@arnilo/prism 0.0.13 → 0.0.15

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [0.0.15] - 2026-07-26
+
+### Added
+
+- Phase 10 provider, memory, and RAG parity: OpenAI hosted-tool attribution, bounded Responses continuation and Realtime seam; exact AI SDK V4 mapping; bounded RAG source lifecycle, document adapters, reranking, citation provenance, content trust, and ingestion status; memory export/rebuild with production-store conformance.
+
+### Changed
+
+- Versioned all **43** publishable manifests, exact internal ranges, and lockfile entries to `0.0.15`; no package was added.
+- Added network-free Phase 10 evidence: `scripts/benchmark-0.0.15.mjs`.
+
+## [0.0.14] - 2026-07-26
+
+### Added
+
+- Phase 9 personal/work-agent surfaces: durable conversation service (`createConversationService`), durable artifact service with review/approval/authorized delivery (`createArtifactService`), memory consent + lifecycle (`setConsent`/`correct`/`forget`/`applyRetention`), AG-UI co-work events (`mapCoWork` + ACP parity), scoped M365/GWS OAuth connectors (`revokeOAuthCredential`, `createOAuthWorkTokenProvider`), a browser verified-state checkpoint ledger, and a deny-by-default device adapter contract (`resolveDevicePolicy`/`assertDeviceAdmit`).
+- New optional provider packages `@arnilo/prism-provider-alibaba` (Model Studio / DashScope + Coding Plan) and `@arnilo/prism-provider-ollama` (cloud/local), both with dynamic model discovery; enrolled via `@arnilo/prism-providers`.
+
+### Changed
+
+- Versioned all **43** first-party manifests and exact internal ranges to `0.0.14` (41 → 43; only the two provider packages are new).
+- Network-free Phase 9 evidence: `scripts/benchmark-0.0.14.mjs`.
+
 ## [0.0.13] - 2026-07-24
 
 ### Added
@@ -16,8 +39,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 All notable changes to this project will be documented in this file.
 
-## [Unreleased]
-
 ## [0.0.12] - 2026-07-22
 
 ### Added

package/README.md

@@ -17,7 +17,7 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: six provider adapters, two compaction strategies,
+- **First-party packages**: fourteen provider adapters, two compaction strategies,
   coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
   encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
@@ -34,6 +34,11 @@ packages. Prism defines contracts, not apps.
 - **Config, settings, security**: layered config merge, settings providers,
   credential resolvers, trust/permission policies, and secret redaction.
 - **CLI/RPC/server**: `prism --mode print|json|rpc`, `prism init`, optional framework-free authorized Web agent/workflow routes, and explicit MCP server exposure.
+- **Ecosystem parity (0.0.15)**: OpenAI hosted-tool attribution, bounded Responses
+  continuation/Realtime, exact AI SDK V4 mapping, bounded RAG lifecycle/reranking/trust,
+  and consent-bound memory export/rebuild; provider, RAG, and memory packages remain optional.
+- **Co-work contracts (0.0.14)**: conversation/artifact review types, deny-by-default device
+  contracts, and OAuth refresh/revoke helpers; services stay in optional packages.
 
 ## Install
 
@@ -150,6 +155,8 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-zai` | ZAI GLM provider |
 | `@arnilo/prism-provider-kimi` | Kimi For Coding provider |
 | `@arnilo/prism-provider-neuralwatt` | NeuralWatt provider with implicit vLLM prefix caching |
+| `@arnilo/prism-provider-alibaba` | Alibaba Cloud (Model Studio / DashScope + Coding Plan) provider with dynamic discovery and explicit/implicit caching |
+| `@arnilo/prism-provider-ollama` | Ollama Cloud / local provider with dynamic discovery and implicit-only caching |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
 | `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
@@ -163,7 +170,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
 | `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases/owned run feedback |
 | `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases/owned run feedback |
-| `@arnilo/prism-providers` | family: all 7 provider adapters, including AI SDK interoperability |
+| `@arnilo/prism-providers` | family: all 11 provider adapters, including AI SDK interoperability |
 | `@arnilo/prism-compaction` | family: both compaction strategies |
 | `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
 | `@arnilo/prism-code` | profile: base + coding tools/security + MCP |

