@arnilo/prism 0.0.3 → 0.0.4

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.4] - 2026-07-14
+
+### Added
+
+- Shared bounded provider transport, OpenAI serialization/media helpers, native structured-output contracts, provider/tool timing metadata, and audio/file/document content capability checks.
+- Generic checkpoint, atomic lease, and bounded event-multiplexer contracts plus persistence/run-ledger conformance helpers.
+- Optional packages for JSON Schema tool validation, MCP, coding approval/sandboxing, OpenTelemetry, encrypted/keychain credentials, SQLite/PostgreSQL persistence, and bounded workflow orchestration.
+- Manifest-only `base`, `code`, and `sdk` profiles; `prism-all` now transitively installs every first-party package.
+- Workflow, multimodal, persistence/resume, provider telemetry, cache, and external-adapter examples.
+
+### Changed
+
+- Single-shot loops support ordered bounded parallel tools; `ToolDefinition.exclusive` serializes dangerous turns without reducing later concurrency.
+- Provider requests, SSE/error bodies, media, schemas, event queues, checkpoints, and workflow fan-out/output use documented finite limits.
+- Session/ledger writes preserve order and redact before persistence; revision-loop transcript ordering and OAuth abort polling are hardened.
+- All first-party providers use shared bounded transport helpers and expose current structured-output, multimodal, caching, reasoning, telemetry, and retry behavior where supported.
+
+### Security
+
+- Added fail-closed schema/prototype-pollution, SSRF/media, SQL/tenant, path/shell approval, MCP result, credential-envelope, OAuth, redaction, and stale-worker fencing coverage.
+- Optional privileged capabilities remain inactive until hosts explicitly register transports/tools, configure roots/credentials/databases, and approve execution.
+
 ## [0.0.3] - 2026-07-08
 
 ### Added

package/README.md

@@ -17,10 +17,9 @@ packages. Prism defines contracts, not apps.
   OpenAI/OpenRouter use best-effort explicit cache hints, NeuralWatt uses
   best-effort implicit prefix caching, and other providers have route/model-specific
   or no cache-control support; see [docs/provider-caching.md](docs/provider-caching.md).
-- **First-party packages**: `@arnilo/prism-provider-openai`, `@arnilo/prism-provider-opencode-go`,
-  `@arnilo/prism-provider-openrouter`, `@arnilo/prism-provider-zai`, `@arnilo/prism-provider-kimi`,
-  `@arnilo/prism-provider-neuralwatt`, `@arnilo/prism-compaction-llm`, and
-  `@arnilo/prism-compaction-observational-memory`.
+- **First-party packages**: six provider adapters, two compaction strategies,
+  coding tools/security, JSON Schema validation, MCP, workflows, OpenTelemetry,
+  encrypted credentials, SQLite/PostgreSQL persistence, and manifest-only install profiles.
 - **Tools, context, skills**: host-owned tool registry with allow/deny filtering
   and dispatch, context providers, and a skill registry with progressive
   disclosure.
@@ -41,14 +40,16 @@ packages. Prism defines contracts, not apps.
 npm install @arnilo/prism
 ```
 
-First-party provider/compaction packages are separate installs and require
-`@arnilo/prism` as a non-optional peer. Install a single package, or use an
-umbrella to grab a whole family in one line:
+First-party code packages are separate imports and require `@arnilo/prism` as
+a non-optional peer. Install atomic packages directly or choose a manifest-only
+family/profile; profiles install packages but expose no alias exports and activate nothing:
 
 ```bash
-npm install @arnilo/prism @arnilo/prism-provider-openai   # core + one provider
-npm install @arnilo/prism @arnilo/prism-providers          # core + all providers
-npm install @arnilo/prism-all                               # everything
+npm install @arnilo/prism @arnilo/prism-provider-openai    # core + one provider
+npm install @arnilo/prism-base                              # core + compaction + validation
+npm install @arnilo/prism-code @arnilo/prism-provider-openai # coding-agent profile
+npm install @arnilo/prism-sdk @arnilo/prism-provider-openai  # application profile
+npm install @arnilo/prism-all                               # every first-party package
 ```
 
 See [docs/release-and-install.md](docs/release-and-install.md) for install
@@ -111,8 +112,8 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 
 - [docs/index.md](docs/index.md) — navigational map of every public surface.
