@arnilo/prism 0.0.6 → 0.0.7

package/dist/contracts.d.ts

@@ -2,7 +2,7 @@ import type { AgentInput } from "./input.js";
 import type { ContributionRegistries } from "./contributions.js";
 import type { Middleware, MiddlewareHookName, MiddlewareRegistry } from "./middleware.js";
 import type { SecretRedactor } from "./redaction.js";
-import type { PermissionPolicy } from "./security.js";
+import type { PermissionPolicy, TrustPolicy } from "./security.js";
 import type { ManifestContributionDeclaration } from "./manifests.js";
 import type { ToolValidator } from "./tools.js";
 import type { AudioContent, DocumentContent, FileContent } from "./content.js";
@@ -106,6 +106,83 @@ export interface Usage {
     readonly cost?: number;
     readonly currency?: string;
 }
+export interface RunLimits {
+    readonly maxTurns?: number;
+    readonly maxProviderAttempts?: number;
+    readonly maxToolRounds?: number;
+    readonly maxToolCalls?: number;
+    readonly maxWallTimeMs?: number;
+    readonly maxRequestBytes?: number;
+    readonly maxResponseBytes?: number;
+    readonly maxInputTokens?: number;
+    readonly maxOutputTokens?: number;
+    readonly maxTotalTokens?: number;
+    readonly maxCost?: {
+        readonly amount: number;
+        readonly currency: string;
+    };
+}
+export type RunLimitName = keyof Required<RunLimits>;
+export interface RunLimitCounters {
+    readonly turns: number;
+    readonly providerAttempts: number;
+    readonly toolRounds: number;
+    readonly toolCalls: number;
+    readonly wallTimeMs: number;
+    readonly requestBytes: number;
+    readonly responseBytes: number;
+    readonly inputTokens: number;
+    readonly outputTokens: number;
+    readonly totalTokens: number;
+    readonly cost: number;
+}
+export interface RunLimitBreach {
+    readonly limit: RunLimitName;
+    readonly maximum: number;
+    readonly observed: number;
+    readonly currency?: string;
+}
+export type GuardrailStage = "input" | "output" | "tool_input" | "tool_output";
+export type GuardrailAction = "allow" | "block" | "tripwire" | "interrupt";
+export type GuardrailValue<S extends GuardrailStage> = S extends "input" ? readonly Message[] : S extends "output" ? ProviderTurnResult : S extends "tool_input" ? ToolCallContent : ToolResult;
+export interface GuardrailContext<S extends GuardrailStage> {
+    readonly stage: S;
+    readonly value: GuardrailValue<S>;
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly toolCallId?: string;
+    readonly toolName?: string;
+    readonly metadata: Readonly<Record<string, unknown>>;
+    readonly signal: AbortSignal;
+}
+export interface GuardrailDecision {
+    readonly action: GuardrailAction;
+    readonly reason?: string;
+    /** Public data only; Prism JSON-normalizes, bounds, and redacts it before emission. */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface Guardrail<S extends GuardrailStage = GuardrailStage> {
+    readonly name: string;
+    readonly stage: S;
+    /** Host-authored stable identity for durable definitions; unused by ordinary runs. */
+    readonly revision?: string;
+    evaluate(context: GuardrailContext<S>): GuardrailDecision | Promise<GuardrailDecision>;
+}
+export interface GuardrailRecord {
+    readonly guardrail: string;
+    readonly stage: GuardrailStage;
+    readonly action: GuardrailAction;
+    readonly reason?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface Guardrails {
+    readonly input?: readonly Guardrail<"input">[];
+    readonly output?: readonly Guardrail<"output">[];
+    readonly toolInput?: readonly Guardrail<"tool_input">[];
+    readonly toolOutput?: readonly Guardrail<"tool_output">[];
+    /** Defaults to sequential; at most 16 stage evaluations run at once. */
+    readonly maxConcurrency?: number;
+}
 export type CacheRetention = "none" | "short" | "long";
 export type PromptCacheKind = "implicit" | "openai_key" | "cache_control" | "provider_specific" | "none";
 export interface ModelCacheCapabilities {
@@ -195,7 +272,10 @@ export interface RunOptions {
     readonly signal?: AbortSignal;
     readonly model?: ModelConfig;
     readonly providerSource?: ProviderResolver;
+    /** @deprecated Use `limits.maxToolRounds`. */
     readonly maxToolRounds?: number;
+    /** Run-scoped ceilings. When an agent config also sets limits, these can only narrow it. */
+    readonly limits?: RunLimits;
     readonly providerOptions?: ProviderRequestOptions;
     readonly providerRequestPolicies?: ProviderRequestPolicy | readonly ProviderRequestPolicy[];
