@arnilo/prism 0.2.6 → 0.2.8

package/dist/field-policy.js

@@ -0,0 +1,418 @@
+/**
+ * Field-level classification and fail-closed redaction (plan 027 Task 8).
+ *
+ * A dependency-free, JSON-like structured-value walker that evaluates an
+ * explicit host policy against every field of a value destined to cross a
+ * data boundary (provider prompt egress, tool dispatch/result persistence,
+ * artifact write/read/export, audit hashing, telemetry attributes/events,
+ * lifecycle export). The policy classifies fields by label, path, destination,
+ * and tenant; unknown fields fail closed under the protected default.
+ *
+ * Non-goals (frozen): no automatic sensitive-data discovery (labels come from
+ * an explicit `labelFor` hint function supplied by the boundary owner), no
+ * global registry, no decorator framework, no second policy language. Existing
+ * hardcoded secret redaction (`createSecretRedactor`) stays in place as
+ * defense in depth and runs *after* policy transformation at egress seams.
+ */
+export class FieldPolicyError extends Error {
+    code = "ERR_PRISM_FIELD_POLICY";
+    path;
+    constructor(path, message) {
+        super(`field policy rejected value at ${path}: ${message}`);
+        this.name = "FieldPolicyError";
+        this.path = path;
+    }
+}
+export const FIELD_POLICY_LIMITS = Object.freeze({
+    maxDepth: 32,
+    maxKeys: 10_000,
+    maxChars: 1_000_000,
+    maxPolicyMs: 5_000,
+    tokenPrefix: "tok_",
+});
+const REDACTED = "[REDACTED]";
+const DENIED = "[DENIED]";
+function tokenOf(prefix, path, original, sha) {
+    const hash = sha(`${path}\u0000${original}`);
+    return `${prefix}${hash.slice(0, 12)}`;
+}
+const ALLOW = { action: "allow" };
+const DENY_UNKNOWN = Object.freeze({ action: "deny", reason: "unknown-field" });
+const DENY_UNKNOWN_LABEL = Object.freeze({ action: "deny", reason: "unknown-label" });
+const denied = (reason) => Object.freeze({ action: "deny", reason });
+function normalizeDecision(value, path) {
+    if (value && typeof value === "object" && typeof value.action === "string") {
+        const candidate = value;
+        const action = candidate.action;
+        if (action === "allow" || action === "redact" || action === "tokenize" || action === "deny") {
+            // Returned decision objects are used as-is (host policies may reuse
+            // frozen constants; a hostile mutation is their own risk).
+            if (candidate.reason !== undefined && typeof candidate.reason !== "string") {
+                throw new FieldPolicyError(path, "policy returned an invalid reason");
+            }
+            return candidate;
+        }
+    }
+    throw new FieldPolicyError(path, "policy returned an invalid decision");
+}
+const JSON_PRIMITIVE_KINDS = new Set(["string", "number", "boolean"]);
+const kindOf = (value) => {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    if (typeof value === "object")
+        return "object";
+    return (JSON_PRIMITIVE_KINDS.has(typeof value) ? typeof value : "object");
+};
+function checkLimits(ctx, path, depth) {
+    // Time budget only when explicitly configured; the default walk is pure
+    // structural (depth/keys/bytes below), so the hot path avoids Date.now().
+    // Time budget only when explicitly configured; the default walk is pure
+    // structural (depth/keys/bytes below), so the hot path avoids Date.now().
+    if (ctx.hasTimeBudget && Date.now() - ctx.startedAt > ctx.maxPolicyMs) {
+        throw new FieldPolicyError(path, `policy walk exceeded ${ctx.maxPolicyMs}ms`);
+    }
+    if (depth > ctx.maxDepth)
+        throw new FieldPolicyError(path, `depth exceeds ${ctx.maxDepth}`);
+}
+/**
+ * Applies `policy` to every field of a JSON-like value.
+ *
+ * Decisions: `allow` keeps the value; `redact` replaces string leaves with
+ * `[REDACTED]` while preserving container shape; `tokenize` replaces string
+ * leaves with a deterministic token; `deny` replaces the value with `[DENIED]`.