package/dist/agent-loops.d.ts

@@ -14,6 +14,10 @@ export declare function resolveToolConcurrency(options: {
 }, config: {
     loop?: AgentLoopStrategy | AgentLoopOptions;
 }): number;
+/** Calls the host must dispatch. Provider-hosted calls (`authority: "provider-hosted"`)
+ *  were already executed server-side; the assistant response text carries their effect, so
+ *  the host neither dispatches them nor appends a `tool_result`. */
+export declare function dispatchableToolCalls(calls: readonly ToolCallContent[]): readonly ToolCallContent[];
 /** Dispatch tool calls with bounded concurrency; append transcript rows in call order. */
 export declare function dispatchToolCallsInOrder(calls: readonly ToolCallContent[], ctx: LoopContext): Promise<void>;
 export declare function resolveLoop(options: {

package/dist/agent-loops.js

@@ -39,7 +39,8 @@ export const singleShotLoop = {
                 ctx.emit({ type: "message_finished", sessionId: ctx.sessionId, runId: ctx.runId, message });
             }
             ctx.emit({ type: "turn_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn });
-            if (calls.length === 0 || toolRounds >= ctx.maxToolRounds) {
+            const dispatchable = dispatchableToolCalls(calls);
+            if (dispatchable.length === 0 || toolRounds >= ctx.maxToolRounds) {
                 // Soft-interrupt / late steer: keep same run going when queue still has text.
                 if (await ctx.applyPendingSteers?.()) {
                     nextInput = [];
@@ -48,7 +49,7 @@ export const singleShotLoop = {
                 break;
             }
             toolRounds += 1;
-            await dispatchToolCallsInOrder(calls, ctx);
+            await dispatchToolCallsInOrder(dispatchable, ctx);
             nextInput = [];
         }
         return usage;
@@ -113,13 +114,19 @@ export function generateValidateReviseLoop(opts) {
                 }
                 ctx.emit({ type: "turn_finished", sessionId: ctx.sessionId, runId: ctx.runId, turn });
                 if (opts.toolCalls === "bounded" && calls.length > 0) {
+                    const dispatchable = dispatchableToolCalls(calls);
+                    if (dispatchable.length === 0) {
+                        // Only provider-hosted calls; no host tool to run. Continue without charging a round.
+                        nextInput = [];
+                        continue;
+                    }
                     if (toolRounds >= ctx.maxToolRounds) {
                         const result = { ok: false, errors: [{ message: "maximum tool rounds exceeded" }], metadata: { reason: "tool_round_limit" } };
                         ctx.emit({ type: "artifact_failed", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt: attempts + 1, result });
                         return usage;
                     }
                     toolRounds += 1;
-                    await dispatchToolCallsInOrder(calls, { ...ctx, toolConcurrency: 1 });
+                    await dispatchToolCallsInOrder(dispatchable, { ...ctx, toolConcurrency: 1 });
                     nextInput = [];
                     continue;
                 }
@@ -195,6 +202,12 @@ export function resolveToolConcurrency(options, config) {
         return 1;
     return Math.floor(value);
 }
+/** Calls the host must dispatch. Provider-hosted calls (`authority: "provider-hosted"`)
+ *  were already executed server-side; the assistant response text carries their effect, so
+ *  the host neither dispatches them nor appends a `tool_result`. */
+export function dispatchableToolCalls(calls) {
+    return calls.filter((call) => call.authority !== "provider-hosted");
+}
 /** Dispatch tool calls with bounded concurrency; append transcript rows in call order. */
 export async function dispatchToolCallsInOrder(calls, ctx) {
     if (calls.length === 0)

