@arnilo/prism 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -1,4 +1,12 @@
-# Changelog
+## [0.2.7] - 2026-08-17
+
+### Changed
+- **Release 0.2.7 (plan 027)** is the enterprise ERP production-readiness cut on the 0.2.x review-remediation line. API surface **additive-only** (plain reviewed compat gate at 0.2.7: expected deltas are the version literal plus the plan 027 additive exports — ERP outbox/inbox stores + bounded dispatcher, saga compensation/reconciliation engine, multi-party SoD approvals, signed hash-chained audit export with WORM/SIEM seams, field-level classification + fail-closed redaction, deterministic ERP invariant evals; zero removals; baselines regenerated with `--update-baseline`, no `--allow-break`; freeze manifest `scripts/phase27-freeze-manifest.json` records per-task evidence tokens, state machines, caps, the demand registry, measured HA/DR/classification/journey numbers, and the 0.3.0 blocker). Nine roadmap items with threat model ERP-T1–ERP-T10, ownership/tenant tests, no exactly-once claim, no implicit credential discovery, package budget, docs entries, and protected end-to-end evidence: (1) **transactional outbox/inbox** (`erp-messaging`, Task 1) — `ErpOutboxStore`/`ErpInboxStore` + bounded `ErpOutboxDispatcher` with claim-token CAS, `FOR UPDATE SKIP LOCKED`, `ON CONFLICT DO NOTHING` idempotent append, at-least-once delivery with explicit unknown-outcome, dead-letter/replay requiring verified tenant `AgentIdentity`; migrations 004 (`prism_erp_outbox`/`prism_erp_inbox`). (2) **saga compensation and reconciliation** (`saga`, Task 2) — `defineSaga`/`runSaga`/`resumeSaga` over existing CheckpointStore + LeaseStore with reverse-order compensation, unknown-outcome detection, manual resolution requiring verified identity + bounded reason + audit ref, stable tenant-scoped operation keys, redacted snapshots, `MAX_SAGA_STEPS=100`. (3) **multi-party SoD approvals** (`approvals`, Task 3) — `ApprovalStore` with role/quorum rules, requester/approver separation, any-party-veto rejection, delegated authority (max depth 8), expiry checked at every protected transition, atomic grant consumption in the host transaction, `policyRevision` pin denying on mismatch; migration 005 (`prism_erp_approvals`). (4) **tamper-evident audit export** (`audit-export`, Task 4) — `createAuditExporter` with WORM-then-SIEM ordering, hash-chained record envelopes (genesis 0x64 zeros), `verifyAuditBatch` independent verification, `AuditCursorStore` CAS, SIEM best-effort pending replay (8-entry cap), legal-hold flag preservation, RFC 8785 canonical JSON for digests. (5) **secret-manager adapters** (Task 5) — Vault/AWS/Azure/GCP stay **deferred** behind the demand gate (no named consumer; no adapter ships; `scripts/phase27-demand-gate.mjs` enforces zero ambient discovery). (6) **HA registries and recovery** (`ha-dr`, Task 6) — two-replica drill on real Postgres proves failover within lease TTL+5s (measured 4100 ms vs 9000 ms ceiling), idempotent outbox re-append on uncertain-commit replay, stale fence/revision write rejection, exactly-one lease owner, tenant isolation fail-closed. (7) **backup/restore/migration rollback evidence** (Task 7) — `pg_dump`/`pg_restore` custom-format backup (108,291 B / 122 ms / 382 ms restore), 0.2.6→0.2.7 migration forward+rollback rehearsed (5 migrations), PITR RPO 0 s / RTO 1 s (recovery 1163 ms); production rollback is roll-forward repair only (no down migrations). (8) **field-level classification and fail-closed redaction** (`field-policy`, Task 8) — `applyFieldPolicy`/`FieldPolicy`/`createProtectedFieldPolicy` at the redaction, audit-export, and OpenTelemetry seams; unknown-label deny-on-outbound fail-closed default, sparse-copy walker, measured overhead peak 99.8% of the redactor-walk baseline (cap 110%). (9) **ERP release journey** (`erp-evals`, Task 9) — `erpInvariantDataset` + `createErpInvariantScorers` (8 hard 0/1 gates consuming structured facts only) + `scripts/phase27-erp-journey.test.mjs` exercising identity/policy/budget/SoD-approval/outbox/saga-compensation/audit-export/legal-hold/classification/failover/restore end-to-end (4815 ms, all 8 invariants pass). Release graph stays **50** publishable manifests at exact **0.2.7**; zero new runtime dependency names (core remains dependency-free). Store compatibility with 0.2.6: **compatible, additive** (two new ERP migrations 004/005 + outbox/inbox/approvals tables; rollback = stop 0.2.7 workers, restore the 0.2.6 manifests/tag — see `docs/migration.md` `0.2.6 → 0.2.7`). Exit gate green (core + script gates incl. `phase27-freeze` 9, `phase27-release` 12, `phase27-ha`/`phase27-dr`/`phase27-erp-journey` protected legs, coverage gate, `sdk:ready`, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain reviewed compat gate at 0.2.7 — version literal + additive exports only, release-evidence manifest with zero blocked surfaces, evidence in `scripts/phase27-release-evidence.json`). **"ERP production ready" remains blocked until the 0.3.0 live-service matrix is recorded** — passing 0.2.7 gates unblocks the release cut, not the 0.3.0 live-service matrix. **Publication remains the operator handoff** (`docs/release-and-install.md` `0.2.7 publish handoff` — signed `v0.2.7` tag + npm OIDC).