+ * Unknown labels fail closed under the protected default. Hostile values
+ * (cycles, unsupported types, over-budget walks) throw `FieldPolicyError`
+ * instead of stringifying guesses. The input is never mutated; only fields the
+ * policy changed are allocated.
+ */
+export function applyFieldPolicy(value, policy, options) {
+    if (typeof policy !== "function")
+        throw new FieldPolicyError("", "policy must be a function");
+    const ctx = {
+        policy,
+        options,
+        tokenSha: (text) => sha256Hex(text),
+        maxDepth: options.maxDepth ?? FIELD_POLICY_LIMITS.maxDepth,
+        maxKeys: options.maxKeys ?? FIELD_POLICY_LIMITS.maxKeys,
+        maxChars: options.maxChars ?? FIELD_POLICY_LIMITS.maxChars,
+        hasTimeBudget: options.maxPolicyMs !== undefined,
+        maxPolicyMs: options.maxPolicyMs,
+        labelCache: new Map(),
+        input: {
+            path: "",
+            destination: options.destination,
+            label: undefined,
+            kind: "object",
+            direction: options.direction ?? "outbound",
+            ...(options.tenantId !== undefined ? { tenantId: options.tenantId } : {}),
+            ...(options.purpose !== undefined ? { purpose: options.purpose } : {}),
+        },
+        budgetRemaining: options.maxChars ?? FIELD_POLICY_LIMITS.maxChars,
+        nodesVisited: 0,
+        startedAt: Date.now(),
+    };
+    return walkValue(value, ctx, "", 0);
+}
+function walkValue(input, ctx, path, depth) {
+    const active = new Set();
+    const climb = (value, p, d, key) => {
+        if (value === null || typeof value !== "object") {
+            return leaf(value, ctx, p, d, key);
+        }
+        if (value instanceof Date || value instanceof RegExp || ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+            return leaf(value, ctx, p, d, key);
+        }
+        if (d > ctx.maxDepth)
+            throw new FieldPolicyError(p, `depth exceeds ${ctx.maxDepth}`);
+        if (active.has(value))
+            throw new FieldPolicyError(p, "cyclic reference is not supported (fail closed)");
+        active.add(value);
+        try {
+            // The root has no key and never substitutes the whole payload; its own
+            // decision governs the walk of children only.
+            const decision = p === "" ? ALLOW : decide(ctx, value, p, d, undefined, key);
+            if (decision.action === "deny")
+                return deny();
+            if (decision.action === "redact")
+                return shapePreserving(value, ctx, p, d, "redact", active);
+            if (decision.action === "tokenize")
+                return shapePreserving(value, ctx, p, d, "tokenize", active);
+            return walkChildren(value, ctx, p, d, climb);
+        }
+        finally {
+            active.delete(value);
+        }
+    };
+    return climb(input, path, depth, "");
+}
+/** labelFor results are key-scoped (paths only reach the first call); cached per walk. */
+function labelForKey(ctx, key, path) {
+    const labelFor = ctx.options.labelFor;
+    if (!labelFor)
+        return undefined;
+    if (ctx.labelCache.has(key))
+        return ctx.labelCache.get(key);
+    const label = labelFor(key, path);
+    ctx.labelCache.set(key, label);
+    return label;
+}
+function decide(ctx, value, path, depth, override, key) {
+    if (override)
+        return override;
+    const kind = kindOf(value);
+    const label = labelForKey(ctx, key, path);
+    const input = ctx.input; // reused per node; see the reuse contract on WalkContext
+    input.path = path;
+    input.label = label;
+    input.kind = kind;
+    let decision;
+    try {
+        decision = ctx.policy(input);
+    }
+    catch (error) {
+        throw new FieldPolicyError(path, `policy threw ${error instanceof Error ? error.name : typeof error} (value never echoed)`);
+    }
+    const normalized = normalizeDecision(decision, path);
+    checkLimits(ctx, path, depth); // slow policy over budget trips here
+    if (normalized.action !== "allow") {
+        ctx.options.onRedact?.(path, normalized.reason ?? normalized.action);
+    }
+    return normalized;
+}
+function leaf(input, ctx, path, depth, key) {