     readonly systemPrompt?: SystemPromptConfig;
@@ -212,6 +292,10 @@ export interface RunOptions {
     readonly instructionInjectors?: readonly InstructionInjector[];
     readonly inputLayout?: InputAssemblyLayout;
     readonly loop?: AgentLoopStrategy | AgentLoopOptions;
+    /** Appended to agent-level guardrails for this run. */
+    readonly guardrails?: Guardrails;
+    /** Opt-in durable interruption/checkpointing. */
+    readonly runState?: AgentRunStateOptions;
 }
 export interface AgentDefinition {
     readonly name: string;
@@ -258,6 +342,8 @@ export interface AgentConfig {
     readonly resourceLoader?: ResourceLoader;
     readonly store?: SessionStore;
     readonly permission?: PermissionPolicy;
+    /** Optional trust check for tool and resource targets. */
+    readonly trust?: TrustPolicy;
     readonly providerOptions?: ProviderRequestOptions;
     readonly providerRequestPolicies?: ProviderRequestPolicy | readonly ProviderRequestPolicy[];
     readonly systemPrompt?: SystemPromptConfig;
@@ -267,11 +353,31 @@ export interface AgentConfig {
     readonly idempotencyKey?: string;
     readonly compaction?: false | CompactionOptions;
     readonly retry?: false | RetryOptions;
+    /** Agent-wide ceilings; per-run limits may only narrow these values. */
+    readonly limits?: RunLimits;
     readonly metadata?: Readonly<Record<string, unknown>>;
     readonly validator?: ToolValidator;
     readonly instructionInjectors?: readonly InstructionInjector[];
     readonly inputLayout?: InputAssemblyLayout;
     readonly loop?: AgentLoopStrategy | AgentLoopOptions;
+    readonly guardrails?: Guardrails;
+    /** Opt-in durable interruption/checkpointing default for this agent. */
+    readonly runState?: AgentRunStateOptions;
+    /** Internal marker set by createSecureAgent(); makes security defaults immutable per run. */
+    readonly secure?: true;
+}
+/** Opt-in fail-closed composition over the normal explicit AgentConfig API. */
+export interface SecureAgentOptions extends Omit<AgentConfig, "tools" | "validator" | "redactor" | "permission" | "trust" | "ownership" | "limits" | "runState" | "secure"> {
+    readonly id: string;
+    readonly tools: readonly ToolDefinition[];
+    readonly toolArgumentValidator: import("./tools.js").ToolArgumentValidator;
+    readonly redactor: SecretRedactor;
+    readonly permission: PermissionPolicy;
+    readonly trust: TrustPolicy;
+    readonly ownership: OwnershipScope;
+    readonly limits: RunLimits;
+    readonly definitionRevision: string;
+    readonly runState: Omit<AgentRunStateOptions, "definitionRevision" | "interruptBeforeTool">;
 }
 export interface Agent {
     readonly config: AgentConfig;
@@ -298,7 +404,61 @@ export interface SubscribeOptions {
     /** What to do when `maxQueuedEvents` is reached. Defaults to `close`. */
     readonly overflow?: SubscriberOverflowPolicy;
 }
-export type AgentRunStatus = "succeeded" | "failed" | "aborted";
+export type AgentRunStatus = "succeeded" | "failed" | "aborted" | "suspended" | "denied";
+export type AgentRunInterruptionKind = "input_guardrail" | "tool_approval";
+/** Redacted safe-boundary descriptor; never contains tool arguments. */
+export interface AgentRunInterruption {
+    readonly kind: AgentRunInterruptionKind;
+    readonly reason: string;
+    readonly toolCallId?: string;
+    readonly toolName?: string;
+}
+export interface AgentRunStateOptions {
+    readonly checkpoints: CheckpointStore;
+    /** Host-authored immutable revision required for durable runs. */
+    readonly definitionRevision: string;
+    /** Suspend every tool call before its side effect. */
+    readonly interruptBeforeTool?: boolean;
+    readonly maxStateBytes?: number;
+    readonly fencingToken?: number;
+}
+/** Versioned, redacted checkpoint payload. Treat as opaque except status/version/interruption. */
+export interface AgentRunState {
+    readonly schemaVersion: 1;
+    readonly agentId: string;
+    readonly definitionRevision: string;
+    readonly fingerprint: string;
+    readonly runId: string;
+    readonly sessionId: string;
+    readonly leafId?: string;
+    readonly model: ModelConfig;
+    readonly status: AgentRunStatus | "running";
+    readonly interruption?: AgentRunInterruption;
+    readonly version?: number;
+}
+export interface AgentRunResume {
+    readonly decision: "approve" | "deny";
+    readonly expectedVersion: number;
+}
+export interface AgentRunResumeOptions {
+    readonly checkpoints: CheckpointStore;
+    /** Current host-authored revision; must exactly match the checkpoint. */