+
+## [0.2.6] - 2026-08-16
+
+### Changed
+- **Release 0.2.6 (plan 026)** is the fully-featured coding-agent-readiness cut on the 0.2.x review-remediation line. API surface **additive-only** (plain reviewed compat gate at 0.2.6: expected deltas are the version literal plus the Task 1-6 additive exports — PTY backend/handle types, the indexed-search seam, the workspace lifecycle, process/ACP recovery, the review manifest + diagnostics; zero removals; no `--allow-break`; freeze manifest `scripts/phase26-freeze-manifest.json` records per-task evidence tokens, state machines, caps, and the demand registry). Seven roadmap items with threat model T1-T8, ownership tests, no implicit activation, package budget, docs entry, and protected end-to-end evidence: (1) **host-selected PTY/interactive terminal backend** (`pty-backend`, plan 026 Task 1) — `createProcessSessions` gains an optional `ptyBackend` seam with explicit `capabilities.resize` (never duck-typed); `pty: true` without a backend fails byte-compatibly with `ERR_PRISM_PROCESS_PTY_UNSUPPORTED` before spawn; bounded terminal geometry/TERM/attach-timeout/resize-rate/metadata caps (`ERR_PRISM_PROCESS_PTY_LIMIT`), generic `ERR_PRISM_PROCESS_PTY_BACKEND` errors that never leak backend text, NUL rejected in PTY input as a policy error, terminal output stays untrusted with no parser/emulator, backend loss surfaces as `unknown` with `exitCode: null`. (2) **scalable indexed code-search seam** (`indexed-search`, Task 2) — `createIndexedRepositoryOperations` composes a host-owned incremental index backend (`update/remove/search/status/dispose`, `capabilities.semantic` explicit) with the bounded literal search as the unchanged default; `indexed_literal`/`semantic` modes fail closed on stale/failed/unsupported/untrusted indexes (`ERR_PRISM_INDEX_*`), no silent semantic-to-literal downgrade, results labeled `untrusted_index`, containment/score/snippet caps enforced, 100k-entry benchmark p95 <= 250 ms. (3) **ownership-scoped multi-repository and worktree lifecycle** (`workspace-lifecycle`, Task 3) — `createCodingWorkspaceLifecycle` over CheckpointStore CAS + LeaseStore fencing (`prism.coding-agent.workspace.v1` records, schemaVersion 1): deterministic `ws-` ids, locked worktrees with `prism-workspace:` reasons, credential-free remote fingerprints (sha256 of redacted URL + default branch, never the URL), idempotent create, verify revalidating repository/worktree identity, and a cleanup refusal matrix (dirty/locked/unowned/missing/mismatched/main) with `ERR_PRISM_WORKSPACE_*` codes; `GitOperations` gains worktree `lock`/`unlock` and `fingerprint()`. (4) **forge breadth demand-gated** (Task 4) — GitLab/Bitbucket adapters stay **deferred** in the demand registry (no named consumer/date/use case recorded), so no adapter source ships and the forge barrel contains no provider name; activation requires a recorded named consumer. (5) **durable ACP/live-task and managed-process recovery** (`durable-recovery`, Task 5) — `ProcessSessions` persists bounded intent/metadata before spawn in `prism.coding-agent.process.v1` records (never handles/env/tokens/raw output), serializes per-record transition CAS writes, and `recover()` is attach-if-attested reporting `attached|terminal|unknown` with no fabricated exit code and no PID probing; per-record leases (30 s/300 s) fence two replicas (split-brain conformance green on real Postgres); `PersistedAcpSession` gains an additive optional `activeRun` ref (0.2.5 records stay readable) and `createAcpRunRecovery` re-resolves status against `AgentRunLifecycle` (suspended keeps pending approval ids, unprovable in-flight -> unknown, never a restarted prompt) with durable ownership/version/fence-checked cancellation in `prism.coding-agent.cancel.v1` markers that never replays a pending/dispatched tool; `ERR_PRISM_RECOVERY_*` codes. (6) **bounded patch review and incremental diagnostics** (`review-diagnostics`, Task 6) — `createCodingPatchReviewManifest` builds a digest-bound manifest (patch sha256 + repository/worktree/base/head identity + changed paths/diffstat + checks + diagnostic summaries, never a raw patch body) composed over the server `ArtifactService`; `assertCodingPatchAccepted` derives `pending|accepted|rejected|superseded` bound to the exact artifact revision and digest, refuses stale acceptance, and never