+    if (input === undefined || typeof input === "bigint" || typeof input === "symbol" || typeof input === "function") {
+        throw new FieldPolicyError(path, `unsupported value type ${typeof input} (fail closed, no stringification)`);
+    }
+    if (typeof input === "string") {
+        ctx.budgetRemaining -= input.length;
+        if (ctx.budgetRemaining < 0)
+            throw new FieldPolicyError(path, `string budget exceeds ${ctx.maxChars}`);
+    }
+    const decision = decide(ctx, input, path, depth, undefined, key);
+    switch (decision.action) {
+        case "allow":
+            return input;
+        case "redact":
+            return typeof input === "string" ? REDACTED : input;
+        case "tokenize":
+            return typeof input === "string"
+                ? tokenOf(ctx.options.tokenPrefix ?? FIELD_POLICY_LIMITS.tokenPrefix, path, input, ctx.tokenSha)
+                : input;
+        case "deny":
+            return deny();
+    }
+}
+// decide() already recorded the redaction entry for this path
+function deny() {
+    return DENIED;
+}
+function shapePreserving(input, ctx, path, depth, mode, active) {
+    if (active.has(input))
+        throw new FieldPolicyError(path, "cyclic reference is not supported (fail closed)");
+    const forced = { action: mode };
+    if (Array.isArray(input)) {
+        const out = new Array(input.length);
+        for (let index = 0; index < input.length; index += 1) {
+            out[index] = safeChild(input[index], ctx, `${path}[${index}]`, depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (isPlainRecord(input)) {
+        const out = {};
+        let keysChecked = 0;
+        for (const [key, item] of Object.entries(input)) {
+            keysChecked += 1;
+            if (keysChecked > ctx.maxKeys)
+                throw new FieldPolicyError(`${path}.${key}`, `key count exceeds ${ctx.maxKeys}`);
+            out[key] = safeChild(item, ctx, joinPath(path, key), depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (input instanceof Map) {
+        const out = {};
+        for (const [key, item] of input) {
+            out[String(key)] = safeChild(item, ctx, joinPath(path, String(key)), depth + 1, forced, active);
+        }
+        return out;
+    }
+    if (input instanceof Set) {
+        return [...input].map((item, index) => safeChild(item, ctx, `${path}[${index}]`, depth + 1, forced, active));
+    }
+    throw new FieldPolicyError(path, `unsupported value ${input?.constructor?.name ?? "object"} (fail closed, no stringification)`);
+}
+function walkChildren(input, ctx, path, depth, climb) {
+    if (Array.isArray(input)) {
+        let changed = false;
+        const out = new Array(input.length);
+        for (let index = 0; index < input.length; index += 1) {
+            const item = input[index];
+            const next = climb(item, `${path}[${index}]`, depth + 1, String(index));
+            if (next !== item)
+                changed = true;
+            out[index] = next;
+        }
+        return changed ? out : input;
+    }
+    if (isPlainRecord(input)) {
+        let changed = false;
+        let keysChecked = 0;
+        const out = {};
+        for (const key in input) {
+            if (!Object.hasOwn(input, key))
+                continue;
+            keysChecked += 1;
+            if (keysChecked > ctx.maxKeys)
+                throw new FieldPolicyError(joinPath(path, key), `key count exceeds ${ctx.maxKeys}`);
+            const item = input[key];
+            if (item === undefined)
+                continue;
+            const next = climb(item, joinPath(path, key), depth + 1, key);
+            out[key] = next;
+            if (next !== item)
+                changed = true;
+        }
+        return changed ? out : input; // sparse copy: untouched subtrees share the input
+    }
+    if (input instanceof Map) {
+        let changed = false;
+        const out = {};
+        for (const [entryKey, item] of input) {
+            out[String(entryKey)] = climb(item, joinPath(path, String(entryKey)), depth + 1, String(entryKey));
+            if (out[String(entryKey)] !== item)
+                changed = true;
+        }
+        return changed ? out : input;
+    }
+    if (input instanceof Set) {
+        let changed = false;