 - The `examples/` directory holds compile-checked typed examples and runnable
-  mock demos (provider registration, auth, tools, stores/branching, compaction,
-  observational-memory recall, CLI, RPC).
+  offline demos covering providers, auth, tools, stores, compaction, structured
+  output, multimodality, workflows, CLI, and RPC.
 
 ## Packages
 
@@ -127,9 +128,21 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 | `@arnilo/prism-provider-neuralwatt` | NeuralWatt provider with implicit vLLM prefix caching |
 | `@arnilo/prism-compaction-llm` | provider-backed compaction strategy |
 | `@arnilo/prism-compaction-observational-memory` | source-backed memory + recall tool |
-| `@arnilo/prism-providers` | umbrella: all 6 provider adapters |
-| `@arnilo/prism-compaction` | umbrella: both compaction strategies |
-| `@arnilo/prism-all` | umbrella: core + providers + compaction |
+| `@arnilo/prism-coding-agent` | bounded shell/read/write/edit tools |
+| `@arnilo/prism-coding-security` | coding approval, containment, and sandbox adapters |
+| `@arnilo/prism-tool-validator-json-schema` | bounded JSON Schema tool validation |
+| `@arnilo/prism-mcp` | MCP client/tool bridge |
+| `@arnilo/prism-workflows` | bounded DAG workflows and durable coordination |
+| `@arnilo/prism-observability-opentelemetry` | optional OpenTelemetry adapter |
+| `@arnilo/prism-credentials-node` | encrypted-file and keychain credentials |
+| `@arnilo/prism-session-store-sqlite` | SQLite persistence/checkpoints/leases |
+| `@arnilo/prism-session-store-postgres` | PostgreSQL persistence/checkpoints/leases |
+| `@arnilo/prism-providers` | family: all 6 provider adapters |
+| `@arnilo/prism-compaction` | family: both compaction strategies |
+| `@arnilo/prism-base` | profile: core + compaction + JSON Schema validation |
+| `@arnilo/prism-code` | profile: base + coding tools/security + MCP |
+| `@arnilo/prism-sdk` | profile: base + workflows + MCP + credentials + OpenTelemetry |
+| `@arnilo/prism-all` | every first-party package, including both persistence adapters |
 
 ## Scripts
 
@@ -142,8 +155,7 @@ printf '{"id":"1","command":"prompt","params":{"input":"Hi"}}\n' \
 
 ## Non-goals (v1)
 
-- Built-in shell/filesystem/browser tools — ship as separate packages only.
-- MCP bridge — external extension package after extension APIs settle.
-- TUI or interactive terminal — CLI/RPC only in core.
-- Workflow/graph orchestration — bounded agent loops first.
-- Encrypted/keychain credential storage — host-owned until a real app needs it.
+- Privileged tools, MCP servers, telemetry, credentials, or databases activated by install — hosts explicitly configure and register every capability.
+- Browser automation or interactive terminal UI — CLI/RPC and workflow control APIs only.
+- Provider, credential, extension, or package auto-discovery.
+- Core-owned database drivers, secret persistence, sandbox, or application policy — optional packages implement adapters over host-owned boundaries.