+    readonly definitionRevision: string;
+    readonly ownership?: OwnershipScope;
+    readonly fencingToken?: number;
+}
+export interface AgentRunRef {
+    readonly runId: string;
+    readonly sessionId?: string;
+}
+export interface AgentRunStatusResult {
+    readonly state: AgentRunState;
+    readonly version: number;
+}
+export declare class AgentRunStateError extends Error {
+    readonly code = "ERR_PRISM_AGENT_RUN_STATE";
+    constructor(message: string);
+}
 /** Terminal result of `session.run()` / `session.prompt()`. Failed and aborted runs throw {@link AgentRunError} with this shape attached. */
 export interface AgentRunResult {
     readonly sessionId: string;
@@ -314,10 +474,16 @@ export interface AgentRunResult {
     readonly message?: Message;
     /** Aggregate usage across provider turns (`run_total` scope). */
     readonly usage?: Usage;
+    /** Present when the run hit a configured resource ceiling. */
+    readonly limit?: RunLimitBreach;
     /** Present when `status` is `"failed"` or when a failed attempt still produced partial output. */
     readonly error?: ErrorInfo;
     /** String form of the abort reason when `status` is `"aborted"`. */
     readonly abortReason?: string;
+    /** Present for durable suspended/terminal runs. Payload is redacted and bounded. */
+    readonly runState?: AgentRunState;
+    /** Present only while awaiting an operator decision. */
+    readonly interruption?: AgentRunInterruption;
 }
 export declare class AgentRunError extends Error {
     readonly result: AgentRunResult;
@@ -365,6 +531,23 @@ export type AgentEvent = {
     readonly sessionId: string;
     readonly runId: string;
     readonly usage?: Usage;
+} | {
+    readonly type: "agent_suspended";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly interruption: AgentRunInterruption;
+    readonly version: number;
+} | {
+    readonly type: "agent_resumed";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly version: number;
+} | {
+    readonly type: "agent_denied";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly interruption: AgentRunInterruption;
+    readonly version: number;
 } | {
     readonly type: "turn_started";
     readonly sessionId: string;
@@ -439,6 +622,18 @@ export type AgentEvent = {
     readonly reason: string;
     readonly error: ErrorInfo;
     readonly metadata: ToolExecutionMetadata;
+} | {
+    readonly type: "guardrail_decision";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly toolCallId?: string;
+    readonly toolName?: string;
+    readonly record: GuardrailRecord;
+} | {
+    readonly type: "run_limit_exceeded";
+    readonly sessionId: string;
+    readonly runId: string;
+    readonly breach: RunLimitBreach;
 } | {
     readonly type: "queue_updated";
     readonly sessionId: string;
@@ -617,6 +812,8 @@ export interface InputBuildContext {
     readonly runId?: string;
     readonly metadata?: Readonly<Record<string, unknown>>;
     readonly signal?: AbortSignal;
+    readonly permission?: PermissionPolicy;
+    readonly trust?: TrustPolicy;
 }
 export interface PromptBuilder {
     readonly name: string;
@@ -1006,7 +1203,7 @@ export interface BranchRecord {
     readonly createdAt: string;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
-export type RunStatus = "queued" | "running" | "succeeded" | "failed" | "aborted";
+export type RunStatus = "queued" | "running" | "suspended" | "denied" | "succeeded" | "failed" | "aborted";
 /** Stored run record. */
 export interface RunRecord extends OwnershipScope {
     readonly id: string;
@@ -1377,6 +1574,7 @@ export interface ResourceLoadContext {
     readonly signal?: AbortSignal;
     readonly metadata?: Readonly<Record<string, unknown>>;
     readonly permission?: PermissionPolicy;
+    readonly trust?: TrustPolicy;
 }
 export interface SettingsProvider {
     get<T = unknown>(key: string): Promise<T | undefined> | T | undefined;
@@ -1420,6 +1618,8 @@ export interface LoopContext {
     /** Maximum independent tool calls dispatched concurrently per provider turn. Default `1`. */
     readonly toolConcurrency: number;
     assemble(nextInput: AgentInput, toolResults?: readonly ToolResult[], turn?: number): Promise<ProviderRequest>;
+    /** Charges a complete tool round before any call in it can start. */
+    chargeToolRound?(calls: readonly ToolCallContent[]): void;
     generate(request: ProviderRequest): Promise<ProviderTurnResult>;
     dispatchToolCall(call: ToolCallContent): Promise<ToolResult>;
     isToolCallExclusive?(call: ToolCallContent): boolean;

