@arnilo/prism 0.0.12 → 0.0.14

package/dist/index.js

@@ -1,4 +1,4 @@
-export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SESSION_SEARCH_UNSUPPORTED_CODE, SessionSearchUnsupportedError, isSessionSearchUnsupported, DEFAULT_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LIMIT, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, resolveSessionSearchQuery, DEFAULT_MAX_PENDING_STEERS, HARD_MAX_PENDING_STEERS, DEFAULT_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEER_BYTES } from "./contracts.js";
+export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError, assertSessionMetadataKey, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SESSION_SEARCH_UNSUPPORTED_CODE, SessionSearchUnsupportedError, isSessionSearchUnsupported, DEFAULT_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LIMIT, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, resolveSessionSearchQuery, DEFAULT_MAX_PENDING_STEERS, HARD_MAX_PENDING_STEERS, DEFAULT_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEER_BYTES } from "./contracts.js";
 export { createAgent, createAgentSession, resumeAgentRun, resumeAgentRunStream } from "./agents.js";
 export { createBatchedRunLedger, isFlushableRunLedger, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_ENTRIES, DEFAULT_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_DELAY_MS, } from "./run-ledger.js";
 export { createSecureAgent } from "./secure-agent.js";
@@ -7,6 +7,7 @@ export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpoi
 export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, DEFAULT_MAX_AGENT_RUN_STATE_BYTES, HARD_MAX_AGENT_RUN_STATE_BYTES, agentFingerprint, loadAgentRunState } from "./agent-run-state.js";
 export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
+export { createMemoryPersistenceLifecycle, isResourceHeld, PersistenceLifecycleError, DEFAULT_LIFECYCLE_PAGE_SIZE, HARD_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_MAX_HOLD_REASON_BYTES, } from "./persistence-lifecycle.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
 export { resolveAgentDefinition } from "./agent-definitions.js";
@@ -15,7 +16,7 @@ export { assertJsonObject, isJsonObject, loadConfigLayers, mergeConfigLayers } f
 export { createDefaultCompactionStrategy, isCompactionEntryData } from "./compaction.js";
 export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./retry.js";
 export { createContributionRegistries, createContributionRegistry, registerDiscoveredContributions } from "./contributions.js";
-export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, resolveCredentialValue } from "./credentials.js";
+export { createChainedCredentialResolver, createEnvCredentialResolver, createExplicitCredentialResolver, createMemoryCredentialStore, refreshOAuthCredential, revokeOAuthCredential, resolveCredentialValue } from "./credentials.js";
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
 export { createModelRegistry } from "./models.js";
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
@@ -34,10 +35,14 @@ export { assembleProviderInput, createDefaultInputBuilder, createDefaultPromptBu
 export { applyContextBudget, CONTEXT_BUDGET_ERROR_CODE, CONTEXT_BUDGET_REPORT_METADATA_KEY, ContextBudgetError, DEFAULT_MAX_CONTEXT_BUDGET_OMISSIONS, estimateAssemblyTokens, estimateMessageBytes, estimateMessageTokens, estimateTextBytes, estimateTextTokens, getContextBudgetReport, HARD_MAX_CONTEXT_BUDGET_BYTES, HARD_MAX_CONTEXT_BUDGET_OMISSIONS, HARD_MAX_CONTEXT_BUDGET_TOKENS, isContextBudgetError, resolveContextBudget, } from "./context-budget.js";
 export { createMockProvider } from "./mock-provider.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext } from "./session-stores.js";
+export { CONVERSATION_METADATA_KEY, DEFAULT_MAX_CONVERSATION_CURSOR_BYTES, HARD_MAX_CONVERSATION_CURSOR_BYTES, ConversationError, conversationMarkerMetadata, conversationThreadFromRecord, decodeConversationReplayCursor, encodeConversationReplayCursor, } from "./conversations.js";
+export { ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactError, artifactApprovalState, artifactCheckpointKey, } from "./artifacts.js";
+export { DEFAULT_DEVICE_MAX_CHUNK_BYTES, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, HARD_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CONCURRENT_SESSIONS, DevicePolicyError, acceptDeviceChunk, assertDeviceAdmit, redactDeviceTelemetry, resolveDevicePolicy, runDevicePolicyConformance, } from "./devices.js";
 export { providerContentDelta, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry } from "./redaction.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError } from "./security.js";
+export { assertIdentityActive, assertIdentityMatchesOwnership, assertIdentityPropagation, DEFAULT_IDENTITY_LIMITS, HARD_IDENTITY_LIMITS, IdentityError, identityTelemetryAttributes, narrowIdentity, ownershipFromIdentity, resolveIdentityLimits, resolveRunIdentity, } from "./identity.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 export { resolveInstructionInjectors, runInstructionInjectors } from "./instruction-injection.js";
@@ -46,6 +51,6 @@ export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, run
 export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export const name = "prism";
-export const version = "0.0.12";
+export const version = "0.0.14";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/persistence-lifecycle.d.ts