package/dist/agent-loops.d.ts

@@ -1,4 +1,4 @@
-import type { AgentLoopOptions, AgentLoopStrategy, ArtifactParser, ArtifactRepairer, ArtifactValidator } from "./contracts.js";
+import type { AgentLoopOptions, AgentLoopStrategy, ArtifactParser, ArtifactRepairer, ArtifactValidator, LoopContext, ToolCallContent } from "./contracts.js";
 export declare const singleShotLoop: AgentLoopStrategy;
 export declare function isAgentLoopOptions(value: AgentLoopStrategy | AgentLoopOptions | undefined): value is AgentLoopOptions;
 export declare function generateValidateReviseLoop(opts: {
@@ -7,6 +7,13 @@ export declare function generateValidateReviseLoop(opts: {
     readonly repairer?: ArtifactRepairer<unknown>;
     readonly maxRevisions?: number;
 }): AgentLoopStrategy;
+export declare function resolveToolConcurrency(options: {
+    loop?: AgentLoopStrategy | AgentLoopOptions;
+}, config: {
+    loop?: AgentLoopStrategy | AgentLoopOptions;
+}): number;
+/** Dispatch tool calls with bounded concurrency; append transcript rows in call order. */
+export declare function dispatchToolCallsInOrder(calls: readonly ToolCallContent[], ctx: LoopContext): Promise<void>;
 export declare function resolveLoop(options: {
     loop?: AgentLoopStrategy | AgentLoopOptions;
 }, config: {

package/dist/agent-loops.js

@@ -18,13 +18,12 @@ export const singleShotLoop = {
     name: "single-shot",
     async run(ctx) {
         let usage;
-        const toolResults = [];
         let toolRounds = 0;
         let nextInput = ctx.input;
         for (let turn = 1;; turn += 1) {
             throwIfAborted(ctx.signal);
             ctx.emit({ type: "turn_started", sessionId: ctx.sessionId, runId: ctx.runId, turn });
-            const request = await ctx.assemble(nextInput, toolResults, turn);
+            const request = await ctx.assemble(nextInput, undefined, turn);
             throwIfAborted(ctx.signal);
             const { content, calls, messageId, started, usage: turnUsage } = await ctx.generate(request);
             usage = turnUsage ?? usage;
@@ -40,12 +39,7 @@ export const singleShotLoop = {
             if (calls.length === 0 || toolRounds >= ctx.maxToolRounds)
                 break;
             toolRounds += 1;
-            for (const call of calls) {
-                const result = await ctx.dispatchToolCall(call);
-                toolResults.push(result);
-                await ctx.appendMessage(toolResultMessage(result));
-                throwIfAborted(ctx.signal);
-            }
+            await dispatchToolCallsInOrder(calls, ctx);
             nextInput = [];
         }
         return usage;
@@ -73,6 +67,7 @@ export function generateValidateReviseLoop(opts) {
         async run(ctx) {
             let usage;
             let nextInput = ctx.input;
+            let pendingHistory = [];
             for (let turn = 1; turn <= max + 1; turn += 1) {
                 throwIfAborted(ctx.signal);
                 ctx.emit({ type: "turn_started", sessionId: ctx.sessionId, runId: ctx.runId, turn });
@@ -80,6 +75,10 @@ export function generateValidateReviseLoop(opts) {
                 throwIfAborted(ctx.signal);
                 const { content, messageId, started, usage: turnUsage } = await ctx.generate(request);
                 usage = turnUsage ?? usage;
+                if (pendingHistory.length > 0) {
+                    ctx.history.push(...pendingHistory);
+                    pendingHistory = [];
+                }
                 if (turn === 1)
                     ctx.history.push(...ctx.inputMessages);
                 if (started) {
@@ -121,10 +120,9 @@ export function generateValidateReviseLoop(opts) {
                 ctx.emit({ type: "artifact_revision_started", sessionId: ctx.sessionId, runId: ctx.runId, turn, attempt, failure: result });
                 const repair = await repairer(parsed.value, result, artifactCtx);
                 const repairMessages = inputMessages(repair).map((m) => ({ ...m, id: randomId("msg") }));
-                for (const message of repairMessages) {
-                    ctx.history.push(message);
+                for (const message of repairMessages)
                     await ctx.appendMessage(message);
-                }
+                pendingHistory = repairMessages;
                 nextInput = repairMessages;
                 continue;
             }
@@ -135,6 +133,54 @@ export function generateValidateReviseLoop(opts) {
 // ponytail: resolveLoop returns the loop to run. RunOptions.loop wins over
 // AgentConfig.loop; default is singleShotLoop. generate-validate-revise maps
 // its options to the factory; unknown strategy throws.