package/dist/artifacts.d.ts

@@ -0,0 +1,78 @@
+import type { OwnershipScope } from "./contracts.js";
+/**
+ * Durable artifact co-work review types (Phase 9 / 0.0.14). Core exports types only;
+ * the service + delivery-link signer live in `@arnilo/prism-server`. Prism persists bounded
+ * metadata, revisions, approvals, and delivery references — never file bodies (hosts own blobs).
+ */
+/** Review state of an artifact's latest revision. */
+export type ArtifactApprovalState = "pending" | "approved" | "rejected";
+/** A resolved decision on one revision (pending is the absence of a decision). */
+export type ArtifactDecisionState = Exclude<ArtifactApprovalState, "pending">;
+/** Bounded citation / data-source reference. Host resolves the body; Prism stores the ref only. */
+export interface ArtifactCitation {
+    readonly uri: string;
+    readonly title?: string;
+    /** Data-source kind (e.g. "web", "database", "upload"); host-defined, bounded. */
+    readonly kind?: string;
+}
+/** One immutable revision of an artifact. `uri`/`hash` reference host-owned content. */
+export interface ArtifactRevision {
+    /** 1-based, monotonic within the artifact. */
+    readonly version: number;
+    /** Host-owned blob reference (redacted; never a local filesystem path). */
+    readonly uri: string;
+    readonly mime: string;
+    /** Host-computed content hash for integrity compare. */
+    readonly hash: string;
+    readonly changeNote?: string;
+    /** Run that produced this revision, if any. */
+    readonly producerRunId?: string;
+    readonly citations?: readonly ArtifactCitation[];
+    /** Preview metadata only; the host renders content. */
+    readonly preview?: Readonly<Record<string, unknown>>;
+    readonly createdAt: string;
+}
+/** A reviewer decision on a specific revision. */
+export interface ArtifactApproval {
+    readonly version: number;
+    readonly state: ArtifactDecisionState;
+    /** Redacted reviewer actor reference. */
+    readonly reviewer: string;
+    /** Change-request / rejection note. */
+    readonly note?: string;
+    readonly decidedAt: string;
+}
+/**
+ * Durable artifact record. Stored as a versioned checkpoint value; the checkpoint version
+ * is the CAS counter for concurrent reviewers, distinct from revision numbers.
+ */
+export interface ArtifactRecord extends OwnershipScope {
+    readonly id: string;
+    readonly threadId: string;
+    readonly title?: string;
+    readonly revisions: readonly ArtifactRevision[];
+    readonly approvals: readonly ArtifactApproval[];
+    /** Last approved revision; remains recoverable after a later rejection. */
+    readonly lastValidatedVersion?: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+/** Signed, expiring delivery authorization. Reauthorized per download; never a bearer secret. */
+export interface ArtifactDeliveryToken extends OwnershipScope {
+    readonly artifactId: string;
+    readonly threadId: string;
+    readonly version: number;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+/** Well-known checkpoint namespace for artifact records. */
+export declare const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export declare class ArtifactError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_ARTIFACT";
+    constructor(message: string, reason: string);
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export declare function artifactCheckpointKey(threadId: string, artifactId: string): string;
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export declare function artifactApprovalState(record: ArtifactRecord): ArtifactApprovalState;

package/dist/artifacts.js

@@ -0,0 +1,24 @@
+/** Well-known checkpoint namespace for artifact records. */
+export const ARTIFACT_CHECKPOINT_NAMESPACE = "prism.artifact";
+export class ArtifactError extends Error {
+    reason;
+    code = "ERR_PRISM_ARTIFACT";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ArtifactError";
+    }
+}
+/** Checkpoint key for an artifact: thread-scoped so per-thread listing uses a key prefix. */
+export function artifactCheckpointKey(threadId, artifactId) {
+    return `${threadId}:${artifactId}`;
+}
+/** Current review state: the decision on the latest revision, or pending when undecided. */
+export function artifactApprovalState(record) {
+    const latest = record.revisions[record.revisions.length - 1];
+    if (latest === undefined)
+        return "pending";
+    const decision = record.approvals.find((approval) => approval.version === latest.version);
+    return decision?.state ?? "pending";
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/contracts.d.ts

