@arnilo/prism 0.0.13 → 0.0.14

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.0.14] - 2026-07-26
+
+### Added
+
+- Phase 9 personal/work-agent surfaces: durable conversation service (`createConversationService`), durable artifact service with review/approval/authorized delivery (`createArtifactService`), memory consent + lifecycle (`setConsent`/`correct`/`forget`/`applyRetention`), AG-UI co-work events (`mapCoWork` + ACP parity), scoped M365/GWS OAuth connectors (`revokeOAuthCredential`, `createOAuthWorkTokenProvider`), a browser verified-state checkpoint ledger, and a deny-by-default device adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`).
+- New optional provider packages `@arnilo/prism-provider-alibaba` (Model Studio / DashScope + Coding Plan) and `@arnilo/prism-provider-ollama` (cloud/local), both with dynamic model discovery; enrolled via `@arnilo/prism-providers`.
+
+### Changed
+
+- Versioned all **43** first-party manifests and exact internal ranges to `0.0.14` (41 → 43; only the two provider packages are new).
+- Network-free Phase 9 evidence: `scripts/benchmark-0.0.14.mjs`.
+
 ## [0.0.13] - 2026-07-24
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: six provider adapters, two compaction strategies,
+- **First-party packages**: fourteen provider adapters, two compaction strategies,
   coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
   encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
@@ -34,6 +34,10 @@ packages. Prism defines contracts, not apps.
 - **Config, settings, security**: layered config merge, settings providers,
   credential resolvers, trust/permission policies, and secret redaction.
 - **CLI/RPC/server**: `prism --mode print|json|rpc`, `prism init`, optional framework-free authorized Web agent/workflow routes, and explicit MCP server exposure.
+- **Co-work contracts (0.0.14)**: conversation thread and artifact/review types, a
+  deny-by-default device-adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`),
+  and OAuth refresh/revoke helpers; services ship in `@arnilo/prism-server` and
+  `@arnilo/prism-credentials-node`.
 
 ## Install
 
@@ -150,6 +154,8 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-zai` | ZAI GLM provider |
 | `@arnilo/prism-provider-kimi` | Kimi For Coding provider |
 | `@arnilo/prism-provider-neuralwatt` | NeuralWatt provider with implicit vLLM prefix caching |
+| `@arnilo/prism-provider-alibaba` | Alibaba Cloud (Model Studio / DashScope + Coding Plan) provider with dynamic discovery and explicit/implicit caching |
+| `@arnilo/prism-provider-ollama` | Ollama Cloud / local provider with dynamic discovery and implicit-only caching |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
 | `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
@@ -163,7 +169,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
 | `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases/owned run feedback |
-| `@arnilo/prism-providers` | family: all 7 provider adapters, including AI SDK interoperability |
+| `@arnilo/prism-providers` | family: all 11 provider adapters, including AI SDK interoperability |
 | `@arnilo/prism-compaction` | family: both compaction strategies |
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |

package/dist/artifacts.d.ts

@@ -0,0 +1,78 @@
+import type { OwnershipScope } from "./contracts.js";
+/**
+ * Durable artifact co-work review types (Phase 9 / 0.0.14). Core exports types only;
+ * the service + delivery-link signer live in `@arnilo/prism-server`. Prism persists bounded
+ * metadata, revisions, approvals, and delivery references — never file bodies (hosts own blobs).
+ */
+/** Review state of an artifact's latest revision. */
+export type ArtifactApprovalState = "pending" | "approved" | "rejected";
+/** A resolved decision on one revision (pending is the absence of a decision). */
+export type ArtifactDecisionState = Exclude<ArtifactApprovalState, "pending">;
+/** Bounded citation / data-source reference. Host resolves the body; Prism stores the ref only. */
+export interface ArtifactCitation {
+    readonly uri: string;
+    readonly title?: string;
+    /** Data-source kind (e.g. "web", "database", "upload"); host-defined, bounded. */
+    readonly kind?: string;
+}
+/** One immutable revision of an artifact. `uri`/`hash` reference host-owned content. */
+export interface ArtifactRevision {
+    /** 1-based, monotonic within the artifact. */
+    readonly version: number;
+    /** Host-owned blob reference (redacted; never a local filesystem path). */
+    readonly uri: string;
+    readonly mime: string;
+    /** Host-computed content hash for integrity compare. */
+    readonly hash: string;
+    readonly changeNote?: string;
+    /** Run that produced this revision, if any. */
+    readonly producerRunId?: string;
+    readonly citations?: readonly ArtifactCitation[];
+    /** Preview metadata only; the host renders content. */
+    readonly preview?: Readonly<Record<string, unknown>>;
+    readonly createdAt: string;
+}
+/** A reviewer decision on a specific revision. */
+export interface ArtifactApproval {
+    readonly version: number;
+    readonly state: ArtifactDecisionState;
+    /** Redacted reviewer actor reference. */
+    readonly reviewer: string;
+    /** Change-request / rejection note. */
+    readonly note?: string;
+    readonly decidedAt: string;
+}
+/**
+ * Durable artifact record. Stored as a versioned checkpoint value; the checkpoint version
+ * is the CAS counter for concurrent reviewers, distinct from revision numbers.
+ */
+export interface ArtifactRecord extends OwnershipScope {
+    readonly id: string;
+    readonly threadId: string;
+    readonly title?: string;
+    readonly revisions: readonly ArtifactRevision[];
+    readonly approvals: readonly ArtifactApproval[];
+    /** Last approved revision; remains recoverable after a later rejection. */
+    readonly lastValidatedVersion?: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** Signed, expiring delivery authorization. Reauthorized per download; never a bearer secret. */
+export interface ArtifactDeliveryToken extends OwnershipScope {
+    readonly artifactId: string;
+    readonly threadId: string;
+    readonly version: number;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+/** Well-known checkpoint namespace for artifact records. */
+export declare const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export declare class ArtifactError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_ARTIFACT";
+    constructor(message: string, reason: string);
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export declare function artifactCheckpointKey(threadId: string, artifactId: string): string;
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export declare function artifactApprovalState(record: ArtifactRecord): ArtifactApprovalState;

package/dist/artifacts.js

@@ -0,0 +1,24 @@
+/** Well-known checkpoint namespace for artifact records. */
+export const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export class ArtifactError extends Error {
+    reason;
+    code = "ERR_PRISM_ARTIFACT";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ArtifactError";
+    }
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export function artifactCheckpointKey(threadId, artifactId) {
+    return `${threadId}:${artifactId}`;
+}
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export function artifactApprovalState(record) {
+    const latest = record.revisions[record.revisions.length - 1];
+    if (latest === undefined)
+        return "pending";
+    const decision = record.approvals.find((approval) => approval.version === latest.version);
+    return decision?.state ?? "pending";
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/contracts.d.ts

@@ -968,6 +968,8 @@ export interface OAuthProvider {
     readonly id: string;
     login(callbacks?: OAuthLoginCallbacks): Promise<OAuthCredentials> | OAuthCredentials;
     refresh?(credentials: OAuthCredentials): Promise<OAuthCredentials> | OAuthCredentials;
+    /** Best-effort upstream revocation; the store delete is what fails closed locally. */
+    revoke?(credentials: OAuthCredentials): Promise<void> | void;
     getCredential?(credentials: OAuthCredentials): Promise<Credential | undefined> | Credential | undefined;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
@@ -1493,16 +1495,21 @@ export interface MigrationRecord {
 }
 /** Query for sessions. */
 export interface SessionQuery extends PersistenceQuery, OwnershipScope {
+    readonly id?: string;
     readonly parentSessionId?: string;
     readonly agentDefinitionId?: string;
     readonly agentDefinitionVersion?: string;
     readonly retentionPolicyId?: string;
+    /** Match sessions whose `metadata` object contains this top-level key (e.g. conversation marker). */
+    readonly metadataKey?: string;
     readonly fromCreatedAt?: string;
     readonly toCreatedAt?: string;
     readonly fromUpdatedAt?: string;
     readonly toUpdatedAt?: string;
     readonly hasExpired?: boolean;
 }
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export declare function assertSessionMetadataKey(key: string): string;
 /** Query for session entries. */
 export interface SessionEntryQuery extends PersistenceQuery, OwnershipScope {
     readonly sessionId?: string;
@@ -1613,6 +1620,9 @@ export interface ProductionPersistenceStore {
     queryAgentDefinitions(query: AgentDefinitionQuery): Promise<PersistencePage<AgentDefinitionRecord>>;
     queryRetentionPolicies(query: RetentionPolicyQuery): Promise<PersistencePage<RetentionPolicy>>;
     queryMigrations(query: MigrationQuery): Promise<PersistencePage<MigrationRecord>>;
+    /** Optional session-record write capability (conversation threads, host-managed sessions).
+     *  Upserts by id; ownership columns are set on create, `metadata`/`updatedAt` on update. */
+    appendSession?(record: SessionRecord): Promise<void>;
     /** DB-friendly branch read (mirrors `SessionStore.readBranchPath`): one ancestor-chain
      *  query instead of `queryEntries({ sessionId })` + in-memory walk. Optional. */
     readBranchPath?(query: SessionBranchRead): Promise<PersistencePage<SessionEntry>>;