applies/commits/pushes/merges; `LanguageIntelligence` gains opt-in full-content `syncDocument` (monotonic versions) and `diagnosticDelta` (push/pull with resultId reuse, stale-version guards) plus `normalizeDiagnostics` with deterministic added/removed/unchanged deltas and host-supplied check parsers; LSP stays strictly opt-in (nothing spawns from tool factories or agent assembly). (7) **protected real coding journey** (`coding-journey`, Task 7) — `scripts/phase26-coding-journey.test.mjs` runs a packed consumer through real host services only (provider call, digest-pinned Docker sandbox, Postgres worktree lifecycle, provider-driven ACP edit with policy approval, named check + `diagnosticDelta`, patch review over the server artifact store, cross-replica process recovery, durable cancellation, real GitHub push/lookup-before-create PR/reconcile/cleanup, host Playwright inspection, host PTY adapter in the frozen profile) under the frozen wall/cleanup ceilings with run-suffix side effects and per-step idempotent cleanup; missing credentials/services or skipped substeps record `blocked`, never a passing skip; the retained `scripts/phase26-coding-journey-report.json` carries timings/states/ids only and gates release evidence (pass/blocked/protected). Release graph stays **50** publishable manifests at exact **0.2.6**; zero new runtime dependency names (core remains dependency-free). Store compatibility with 0.2.5: **compatible, additive** (three new versioned record namespaces + the optional ACP `activeRun` field; rollback = stop 0.2.6 workers, mark active PTY/process/recovery records unknown, restore the 0.2.5 manifests/tag — see `docs/migration.md` `0.2.5 → 0.2.6`). Exit gate green (core + script gates incl. `phase26-freeze` 11, `phase26-index-benchmark`, coding-agent 348 + ag-ui 203 workspace suites, coverage gate, `sdk:ready`, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain reviewed compat gate at 0.2.6 — version literal + additive exports only, protected Postgres recovery/workspace conformance 8/8, protected PTY leg 4/4, protected real coding journey per the retained report, release-evidence manifest with zero blocked surfaces, evidence in `scripts/phase26-baseline.json`). **Publication remains the operator handoff** (`docs/release-and-install.md` `0.2.6 publish handoff` — signed `v0.2.6` tag + npm OIDC).
 
 ## [0.2.5] - 2026-08-15
 

package/README.md

@@ -11,6 +11,7 @@ packages. Prism defines contracts, not apps.
 - **Agent/session runtime**: `createAgent`/`createAgentSession`, run prompts,
   dispatch host tools, subscribe to normalized `AgentEvent` streams, abort runs,
   compact, and navigate branches.
+- **Field-level classification (0.2.7)**: `applyFieldPolicy` + the fail-closed protected default walk JSON-like values across prompt/tool/artifact/audit/telemetry/persistence/export boundaries with `allow`/`redact`/`tokenize`/`deny` decisions, explicit per-boundary `labelFor` hints, bounded traversal, and sparse-copy allocation; seams at the egress redaction functions, the audit-export redactor hook, and the OpenTelemetry attribute policy. See [docs/data-classification.md](docs/data-classification.md).
 - **Providers and models**: provider/model registries, provider event helpers,
   credential redaction helpers, mock provider, and an optional
   OpenAI-compatible provider subpath. Cache support is provider-specific:

package/dist/field-policy.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Field-level classification and fail-closed redaction (plan 027 Task 8).
+ *
+ * A dependency-free, JSON-like structured-value walker that evaluates an
+ * explicit host policy against every field of a value destined to cross a
+ * data boundary (provider prompt egress, tool dispatch/result persistence,
+ * artifact write/read/export, audit hashing, telemetry attributes/events,
+ * lifecycle export). The policy classifies fields by label, path, destination,
+ * and tenant; unknown fields fail closed under the protected default.
+ *
+ * Non-goals (frozen): no automatic sensitive-data discovery (labels come from
+ * an explicit `labelFor` hint function supplied by the boundary owner), no
+ * global registry, no decorator framework, no second policy language. Existing
+ * hardcoded secret redaction (`createSecretRedactor`) stays in place as
+ * defense in depth and runs *after* policy transformation at egress seams.