+export function resolveToolConcurrency(options, config) {
+    const loop = options.loop ?? config.loop;
+    if (!loop || !isAgentLoopOptions(loop) || loop.strategy !== "single-shot")
+        return 1;
+    const value = loop.toolConcurrency;
+    if (value === undefined)
+        return 1;
+    if (!Number.isFinite(value) || value < 1)
+        return 1;
+    return Math.floor(value);
+}
+/** Dispatch tool calls with bounded concurrency; append transcript rows in call order. */
+export async function dispatchToolCallsInOrder(calls, ctx) {
+    if (calls.length === 0)
+        return;
+    const concurrency = calls.some((call) => ctx.isToolCallExclusive?.(call))
+        ? 1
+        : Math.max(1, Math.min(ctx.toolConcurrency, calls.length));
+    if (concurrency === 1) {
+        for (const call of calls) {
+            const result = await ctx.dispatchToolCall(call);
+            await appendToolResultMessage(result, ctx);
+        }
+        return;
+    }
+    const results = new Array(calls.length);
+    let nextIndex = 0;
+    const workers = Array.from({ length: concurrency }, async () => {
+        for (;;) {
+            throwIfAborted(ctx.signal);
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= calls.length)
+                return;
+            results[index] = await ctx.dispatchToolCall(calls[index]);
+        }
+    });
+    await Promise.all(workers);
+    for (const result of results) {
+        throwIfAborted(ctx.signal);
+        await appendToolResultMessage(result, ctx);
+    }
+}
+async function appendToolResultMessage(result, ctx) {
+    const message = toolResultMessage(result);
+    ctx.history.push(message);
+    await ctx.appendMessage(message);
+}
 export function resolveLoop(options, config) {
     const loop = options.loop ?? config.loop;
     if (!loop)

package/dist/agents.js

@@ -1,8 +1,10 @@
-import { resolveLoop } from "./agent-loops.js";
+import { resolveLoop, resolveToolConcurrency } from "./agent-loops.js";
+import { createProviderTurnMetadata, readProviderHttpStatus } from "./observability.js";
 import { createDefaultCompactionStrategy, isCompactionEntryData } from "./compaction.js";
 import { assembleProviderInput } from "./input.js";
 import { providerToolCallDeltaContent, reconstructToolCallDeltas } from "./provider-events.js";
-import { createProviderRequestPolicyChain, mergeProviderRequestOptions, normalizeProviderRequestPolicyResult } from "./provider-request-policy.js";
+import { createProviderRequestPolicyChain, normalizeProviderRequestPolicyResult } from "./provider-request-policy.js";
+import { assertStructuredOutputRequestSupported, resolveRunProviderOptions } from "./structured-output.js";
 import { errorToErrorInfo, redactAgentEvent, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry } from "./redaction.js";
 import { composeSystemPrompt, mergeSystemPromptConfig } from "./system-prompts.js";
 import { createDefaultRetryPolicy, waitForRetry } from "./retry.js";
@@ -34,7 +36,9 @@ class RuntimeAgentSession {
     activeLedger;
     activeOwnership;
     activeIdempotencyKey;
-    ledgerPromises = [];
+    activeLoopTurn = 1;
+    ledgerChain = Promise.resolve();
+    ledgerFailure;
     constructor(config) {
         this.id = config.id ?? randomId("session");
         this.agent = config.agent;
@@ -101,12 +105,15 @@ class RuntimeAgentSession {
                 // ponytail: skill context after host context; no per-skill token budget yet.
                 ...activeSkills.flatMap((skill) => skill.context ?? []),
             ];
-            const providerOptions = mergeProviderRequestOptions(this.agent.config.providerOptions, options.providerOptions);
+            const providerOptions = resolveRunProviderOptions(options, this.agent.config);
+            assertStructuredOutputRequestSupported(options.model ?? this.agent.config.model, providerOptions);
             const validate = options.validate ?? this.agent.config.validator;
             // ponytail: RunOptions.instructionInjectors overrides AgentConfig.instructionInjectors (mirrors validate/loop).
             const instructionInjectors = options.instructionInjectors ?? this.agent.config.instructionInjectors ?? [];
             const inputLayout = options.inputLayout ?? this.agent.config.inputLayout;
             const loop = resolveLoop(options, this.agent.config);
+            const toolConcurrency = resolveToolConcurrency(options, this.agent.config);
+            this.activeLoopTurn = 1;
             // ponytail: LoopContext binds existing private helpers; loop orchestrates only.