package/dist/contracts.js

@@ -128,4 +128,12 @@ export class SessionAppendConflictError extends Error {
 export function isSessionAppendConflict(error) {
     return error instanceof Error && error.code === SESSION_APPEND_CONFLICT_CODE;
 }
+const SESSION_METADATA_KEY_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export function assertSessionMetadataKey(key) {
+    if (typeof key !== "string" || !SESSION_METADATA_KEY_PATTERN.test(key)) {
+        throw new RangeError("metadataKey must match /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/");
+    }
+    return key;
+}
 //# sourceMappingURL=contracts.js.map

package/dist/conversations.d.ts

@@ -0,0 +1,50 @@
+import type { OwnershipScope, SessionRecord } from "./contracts.js";
+/** Conversation thread lifecycle state. Archive is soft; deletion goes through persistence lifecycle. */
+export type ConversationThreadState = "active" | "archived";
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export declare const CONVERSATION_METADATA_KEY = "prismConversation";
+export declare const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES: number;
+export declare const HARD_MAX_CONVERSATION_CURSOR_BYTES: number;
+export interface ConversationBranchRef {
+    readonly leafId: string;
+    readonly createdAt: string;
+}
+/**
+ * Durable user-scoped conversation thread. A thread is an ownership-scoped session
+ * branch plus metadata; content lives in session entries and the redacted event ledger.
+ */
+export interface ConversationThread extends OwnershipScope {
+    readonly id: string;
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    /** Branch leaves recorded by the conversation service; the entry tree remains the content source of truth. */
+    readonly branches: readonly ConversationBranchRef[];
+    /** Host-supplied create metadata; never credentials or raw transcripts. */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** Opaque thread-bound replay cursor; prevents replaying a cursor minted for another thread. */
+export interface ConversationReplayCursor {
+    readonly v: 1;
+    readonly threadId: string;
+    /** Opaque store keyset cursor; undefined means the start of the thread. */
+    readonly cursor?: string;
+}
+export declare class ConversationError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_CONVERSATION";
+    constructor(message: string, reason: string);
+}
+export declare function encodeConversationReplayCursor(cursor: ConversationReplayCursor): string;
+export declare function decodeConversationReplayCursor(encoded: string, expectedThreadId: string, maxBytes?: number): ConversationReplayCursor;
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export declare function conversationThreadFromRecord(record: SessionRecord): ConversationThread | undefined;
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export declare function conversationMarkerMetadata(marker: {
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly branches?: readonly ConversationBranchRef[];
+    readonly requestId?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}): Readonly<Record<string, unknown>>;