+ */
+export type FieldPolicyAction = "allow" | "redact" | "tokenize" | "deny";
+export interface FieldPolicyDecision {
+    readonly action: FieldPolicyAction;
+    /** Bounded reason recorded in audit redaction lists; never includes values. */
+    readonly reason?: string;
+}
+export interface FieldPolicyInput {
+    /** Dot/bracket path from the value root, e.g. `user.credentials[2].apiKey`. */
+    readonly path: string;
+    /** Boundary destination: prompt, tool, artifact, audit, telemetry, persistence, export, ... */
+    readonly destination: string;
+    /** Explicit caller-assigned label from `labelFor`; undefined = unknown. */
+    readonly label?: string;
+    readonly kind: "string" | "number" | "boolean" | "null" | "array" | "object";
+    readonly tenantId?: string;
+    readonly direction: "inbound" | "outbound";
+    readonly purpose?: string;
+}
+export type FieldPolicy = (input: FieldPolicyInput) => FieldPolicyDecision;
+export interface ApplyFieldPolicyOptions {
+    readonly destination: string;
+    readonly direction?: "inbound" | "outbound";
+    readonly tenantId?: string;
+    readonly purpose?: string;
+    /** Explicit key→label hints owned by the boundary; no automatic discovery. */
+    readonly labelFor?: (key: string, path: string) => string | undefined;
+    /** Called for every non-allow decision with {path, reason}; used by audit adapters. */
+    readonly onRedact?: (path: string, reason: string) => void;
+    readonly maxDepth?: number;
+    readonly maxKeys?: number;
+    readonly maxChars?: number;
+    /** Wall-clock budget for the whole walk; a slow policy trips it (fail closed). */
+    readonly maxPolicyMs?: number;
+    /** Deterministic token prefix (stable across runs; safe for audit chains). */
+    readonly tokenPrefix?: string;
+}
+export declare class FieldPolicyError extends Error {
+    readonly code = "ERR_PRISM_FIELD_POLICY";
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+export declare const FIELD_POLICY_LIMITS: Readonly<{
+    readonly maxDepth: 32;
+    readonly maxKeys: 10000;
+    readonly maxChars: 1000000;
+    readonly maxPolicyMs: 5000;
+    readonly tokenPrefix: "tok_";
+}>;
+/**
+ * Applies `policy` to every field of a JSON-like value.
+ *
+ * Decisions: `allow` keeps the value; `redact` replaces string leaves with
+ * `[REDACTED]` while preserving container shape; `tokenize` replaces string
+ * leaves with a deterministic token; `deny` replaces the value with `[DENIED]`.
+ * Unknown labels fail closed under the protected default. Hostile values
+ * (cycles, unsupported types, over-budget walks) throw `FieldPolicyError`
+ * instead of stringifying guesses. The input is never mutated; only fields the
+ * policy changed are allocated.
+ */
+export declare function applyFieldPolicy<T>(value: T, policy: FieldPolicy, options: ApplyFieldPolicyOptions): T;
+export interface ProtectedFieldPolicyOptions {
+    /** Labels allowed to cross outbound/persisted boundaries unchanged. */
+    readonly publicLabels?: readonly string[];
+    /** Labels denied with the given reason; default `secret` and `financial`. */
+    readonly deniedLabels?: Readonly<Record<string, string>>;
+    /** Labels redacted with the given reason; default `personal`. */
+    readonly redactedLabels?: Readonly<Record<string, string>>;
+    /** Labels tokenized; default none. */
+    readonly tokenizedLabels?: Readonly<Record<string, string>>;
+}
+/**
+ * Fail-closed default for the protected profile (frozen behavior):
+ * unknown labels are denied on outbound boundaries and allowed inbound;
+ * `secret`/`financial` denied, `personal` redacted, listed public labels
+ * allowed. Labels are never auto-discovered — `labelFor` decides them.
+ */
+export declare function createProtectedFieldPolicy(options?: ProtectedFieldPolicyOptions): FieldPolicy;
+/** Identity policy: every field allowed (explicit override for trusted marks). */
+export declare const ALLOW_FIELD_POLICY: FieldPolicy;
+export interface AuditFieldRedaction {
+    readonly path: string;
+    readonly reason: string;
+}
+/** Structural match for `AuditRedactionPolicy` in @arnilo/prism-policy. */
+export interface AuditFieldRedactorLike {
+    apply(record: Readonly<Record<string, unknown>>): {
+        record: Readonly<Record<string, unknown>>;
+        redactions?: readonly AuditFieldRedaction[];
+    };
+}
+export interface AuditFieldRedactorOptions {
+    readonly tenantId?: string;
+    readonly purpose?: string;
+    readonly labelFor?: (key: string, path: string) => string | undefined;
+    /** Default true; denial instead would fail export (protected profile fails closed). */
+    readonly collectProvenance?: boolean;
+}
+/**
+ * Adapts a `FieldPolicy` to the audit-export redaction hook. Transformation
+ * runs BEFORE canonical hashing so the exported chain verifies exactly.
+ * Only `{path, reason}` provenance survives; values never echo into the list.
+ */
+export declare function createAuditFieldRedactor(policy: FieldPolicy, options?: AuditFieldRedactorOptions): AuditFieldRedactorLike;

package/dist/field-policy.js

@@ -0,0 +1,418 @@
+/**
+ * Field-level classification and fail-closed redaction (plan 027 Task 8).
+ *
+ * A dependency-free, JSON-like structured-value walker that evaluates an
+ * explicit host policy against every field of a value destined to cross a
+ * data boundary (provider prompt egress, tool dispatch/result persistence,
+ * artifact write/read/export, audit hashing, telemetry attributes/events,
+ * lifecycle export). The policy classifies fields by label, path, destination,
+ * and tenant; unknown fields fail closed under the protected default.