             const ctx = {
                 sessionId: this.id,
@@ -117,6 +124,7 @@ class RuntimeAgentSession {
                 input,
                 inputMessages,
                 maxToolRounds,
+                toolConcurrency,
                 assemble: async (nextInput, toolResults, turn) => assembleProviderInput({
                     model: options.model ?? this.agent.config.model,
                     input: nextInput,
@@ -144,8 +152,9 @@ class RuntimeAgentSession {
                 generate: async (request) => {
                     const policyResult = await this.applyProviderRequestPolicies(request, runId, options, metadata, controller.signal);
                     const middlewareRequest = await this.agent.config.middleware?.run("provider_request", policyResult.request) ?? policyResult.request;
-                    return this.generateWithRetry(this.redactProviderRequest(middlewareRequest), runId, options, controller.signal, policyResult.secrets);
+                    return this.generateWithRetry(this.redactProviderRequest(middlewareRequest), runId, options, controller.signal, policyResult.secrets, this.activeLoopTurn);
                 },
+                isToolCallExclusive: (call) => registry.get(call.name)?.exclusive === true,
                 dispatchToolCall: (call) => dispatchToolCall({
                     call,
                     registry,
@@ -160,7 +169,11 @@ class RuntimeAgentSession {
                     validate,
                 }),
                 appendMessage: (message) => this.appendMessage(message, runId),
-                emit: (event) => this.emit(event),
+                emit: (event) => {
+                    if (event.type === "turn_started")
+                        this.activeLoopTurn = event.turn;
+                    this.emit(event);
+                },
             };
             const usage = await loop.run(ctx);
             if (usage && this.activeLedger) {
@@ -301,7 +314,17 @@ class RuntimeAgentSession {
                 redacted: Boolean(this.activeRedactor),
                 ...this.activeOwnership,
             };
-            this.ledgerPromises.push(this.activeLedger.appendEvent(redactRunLedgerRecord(record, this.activeRedactor)));
+            const ledger = this.activeLedger;
+            this.ledgerChain = this.ledgerChain.then(async () => {
+                if (this.ledgerFailure)
+                    return;
+                try {
+                    await ledger.appendEvent(redactRunLedgerRecord(record, this.activeRedactor));
+                }
+                catch (error) {
+                    this.ledgerFailure = error;
+                }
+            });
         }
     }
     closeSubscribers() {
@@ -310,19 +333,20 @@ class RuntimeAgentSession {
         this.subscribers.clear();
     }
     async drainLedger() {
-        if (this.ledgerPromises.length === 0)
-            return;
-        const pending = this.ledgerPromises;
-        this.ledgerPromises = [];
-        await Promise.all(pending);
-    }
-    async generateWithRetry(request, runId, options, signal, requestSecrets = []) {
+        await this.ledgerChain;
+        const failure = this.ledgerFailure;
+        this.ledgerChain = Promise.resolve();
+        this.ledgerFailure = undefined;
+        if (failure)
+            throw failure;
+    }
+    async generateWithRetry(request, runId, options, signal, requestSecrets = [], turn = 1) {
         const retry = mergeRetry(this.agent.config.retry, options.retry);
         const secrets = [...requestSecrets, ...(retry?.secrets ?? [])];
         const policy = retry?.policy ?? (retry ? createDefaultRetryPolicy(retry) : undefined);
         for (let attempt = 1;; attempt += 1) {
             try {
-                return await this.generateProviderTurn(request, runId, signal, secrets);
+                return await this.generateProviderTurn(request, runId, signal, secrets, turn, attempt);
             }
             catch (error) {
                 const failure = error instanceof ProviderTurnFailure ? error : undefined;
@@ -341,7 +365,17 @@ class RuntimeAgentSession {
             }
         }
     }
-    async generateProviderTurn(request, runId, signal, secrets = []) {
+    async generateProviderTurn(request, runId, signal, secrets = [], turn = 1, attempt = 1) {
+        const startedAt = performance.now();
+        const providerId = this.activeProvider?.id ?? request.model.provider;
+        const buildMetadata = (extra = {}) => createProviderTurnMetadata(request, providerId, { attempt, ...extra });
+        this.emit({
+            type: "provider_turn_started",
+            sessionId: this.id,
+            runId,
+            turn,
+            metadata: buildMetadata(),