@@ -0,0 +1,103 @@
+import type { OwnershipScope, PersistencePage, PersistenceQuery, RetentionPolicy } from "./contracts.js";
+/** Resource classes covered by holds, quotas, and retention sweeps. */
+export type PersistenceResourceKind = "session" | "entry" | "run" | "event" | "tool_call" | "usage" | "checkpoint" | "feedback" | "audit" | "work_artifact" | "connector_operation";
+export declare const DEFAULT_LIFECYCLE_PAGE_SIZE = 100;
+export declare const HARD_LIFECYCLE_PAGE_SIZE = 500;
+export declare const DEFAULT_MAX_HOLD_REASON_BYTES = 1024;
+export declare const HARD_MAX_HOLD_REASON_BYTES: number;
+export declare class PersistenceLifecycleError extends Error {
+    readonly code: string;
+    constructor(message: string, code?: string);
+}
+export interface LegalHoldRecord extends OwnershipScope {
+    readonly id: string;
+    readonly resourceKind: PersistenceResourceKind;
+    readonly resourceId: string;
+    readonly reason: string;
+    readonly createdAt: string;
+    readonly createdBy?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface PutLegalHoldInput extends OwnershipScope {
+    readonly resourceKind: PersistenceResourceKind;
+    readonly resourceId: string;
+    readonly reason: string;
+    readonly id?: string;
+    readonly createdBy?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+    readonly signal?: AbortSignal;
+}
+export interface ReleaseLegalHoldInput extends OwnershipScope {
+    readonly id: string;
+    readonly signal?: AbortSignal;
+}
+export interface LegalHoldQuery extends PersistenceQuery, OwnershipScope {
+    readonly resourceKind?: PersistenceResourceKind;
+    readonly resourceId?: string;
+    readonly holdId?: string;
+    readonly signal?: AbortSignal;
+}
+export interface ApplyRetentionInput extends OwnershipScope {
+    readonly policy: RetentionPolicy;
+    /** When omitted, adapters discover expired/over-limit session ids for this ownership page. */
+    readonly candidates?: readonly string[];
+    readonly cursor?: string;
+    readonly limit?: number;
+    readonly signal?: AbortSignal;
+}
+export interface ApplyRetentionResult {
+    readonly deleted: readonly string[];
+    readonly skippedHeld: readonly string[];
+    readonly nextCursor?: string;
+}
+export interface LegalHoldExportItem {
+    readonly holdId: string;
+    readonly resourceKind: PersistenceResourceKind;
+    readonly resourceId: string;
+    readonly reason: string;
+    readonly createdAt: string;
+    readonly redacted: true;
+}
+export interface ExportUnderHoldInput extends OwnershipScope {
+    readonly holdId?: string;
+    readonly resourceKind?: PersistenceResourceKind;
+    readonly cursor?: string;
+    readonly limit?: number;
+    readonly signal?: AbortSignal;
+}
+export interface TenantQuota extends OwnershipScope {
+    readonly resourceKind: PersistenceResourceKind;
+    readonly limit: number;
+    readonly used: number;
+    readonly updatedAt: string;
+}
+export interface SetTenantQuotaInput extends OwnershipScope {
+    readonly resourceKind: PersistenceResourceKind;
+    readonly limit: number;
+    readonly signal?: AbortSignal;
+}
+export interface ConsumeTenantQuotaInput extends OwnershipScope {
+    readonly resourceKind: PersistenceResourceKind;
+    /** Units to consume. Default 1. */
+    readonly delta?: number;
+    readonly signal?: AbortSignal;
+}
+/** Optional persistence lifecycle capability (retention / hold / export / quota). */
+export interface PersistenceLifecycleStore {
+    putLegalHold(input: PutLegalHoldInput): Promise<LegalHoldRecord>;
+    releaseLegalHold(input: ReleaseLegalHoldInput): Promise<boolean>;
+    listLegalHolds(query: LegalHoldQuery): Promise<PersistencePage<LegalHoldRecord>>;
+    /** Deletes candidates not under legal hold. Hold always wins over retention. */
+    applyRetention(input: ApplyRetentionInput): Promise<ApplyRetentionResult>;
+    exportUnderHold(input: ExportUnderHoldInput): Promise<PersistencePage<LegalHoldExportItem>>;
+    setTenantQuota(input: SetTenantQuotaInput): Promise<TenantQuota>;
+    getTenantQuota(input: OwnershipScope & {
+        readonly resourceKind: PersistenceResourceKind;
+        readonly signal?: AbortSignal;
+    }): Promise<TenantQuota | null>;
+    /** Fails closed when used + delta would exceed limit. */
+    consumeTenantQuota(input: ConsumeTenantQuotaInput): Promise<TenantQuota>;
+}
+export declare function createMemoryPersistenceLifecycle(): PersistenceLifecycleStore;
+/** True when a session/resource id is under an active legal hold in the page of holds. */
+export declare function isResourceHeld(holds: readonly Pick<LegalHoldRecord, "resourceKind" | "resourceId">[], resourceKind: PersistenceResourceKind, resourceId: string): boolean;