+        const items = [...input];
+        const out = new Array(items.length);
+        for (let index = 0; index < items.length; index += 1) {
+            out[index] = climb(items[index], `${path}[${index}]`, depth + 1, String(index));
+            if (out[index] !== items[index])
+                changed = true;
+        }
+        return changed ? out : input;
+    }
+    throw new FieldPolicyError(path, `unsupported value ${input?.constructor?.name ?? "object"} (fail closed, no stringification)`);
+}
+function safeChild(item, ctx, path, depth, forced, active) {
+    if (item === null || typeof item !== "object") {
+        return applyForcedLeaf(item, ctx, path, forced);
+    }
+    if (item instanceof Date || item instanceof RegExp || ArrayBuffer.isView(item) || item instanceof ArrayBuffer) {
+        return item;
+    }
+    checkLimits(ctx, path, depth);
+    return shapePreserving(item, ctx, path, depth, forced.action, active);
+}
+function applyForcedLeaf(item, ctx, path, forced) {
+    if (typeof item === "string") {
+        ctx.budgetRemaining -= item.length;
+        if (ctx.budgetRemaining < 0)
+            throw new FieldPolicyError(path, `string budget exceeds ${ctx.maxChars}`);
+    }
+    switch (forced.action) {
+        case "redact":
+            return typeof item === "string" ? REDACTED : item;
+        case "tokenize":
+            return typeof item === "string"
+                ? tokenOf(ctx.options.tokenPrefix ?? FIELD_POLICY_LIMITS.tokenPrefix, path, item, ctx.tokenSha)
+                : item;
+        case "deny":
+            return DENIED;
+        default:
+            return item;
+    }
+}
+function isPlainRecord(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/** `a.b` for object keys; arrays use `[i]`; root fields use bare `key`. */
+function joinPath(base, key) {
+    return base ? `${base}.${key}` : key;
+}
+function sha256Hex(text) {
+    // FNV-1a is enough for token differentiation and avoids a crypto import at
+    // every leaf; collisions change a token value, never cross boundaries.
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i += 1) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0") + (hash >>> 8).toString(16).padStart(8, "0").slice(0, 4);
+}
+/**
+ * Fail-closed default for the protected profile (frozen behavior):
+ * unknown labels are denied on outbound boundaries and allowed inbound;
+ * `secret`/`financial` denied, `personal` redacted, listed public labels
+ * allowed. Labels are never auto-discovered — `labelFor` decides them.
+ */
+export function createProtectedFieldPolicy(options = {}) {
+    const publicLabels = new Set(options.publicLabels ?? ["public"]);
+    const deniedLabels = {
+        secret: "secret-egress",
+        financial: "financial-egress",
+        ...options.deniedLabels,
+    };
+    const LABEL_DENY_REASONS = deniedLabels;
+    const redactedLabels = {
+        personal: "personal-data",
+        ...options.redactedLabels,
+    };
+    const tokenizedLabels = { token: "tokenization", ...options.tokenizedLabels };
+    const outbound = new Set(["prompt", "tool", "artifact", "audit", "telemetry", "export", "persistence"]);
+    return (input) => {
+        const { label } = input;
+        if (label === undefined || label === "") {
+            // Fail closed: unknown fields do not cross outbound/persisted boundaries.
+            if (input.direction === "outbound" && outbound.has(input.destination))
+                return DENY_UNKNOWN;
+            return ALLOW;
+        }
+        if (publicLabels.has(label))
+            return ALLOW;
+        if (label in deniedLabels)
+            return denied(LABEL_DENY_REASONS[label] ?? "denied");
+        if (label in redactedLabels)
+            return { action: "redact", reason: redactedLabels[label] };
+        if (label in tokenizedLabels)
+            return { action: "tokenize", reason: tokenizedLabels[label] };
+        return DENY_UNKNOWN_LABEL;
+    };
+}
+/** Identity policy: every field allowed (explicit override for trusted marks). */
+export const ALLOW_FIELD_POLICY = () => ALLOW;
+/**
+ * Adapts a `FieldPolicy` to the audit-export redaction hook. Transformation
+ * runs BEFORE canonical hashing so the exported chain verifies exactly.