@@ -43,7 +43,11 @@ export interface ToolCallDeltaContent {
     readonly id?: string;
     readonly name?: string;
     readonly argumentsText?: string;
+    /** Who executes the call. `"provider-hosted"` = the provider runs it server-side;
+     *  the host must NOT dispatch it or send a `tool_result`. Defaults to `"host"`. */
+    readonly authority?: ToolCallAuthority;
 }
+export type ToolCallAuthority = "host" | "provider-hosted";
 export interface ToolCallContent {
     readonly type: "tool_call";
     readonly id: string;
@@ -51,6 +55,10 @@ export interface ToolCallContent {
     readonly arguments: JsonObject;
     /** Set when streamed arguments failed JSON parse; dispatch blocks without execute(). */
     readonly argumentsError?: ErrorInfo;
+    /** Who executes the call. `"provider-hosted"` = the provider already ran it
+     *  server-side; the host must NOT dispatch it or append a `tool_result`. The
+     *  assistant response text already incorporates the call's effect. */
+    readonly authority?: ToolCallAuthority;
 }
 export interface ToolResultContent {
     readonly type: "tool_result";
@@ -229,6 +237,11 @@ export interface ProviderRequestOptions {
     readonly extra?: JsonObject;
     /** Provider-neutral JSON-schema structured output request. Requires model `capabilities.structuredOutput`. */
     readonly structuredOutput?: StructuredOutputOptions;
+    /** Opaque provider continuation cursor (e.g. OpenAI `previous_response_id`). When set,
+     *  the provider resumes from this cursor instead of re-sending full history. */
+    readonly continuation?: {
+        readonly cursor: string;
+    };
 }
 export interface ProviderRequest {
     readonly model: ModelConfig;
@@ -251,12 +264,17 @@ export type ProviderEvent = {
     readonly id?: string;
     readonly name?: string;
     readonly argumentsText?: string;
+    readonly authority?: ToolCallAuthority;
 } | {
     readonly type: "tool_call";
     readonly call: ToolCallContent;
 } | {
     readonly type: "usage";
     readonly usage: Usage;
+} | {
+    readonly type: "continuation_required";
+    readonly cursor: string;
+    readonly reason?: string;
 } | {
     readonly type: "done";
     readonly usage?: Usage;
@@ -269,6 +287,64 @@ export interface AIProvider {
     generate(request: ProviderRequest): AsyncIterable<ProviderEvent>;
 }
 export type ProviderResolver = (model: ModelConfig) => AIProvider | undefined;
+/** Realtime audio/session event. Realtime is a bidirectional session, not a request/response
+ *  stream, so it is a separate neutral seam from `AIProvider.generate()`. Credentials are
+ *  bound to the session handshake only and never appear in events. */
+export type RealtimeEvent = {
+    readonly type: "session_started";
+    readonly sessionId?: string;
+} | {
+    readonly type: "audio_delta";
+    readonly audio: Uint8Array;
+} | {
+    readonly type: "transcript_delta";
+    readonly text: string;
+    readonly role: "user" | "assistant";
+} | {
+    readonly type: "tool_call";
+    readonly call: ToolCallContent;
+} | {
+    readonly type: "interrupted";
+} | {
+    readonly type: "session_closed";
+    readonly reason?: string;
+} | {
+    readonly type: "error";
+    readonly error: ErrorInfo;
+};
+/** Neutral bidirectional realtime session seam. The provider owns the transport
+ *  (e.g. WebSocket); the host owns audio capture/playback and session lifecycle. */
+export interface RealtimeSession {
+    readonly id: string;
+    readonly provider: string;
+    /** Send an audio chunk (PCM/Opus; provider-specific format set at creation). */