package/dist/persistence-lifecycle.js

@@ -0,0 +1,204 @@
+export const DEFAULT_LIFECYCLE_PAGE_SIZE = 100;
+export const HARD_LIFECYCLE_PAGE_SIZE = 500;
+export const DEFAULT_MAX_HOLD_REASON_BYTES = 1024;
+export const HARD_MAX_HOLD_REASON_BYTES = 8 * 1024;
+export class PersistenceLifecycleError extends Error {
+    code;
+    constructor(message, code = "ERR_PRISM_PERSISTENCE_LIFECYCLE") {
+        super(message);
+        this.code = code;
+        this.name = "PersistenceLifecycleError";
+    }
+}
+export function createMemoryPersistenceLifecycle() {
+    const holds = new Map();
+    const quotas = new Map();
+    const deleted = new Set();
+    return {
+        async putLegalHold(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            const reason = assertReason(input.reason);
+            if (!input.resourceId || !input.resourceKind) {
+                throw new PersistenceLifecycleError("resourceKind and resourceId are required", "ERR_PRISM_LIFECYCLE_HOLD");
+            }
+            const id = input.id ?? crypto.randomUUID();
+            const record = {
+                id,
+                resourceKind: input.resourceKind,
+                resourceId: input.resourceId,
+                reason,
+                createdAt: new Date().toISOString(),
+                ...(input.createdBy === undefined ? {} : { createdBy: input.createdBy }),
+                ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+                ...ownership(input),
+            };
+            holds.set(id, record);
+            return record;
+        },
+        async releaseLegalHold(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            const current = holds.get(input.id);
+            if (!current)
+                return false;
+            assertSameOwnership(input, current);
+            holds.delete(input.id);
+            return true;
+        },
+        async listLegalHolds(query) {
+            throwIfAborted(query.signal);
+            assertOwnership(query);
+            const limit = pageLimit(query.limit);
+            const items = [...holds.values()]
+                .filter((hold) => sameOwnership(query, hold))
+                .filter((hold) => query.holdId === undefined || hold.id === query.holdId)
+                .filter((hold) => query.resourceKind === undefined || hold.resourceKind === query.resourceKind)
+                .filter((hold) => query.resourceId === undefined || hold.resourceId === query.resourceId)
+                .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.id.localeCompare(b.id));
+            const start = query.cursor ? items.findIndex((item) => item.id === query.cursor) + 1 : 0;
+            const slice = items.slice(Math.max(0, start), Math.max(0, start) + limit);
+            const next = start + limit < items.length ? slice.at(-1)?.id : undefined;
+            return { items: slice, ...(next === undefined ? {} : { nextCursor: next }) };
+        },
+        async applyRetention(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            const held = new Set([...holds.values()]
+                .filter((hold) => sameOwnership(input, hold) && hold.resourceKind === "session")
+                .map((hold) => hold.resourceId));
+            const candidates = input.candidates ?? [];
+            const deletedIds = [];
+            const skippedHeld = [];
+            for (const id of candidates) {
+                if (held.has(id)) {
+                    skippedHeld.push(id);
+                    continue;
+                }
+                deleted.add(id);
+                deletedIds.push(id);
+            }
+            return { deleted: deletedIds, skippedHeld };
+        },
+        async exportUnderHold(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            const page = await this.listLegalHolds({
+                ...ownership(input),
+                holdId: input.holdId,
+                resourceKind: input.resourceKind,
+                cursor: input.cursor,
+                limit: input.limit,
+                signal: input.signal,
+            });
+            return {
+                items: page.items.map((hold) => ({
+                    holdId: hold.id,
+                    resourceKind: hold.resourceKind,
+                    resourceId: hold.resourceId,
+                    reason: hold.reason,
+                    createdAt: hold.createdAt,
+                    redacted: true,
+                })),