package/dist/contracts.js

@@ -1,3 +1,7 @@
+export class AgentRunStateError extends Error {
+    code = "ERR_PRISM_AGENT_RUN_STATE";
+    constructor(message) { super(message); this.name = "AgentRunStateError"; }
+}
 export class AgentRunError extends Error {
     result;
     constructor(result, options) {

package/dist/guardrails.d.ts

@@ -0,0 +1,25 @@
+import type { AgentEvent, GuardrailContext, GuardrailRecord, Guardrails, GuardrailStage, GuardrailValue } from "./contracts.js";
+import type { SecretRedactor } from "./redaction.js";
+export declare const MAX_GUARDRAIL_CONCURRENCY = 16;
+export declare class GuardrailError extends Error {
+    readonly code: string;
+    readonly record: GuardrailRecord;
+    constructor(record: GuardrailRecord);
+}
+export interface RunGuardrailsOptions<S extends GuardrailStage> {
+    readonly stage: S;
+    readonly guardrails?: Guardrails;
+    readonly value: GuardrailValue<S>;
+    readonly context: Omit<GuardrailContext<S>, "stage" | "value" | "signal"> & {
+        readonly signal?: AbortSignal;
+    };
+    readonly redactor?: SecretRedactor;
+    readonly emit?: (event: AgentEvent) => void | Promise<void>;
+}
+export interface GuardrailRunResult {
+    readonly records: readonly GuardrailRecord[];
+    readonly terminal?: GuardrailRecord;
+}
+/** Evaluate one typed stage. Default is declaration-order sequential; bounded parallel mode still reports declaration order. */
+export declare function runGuardrails<S extends GuardrailStage>(options: RunGuardrailsOptions<S>): Promise<GuardrailRunResult>;
+export declare function assertGuardrailsAllowed(result: GuardrailRunResult): void;