+        });
         const content = [];
         const calls = [];
         const toolDeltas = [];
@@ -399,12 +433,31 @@ class RuntimeAgentSession {
                 calls.push(call);
                 this.emit({ type: "message_delta", sessionId: this.id, runId, content: call });
             }
+            const latencyMs = Math.round(performance.now() - startedAt);
+            this.emit({
+                type: "provider_turn_finished",
+                sessionId: this.id,
+                runId,
+                turn,
+                metadata: buildMetadata({ latencyMs }),
+                usage,
+            });
             return { content, calls, messageId, started, usage };
         }
         catch (error) {
+            const latencyMs = Math.round(performance.now() - startedAt);
+            const info = error instanceof ProviderTurnFailure ? redactSecrets(error.info, secrets) : errorToErrorInfo(error, secrets);
+            this.emit({
+                type: "provider_turn_finished",
+                sessionId: this.id,
+                runId,
+                turn,
+                metadata: buildMetadata({ latencyMs, httpStatus: readProviderHttpStatus(info) }),
+                error: info,
+            });
             if (error instanceof ProviderTurnFailure)
                 throw error;
-            throw new ProviderTurnFailure(errorToErrorInfo(error, secrets), started);
+            throw new ProviderTurnFailure(info, started);
         }
     }
     async applyProviderRequestPolicies(request, runId, options, metadata, signal) {

package/dist/checkpoints.d.ts

@@ -0,0 +1,11 @@
+import type { CheckpointStore } from "./contracts.js";
+export declare const CHECKPOINT_CONFLICT_CODE = "ERR_PRISM_CHECKPOINT_CONFLICT";
+export declare class CheckpointConflictError extends Error {
+    readonly code = "ERR_PRISM_CHECKPOINT_CONFLICT";
+    constructor(message: string);
+}
+export interface MemoryCheckpointStoreOptions {
+    readonly maxPageSize?: number;
+}
+/** In-process reference implementation of the generic checkpoint contract. */
+export declare function createMemoryCheckpointStore(options?: MemoryCheckpointStoreOptions): CheckpointStore;

package/dist/checkpoints.js

@@ -0,0 +1,144 @@
+export const CHECKPOINT_CONFLICT_CODE = "ERR_PRISM_CHECKPOINT_CONFLICT";
+export class CheckpointConflictError extends Error {
+    code = CHECKPOINT_CONFLICT_CODE;
+    constructor(message) {
+        super(message);
+        this.name = "CheckpointConflictError";
+    }
+}
+/** In-process reference implementation of the generic checkpoint contract. */
+export function createMemoryCheckpointStore(options = {}) {
+    const records = new Map();
+    const maxPageSize = Math.max(1, options.maxPageSize ?? 500);
+    return {
+        async saveCheckpoint(input) {
+            throwIfAborted(input.signal);
+            assertKey(input);
+            if (!Number.isSafeInteger(input.version) || input.version < 1) {
+                throw new CheckpointConflictError("Checkpoint version must be a positive safe integer");
+            }
+            const id = recordKey(input);
+            const existing = records.get(id);
+            if (existing)
+                assertOwnership(input, existing);
+            if (input.expectedVersion !== undefined && input.expectedVersion !== (existing?.version ?? 0)) {
+                throw new CheckpointConflictError(`Checkpoint compare-and-swap failed (expected ${input.expectedVersion}, current ${existing?.version ?? 0})`);
+            }
+            if (existing && input.version <= existing.version) {
+                throw new CheckpointConflictError(`Stale checkpoint version ${input.version} (current ${existing.version})`);
+            }
+            if (existing?.fencingToken !== undefined && (input.fencingToken === undefined || input.fencingToken < existing.fencingToken)) {
+                throw new CheckpointConflictError(`Stale checkpoint fencing token ${input.fencingToken ?? "missing"} (current ${existing.fencingToken})`);
+            }
+            const now = new Date().toISOString();
+            const value = cloneJson(input.value, "Checkpoint value");
+            const metadata = input.metadata === undefined ? undefined : cloneJson(input.metadata, "Checkpoint metadata");
+            const record = {
+                namespace: input.namespace,
+                key: input.key,
+                version: input.version,
+                ...(input.fencingToken === undefined ? {} : { fencingToken: input.fencingToken }),
+                value,
+                ...(input.category === undefined ? {} : { category: input.category }),
+                ...ownership(input),