+                ...(page.nextCursor === undefined ? {} : { nextCursor: page.nextCursor }),
+            };
+        },
+        async setTenantQuota(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            if (!Number.isSafeInteger(input.limit) || input.limit < 0) {
+                throw new PersistenceLifecycleError("limit must be a non-negative safe integer", "ERR_PRISM_LIFECYCLE_QUOTA");
+            }
+            const key = quotaKey(input, input.resourceKind);
+            const previous = quotas.get(key);
+            const record = {
+                ...ownership(input),
+                resourceKind: input.resourceKind,
+                limit: input.limit,
+                used: previous?.used ?? 0,
+                updatedAt: new Date().toISOString(),
+            };
+            if (record.used > record.limit) {
+                throw new PersistenceLifecycleError("quota already exceeded", "ERR_PRISM_LIFECYCLE_QUOTA");
+            }
+            quotas.set(key, record);
+            return record;
+        },
+        async getTenantQuota(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            return quotas.get(quotaKey(input, input.resourceKind)) ?? null;
+        },
+        async consumeTenantQuota(input) {
+            throwIfAborted(input.signal);
+            assertOwnership(input);
+            const delta = input.delta ?? 1;
+            if (!Number.isSafeInteger(delta) || delta < 1) {
+                throw new PersistenceLifecycleError("delta must be a positive safe integer", "ERR_PRISM_LIFECYCLE_QUOTA");
+            }
+            const key = quotaKey(input, input.resourceKind);
+            const current = quotas.get(key);
+            if (!current) {
+                throw new PersistenceLifecycleError("tenant quota not configured", "ERR_PRISM_LIFECYCLE_QUOTA");
+            }
+            if (current.used + delta > current.limit) {
+                throw new PersistenceLifecycleError(`tenant quota exhausted for ${input.resourceKind}`, "ERR_PRISM_LIFECYCLE_QUOTA_EXHAUSTED");
+            }
+            const next = {
+                ...current,
+                used: current.used + delta,
+                updatedAt: new Date().toISOString(),
+            };
+            quotas.set(key, next);
+            return next;
+        },
+    };
+}
+/** True when a session/resource id is under an active legal hold in the page of holds. */
+export function isResourceHeld(holds, resourceKind, resourceId) {
+    return holds.some((hold) => hold.resourceKind === resourceKind && hold.resourceId === resourceId);
+}
+function ownership(input) {
+    return {
+        ...(input.tenantId === undefined ? {} : { tenantId: input.tenantId }),
+        ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
+        ...(input.userId === undefined ? {} : { userId: input.userId }),
+    };
+}
+function sameOwnership(a, b) {
+    return a.tenantId === b.tenantId && a.accountId === b.accountId && a.userId === b.userId;
+}
+function assertSameOwnership(expected, actual) {
+    if (!sameOwnership(expected, actual)) {
+        throw new PersistenceLifecycleError("ownership mismatch", "ERR_PRISM_LIFECYCLE_OWNERSHIP");
+    }
+}
+function assertOwnership(input) {
+    if (![input.tenantId, input.accountId, input.userId].some((value) => typeof value === "string" && value.length > 0)) {
+        throw new PersistenceLifecycleError("ownership required", "ERR_PRISM_LIFECYCLE_OWNERSHIP");
+    }
+}
+function assertReason(reason) {
+    if (typeof reason !== "string" || !reason.trim()) {
+        throw new PersistenceLifecycleError("reason is required", "ERR_PRISM_LIFECYCLE_HOLD");
+    }
+    if (Buffer.byteLength(reason, "utf8") > HARD_MAX_HOLD_REASON_BYTES) {
+        throw new PersistenceLifecycleError("reason exceeds limit", "ERR_PRISM_LIFECYCLE_HOLD");
+    }
+    return reason;
+}
+function pageLimit(limit) {
+    const resolved = limit ?? DEFAULT_LIFECYCLE_PAGE_SIZE;
+    if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > HARD_LIFECYCLE_PAGE_SIZE) {
+        throw new PersistenceLifecycleError(`limit must be 1..${HARD_LIFECYCLE_PAGE_SIZE}`, "ERR_PRISM_LIFECYCLE_LIMITS");
+    }
+    return resolved;
+}
+function quotaKey(ownership, kind) {
+    return `${ownership.tenantId ?? ""}\0${ownership.accountId ?? ""}\0${ownership.userId ?? ""}\0${kind}`;
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+//# sourceMappingURL=persistence-lifecycle.js.map