+    sendAudio(chunk: Uint8Array, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<void>;
+    /** Inbound events (audio out, transcripts, hosted tool calls, interruption, close, error). */
+    events(): AsyncIterable<RealtimeEvent>;
+    /** Request the provider stop the current response mid-stream. */
+    interrupt(options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<void>;
+    /** Close the session and release the transport. Idempotent. */
+    close(reason?: string, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<void>;
+}
+/** Factory a provider exposes for realtime sessions; not part of `AIProvider`. */
+export type RealtimeSessionFactory = (options: RealtimeSessionOptions) => RealtimeSession;
+export interface RealtimeSessionOptions {
+    readonly model: ModelConfig;
+    readonly signal?: AbortSignal;
+    /** Provider-specific caps override; providers enforce finite defaults. */
+    readonly caps?: RealtimeCaps;
+}
+export interface RealtimeCaps {
+    readonly maxAudioEventsPerSecond?: number;
+    readonly maxBytesPerSecond?: number;
+    readonly maxWallMs?: number;
+}
 export type InputAssemblyLayout = "legacy" | "cache_aware";
 export interface RunOptions {
     readonly signal?: AbortSignal;
@@ -968,6 +1044,8 @@ export interface OAuthProvider {
     readonly id: string;
     login(callbacks?: OAuthLoginCallbacks): Promise<OAuthCredentials> | OAuthCredentials;
     refresh?(credentials: OAuthCredentials): Promise<OAuthCredentials> | OAuthCredentials;
+    /** Best-effort upstream revocation; the store delete is what fails closed locally. */
+    revoke?(credentials: OAuthCredentials): Promise<void> | void;
     getCredential?(credentials: OAuthCredentials): Promise<Credential | undefined> | Credential | undefined;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
@@ -1493,16 +1571,21 @@ export interface MigrationRecord {
 }
 /** Query for sessions. */
 export interface SessionQuery extends PersistenceQuery, OwnershipScope {
+    readonly id?: string;
     readonly parentSessionId?: string;
     readonly agentDefinitionId?: string;
     readonly agentDefinitionVersion?: string;
     readonly retentionPolicyId?: string;
+    /** Match sessions whose `metadata` object contains this top-level key (e.g. conversation marker). */
+    readonly metadataKey?: string;
     readonly fromCreatedAt?: string;
     readonly toCreatedAt?: string;
     readonly fromUpdatedAt?: string;
     readonly toUpdatedAt?: string;
     readonly hasExpired?: boolean;
 }
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export declare function assertSessionMetadataKey(key: string): string;
 /** Query for session entries. */
 export interface SessionEntryQuery extends PersistenceQuery, OwnershipScope {
     readonly sessionId?: string;
@@ -1613,6 +1696,9 @@ export interface ProductionPersistenceStore {
     queryAgentDefinitions(query: AgentDefinitionQuery): Promise<PersistencePage<AgentDefinitionRecord>>;
     queryRetentionPolicies(query: RetentionPolicyQuery): Promise<PersistencePage<RetentionPolicy>>;
     queryMigrations(query: MigrationQuery): Promise<PersistencePage<MigrationRecord>>;
+    /** Optional session-record write capability (conversation threads, host-managed sessions).
+     *  Upserts by id; ownership columns are set on create, `metadata`/`updatedAt` on update. */
+    appendSession?(record: SessionRecord): Promise<void>;
     /** DB-friendly branch read (mirrors `SessionStore.readBranchPath`): one ancestor-chain
      *  query instead of `queryEntries({ sessionId })` + in-memory walk. Optional. */
     readBranchPath?(query: SessionBranchRead): Promise<PersistencePage<SessionEntry>>;