+ *
+ * Non-goals (frozen): no automatic sensitive-data discovery (labels come from
+ * an explicit `labelFor` hint function supplied by the boundary owner), no
+ * global registry, no decorator framework, no second policy language. Existing
+ * hardcoded secret redaction (`createSecretRedactor`) stays in place as
+ * defense in depth and runs *after* policy transformation at egress seams.
+ */
+export class FieldPolicyError extends Error {
+    code = "ERR_PRISM_FIELD_POLICY";
+    path;
+    constructor(path, message) {
+        super(`field policy rejected value at ${path}: ${message}`);
+        this.name = "FieldPolicyError";
+        this.path = path;
+    }
+}
+export const FIELD_POLICY_LIMITS = Object.freeze({
+    maxDepth: 32,
+    maxKeys: 10_000,
+    maxChars: 1_000_000,
+    maxPolicyMs: 5_000,
+    tokenPrefix: "tok_",
+});
+const REDACTED = "[REDACTED]";
+const DENIED = "[DENIED]";
+function tokenOf(prefix, path, original, sha) {
+    const hash = sha(`${path}\u0000${original}`);
+    return `${prefix}${hash.slice(0, 12)}`;
+}
+const ALLOW = { action: "allow" };
+const DENY_UNKNOWN = Object.freeze({ action: "deny", reason: "unknown-field" });
+const DENY_UNKNOWN_LABEL = Object.freeze({ action: "deny", reason: "unknown-label" });
+const denied = (reason) => Object.freeze({ action: "deny", reason });
+function normalizeDecision(value, path) {
+    if (value && typeof value === "object" && typeof value.action === "string") {
+        const candidate = value;
+        const action = candidate.action;
+        if (action === "allow" || action === "redact" || action === "tokenize" || action === "deny") {
+            // Returned decision objects are used as-is (host policies may reuse
+            // frozen constants; a hostile mutation is their own risk).
+            if (candidate.reason !== undefined && typeof candidate.reason !== "string") {
+                throw new FieldPolicyError(path, "policy returned an invalid reason");
+            }
+            return candidate;
+        }
+    }
+    throw new FieldPolicyError(path, "policy returned an invalid decision");
+}
+const JSON_PRIMITIVE_KINDS = new Set(["string", "number", "boolean"]);
+const kindOf = (value) => {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    if (typeof value === "object")
+        return "object";
+    return (JSON_PRIMITIVE_KINDS.has(typeof value) ? typeof value : "object");
+};
+function checkLimits(ctx, path, depth) {
+    // Time budget only when explicitly configured; the default walk is pure
+    // structural (depth/keys/bytes below), so the hot path avoids Date.now().
+    // Time budget only when explicitly configured; the default walk is pure
+    // structural (depth/keys/bytes below), so the hot path avoids Date.now().
+    if (ctx.hasTimeBudget && Date.now() - ctx.startedAt > ctx.maxPolicyMs) {
+        throw new FieldPolicyError(path, `policy walk exceeded ${ctx.maxPolicyMs}ms`);
+    }
+    if (depth > ctx.maxDepth)
+        throw new FieldPolicyError(path, `depth exceeds ${ctx.maxDepth}`);
+}
+/**
+ * Applies `policy` to every field of a JSON-like value.
+ *
+ * Decisions: `allow` keeps the value; `redact` replaces string leaves with
+ * `[REDACTED]` while preserving container shape; `tokenize` replaces string
+ * leaves with a deterministic token; `deny` replaces the value with `[DENIED]`.
+ * Unknown labels fail closed under the protected default. Hostile values
+ * (cycles, unsupported types, over-budget walks) throw `FieldPolicyError`
+ * instead of stringifying guesses. The input is never mutated; only fields the
+ * policy changed are allocated.
+ */
+export function applyFieldPolicy(value, policy, options) {
+    if (typeof policy !== "function")
+        throw new FieldPolicyError("", "policy must be a function");
+    const ctx = {
+        policy,
+        options,
+        tokenSha: (text) => sha256Hex(text),
+        maxDepth: options.maxDepth ?? FIELD_POLICY_LIMITS.maxDepth,
+        maxKeys: options.maxKeys ?? FIELD_POLICY_LIMITS.maxKeys,
+        maxChars: options.maxChars ?? FIELD_POLICY_LIMITS.maxChars,
+        hasTimeBudget: options.maxPolicyMs !== undefined,
+        maxPolicyMs: options.maxPolicyMs,
+        labelCache: new Map(),
+        input: {
+            path: "",
+            destination: options.destination,
+            label: undefined,
+            kind: "object",
+            direction: options.direction ?? "outbound",
+            ...(options.tenantId !== undefined ? { tenantId: options.tenantId } : {}),
+            ...(options.purpose !== undefined ? { purpose: options.purpose } : {}),
+        },
+        budgetRemaining: options.maxChars ?? FIELD_POLICY_LIMITS.maxChars,
+        nodesVisited: 0,
+        startedAt: Date.now(),
+    };
+    return walkValue(value, ctx, "", 0);
+}
+function walkValue(input, ctx, path, depth) {
+    const active = new Set();
+    const climb = (value, p, d, key) => {
+        if (value === null || typeof value !== "object") {
+            return leaf(value, ctx, p, d, key);
+        }
+        if (value instanceof Date || value instanceof RegExp || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+            return leaf(value, ctx, p, d, key);
+        }
+        if (d > ctx.maxDepth)
+            throw new FieldPolicyError(p, `depth exceeds ${ctx.maxDepth}`);
+        if (active.has(value))
+            throw new FieldPolicyError(p, "cyclic reference is not supported (fail closed)");
+        active.add(value);
+        try {
+            // The root has no key and never substitutes the whole payload; its own
+            // decision governs the walk of children only.