+ * Only `{path, reason}` provenance survives; values never echo into the list.
+ */
+export function createAuditFieldRedactor(policy, options = {}) {
+    return {
+        apply(record) {
+            const redactions = [];
+            const transformed = applyFieldPolicy(record, policy, {
+                destination: "audit",
+                direction: "outbound",
+                tenantId: options.tenantId,
+                purpose: options.purpose ?? "audit-export",
+                labelFor: options.labelFor,
+                onRedact: (path, reason) => {
+                    if (options.collectProvenance !== false)
+                        redactions.push({ path, reason });
+                },
+            });
+            return {
+                record: transformed,
+                ...(redactions.length ? { redactions } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=field-policy.js.map

package/dist/index.d.ts

@@ -1,6 +1,4 @@
 export { resolveAgentDefinition } from "./agent-definitions.js";
-export { abortableSleep, pollDeviceCodeToken, redactOAuthError, throwIfAborted, type OAuthTokenSuccessPayload, type PollDeviceCodeTokenOptions, } from "./oauth-device-code.js";
-export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, type PinnedFetchOptions, } from "./pinned-fetch.js";
 export type { AgentEventSourceErrorCode } from "./agent-event-source.js";
 export { AgentEventSourceError, createMemoryAgentEventSource } from "./agent-event-source.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop, } from "./agent-loops.js";
@@ -14,7 +12,7 @@ export { ARTIFACT_BODY_ERROR_CODES, ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactBodyS
 export type { ApplyCacheControlOptions, CacheControlledContentBlock, CacheControlledMessage, CacheControlValue, CacheUsageReport, } from "./cache-helpers.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
 export type { CacheTelemetry, CacheTelemetryOptions, CacheTelemetryReport, CacheTelemetrySample, } from "./cache-telemetry.js";
-export { CACHE_TELEMETRY_OVERFLOW_KEY, CacheTelemetryError, DEFAULT_CACHE_TELEMETRY_CAP, createCacheTelemetry, } from "./cache-telemetry.js";
+export { CACHE_TELEMETRY_OVERFLOW_KEY, CacheTelemetryError, createCacheTelemetry, DEFAULT_CACHE_TELEMETRY_CAP, } from "./cache-telemetry.js";
 export type { MemoryCheckpointStoreOptions } from "./checkpoints.js";
 export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpointStore } from "./checkpoints.js";
 export type { DefaultCompactionStrategyOptions } from "./compaction.js";
@@ -45,6 +43,8 @@ export type { ExtensionErrorPolicy, ExtensionEventBus, ExtensionEventHandler, Ex
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
 export type { MemoryRunFeedbackStoreOptions, PrepareRunFeedbackOptions, RunFeedbackLimits, RunFeedbackRun, RunFeedbackRunResolver, } from "./feedback.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
+export type { ApplyFieldPolicyOptions, AuditFieldRedaction, AuditFieldRedactorLike, AuditFieldRedactorOptions, FieldPolicy, FieldPolicyAction, FieldPolicyDecision, FieldPolicyInput, ProtectedFieldPolicyOptions, } from "./field-policy.js";
+export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FIELD_POLICY_LIMITS, FieldPolicyError, } from "./field-policy.js";
 export type { GuardrailRunResult, RunGuardrailsOptions, } from "./guardrails.js";
 export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, runGuardrails } from "./guardrails.js";
 export type { AgentIdentity, AssertIdentityActiveOptions, IdentityLimits, IdentityVerifier, NarrowIdentityOptions, Principal, ResolvedIdentityLimits, } from "./identity.js";
@@ -62,9 +62,11 @@ export type { MockProviderOptions } from "./mock-provider.js";
 export { createMockProvider } from "./mock-provider.js";
 export type { ModelRegistry, ModelRegistryOptions } from "./models.js";
 export { createModelRegistry } from "./models.js";
+export { abortableSleep, type OAuthTokenSuccessPayload, type PollDeviceCodeTokenOptions, pollDeviceCodeToken, redactOAuthError, throwIfAborted, } from "./oauth-device-code.js";