package/dist/guardrails.js

@@ -0,0 +1,133 @@
+export const MAX_GUARDRAIL_CONCURRENCY = 16;
+const MAX_REASON_BYTES = 4 * 1024;
+const MAX_METADATA_BYTES = 16 * 1024;
+export class GuardrailError extends Error {
+    code;
+    record;
+    constructor(record) {
+        super(record.action === "interrupt" ? "Guardrail interruption is unavailable" : "Guardrail blocked run");
+        this.name = "GuardrailError";
+        this.code = record.action === "interrupt"
+            ? "ERR_PRISM_GUARDRAIL_INTERRUPT_UNAVAILABLE"
+            : "ERR_PRISM_GUARDRAIL_BLOCKED";
+        this.record = record;
+    }
+}
+/** Evaluate one typed stage. Default is declaration-order sequential; bounded parallel mode still reports declaration order. */
+export async function runGuardrails(options) {
+    const guards = stageGuards(options.guardrails, options.stage);
+    if (guards.length === 0)
+        return { records: [] };
+    const maxConcurrency = resolveConcurrency(options.guardrails?.maxConcurrency);
+    const controller = new AbortController();
+    const signal = options.context.signal
+        ? AbortSignal.any([options.context.signal, controller.signal])
+        : controller.signal;
+    const records = new Array(guards.length);
+    let next = 0;
+    let stopped = false;
+    const worker = async () => {
+        for (;;) {
+            if (stopped)
+                return;
+            const index = next++;
+            if (index >= guards.length)
+                return;
+            const record = await evaluate(guards[index], options, signal);
+            // A sibling may have reached a terminal decision while this callback was settling.
+            if (stopped)
+                return;
+            records[index] = record;
+            if (record.action !== "allow") {
+                stopped = true;
+                controller.abort(new GuardrailError(record));
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(maxConcurrency, guards.length) }, worker));
+    const normalized = records.filter((record) => record !== undefined);
+    for (const record of normalized) {
+        await options.emit?.({
+            type: "guardrail_decision",
+            sessionId: options.context.sessionId,
+            runId: options.context.runId,
+            toolCallId: options.context.toolCallId,
+            toolName: options.context.toolName,
+            record,
+        });
+    }
+    return { records: normalized, terminal: normalized.find((record) => record.action !== "allow") };
+}
+export function assertGuardrailsAllowed(result) {
+    if (result.terminal)
+        throw new GuardrailError(result.terminal);
+}
+function stageGuards(guardrails, stage) {
+    if (!guardrails)
+        return [];
+    switch (stage) {
+        case "input": return (guardrails.input ?? []);
+        case "output": return (guardrails.output ?? []);
+        case "tool_input": return (guardrails.toolInput ?? []);
+        case "tool_output": return (guardrails.toolOutput ?? []);
+    }
+}
+async function evaluate(guardrail, options, signal) {
+    if (!guardrail || typeof guardrail.name !== "string" || !guardrail.name || guardrail.name.length > 128 || guardrail.stage !== options.stage || typeof guardrail.evaluate !== "function") {
+        return record(guardrail?.name ?? "invalid", options.stage, "tripwire", "guardrail_invalid", undefined, options.redactor);
+    }
+    try {
+        const decision = await guardrail.evaluate({ ...options.context, stage: options.stage, value: options.value, signal });
+        if (!decision || !isAction(decision.action)) {
+            return record(guardrail.name, options.stage, "tripwire", "guardrail_invalid_decision", undefined, options.redactor);
+        }
+        return record(guardrail.name, options.stage, decision.action, decision.reason, decision.metadata, options.redactor);
+    }
+    catch {
+        return record(guardrail.name, options.stage, "tripwire", "guardrail_failed", undefined, options.redactor);
+    }
+}
+function resolveConcurrency(value) {
+    if (value === undefined)
+        return 1;
+    if (!Number.isSafeInteger(value) || value < 1 || value > MAX_GUARDRAIL_CONCURRENCY) {
+        throw new Error(`Guardrail maxConcurrency must be a safe integer from 1 to ${MAX_GUARDRAIL_CONCURRENCY}`);
+    }
+    return value;
+}
+function isAction(value) {
+    return value === "allow" || value === "block" || value === "tripwire" || value === "interrupt";
+}
+function record(guardrail, stage, action, reason, metadata, redactor) {
+    return {
+        guardrail: boundText(guardrail, 128) || "invalid",
+        stage,
+        action,
+        reason: typeof reason === "string" ? boundText(redactor?.redact(reason) ?? reason, MAX_REASON_BYTES) : undefined,
+        metadata: boundedMetadata(metadata, redactor),
+    };
+}
+function boundedMetadata(value, redactor) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    try {
+        const json = JSON.stringify(redactor?.redact(value) ?? value);
+        if (!json || byteLength(json) > MAX_METADATA_BYTES)
+            return { truncated: true };
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return { invalid: true };
+    }
+}
+function boundText(value, limit) {
+    const bytes = new TextEncoder().encode(value);
+    return bytes.length <= limit ? value : new TextDecoder().decode(bytes.subarray(0, limit));
+}
+function byteLength(value) {
+    return new TextEncoder().encode(value).length;
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/index.d.ts