package/dist/conversations.js

@@ -0,0 +1,97 @@
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export const CONVERSATION_METADATA_KEY = "prismConversation";
+export const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES = 4 * 1024;
+export const HARD_MAX_CONVERSATION_CURSOR_BYTES = 16 * 1024;
+export class ConversationError extends Error {
+    reason;
+    code = "ERR_PRISM_CONVERSATION";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ConversationError";
+    }
+}
+export function encodeConversationReplayCursor(cursor) {
+    return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+export function decodeConversationReplayCursor(encoded, expectedThreadId, maxBytes = DEFAULT_MAX_CONVERSATION_CURSOR_BYTES) {
+    if (typeof encoded !== "string" || encoded.length === 0) {
+        throw new ConversationError("Replay cursor is required", "invalid_cursor");
+    }
+    if (Buffer.byteLength(encoded, "utf8") > maxBytes) {
+        throw new ConversationError("Replay cursor exceeds byte limit", "cursor_too_large");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    const cursor = parsed;
+    if (cursor.v !== 1 || typeof cursor.threadId !== "string" || cursor.threadId.length === 0) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (cursor.threadId !== expectedThreadId) {
+        throw new ConversationError("Replay cursor belongs to another thread", "cursor_thread_mismatch");
+    }
+    if (cursor.cursor !== undefined && (typeof cursor.cursor !== "string" || cursor.cursor.length === 0)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    return {
+        v: 1,
+        threadId: cursor.threadId,
+        ...(cursor.cursor === undefined ? {} : { cursor: cursor.cursor }),
+    };
+}
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export function conversationThreadFromRecord(record) {
+    const marker = record.metadata?.[CONVERSATION_METADATA_KEY];
+    if (!marker || typeof marker !== "object" || Array.isArray(marker))
+        return undefined;
+    const value = marker;
+    const branches = [];
+    if (Array.isArray(value.branches)) {
+        for (const item of value.branches) {
+            if (item && typeof item === "object" &&
+                typeof item.leafId === "string" &&
+                typeof item.createdAt === "string") {
+                branches.push({
+                    leafId: item.leafId,
+                    createdAt: item.createdAt,
+                });
+            }
+        }
+    }
+    const metadata = value.metadata && typeof value.metadata === "object" && !Array.isArray(value.metadata)
+        ? value.metadata
+        : undefined;
+    return {
+        id: record.id,
+        ...(record.tenantId !== undefined ? { tenantId: record.tenantId } : {}),
+        ...(record.accountId !== undefined ? { accountId: record.accountId } : {}),
+        ...(record.userId !== undefined ? { userId: record.userId } : {}),
+        ...(typeof value.title === "string" && value.title.length > 0 ? { title: value.title } : {}),
+        state: value.state === "archived" ? "archived" : "active",
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        branches: Object.freeze(branches),
+        ...(metadata === undefined ? {} : { metadata }),
+    };
+}
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export function conversationMarkerMetadata(marker) {
+    return {
+        [CONVERSATION_METADATA_KEY]: {
+            ...(marker.title === undefined ? {} : { title: marker.title }),
+            state: marker.state,
+            ...(marker.branches === undefined || marker.branches.length === 0 ? {} : { branches: marker.branches }),
+            ...(marker.requestId === undefined ? {} : { requestId: marker.requestId }),
+            ...(marker.metadata === undefined ? {} : { metadata: marker.metadata }),
+        },
+    };
+}
+//# sourceMappingURL=conversations.js.map

package/dist/credentials.d.ts

@@ -19,4 +19,18 @@ export declare function refreshOAuthCredential(options: {
     readonly credentials: OAuthCredentials;
     readonly store?: OAuthCredentialStore;
 }): Promise<OAuthCredentials>;
+/** A credential store that can also remove entries (revocation fails closed on the delete). */
+export interface RevocableOAuthCredentialStore extends OAuthCredentialStore {
+    delete(provider: string, accountId?: string): Promise<boolean> | boolean;
+}
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export declare function revokeOAuthCredential(options: {
+    readonly provider: OAuthProvider;
+    readonly credentials: OAuthCredentials;
+    readonly store?: RevocableOAuthCredentialStore;
+}): Promise<void>;
 export declare function resolveCredentialValue(source: CredentialValueSource | undefined, request: CredentialRequest): Promise<string | undefined>;

package/dist/credentials.js

@@ -48,6 +48,15 @@ export async function refreshOAuthCredential(options) {
     await options.store?.set(options.provider.id, refreshed);
     return refreshed;
 }
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export async function revokeOAuthCredential(options) {
+    await options.provider.revoke?.(options.credentials);
+    await options.store?.delete(options.provider.id, options.credentials.accountId);
+}
 function credentialMapKey(name, provider) {
     return provider ? `${provider}:${name}` : name;
 }