package/dist/providers/openai-compatible.d.ts

@@ -1,9 +1,13 @@
-import type { AIProvider } from "../contracts.js";
+import type { AIProvider, ProviderRequest } from "../contracts.js";
 import { type CredentialValueSource } from "../credentials.js";
 export interface OpenAICompatibleProviderOptions {
     readonly id?: string;
     readonly baseUrl: string;
     readonly apiKey?: CredentialValueSource;
     readonly fetch?: typeof fetch;
+    /** Override chat-completions URL (default `${baseUrl}/chat/completions`). */
+    readonly chatCompletionsUrl?: string | ((request: ProviderRequest) => string);
+    /** Default `bearer`. Azure resource keys use `api-key`; host-signed fetches may use `none`. */
+    readonly authStyle?: "bearer" | "api-key" | "none";
 }
 export declare function createOpenAICompatibleProvider(options: OpenAICompatibleProviderOptions): AIProvider;

package/dist/providers/openai-compatible.js

@@ -16,13 +16,22 @@ export function createOpenAICompatibleProvider(options) {
             const secrets = [apiKey];
             const tools = new Map();
             try {
-                const response = await fetchImpl(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+                const url = typeof options.chatCompletionsUrl === "function"
+                    ? options.chatCompletionsUrl(request)
+                    : options.chatCompletionsUrl
+                        ?? `${options.baseUrl.replace(/\/$/, "")}/chat/completions`;
+                const authStyle = options.authStyle ?? "bearer";
+                const headers = {
+                    ...Object.fromEntries(Object.entries(request.options?.headers ?? {}).filter((entry) => typeof entry[1] === "string")),
+                    "content-type": "application/json",
+                };
+                if (apiKey && authStyle === "api-key")
+                    headers["api-key"] = apiKey;
+                if (apiKey && authStyle === "bearer")
+                    headers.authorization = `Bearer ${apiKey}`;
+                const response = await fetchImpl(url, {
                     method: "POST",
-                    headers: {
-                        ...request.options?.headers,
-                        "content-type": "application/json",
-                        ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
-                    },
+                    headers,
                     body: JSON.stringify(toOpenAIRequest(request)),
                     signal: request.signal,
                 });

package/dist/providers/openai-primitives.js

@@ -115,7 +115,8 @@ export function mapOpenAIChatUsage(usage) {
         && wire.total_tokens === undefined
         && wire.prompt_cache_hit_tokens === undefined
         && wire.prompt_tokens_details?.cached_tokens === undefined
-        && wire.prompt_tokens_details?.cache_write_tokens === undefined) {
+        && wire.prompt_tokens_details?.cache_write_tokens === undefined
+        && wire.prompt_tokens_details?.cache_creation_input_tokens === undefined) {
         return undefined;
     }
     return {
@@ -123,7 +124,9 @@ export function mapOpenAIChatUsage(usage) {
         outputTokens: wire.completion_tokens,
         totalTokens: wire.total_tokens,
         cacheReadTokens: wire.prompt_tokens_details?.cached_tokens ?? wire.prompt_cache_hit_tokens,
-        cacheWriteTokens: wire.prompt_tokens_details?.cache_write_tokens,
+        // Some OpenAI-compatible vendors report cache writes as `cache_write_tokens`,
+        // others as the `cache_creation_input_tokens` variant; accept both.
+        cacheWriteTokens: wire.prompt_tokens_details?.cache_write_tokens ?? wire.prompt_tokens_details?.cache_creation_input_tokens,
     };
 }
 //# sourceMappingURL=openai-primitives.js.map

package/dist/secure-agent.js

@@ -1,5 +1,6 @@
 import { createAgent } from "./agents.js";
 import { validateRunStateOptions } from "./agent-run-state.js";
+import { assertIdentityActive, assertIdentityMatchesOwnership } from "./identity.js";
 import { resolveRunLimits } from "./run-limits.js";
 import { createToolParameterValidator, createToolRegistry } from "./tools.js";
 /** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
@@ -27,6 +28,10 @@ export function createSecureAgent(options) {
             throw new TypeError(`Secure agent tool ${tool.name} requires a non-empty parameters schema`);
     }
     resolveRunLimits(options.limits);
+    if (options.identity) {
+        assertIdentityActive(options.identity);
+        assertIdentityMatchesOwnership(options.identity, options.ownership);
+    }
     const runState = Object.freeze({ ...options.runState, definitionRevision: options.definitionRevision, interruptBeforeTool: true });
     validateRunStateOptions(runState);
     const config = Object.freeze({
@@ -38,6 +43,7 @@ export function createSecureAgent(options) {
         permission: options.permission,
         trust: options.trust,
         ownership: Object.freeze({ ...options.ownership }),
+        ...(options.identity ? { identity: Object.freeze({ ...options.identity, scopes: Object.freeze([...options.identity.scopes]) }) } : {}),
         limits: Object.freeze({ ...options.limits }),
         guardrails: freezeGuardrails(options.guardrails),
         runState,
@@ -46,7 +52,7 @@ export function createSecureAgent(options) {
     return createAgent(config);
 }
 function withoutSecureFields(options) {
-    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, ...config } = options;
+    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, identity: _identity, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, ...config } = options;
     return config;
 }
 function freezeGuardrails(guardrails) {