@@ -1,9 +1,15 @@
 export type * from "./contracts.js";
-export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError } from "./contracts.js";
-export { createAgent, createAgentSession } from "./agents.js";
+export type { RunLimitCounters, RunLimitName, SecureAgentOptions } from "./contracts.js";
+export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError } from "./contracts.js";
+export { createAgent, createAgentSession, resumeAgentRun } from "./agents.js";
+export { createSecureAgent } from "./secure-agent.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, requireRunFeedbackOwnership, runFeedbackPageLimit, RunFeedbackError, } from "./feedback.js";
 export type { MemoryRunFeedbackStoreOptions, PrepareRunFeedbackOptions, RunFeedbackLimits, RunFeedbackRun, RunFeedbackRunResolver, } from "./feedback.js";
 export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpointStore } from "./checkpoints.js";
+export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, DEFAULT_MAX_AGENT_RUN_STATE_BYTES, HARD_MAX_AGENT_RUN_STATE_BYTES, agentFingerprint, loadAgentRunState } from "./agent-run-state.js";
+export type { StoredAgentRunState } from "./agent-run-state.js";
+export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
+export type { AgentRunLifecycle, AgentRunLifecycleAgent, AgentRunLifecycleOptions, AgentRunLifecycleRequest } from "./agent-run-lifecycle.js";
 export type { MemoryCheckpointStoreOptions } from "./checkpoints.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
@@ -67,9 +73,13 @@ export type { ResolveActiveSkillsOptions, SkillRegistryOptions } from "./skills.
 export { resolveInstructionInjectors, runInstructionInjectors } from "./instruction-injection.js";
 export type { ResolveInstructionInjectorsOptions } from "./instruction-injection.js";
 export { createToolRegistry, dispatchToolCall, filterTools, createToolParameterValidator } from "./tools.js";
+export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, runGuardrails } from "./guardrails.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
+export type { GuardrailRunResult, RunGuardrailsOptions, } from "./guardrails.js";
+export type { RunLimitTrackerOptions, } from "./run-limits.js";
 export type { DispatchToolCallOptions, ToolArgumentValidationError, ToolArgumentValidationResult, ToolArgumentValidator, ToolFilter, ToolFilterInput, ToolParameterValidatorOptions, ToolRegistryOptions, ToolValidator, } from "./tools.js";
 export type { DuplicateRegistrationOptions, DuplicateRegistrationPolicy } from "./registry-options.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export declare const name = "prism";
-export declare const version = "0.0.6";
+export declare const version = "0.0.7";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -1,7 +1,10 @@
-export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError } from "./contracts.js";
-export { createAgent, createAgentSession } from "./agents.js";
+export { isSessionEntryKind, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SessionAppendConflictError, isSessionAppendConflict, AgentRunError, AgentRunStateError } from "./contracts.js";
+export { createAgent, createAgentSession, resumeAgentRun } from "./agents.js";
+export { createSecureAgent } from "./secure-agent.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, requireRunFeedbackOwnership, runFeedbackPageLimit, RunFeedbackError, } from "./feedback.js";
 export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpointStore } from "./checkpoints.js";
+export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, DEFAULT_MAX_AGENT_RUN_STATE_BYTES, HARD_MAX_AGENT_RUN_STATE_BYTES, agentFingerprint, loadAgentRunState } from "./agent-run-state.js";
+export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export { LEASE_CONFLICT_CODE, LeaseConflictError, createMemoryLeaseStore } from "./leases.js";
 export { createEventMultiplexer } from "./event-multiplexer.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
@@ -37,8 +40,10 @@ export { applyExecutionDecision, assertExecutionAllowed, checkExecution, Executi
 export { createSkillRegistry, resolveActiveSkills } from "./skills.js";
 export { resolveInstructionInjectors, runInstructionInjectors } from "./instruction-injection.js";
 export { createToolRegistry, dispatchToolCall, filterTools, createToolParameterValidator } from "./tools.js";
+export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, runGuardrails } from "./guardrails.js";
+export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_MAX_RUN_COST, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits } from "./run-limits.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop } from "./agent-loops.js";
 export const name = "prism";
-export const version = "0.0.6";
+export const version = "0.0.7";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/input.js