 export { createProviderTurnMetadata, readProviderHttpStatus } from "./observability.js";
 export type { ApplyRetentionInput, ApplyRetentionResult, ConsumeTenantQuotaInput, ExportUnderHoldInput, LegalHoldExportItem, LegalHoldQuery, LegalHoldRecord, PersistenceLifecycleStore, PersistenceResourceKind, PutLegalHoldInput, ReleaseLegalHoldInput, SetTenantQuotaInput, TenantQuota, } from "./persistence-lifecycle.js";
 export { createMemoryPersistenceLifecycle, DEFAULT_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_LIFECYCLE_PAGE_SIZE, HARD_MAX_HOLD_REASON_BYTES, isResourceHeld, PersistenceLifecycleError, } from "./persistence-lifecycle.js";
+export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, type PinnedFetchOptions, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, } from "./pinned-fetch.js";
 export { providerContentDelta, providerContinuationRequired, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
 export type { SessionCachePolicyOptions } from "./provider-request-policy.js";
@@ -109,5 +111,5 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.2.6";
+export declare const version = "0.2.8";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -1,6 +1,4 @@
 export { resolveAgentDefinition } from "./agent-definitions.js";
-export { abortableSleep, pollDeviceCodeToken, redactOAuthError, throwIfAborted, } from "./oauth-device-code.js";
-export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, } from "./pinned-fetch.js";
 export { AgentEventSourceError, createMemoryAgentEventSource } from "./agent-event-source.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop, } from "./agent-loops.js";
 export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
@@ -8,7 +6,7 @@ export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, agentFingerp
 export { createAgent, createAgentSession, resumeAgentRun, resumeAgentRunStream } from "./agents.js";
 export { ARTIFACT_BODY_ERROR_CODES, ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactBodyStoreError, ArtifactError, artifactApprovalState, artifactCheckpointKey, } from "./artifacts.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, sanitizeCacheKey } from "./cache-helpers.js";
-export { CACHE_TELEMETRY_OVERFLOW_KEY, CacheTelemetryError, DEFAULT_CACHE_TELEMETRY_CAP, createCacheTelemetry, } from "./cache-telemetry.js";
+export { CACHE_TELEMETRY_OVERFLOW_KEY, CacheTelemetryError, createCacheTelemetry, DEFAULT_CACHE_TELEMETRY_CAP, } from "./cache-telemetry.js";
 export { CHECKPOINT_CONFLICT_CODE, CheckpointConflictError, createMemoryCheckpointStore } from "./checkpoints.js";
 export { createDefaultCompactionStrategy, isCompactionEntryData } from "./compaction.js";
 export { assertJsonObject, isJsonObject, loadConfigLayers, mergeConfigLayers } from "./config.js";
@@ -24,6 +22,7 @@ export { createEventMultiplexer, EVENT_MULTIPLEXER_SINGLE_CONSUMER_CODE, EventMu
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { createExtensionEventBus, createExtensionKernel } from "./extensions.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
+export { ALLOW_FIELD_POLICY, applyFieldPolicy, createAuditFieldRedactor, createProtectedFieldPolicy, FIELD_POLICY_LIMITS, FieldPolicyError, } from "./field-policy.js";
 export { assertGuardrailsAllowed, GuardrailError, MAX_GUARDRAIL_CONCURRENCY, runGuardrails } from "./guardrails.js";
 export { assertIdentityActive, assertIdentityMatchesOwnership, assertIdentityPropagation, DEFAULT_IDENTITY_LIMITS, HARD_IDENTITY_LIMITS, IdentityError, identityTelemetryAttributes, narrowIdentity, ownershipFromIdentity, resolveIdentityLimits, resolveRunIdentity, } from "./identity.js";
 export { assembleProviderInput, createDefaultInputBuilder, createDefaultPromptBuilder, renderPromptTemplate, resolveContextProviders, } from "./input.js";
@@ -33,8 +32,10 @@ export { definePrismManifest, parsePrismManifest } from "./manifests.js";
 export { createMiddlewareRegistry } from "./middleware.js";
 export { createMockProvider } from "./mock-provider.js";
 export { createModelRegistry } from "./models.js";