package/dist/devices.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Device adapter contract (realtime voice / desktop OS control) — 0.0.14.
+ *
+ * Contracts + deny-by-default policy ONLY. No vendor voice or desktop-control
+ * implementation ships in 0.0.14 (demand-gated to 0.1.x). This module composes
+ * over the existing `PermissionPolicy` / `RunLimits` / redactor seams; it adds
+ * no second approval runtime and no device framework. Hosts implement
+ * `DeviceAdapter`, resolve a policy, and admit sessions through the fail-closed
+ * gate below. Conformance fixtures (denial/approval/stream-bounds/redaction)
+ * live in `runDevicePolicyConformance` for future vendor adapters to run.
+ */
+import type { RunLimits } from "./contracts.js";
+import { type SecretRedactor } from "./redaction.js";
+/** Audio / screenshot / stream chunk: 1 MiB default / 8 MiB hard. */
+export declare const DEFAULT_DEVICE_MAX_CHUNK_BYTES: number;
+export declare const HARD_DEVICE_MAX_CHUNK_BYTES: number;
+/** Concurrent device sessions per identity: 1 default / 4 hard. */
+export declare const DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS = 1;
+export declare const HARD_DEVICE_MAX_CONCURRENT_SESSIONS = 4;
+export type DeviceKind = "voice" | "desktop-control";
+export type DevicePolicyErrorCode = "ERR_PRISM_DEVICE_INPUT" | "ERR_PRISM_DEVICE_DISABLED" | "ERR_PRISM_DEVICE_APPROVAL" | "ERR_PRISM_DEVICE_SESSIONS" | "ERR_PRISM_DEVICE_CHUNK" | "ERR_PRISM_DEVICE_RUN_LIMITS";
+export declare class DevicePolicyError extends Error {
+    readonly code: DevicePolicyErrorCode;
+    constructor(code: DevicePolicyErrorCode, message: string);
+}
+export interface DeviceStreamLimits {
+    readonly maxChunkBytes?: number;
+    readonly maxConcurrentSessions?: number;
+}
+/**
+ * Host-declared device adapter. `enabled` is deny-by-default: a device is
+ * admitted only when the host explicitly sets it `true` AND supplies a sandbox
+ * AND (when `requireApproval`) explicit per-side-effect approval.
+ */
+export interface DeviceAdapter {
+    readonly kind: DeviceKind;
+    readonly enabled: boolean;
+    readonly requireApproval: boolean;
+    readonly limits?: DeviceStreamLimits;
+    /** Host-owned sandbox identifier; admission fails closed without it. */
+    readonly sandbox?: string;
+    /** Host-owned network/egress policy identifier. */
+    readonly network?: string;
+}
+export interface ResolvedDevicePolicy {
+    readonly kind: DeviceKind;
+    readonly enabled: boolean;
+    readonly requireApproval: boolean;
+    readonly maxChunkBytes: number;
+    readonly maxConcurrentSessions: number;
+    readonly sandbox?: string;
+    readonly network?: string;
+    /** Shared run accounting the device session must consume. */
+    readonly runLimits?: RunLimits;
+}
+export interface DevicePolicyOptions {
+    readonly maxChunkBytes?: number;
+    readonly maxConcurrentSessions?: number;
+    readonly runLimits?: RunLimits;
+}
+export declare function resolveDevicePolicy(adapter: DeviceAdapter, options?: DevicePolicyOptions): ResolvedDevicePolicy;
+export interface DeviceAdmitRequest {
+    /** Explicit host approval for this device side effect. */
+    readonly approved: boolean;
+    /** Currently active device sessions for this identity. */
+    readonly activeSessions: number;
+}
+/**
+ * Fail-closed admission gate. Denies unless the device is explicitly enabled,
+ * sandboxed, approved (when required), under the concurrent-session budget, and
+ * bound to shared run accounting. Side effects never replay after reconnect:
+ * hosts must re-admit on every resume.
+ */
+export declare function assertDeviceAdmit(policy: ResolvedDevicePolicy, request: DeviceAdmitRequest): void;
+export interface DeviceChunkResult {
+    readonly accepted: boolean;
+    readonly bytes: number;
+    /** Present when the chunk exceeded the stream bound and was dropped. */
+    readonly marker?: "dropped_oversize";
+}
+/** Stream bound: oversize audio/screenshot/stream chunks are dropped with a marker, never forwarded. */
+export declare function acceptDeviceChunk(policy: ResolvedDevicePolicy, bytes: number): DeviceChunkResult;
+/** Telemetry must be metadata-safe: apply the host redactor before any emit/persist. */
+export declare function redactDeviceTelemetry<T>(redactor: SecretRedactor | undefined, telemetry: T): T;
+export interface DeviceConformanceResult {
+    readonly passed: readonly string[];
+}
+/**
+ * Conformance pair for future voice / desktop-control adapters. Runs the
+ * deny-by-default fixtures (denial, approval, stream bounds, session budget,
+ * run accounting, redaction) against a resolved policy and throws on any
+ * regression. Tested in 0.0.14 via fixtures only.
+ */
+export declare function runDevicePolicyConformance(adapter: DeviceAdapter, options?: DevicePolicyOptions): DeviceConformanceResult;