package/dist/contracts.js

@@ -128,4 +128,12 @@ export class SessionAppendConflictError extends Error {
 export function isSessionAppendConflict(error) {
     return error instanceof Error && error.code === SESSION_APPEND_CONFLICT_CODE;
 }
+const SESSION_METADATA_KEY_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+/** Validate a top-level `SessionRecord.metadata` key used by `SessionQuery.metadataKey` filters. */
+export function assertSessionMetadataKey(key) {
+    if (typeof key !== "string" || !SESSION_METADATA_KEY_PATTERN.test(key)) {
+        throw new RangeError("metadataKey must match /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/");
+    }
+    return key;
+}
 //# sourceMappingURL=contracts.js.map

package/dist/conversations.d.ts

@@ -0,0 +1,50 @@
+import type { OwnershipScope, SessionRecord } from "./contracts.js";
+/** Conversation thread lifecycle state. Archive is soft; deletion goes through persistence lifecycle. */
+export type ConversationThreadState = "active" | "archived";
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export declare const CONVERSATION_METADATA_KEY = "prismConversation";
+export declare const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES: number;
+export declare const HARD_MAX_CONVERSATION_CURSOR_BYTES: number;
+export interface ConversationBranchRef {
+    readonly leafId: string;
+    readonly createdAt: string;
+}
+/**
+ * Durable user-scoped conversation thread. A thread is an ownership-scoped session
+ * branch plus metadata; content lives in session entries and the redacted event ledger.
+ */
+export interface ConversationThread extends OwnershipScope {
+    readonly id: string;
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    /** Branch leaves recorded by the conversation service; the entry tree remains the content source of truth. */
+    readonly branches: readonly ConversationBranchRef[];
+    /** Host-supplied create metadata; never credentials or raw transcripts. */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** Opaque thread-bound replay cursor; prevents replaying a cursor minted for another thread. */
+export interface ConversationReplayCursor {
+    readonly v: 1;
+    readonly threadId: string;
+    /** Opaque store keyset cursor; undefined means the start of the thread. */
+    readonly cursor?: string;
+}
+export declare class ConversationError extends Error {
+    readonly reason: string;
+    readonly code = "ERR_PRISM_CONVERSATION";
+    constructor(message: string, reason: string);
+}
+export declare function encodeConversationReplayCursor(cursor: ConversationReplayCursor): string;
+export declare function decodeConversationReplayCursor(encoded: string, expectedThreadId: string, maxBytes?: number): ConversationReplayCursor;
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export declare function conversationThreadFromRecord(record: SessionRecord): ConversationThread | undefined;
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export declare function conversationMarkerMetadata(marker: {
+    readonly title?: string;
+    readonly state: ConversationThreadState;
+    readonly branches?: readonly ConversationBranchRef[];
+    readonly requestId?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}): Readonly<Record<string, unknown>>;