package/dist/testing/persistence-schema.d.ts

@@ -1,7 +1,7 @@
 import type { PersistencePage, SessionEntry, SessionEntryQuery } from "../contracts.js";
 /** Current shared persistence schema version for production database adapters. */
-export declare const PERSISTENCE_SCHEMA_VERSION = 4;
-export type PersistenceTableName = "prism_tenants" | "prism_accounts" | "prism_users" | "prism_agent_definitions" | "prism_sessions" | "prism_branches" | "prism_session_entries" | "prism_session_append_idempotency" | "prism_runs" | "prism_agent_events" | "prism_tool_calls" | "prism_usage" | "prism_run_feedback" | "prism_retention_policies" | "prism_migrations";
+export declare const PERSISTENCE_SCHEMA_VERSION = 5;
+export type PersistenceTableName = "prism_tenants" | "prism_accounts" | "prism_users" | "prism_agent_definitions" | "prism_sessions" | "prism_branches" | "prism_session_entries" | "prism_session_append_idempotency" | "prism_runs" | "prism_agent_events" | "prism_tool_calls" | "prism_usage" | "prism_run_feedback" | "prism_retention_policies" | "prism_legal_holds" | "prism_tenant_quotas" | "prism_migrations";
 export type PersistenceColumnType = "text" | "integer" | "number" | "boolean" | "json" | "timestamp";
 export interface PersistenceColumnDefinition {
     readonly name: string;

package/dist/testing/persistence-schema.js

@@ -4,7 +4,7 @@ import { createHash } from "node:crypto";
 // this module defines the shared table/index/pagination/migration expectations
 // adapter authors implement and test against before shipping dialect-specific DDL.
 /** Current shared persistence schema version for production database adapters. */
-export const PERSISTENCE_SCHEMA_VERSION = 4;
+export const PERSISTENCE_SCHEMA_VERSION = 5;
 /** Guidance adapters must follow: values are bound parameters, never interpolated. */
 export const PARAMETERIZED_QUERY_GUIDANCE = "Bind every user-supplied value (session ids, idempotency keys, tenant ids, timestamps, JSON payloads) as a query parameter. Quote/validate schema and table identifiers only; never interpolate untrusted strings into SQL text.";
 const TENANT_COLUMNS = [
@@ -258,6 +258,33 @@ export function createPersistenceSchemaModel() {
                     { name: "metadata", type: "json", nullable: true },
                 ],
             },
+            {
+                name: "prism_legal_holds",
+                primaryKey: ["id"],
+                columns: [
+                    { name: "id", type: "text" },
+                    ...TENANT_COLUMNS,
+                    { name: "resource_kind", type: "text" },
+                    { name: "resource_id", type: "text" },
+                    { name: "reason", type: "text" },
+                    { name: "created_at", type: "timestamp" },
+                    { name: "created_by", type: "text", nullable: true },
+                    { name: "metadata", type: "json", nullable: true },
+                ],
+            },
+            {
+                name: "prism_tenant_quotas",
+                primaryKey: ["id"],
+                columns: [
+                    { name: "id", type: "text" },
+                    ...TENANT_COLUMNS,
+                    { name: "resource_kind", type: "text" },
+                    { name: "limit_count", type: "integer" },
+                    { name: "used_count", type: "integer" },
+                    { name: "updated_at", type: "timestamp" },
+                ],
+                uniqueKeys: [["tenant_id", "account_id", "user_id", "resource_kind"]],
+            },
             {
                 name: "prism_migrations",
                 primaryKey: ["id"],
@@ -298,6 +325,9 @@ export function createPersistenceSchemaModel() {
             { name: "prism_run_feedback_run_created_idx", table: "prism_run_feedback", columns: ["run_id", "created_at", "id"], purpose: "run feedback lookup" },
             { name: "prism_run_feedback_trace_created_idx", table: "prism_run_feedback", columns: ["trace_id", "created_at", "id"], purpose: "trace feedback lookup" },
             { name: "prism_agent_definitions_name_version_idx", table: "prism_agent_definitions", columns: ["name", "version"], purpose: "definition lookup" },
+            { name: "prism_legal_holds_owner_resource_idx", table: "prism_legal_holds", columns: ["tenant_id", "account_id", "user_id", "resource_kind", "resource_id"], purpose: "hold lookup by owned resource" },
+            { name: "prism_legal_holds_created_id_idx", table: "prism_legal_holds", columns: ["created_at", "id"], purpose: "hold export pagination" },
+            { name: "prism_tenant_quotas_owner_kind_idx", table: "prism_tenant_quotas", columns: ["tenant_id", "account_id", "user_id", "resource_kind"], purpose: "tenant quota lookup" },
             { name: "prism_migrations_name_version_idx", table: "prism_migrations", columns: ["name", "version"], purpose: "applied-migration lookup (table constraint enforces uniqueness)" },
         ],
     };
@@ -320,7 +350,9 @@ function migrationStep(version, name, description) {
                 : version === 4
                     // Adapter-local FTS objects (SQLite FTS5 / Postgres tsvector) map to this canonical name.
                     ? { search: ["prism_session_search"], indexes: ["prism_sessions_updated_id_idx"] }
-                    : (() => { throw new Error(`Unknown migration version ${version}`); })();
+                    : version === 5
+                        ? { tables: ["prism_legal_holds", "prism_tenant_quotas"], indexes: ["prism_legal_holds_owner_resource_idx", "prism_legal_holds_created_id_idx", "prism_tenant_quotas_owner_kind_idx"] }
+                        : (() => { throw new Error(`Unknown migration version ${version}`); })();
     return {
         version,
         name,
@@ -338,6 +370,7 @@ export function createPersistenceMigrationContract() {
             migrationStep(2, "002_usage_scope", "Distinguish provider-turn usage from aggregate run totals."),
             migrationStep(3, "003_run_feedback", "Add immutable ownership-scoped run/trace feedback and evaluation links."),
             migrationStep(4, "004_session_search", "Add bounded session search indexes and adapter-local FTS objects."),
+            migrationStep(5, "005_lifecycle_hold_quota", "Add legal-hold and tenant-quota tables for retention lifecycle."),
         ],
         lockGuidance: "Acquire a dialect-specific migration lock before applying steps (PostgreSQL advisory lock; SQLite exclusive transaction). Only one process should migrate at a time.",
         leastPrivilegeGuidance: "Run migrations with a DDL-capable role; use a separate least-privilege runtime role limited to INSERT/SELECT/UPDATE on adapter tables. Never grant migration credentials to the agent runtime.",