package/dist/devices.js

@@ -0,0 +1,138 @@
+import { redactSecrets } from "./redaction.js";
+/** Audio / screenshot / stream chunk: 1 MiB default / 8 MiB hard. */
+export const DEFAULT_DEVICE_MAX_CHUNK_BYTES = 1 * 1024 * 1024;
+export const HARD_DEVICE_MAX_CHUNK_BYTES = 8 * 1024 * 1024;
+/** Concurrent device sessions per identity: 1 default / 4 hard. */
+export const DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS = 1;
+export const HARD_DEVICE_MAX_CONCURRENT_SESSIONS = 4;
+export class DevicePolicyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "DevicePolicyError";
+    }
+}
+function validateCap(name, value, def, hard) {
+    const resolved = value ?? def;
+    if (!Number.isSafeInteger(resolved) || resolved < 1 || resolved > hard) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", `${name} must be a positive safe integer at most ${hard}`);
+    }
+    return resolved;
+}
+export function resolveDevicePolicy(adapter, options = {}) {
+    if (!adapter || (adapter.kind !== "voice" && adapter.kind !== "desktop-control")) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "device kind must be 'voice' or 'desktop-control'");
+    }
+    return {
+        kind: adapter.kind,
+        // Deny-by-default: anything but an explicit `true` resolves to disabled.
+        enabled: adapter.enabled === true,
+        // Approval is required unless the host explicitly opts out (it should not).
+        requireApproval: adapter.requireApproval !== false,
+        maxChunkBytes: validateCap("maxChunkBytes", options.maxChunkBytes ?? adapter.limits?.maxChunkBytes, DEFAULT_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CHUNK_BYTES),
+        maxConcurrentSessions: validateCap("maxConcurrentSessions", options.maxConcurrentSessions ?? adapter.limits?.maxConcurrentSessions, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, HARD_DEVICE_MAX_CONCURRENT_SESSIONS),
+        ...(adapter.sandbox ? { sandbox: adapter.sandbox } : {}),
+        ...(adapter.network ? { network: adapter.network } : {}),
+        ...(options.runLimits ? { runLimits: options.runLimits } : {}),
+    };
+}
+/**
+ * Fail-closed admission gate. Denies unless the device is explicitly enabled,
+ * sandboxed, approved (when required), under the concurrent-session budget, and
+ * bound to shared run accounting. Side effects never replay after reconnect:
+ * hosts must re-admit on every resume.
+ */
+export function assertDeviceAdmit(policy, request) {
+    if (!policy.enabled) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_DISABLED", `${policy.kind} device is disabled by default`);
+    }
+    if (!policy.sandbox) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_DISABLED", `${policy.kind} device requires an explicit sandbox`);
+    }
+    if (policy.requireApproval && !request.approved) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_APPROVAL", `${policy.kind} device side effect requires approval`);
+    }
+    if (!Number.isSafeInteger(request.activeSessions) || request.activeSessions < 0) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "activeSessions must be a non-negative safe integer");
+    }
+    if (request.activeSessions >= policy.maxConcurrentSessions) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_SESSIONS", `concurrent ${policy.kind} sessions capped at ${policy.maxConcurrentSessions}`);
+    }
+    if (!policy.runLimits) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_RUN_LIMITS", `${policy.kind} device must consume shared RunLimits`);
+    }
+}
+/** Stream bound: oversize audio/screenshot/stream chunks are dropped with a marker, never forwarded. */
+export function acceptDeviceChunk(policy, bytes) {
+    if (!Number.isSafeInteger(bytes) || bytes < 0) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "chunk bytes must be a non-negative safe integer");
+    }