+                createdAt: existing?.createdAt ?? now,
+                updatedAt: now,
+                ...(metadata === undefined ? {} : { metadata }),
+            };
+            records.set(id, record);
+            return record;
+        },
+        async loadCheckpoint(input) {
+            throwIfAborted(input.signal);
+            assertKey(input);
+            const record = records.get(recordKey(input));
+            if (!record)
+                return null;
+            assertOwnership(input, record);
+            return record;
+        },
+        async listCheckpoints(query = {}) {
+            throwIfAborted(query.signal);
+            const offset = decodeCursor(query.cursor);
+            const limit = Math.min(Math.max(1, query.limit ?? 100), maxPageSize);
+            const categories = query.category === undefined
+                ? undefined
+                : new Set(Array.isArray(query.category) ? query.category : [query.category]);
+            const items = [...records.values()]
+                .filter((record) => query.namespace === undefined || record.namespace === query.namespace)
+                .filter((record) => query.keyPrefix === undefined || record.key.startsWith(query.keyPrefix))
+                .filter((record) => categories === undefined || (record.category !== undefined && categories.has(record.category)))
+                .filter((record) => ownershipFilterMatches(query, record))
+                .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt) || a.key.localeCompare(b.key));
+            const page = items.slice(offset, offset + limit);
+            const next = offset + page.length;
+            return {
+                items: page,
+                ...(next < items.length ? { nextCursor: String(next) } : {}),
+            };
+        },
+        async deleteCheckpoint(input) {
+            throwIfAborted(input.signal);
+            assertKey(input);
+            const id = recordKey(input);
+            const record = records.get(id);
+            if (!record)
+                return false;
+            assertOwnership(input, record);
+            return records.delete(id);
+        },
+    };
+}
+function recordKey(input) {
+    return `${input.namespace}\0${input.key}`;
+}
+function assertKey(input) {
+    if (!input.namespace || !input.key)
+        throw new CheckpointConflictError("Checkpoint namespace and key are required");
+}
+function ownership(input) {
+    return {
+        ...(input.tenantId === undefined ? {} : { tenantId: input.tenantId }),
+        ...(input.accountId === undefined ? {} : { accountId: input.accountId }),
+        ...(input.userId === undefined ? {} : { userId: input.userId }),
+    };
+}
+function ownershipMatches(expected, actual) {
+    return expected.tenantId === actual.tenantId
+        && expected.accountId === actual.accountId
+        && expected.userId === actual.userId;
+}
+function ownershipFilterMatches(expected, actual) {
+    return (expected.tenantId === undefined || expected.tenantId === actual.tenantId)
+        && (expected.accountId === undefined || expected.accountId === actual.accountId)
+        && (expected.userId === undefined || expected.userId === actual.userId);
+}
+function assertOwnership(expected, actual) {
+    if (!ownershipMatches(expected, actual)) {
+        throw new CheckpointConflictError("Checkpoint ownership mismatch");
+    }
+}
+function cloneJson(value, label) {
+    try {
+        const encoded = JSON.stringify(value);
+        if (encoded === undefined)
+            throw new Error("not JSON serializable");
+        return JSON.parse(encoded);
+    }
+    catch (error) {
+        throw new CheckpointConflictError(`${label} must be JSON serializable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function decodeCursor(cursor) {
+    if (cursor === undefined)
+        return 0;
+    const value = Number(cursor);
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new CheckpointConflictError("Invalid checkpoint cursor");
+    return value;
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+//# sourceMappingURL=checkpoints.js.map

package/dist/compaction.js

@@ -59,7 +59,15 @@ function blockText(block) {
         return `[tool_call_delta ${block.name ?? block.index}]`;
     if (block.type === "tool_result")
         return `[tool_result ${block.name}]`;
-    return "[image]";
+    if (block.type === "image")
+        return "[image]";
+    if (block.type === "audio")
+        return "[audio]";
+    if (block.type === "file")
+        return "[file]";
+    if (block.type === "document")
+        return "[document]";
+    return "[content]";
 }
 function truncate(text, max) {
     if (max === 0 || text.length <= max)