package/dist/tools.d.ts

@@ -43,6 +43,8 @@ export interface DispatchToolCallOptions {
     readonly redactor?: SecretRedactor;
     readonly ledger?: RunLedger;
     readonly ownership?: OwnershipScope;
+    /** Host-verified identity; asserted active before tool side effects when present. */
+    readonly identity?: import("./identity.js").AgentIdentity;
     /** Tool stages run after middleware normalization and before side effects/exposure. */
     readonly guardrails?: Guardrails;
     /** Shared run tracker; direct hosts may supply one for their call scope. */

package/dist/tools.js

@@ -1,6 +1,7 @@
 import { isJsonObject } from "./config.js";
 import { createId } from "./ids.js";
 import { GuardrailError, runGuardrails } from "./guardrails.js";
+import { assertIdentityActive, assertIdentityMatchesOwnership } from "./identity.js";
 import { errorToErrorInfo, redactRunLedgerRecord, redactSecrets } from "./redaction.js";
 import { assertCanRegister } from "./registry-options.js";
 import { assertPermission, assertTrusted } from "./security.js";
@@ -89,6 +90,7 @@ export async function dispatchToolCall(options) {
     const context = {
         ...options.context,
         toolCallId: mediatedCall.id,
+        identity: options.identity ?? options.context.identity,
         progress: async (progress, metadata) => {
             await options.context.progress?.(progress, metadata);
             await options.emit?.({
@@ -108,6 +110,10 @@ export async function dispatchToolCall(options) {
         },
     };
     try {
+        if (context.identity) {
+            assertIdentityActive(context.identity);
+            assertIdentityMatchesOwnership(context.identity, options.ownership);
+        }
         await assertTrusted(options.trust, { kind: "tool", target: mediatedCall.name, capability: "execute", metadata: options.context.metadata });
         await assertPermission(options.permission, { kind: "tool", action: "execute", target: mediatedCall.name, metadata: options.context.metadata });
     }

package/docs/a2a.md

@@ -80,6 +80,7 @@ Defaults/hard caps include: request 64 KiB/1 MiB; response 1/8 MiB; event 64 KiB
 ## Security and performance notes
 
