, SessionSearchUnsupportedError, isSessionSearchUnsupported, DEFAULT_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LIMIT, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, resolveSessionSearchQuery, DEFAULT_MAX_PENDING_STEERS, HARD_MAX_PENDING_STEERS, DEFAULT_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEER_BYTES } from "./contracts.js";
+export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError, assertSessionMetadataKey, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SESSION_SEARCH_UNSUPPORTED_CODE, SessionSearchUnsupportedError, isSessionSearchUnsupported, DEFAULT_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LIMIT, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, resolveSessionSearchQuery, DEFAULT_MAX_PENDING_STEERS, HARD_MAX_PENDING_STEERS, DEFAULT_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEER_BYTES } from "./contracts.js";
 export { createAgent, createAgentSession, resumeAgentRun, resumeAgentRunStream } from "./agents.js";
 export { createBatchedRunLedger, isFlushableRunLedger, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, } from "./run-ledger.js";
 export type { BatchedRunLedgerOptions } from "./run-ledger.js";
@@ -14,6 +14,8 @@ export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export type { AgentRunLifecycle, AgentRunLifecycleAgent, AgentRunLifecycleOptions, AgentRunLifecycleRequest, AgentRunLifecycleStreamRequest } from "./agent-run-lifecycle.js";
 export type { MemoryCheckpointStoreOptions } from "./checkpoints.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
+export { createMemoryPersistenceLifecycle, isResourceHeld, PersistenceLifecycleError, DEFAULT_LIFECYCLE_PAGE_SIZE, HARD_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_MAX_HOLD_REASON_BYTES, } from "./persistence-lifecycle.js";
+export type { PersistenceResourceKind, LegalHoldRecord, PutLegalHoldInput, ReleaseLegalHoldInput, LegalHoldQuery, ApplyRetentionInput, ApplyRetentionResult, LegalHoldExportItem, ExportUnderHoldInput, TenantQuota, SetTenantQuotaInput, ConsumeTenantQuotaInput, PersistenceLifecycleStore, } from "./persistence-lifecycle.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
 export type { EventMultiplexer, EventMultiplexerOptions, EventOverflowInfo, EventOverflowPolicy } from "./event-multiplexer.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
@@ -28,10 +30,10 @@ export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./
 export type { DefaultRetryPolicyOptions } from "./retry.js";
 export { createContributionRegistries, createContributionRegistry, registerDiscoveredContributions } from "./contributions.js";
 export type { ContributionRegistries, ContributionRegistriesOptions, ContributionRegistry, ContributionRegistryOptions } from "./contributions.js";
-export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, resolveCredentialValue } from "./credentials.js";
+export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, revokeOAuthCredential, resolveCredentialValue } from "./credentials.js";
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
-export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, ExtensionKernel, ExtensionKernelOptions } from "./extensions.js";
-export type { CredentialRecord, CredentialValueSource, MemoryCredentialStore } from "./credentials.js";
+export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, ExtensionKernel, ExtensionKernelOptions, ExtensionLoadPolicy } from "./extensions.js";
+export type { CredentialRecord, CredentialValueSource, MemoryCredentialStore, RevocableOAuthCredentialStore } from "./credentials.js";
 export { createModelRegistry } from "./models.js";
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
 export { assertStructuredOutputRequestSupported, artifactStructuredOutputRequest, DEFAULT_MAX_STRUCTURED_OUTPUT_NAME_LENGTH, DEFAULT_MAX_STRUCTURED_OUTPUT_SCHEMA_BYTES, modelSupportsStructuredOutput, resolveRunProviderOptions, StructuredOutputError, validateStructuredOutputOptions, withoutStructuredOutput, } from "./structured-output.js";
@@ -60,6 +62,12 @@ export type { ContextBudget, ContextBudgetMessageGroups, ContextBudgetOmission,
 export type { AgentInput, AssembleProviderInputOptions, DefaultInputBuilder, DefaultInputBuildContext, DefaultPromptBuilder, InputAttachment, PromptInstruction, PromptTemplateOptions, ResolveContextOptions } from "./input.js";
 export { createMockProvider } from "./mock-provider.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext } from "./session-stores.js";
+export { CONVERSATION_METADATA_KEY, DEFAULT_MAX_CONVERSATION_CURSOR_BYTES, HARD_MAX_CONVERSATION_CURSOR_BYTES, ConversationError, conversationMarkerMetadata, conversationThreadFromRecord, decodeConversationReplayCursor, encodeConversationReplayCursor, } from "./conversations.js";
+export type { ConversationBranchRef, ConversationReplayCursor, ConversationThread, ConversationThreadState, } from "./conversations.js";
+export { ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactError, artifactApprovalState, artifactCheckpointKey, } from "./artifacts.js";
+export type { ArtifactApproval, ArtifactApprovalState, ArtifactCitation, ArtifactDecisionState, ArtifactDeliveryToken, ArtifactRecord, ArtifactRevision, } from "./artifacts.js";
+export { DEFAULT_DEVICE_MAX_CHUNK_BYTES, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, HARD_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CONCURRENT_SESSIONS, DevicePolicyError, acceptDeviceChunk, assertDeviceAdmit, redactDeviceTelemetry, resolveDevicePolicy, runDevicePolicyConformance, } from "./devices.js";
+export type { DeviceAdapter, DeviceAdmitRequest, DeviceChunkResult, DeviceConformanceResult, DeviceKind, DevicePolicyErrorCode, DevicePolicyOptions, DeviceStreamLimits, ResolvedDevicePolicy, } from "./devices.js";
 export type { CreateMemorySessionStoreOptions, CreateSessionEntryOptions, MemorySessionSearchMode, SessionBranch, SessionBranchOptions, SessionContextSnapshot } from "./session-stores.js";
 export type { MockProviderOptions } from "./mock-provider.js";
 export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
@@ -70,6 +78,8 @@ export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage
 export type { SecretRedactor } from "./redaction.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError } from "./security.js";
 export type { PermissionDecision, PermissionPolicy, PermissionRequest, TrustDecision, TrustPolicy, TrustRequest } from "./security.js";
+export { assertIdentityActive, assertIdentityMatchesOwnership, assertIdentityPropagation, DEFAULT_IDENTITY_LIMITS, HARD_IDENTITY_LIMITS, IdentityError, identityTelemetryAttributes, narrowIdentity, ownershipFromIdentity, resolveIdentityLimits, resolveRunIdentity, } from "./identity.js";
+export type { AgentIdentity, AssertIdentityActiveOptions, IdentityLimits, IdentityVerifier, NarrowIdentityOptions, Principal, ResolvedIdentityLimits, } from "./identity.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export type { ExecutionAction, ExecutionDecision, ExecutionPolicy, ExecutionRisk } from "./execution-policy.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
@@ -85,5 +95,5 @@ export type { DispatchToolCallOptions, ToolArgumentValidationError, ToolArgument
 export type { DuplicateRegistrationOptions, DuplicateRegistrationPolicy } from "./registry-options.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export declare const name = "prism";
-export declare const version = "0.0.12";
+export declare const version = "0.0.14";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";