+            const decision = p === "" ? ALLOW : decide(ctx, value, p, d, undefined, key);
+            if (decision.action === "deny")
+                return deny();
+            if (decision.action === "redact")
+                return shapePreserving(value, ctx, p, d, "redact", active);
+            if (decision.action === "tokenize")
+                return shapePreserving(value, ctx, p, d, "tokenize", active);
+            return walkChildren(value, ctx, p, d, climb);
+        }
+        finally {
+            active.delete(value);
+        }
+    };
+    return climb(input, path, depth, "");
+}
+/** labelFor results are key-scoped (paths only reach the first call); cached per walk. */
+function labelForKey(ctx, key, path) {
+    const labelFor = ctx.options.labelFor;
+    if (!labelFor)
+        return undefined;
+    if (ctx.labelCache.has(key))
+        return ctx.labelCache.get(key);
+    const label = labelFor(key, path);
+    ctx.labelCache.set(key, label);
+    return label;
+}
+function decide(ctx, value, path, depth, override, key) {
+    if (override)
+        return override;
+    const kind = kindOf(value);
+    const label = labelForKey(ctx, key, path);
+    const input = ctx.input; // reused per node; see the reuse contract on WalkContext
+    input.path = path;
+    input.label = label;
+    input.kind = kind;
+    let decision;
+    try {
+        decision = ctx.policy(input);
+    }
+    catch (error) {
+        throw new FieldPolicyError(path, `policy threw ${error instanceof Error ? error.name : typeof error} (value never echoed)`);
+    }
+    const normalized = normalizeDecision(decision, path);
+    checkLimits(ctx, path, depth); // slow policy over budget trips here
+    if (normalized.action !== "allow") {
+        ctx.options.onRedact?.(path, normalized.reason ?? normalized.action);
+    }
+    return normalized;
+}
+function leaf(input, ctx, path, depth, key) {
+    if (input === undefined || typeof input === "bigint" || typeof input === "symbol" || typeof input === "function") {
+        throw new FieldPolicyError(path, `unsupported value type ${typeof input} (fail closed, no stringification)`);
+    }
+    if (typeof input === "string") {
+        ctx.budgetRemaining -= input.length;
+        if (ctx.budgetRemaining < 0)
+            throw new FieldPolicyError(path, `string budget exceeds ${ctx.maxChars}`);
+    }
+    const decision = decide(ctx, input, path, depth, undefined, key);
+    switch (decision.action) {
+        case "allow":
+            return input;
+        case "redact":
+            return typeof input === "string" ? REDACTED : input;
+        case "tokenize":
+            return typeof input === "string"
+                ? tokenOf(ctx.options.tokenPrefix ?? FIELD_POLICY_LIMITS.tokenPrefix, path, input, ctx.tokenSha)
+                : input;
+        case "deny":
+            return deny();
+    }
+}
+// decide() already recorded the redaction entry for this path
+function deny() {
+    return DENIED;
+}
+function shapePreserving(input, ctx, path, depth, mode, active) {
+    if (active.has(input))
+        throw new FieldPolicyError(path, "cyclic reference is not supported (fail closed)");
+    const forced = { action: mode };
+    if (Array.isArray(input)) {
+        const out = new Array(input.length);
+        for (let index = 0; index < input.length; index += 1) {
+            out[index] = safeChild(input[index], ctx, `${path}[${index}]`, depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (isPlainRecord(input)) {
+        const out = {};
+        let keysChecked = 0;
+        for (const [key, item] of Object.entries(input)) {
+            keysChecked += 1;
+            if (keysChecked > ctx.maxKeys)
+                throw new FieldPolicyError(`${path}.${key}`, `key count exceeds ${ctx.maxKeys}`);
+            out[key] = safeChild(item, ctx, joinPath(path, key), depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (input instanceof Map) {
+        const out = {};
+        for (const [key, item] of input) {
+            out[String(key)] = safeChild(item, ctx, joinPath(path, String(key)), depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (input instanceof Set) {
+        return [...input].map((item, index) => safeChild(item, ctx, `${path}[${index}]`, depth + 1, forced, active));
+    }
+    throw new FieldPolicyError(path, `unsupported value ${input?.constructor?.name ?? "object"} (fail closed, no stringification)`);
+}
+function walkChildren(input, ctx, path, depth, climb) {
+    if (Array.isArray(input)) {
+        let changed = false;
+        const out = new Array(input.length);
+        for (let index = 0; index < input.length; index += 1) {
+            const item = input[index];
+            const next = climb(item, `${path}[${index}]`, depth + 1, String(index));