@@ -189,6 +189,8 @@ async function resourceMessage(uri, context, attachment) {
     const text = await loadTextResource(context.resourceLoader, uri, {
         signal: context.signal,
         metadata: context.metadata,
+        permission: context.permission,
+        trust: context.trust,
     });
     const label = attachment?.name ?? uri;
     return textMessage("user", `Resource ${label}:\n${text}`, attachmentMetadata({ ...attachment, uri }));

package/dist/resources.js

@@ -1,8 +1,9 @@
 import { parsePrismManifest } from "./manifests.js";
 import { assertJsonObject } from "./config.js";
 import { DEFAULT_MAX_MEDIA_ITEM_BYTES, loadBoundedBinaryResource, } from "./content.js";
-import { assertPermission } from "./security.js";
+import { assertPermission, assertTrusted } from "./security.js";
 export async function loadTextResource(loader, uri, context) {
+    await assertTrusted(context?.trust, { kind: "resource", target: uri, capability: "load", metadata: context?.metadata });
     await assertPermission(context?.permission, { kind: "resource", action: "load", target: uri, metadata: context?.metadata });
     const resource = await loader.load(uri, context);
     if (resource.text !== undefined)

package/dist/run-limits.d.ts

@@ -0,0 +1,34 @@
+import type { RunLimitBreach, RunLimitCounters, RunLimitName, RunLimits, Usage } from "./contracts.js";
+export declare const DEFAULT_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+export declare const HARD_MAX_RUN_COST = 10000;
+export declare const HARD_RUN_LIMITS: Required<Omit<RunLimits, "maxCost">>;
+export declare class RunLimitError extends Error {
+    readonly breach: RunLimitBreach;
+    readonly code = "ERR_PRISM_RUN_LIMIT";
+    constructor(breach: RunLimitBreach);
+}
+export interface RunLimitTrackerOptions {
+    readonly onExceeded?: (breach: RunLimitBreach) => void;
+    /** Durable resumption restores cumulative counters and original wall deadline. */
+    readonly snapshot?: RunLimitCounters;
+    readonly deadlineAt?: string;
+}
+/** Validate one host-authored layer. Defaults are applied only after inheritance is resolved. */
+export declare function resolveRunLimits(agent?: RunLimits, run?: RunLimits): Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+export declare class RunLimitTracker {
+    private readonly options;
+    readonly limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>;
+    private readonly startedAt;
+    readonly deadlineAt: string;
+    private readonly counters;
+    private timer?;
+    private exceeded?;
+    constructor(limits: Readonly<Required<Omit<RunLimits, "maxCost">> & Pick<RunLimits, "maxCost">>, options?: RunLimitTrackerOptions);
+    get breach(): RunLimitBreach | undefined;
+    snapshot(): RunLimitCounters;
+    dispose(): void;
+    charge(limit: Exclude<RunLimitName, "maxCost">, delta?: number): void;
+    recordUsage(usage: Usage | undefined): void;
+    private exceed;
+}
+export declare function createRunLimitTracker(limits: RunLimits | undefined, options?: RunLimitTrackerOptions): RunLimitTracker;