package/dist/conversations.js

@@ -0,0 +1,97 @@
+/** Well-known `SessionRecord.metadata` key marking conversation threads. */
+export const CONVERSATION_METADATA_KEY = "prismConversation";
+export const DEFAULT_MAX_CONVERSATION_CURSOR_BYTES = 4 * 1024;
+export const HARD_MAX_CONVERSATION_CURSOR_BYTES = 16 * 1024;
+export class ConversationError extends Error {
+    reason;
+    code = "ERR_PRISM_CONVERSATION";
+    constructor(message, reason) {
+        super(message);
+        this.reason = reason;
+        this.name = "ConversationError";
+    }
+}
+export function encodeConversationReplayCursor(cursor) {
+    return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+export function decodeConversationReplayCursor(encoded, expectedThreadId, maxBytes = DEFAULT_MAX_CONVERSATION_CURSOR_BYTES) {
+    if (typeof encoded !== "string" || encoded.length === 0) {
+        throw new ConversationError("Replay cursor is required", "invalid_cursor");
+    }
+    if (Buffer.byteLength(encoded, "utf8") > maxBytes) {
+        throw new ConversationError("Replay cursor exceeds byte limit", "cursor_too_large");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    }
+    catch {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    const cursor = parsed;
+    if (cursor.v !== 1 || typeof cursor.threadId !== "string" || cursor.threadId.length === 0) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    if (cursor.threadId !== expectedThreadId) {
+        throw new ConversationError("Replay cursor belongs to another thread", "cursor_thread_mismatch");
+    }
+    if (cursor.cursor !== undefined && (typeof cursor.cursor !== "string" || cursor.cursor.length === 0)) {
+        throw new ConversationError("Replay cursor is invalid", "invalid_cursor");
+    }
+    return {
+        v: 1,
+        threadId: cursor.threadId,
+        ...(cursor.cursor === undefined ? {} : { cursor: cursor.cursor }),
+    };
+}
+/** Project a persisted session record into a conversation thread. Undefined for non-conversation sessions. */
+export function conversationThreadFromRecord(record) {
+    const marker = record.metadata?.[CONVERSATION_METADATA_KEY];
+    if (!marker || typeof marker !== "object" || Array.isArray(marker))
+        return undefined;
+    const value = marker;
+    const branches = [];
+    if (Array.isArray(value.branches)) {
+        for (const item of value.branches) {
+            if (item && typeof item === "object" &&
+                typeof item.leafId === "string" &&
+                typeof item.createdAt === "string") {
+                branches.push({
+                    leafId: item.leafId,
+                    createdAt: item.createdAt,
+                });
+            }
+        }
+    }
+    const metadata = value.metadata && typeof value.metadata === "object" && !Array.isArray(value.metadata)
+        ? value.metadata
+        : undefined;
+    return {
+        id: record.id,
+        ...(record.tenantId !== undefined ? { tenantId: record.tenantId } : {}),
+        ...(record.accountId !== undefined ? { accountId: record.accountId } : {}),
+        ...(record.userId !== undefined ? { userId: record.userId } : {}),
+        ...(typeof value.title === "string" && value.title.length > 0 ? { title: value.title } : {}),
+        state: value.state === "archived" ? "archived" : "active",
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        branches: Object.freeze(branches),
+        ...(metadata === undefined ? {} : { metadata }),
+    };
+}
+/** Serialize conversation marker metadata for `SessionRecord.metadata`. */
+export function conversationMarkerMetadata(marker) {
+    return {
+        [CONVERSATION_METADATA_KEY]: {
+            ...(marker.title === undefined ? {} : { title: marker.title }),
+            state: marker.state,
+            ...(marker.branches === undefined || marker.branches.length === 0 ? {} : { branches: marker.branches }),
+            ...(marker.requestId === undefined ? {} : { requestId: marker.requestId }),
+            ...(marker.metadata === undefined ? {} : { metadata: marker.metadata }),
+        },
+    };
+}
+//# sourceMappingURL=conversations.js.map

package/dist/credentials.d.ts

@@ -19,4 +19,18 @@ export declare function refreshOAuthCredential(options: {
     readonly credentials: OAuthCredentials;
     readonly store?: OAuthCredentialStore;
 }): Promise<OAuthCredentials>;
+/** A credential store that can also remove entries (revocation fails closed on the delete). */
+export interface RevocableOAuthCredentialStore extends OAuthCredentialStore {
+    delete(provider: string, accountId?: string): Promise<boolean> | boolean;
+}
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export declare function revokeOAuthCredential(options: {
+    readonly provider: OAuthProvider;
+    readonly credentials: OAuthCredentials;
+    readonly store?: RevocableOAuthCredentialStore;
+}): Promise<void>;
 export declare function resolveCredentialValue(source: CredentialValueSource | undefined, request: CredentialRequest): Promise<string | undefined>;

package/dist/credentials.js

@@ -48,6 +48,15 @@ export async function refreshOAuthCredential(options) {
     await options.store?.set(options.provider.id, refreshed);
     return refreshed;
 }
+/**
+ * Revokes an OAuth credential: best-effort upstream revocation, then a mandatory local
+ * store delete so subsequent connector calls fail closed. The local delete is the trust
+ * boundary — an upstream revoke failure never leaves a stored token usable.
+ */
+export async function revokeOAuthCredential(options) {
+    await options.provider.revoke?.(options.credentials);
+    await options.store?.delete(options.provider.id, options.credentials.accountId);
+}
 function credentialMapKey(name, provider) {
     return provider ? `${provider}:${name}` : name;
 }