+            if (next !== item)
+                changed = true;
+            out[index] = next;
+        }
+        return changed ? out : input;
+    }
+    if (isPlainRecord(input)) {
+        let changed = false;
+        let keysChecked = 0;
+        const out = {};
+        for (const key in input) {
+            if (!Object.hasOwn(input, key))
+                continue;
+            keysChecked += 1;
+            if (keysChecked > ctx.maxKeys)
+                throw new FieldPolicyError(joinPath(path, key), `key count exceeds ${ctx.maxKeys}`);
+            const item = input[key];
+            if (item === undefined)
+                continue;
+            const next = climb(item, joinPath(path, key), depth + 1, key);
+            out[key] = next;
+            if (next !== item)
+                changed = true;
+        }
+        return changed ? out : input; // sparse copy: untouched subtrees share the input
+    }
+    if (input instanceof Map) {
+        let changed = false;
+        const out = {};
+        for (const [entryKey, item] of input) {
+            out[String(entryKey)] = climb(item, joinPath(path, String(entryKey)), depth + 1, String(entryKey));
+            if (out[String(entryKey)] !== item)
+                changed = true;
+        }
+        return changed ? out : input;
+    }
+    if (input instanceof Set) {
+        let changed = false;
+        const items = [...input];
+        const out = new Array(items.length);
+        for (let index = 0; index < items.length; index += 1) {
+            out[index] = climb(items[index], `${path}[${index}]`, depth + 1, String(index));
+            if (out[index] !== items[index])
+                changed = true;
+        }
+        return changed ? out : input;
+    }
+    throw new FieldPolicyError(path, `unsupported value ${input?.constructor?.name ?? "object"} (fail closed, no stringification)`);
+}
+function safeChild(item, ctx, path, depth, forced, active) {
+    if (item === null || typeof item !== "object") {
+        return applyForcedLeaf(item, ctx, path, forced);
+    }
+    if (item instanceof Date || item instanceof RegExp || ArrayBuffer.isView(item) || item instanceof ArrayBuffer) {
+        return item;
+    }
+    checkLimits(ctx, path, depth);
+    return shapePreserving(item, ctx, path, depth, forced.action, active);
+}
+function applyForcedLeaf(item, ctx, path, forced) {
+    if (typeof item === "string") {
+        ctx.budgetRemaining -= item.length;
+        if (ctx.budgetRemaining < 0)
+            throw new FieldPolicyError(path, `string budget exceeds ${ctx.maxChars}`);
+    }
+    switch (forced.action) {
+        case "redact":
+            return typeof item === "string" ? REDACTED : item;
+        case "tokenize":
+            return typeof item === "string"
+                ? tokenOf(ctx.options.tokenPrefix ?? FIELD_POLICY_LIMITS.tokenPrefix, path, item, ctx.tokenSha)
+                : item;
+        case "deny":
+            return DENIED;
+        default:
+            return item;
+    }
+}
+function isPlainRecord(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/** `a.b` for object keys; arrays use `[i]`; root fields use bare `key`. */
+function joinPath(base, key) {
+    return base ? `${base}.${key}` : key;
+}
+function sha256Hex(text) {
+    // FNV-1a is enough for token differentiation and avoids a crypto import at
+    // every leaf; collisions change a token value, never cross boundaries.
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i += 1) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0") + (hash >>> 8).toString(16).padStart(8, "0").slice(0, 4);
+}
+/**
+ * Fail-closed default for the protected profile (frozen behavior):
+ * unknown labels are denied on outbound boundaries and allowed inbound;
+ * `secret`/`financial` denied, `personal` redacted, listed public labels
+ * allowed. Labels are never auto-discovered — `labelFor` decides them.
+ */
+export function createProtectedFieldPolicy(options = {}) {
+    const publicLabels = new Set(options.publicLabels ?? ["public"]);
+    const deniedLabels = {
+        secret: "secret-egress",
+        financial: "financial-egress",
+        ...options.deniedLabels,
+    };
+    const LABEL_DENY_REASONS = deniedLabels;
+    const redactedLabels = {
+        personal: "personal-data",
+        ...options.redactedLabels,
+    };
+    const tokenizedLabels = { token: "tokenization", ...options.tokenizedLabels };
+    const outbound = new Set(["prompt", "tool", "artifact", "audit", "telemetry", "export", "persistence"]);
+    return (input) => {
+        const { label } = input;
+        if (label === undefined || label === "") {
+            // Fail closed: unknown fields do not cross outbound/persisted boundaries.