+    if (bytes > policy.maxChunkBytes) {
+        return { accepted: false, bytes, marker: "dropped_oversize" };
+    }
+    return { accepted: true, bytes };
+}
+/** Telemetry must be metadata-safe: apply the host redactor before any emit/persist. */
+export function redactDeviceTelemetry(redactor, telemetry) {
+    return redactor ? redactor.redact(telemetry) : telemetry;
+}
+/**
+ * Conformance pair for future voice / desktop-control adapters. Runs the
+ * deny-by-default fixtures (denial, approval, stream bounds, session budget,
+ * run accounting, redaction) against a resolved policy and throws on any
+ * regression. Tested in 0.0.14 via fixtures only.
+ */
+export function runDevicePolicyConformance(adapter, options = {}) {
+    const runLimits = options.runLimits ?? { maxTurns: 1 };
+    const expectThrow = (code, fn) => {
+        let threw = false;
+        try {
+            fn();
+        }
+        catch (error) {
+            threw = error instanceof DevicePolicyError && error.code === code;
+        }
+        if (!threw)
+            throw new DevicePolicyError(code, `conformance: expected ${code}`);
+    };
+    const passed = [];
+    // 1. Denial by default: a disabled adapter never admits.
+    const disabled = resolveDevicePolicy({ ...adapter, enabled: false }, { ...options, runLimits });
+    expectThrow("ERR_PRISM_DEVICE_DISABLED", () => assertDeviceAdmit(disabled, { approved: true, activeSessions: 0 }));
+    passed.push("denial-by-default");
+    // 2. Approval gate: enabled+sandboxed but unapproved denies; approved admits.
+    const enabled = resolveDevicePolicy({ ...adapter, enabled: true, requireApproval: true, sandbox: adapter.sandbox ?? "sandbox" }, { ...options, runLimits });
+    expectThrow("ERR_PRISM_DEVICE_APPROVAL", () => assertDeviceAdmit(enabled, { approved: false, activeSessions: 0 }));
+    assertDeviceAdmit(enabled, { approved: true, activeSessions: 0 });
+    passed.push("approval-gate");
+    // 3. Session budget: at/over the concurrent cap denies.
+    expectThrow("ERR_PRISM_DEVICE_SESSIONS", () => assertDeviceAdmit(enabled, { approved: true, activeSessions: enabled.maxConcurrentSessions }));
+    passed.push("session-budget");
+    // 4. Run accounting: no shared RunLimits denies.
+    const unaccounted = resolveDevicePolicy({ ...adapter, enabled: true, sandbox: "sandbox" }, { ...options, runLimits: undefined });
+    expectThrow("ERR_PRISM_DEVICE_RUN_LIMITS", () => assertDeviceAdmit(unaccounted, { approved: true, activeSessions: 0 }));
+    passed.push("run-accounting");
+    // 5. Stream bounds: oversize chunk dropped with marker; in-bound accepted.
+    const over = acceptDeviceChunk(enabled, enabled.maxChunkBytes + 1);
+    if (over.accepted || over.marker !== "dropped_oversize") {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "conformance: oversize chunk must be dropped");
+    }
+    if (!acceptDeviceChunk(enabled, enabled.maxChunkBytes).accepted) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_CHUNK", "conformance: in-bound chunk must accept");
+    }
+    passed.push("stream-bounds");
+    // 6. Redaction: telemetry passes through the host redactor (secrets stripped), passthrough when absent.
+    const secret = "super-secret-device-token";
+    const redactor = { redact: (value) => redactSecrets(value, [secret]) };
+    const redacted = redactDeviceTelemetry(redactor, { note: `leak ${secret}` });
+    if (redacted.note.includes(secret)) {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "conformance: telemetry secret must be redacted");
+    }
+    if (redactDeviceTelemetry(undefined, { note: "ok" }).note !== "ok") {
+        throw new DevicePolicyError("ERR_PRISM_DEVICE_INPUT", "conformance: telemetry must pass through without a redactor");
+    }
+    passed.push("redaction");
+    return { passed };
+}
+//# sourceMappingURL=devices.js.map