 - Authorize every operation; lifecycle/push adapters enforce exact owner again at durable storage boundary. Missing and foreign tasks/configs share `-32001`.
+- Optional `A2AAuthorization.identity` is host-verified; the handler asserts activity/ownership match and forwards identity into `session.run`. Cross-tenant or widened scopes fail closed.
 - URL policy must reject private, loopback, link-local, rebound, redirected, or otherwise disallowed destinations. Package never fetches file URLs. Host push delivery must repeat equivalent checks for every attempt/redirect and process event IDs idempotently.
 - Push token/auth credentials are accepted only into host adapter input and removed from protocol reads/responses. Keep them out of task parts, events, telemetry, ledgers, and errors.
 - Known-secret redaction applies before handler JSON/SSE output. Client redacts mapped text/errors. Raw/data/url content remains explicitly untrusted.
@@ -88,6 +89,7 @@ Defaults/hard caps include: request 64 KiB/1 MiB; response 1/8 MiB; event 64 KiB
 
 ## Related APIs
 
+- [Agent identity](agent-identity.md)
 - [Supervisor delegation](supervisors.md)
 - [Agent/session runtime](agent-session-runtime.md)
 - [Workflows](workflows.md)

package/docs/ag-ui.md

@@ -47,6 +47,8 @@ A Prism durable `agent_suspended` returns `RUN_FINISHED` with interrupt id `${ru
 
 ACP maps assistant text to `agent_message_chunk`, safe tool lifecycle to `tool_call`/`tool_call_update`, provider usage to `usage_update`, and durable suspension to `session/request_permission`. Only `allow_once` approves; reject, cancellation, unknown outcomes, and request failure deny. It advertises only close-session capability—no terminal, filesystem, MCP, editor state, location, diff, or raw input/output capability.
 
+Co-work review (0.0.14) projects durable collaboration state over the same stream as named `CUSTOM` events, one per kind: `prism.cowork.artifact.progress`, `prism.cowork.artifact.approval.requested`, `prism.cowork.draft.connector.pending`, `prism.cowork.browser.snapshot`, and `prism.cowork.artifact.download.link`. `AgUiEventMapper.mapCoWork()` (and ACP `mapCoWork()` parity) validate, host-project (`AgUiProjection.coWork`), redact, and byte-cap each event; malformed or oversized events fail closed to nothing rather than leak. The handler accepts optional `coWorkContext` (thread/artifact/identity) and a durable `coWork` source (`createCoWorkReplay()`); one bounded, redacted page is appended after the run stream. Because projection is a pure read + map, disconnect/resume from a cursor replays co-work state without duplicate side effects. Download-link events carry an authorized, expiring token only — hosts fetch the body and never receive local paths, raw credentials, injected browser secrets, or tool-argument dumps.
+
 ## Request/response example
 
 ```json
@@ -105,6 +107,8 @@ All identity, authorization, session/thread mapping, durable checkpoint lookup,
 
 `AgUiProjection` is an allow-list. Without a callback, raw tool arguments/results/progress, paths, arbitrary state, raw Prism events, ACP locations/diffs/terminals/raw I/O, and frontend-supplied tools remain absent. Use a projector that returns a redacted display value, not a host filesystem path or tool payload.
 
+Co-work projection reuses the same allow-list: `AgUiProjection.coWork(event)` may return a curated, JSON-serializable payload for a co-work event; absent it, the redacted event fields are exposed. Wire `coWorkContext` to derive thread/artifact/identity from the authorized request (never client JSON) and `coWork` to a `createCoWorkReplay()` over your durable artifact/draft/snapshot stores. The handler projects one bounded page after the run; mount a dedicated cursor-paged co-work endpoint when full pagination is needed.
+
 ## Security and performance notes
 
 Authorize every start, replay, resume, ACP new/prompt/cancel/close request. Treat thread IDs, run IDs, cursors, client messages, resume payloads, and protocol output as untrusted. Persist run ↔ protocol correlation before exposing an interrupt. Keep `SecretRedactor` active for streaming and ledger writes.
@@ -121,3 +125,4 @@ Benchmark command/result placeholder: Task 8 adds `node scripts/benchmark-0.0.12
 - [Web-standard server handler](server.md): generic Prism HTTP API, separate from AG-UI.
 - [A2A interoperability](a2a.md): remote agent-to-agent tasks, not frontend protocol mapping.
 - [Host security guide](host-security.md): authorization, ownership, redaction, and credential boundaries.
+- [Work artifacts and review](work-artifacts-and-review.md): durable artifact service that produces the co-work approval/progress/download-link events projected here.