+            if (input.direction === "outbound" && outbound.has(input.destination))
+                return DENY_UNKNOWN;
+            return ALLOW;
+        }
+        if (publicLabels.has(label))
+            return ALLOW;
+        if (label in deniedLabels)
+            return denied(LABEL_DENY_REASONS[label] ?? "denied");
+        if (label in redactedLabels)
+            return { action: "redact", reason: redactedLabels[label] };
+        if (label in tokenizedLabels)
+            return { action: "tokenize", reason: tokenizedLabels[label] };
+        return DENY_UNKNOWN_LABEL;
+    };
+}
+/** Identity policy: every field allowed (explicit override for trusted marks). */
+export const ALLOW_FIELD_POLICY = () => ALLOW;
+/**
+ * Adapts a `FieldPolicy` to the audit-export redaction hook. Transformation
+ * runs BEFORE canonical hashing so the exported chain verifies exactly.
+ * Only `{path, reason}` provenance survives; values never echo into the list.
+ */
+export function createAuditFieldRedactor(policy, options = {}) {
+    return {
+        apply(record) {
+            const redactions = [];
+            const transformed = applyFieldPolicy(record, policy, {
+                destination: "audit",
+                direction: "outbound",
+                tenantId: options.tenantId,
+                purpose: options.purpose ?? "audit-export",
+                labelFor: options.labelFor,
+                onRedact: (path, reason) => {
+                    if (options.collectProvenance !== false)
+                        redactions.push({ path, reason });
+                },
+            });
+            return {
+                record: transformed,
+                ...(redactions.length ? { redactions } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=field-policy.js.map

package/dist/index.d.ts

@@ -72,6 +72,8 @@ export { createProviderRequestPolicyChain, createSessionCachePolicy, mergeProvid
 export type { ProviderRegistry, ProviderRegistryOptions } from "./providers.js";
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export type { SecretRedactor } from "./redaction.js";
+export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FieldPolicyError, FIELD_POLICY_LIMITS, } from "./field-policy.js";
+export type { ApplyFieldPolicyOptions, AuditFieldRedaction, AuditFieldRedactorLike, AuditFieldRedactorOptions, FieldPolicy, FieldPolicyAction, FieldPolicyDecision, FieldPolicyInput, ProtectedFieldPolicyOptions, } from "./field-policy.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry, resolveRedactor, } from "./redaction.js";
 export type { DuplicateRegistrationOptions, DuplicateRegistrationPolicy } from "./registry-options.js";
 export type { LoadBinaryResourceOptions } from "./resources.js";
@@ -109,5 +111,5 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.2.5";
+export declare const version = "0.2.7";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -39,6 +39,7 @@ export { providerContentDelta, providerContinuationRequired, providerDone, provi
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
 export { createProviderRequestPolicyChain, createSessionCachePolicy, mergeProviderRequestOptions } from "./provider-request-policy.js";
 export { createProviderRegistry, createProviderResolver } from "./providers.js";
+export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FieldPolicyError, FIELD_POLICY_LIMITS, } from "./field-policy.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry, resolveRedactor, } from "./redaction.js";
 export { loadBinaryResource, loadJsonResource, loadManifestResource, loadTextResource } from "./resources.js";
 export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./retry.js";
@@ -60,6 +61,6 @@ export { DEFAULT_TOOL_RESULT_FOLD_MAX_SUMMARY_BYTES, DEFAULT_TOOL_RESULT_FOLD_MI
 export { createToolParameterValidator, createToolRegistry, dispatchToolCall, filterTools } from "./tools.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.2.5";
+export const version = "0.2.7";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/redaction.d.ts

@@ -1,13 +1,14 @@
 import type { AgentEvent, ErrorInfo, Message, ProviderRequest, RunLedgerRecord, SessionEntry } from "./contracts.js";
+import type { FieldPolicy } from "./field-policy.js";
 export interface SecretRedactor {
     redact<T>(value: T): T;
 }
 export declare function createSecretRedactor(secrets: readonly (string | undefined)[]): SecretRedactor;
-export declare function redactMessage(message: Message, redactor?: SecretRedactor): Message;
-export declare function redactAgentEvent(event: AgentEvent, redactor?: SecretRedactor): AgentEvent;
-export declare function redactSessionEntry(entry: SessionEntry, redactor?: SecretRedactor): SessionEntry;
-export declare function redactProviderRequest(request: ProviderRequest, redactor?: SecretRedactor): ProviderRequest;
-export declare function redactRunLedgerRecord<T extends RunLedgerRecord>(record: T, redactor?: SecretRedactor): T;
+export declare function redactMessage(message: Message, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): Message;
+export declare function redactAgentEvent(event: AgentEvent, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): AgentEvent;
+export declare function redactSessionEntry(entry: SessionEntry, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): SessionEntry;
+export declare function redactProviderRequest(request: ProviderRequest, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): ProviderRequest;
+export declare function redactRunLedgerRecord<T extends RunLedgerRecord>(record: T, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): T;
 export declare function resolveRedactor(redactor?: SecretRedactor, secrets?: readonly (string | undefined)[]): SecretRedactor | undefined;
 export declare function redactSecrets<T>(value: T, secrets: readonly (string | undefined)[]): T;
 export declare function errorToErrorInfo(error: unknown, secrets?: readonly (string | undefined)[]): ErrorInfo;