+export { abortableSleep, pollDeviceCodeToken, redactOAuthError, throwIfAborted, } from "./oauth-device-code.js";
 export { createProviderTurnMetadata, readProviderHttpStatus } from "./observability.js";
 export { createMemoryPersistenceLifecycle, DEFAULT_LIFECYCLE_PAGE_SIZE, DEFAULT_MAX_HOLD_REASON_BYTES, HARD_LIFECYCLE_PAGE_SIZE, HARD_MAX_HOLD_REASON_BYTES, isResourceHeld, PersistenceLifecycleError, } from "./persistence-lifecycle.js";
+export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, } from "./pinned-fetch.js";
 export { providerContentDelta, providerContinuationRequired, providerDone, providerError, providerTextDelta, providerThinkingDelta, providerToolCall, providerToolCallDelta, providerUsage, toolCallContent, toolCallFromArgumentsText, } from "./provider-events.js";
 export { authMethodKey, defineProviderPackage, systemPromptContributionKey } from "./provider-packages.js";
 export { createProviderRequestPolicyChain, createSessionCachePolicy, mergeProviderRequestOptions } from "./provider-request-policy.js";
@@ -60,6 +61,6 @@ export { DEFAULT_TOOL_RESULT_FOLD_MAX_SUMMARY_BYTES, DEFAULT_TOOL_RESULT_FOLD_MI
 export { createToolParameterValidator, createToolRegistry, dispatchToolCall, filterTools } from "./tools.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.2.6";
+export const version = "0.2.8";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/input.js

@@ -4,8 +4,8 @@ import { runInstructionInjectors } from "./instruction-injection.js";
 import { redactMessage } from "./redaction.js";
 import { loadTextResource } from "./resources.js";
 import { skillMessages as buildSkillMessages } from "./skill-disclosure.js";
-import { foldToolResultHistory, foldToolResults } from "./tool-result-fold.js";
 import { composeSystemPrompt } from "./system-prompts.js";
+import { foldToolResultHistory, foldToolResults } from "./tool-result-fold.js";
 export function createDefaultInputBuilder() {
     return {
         name: "default-input",

package/dist/redaction.d.ts

@@ -1,13 +1,14 @@
 import type { AgentEvent, ErrorInfo, Message, ProviderRequest, RunLedgerRecord, SessionEntry } from "./contracts.js";
+import type { FieldPolicy } from "./field-policy.js";
 export interface SecretRedactor {
     redact<T>(value: T): T;
 }
 export declare function createSecretRedactor(secrets: readonly (string | undefined)[]): SecretRedactor;
-export declare function redactMessage(message: Message, redactor?: SecretRedactor): Message;
-export declare function redactAgentEvent(event: AgentEvent, redactor?: SecretRedactor): AgentEvent;
-export declare function redactSessionEntry(entry: SessionEntry, redactor?: SecretRedactor): SessionEntry;
-export declare function redactProviderRequest(request: ProviderRequest, redactor?: SecretRedactor): ProviderRequest;
-export declare function redactRunLedgerRecord<T extends RunLedgerRecord>(record: T, redactor?: SecretRedactor): T;
+export declare function redactMessage(message: Message, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): Message;
+export declare function redactAgentEvent(event: AgentEvent, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): AgentEvent;
+export declare function redactSessionEntry(entry: SessionEntry, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): SessionEntry;
+export declare function redactProviderRequest(request: ProviderRequest, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): ProviderRequest;
+export declare function redactRunLedgerRecord<T extends RunLedgerRecord>(record: T, redactor?: SecretRedactor, fieldPolicy?: FieldPolicy, destination?: string, labelFor?: (key: string, path: string) => string | undefined): T;
 export declare function resolveRedactor(redactor?: SecretRedactor, secrets?: readonly (string | undefined)[]): SecretRedactor | undefined;
 export declare function redactSecrets<T>(value: T, secrets: readonly (string | undefined)[]): T;
 export declare function errorToErrorInfo(error: unknown, secrets?: readonly (string | undefined)[]): ErrorInfo;

package/dist/redaction.js

@@ -1,3 +1,4 @@
+import { applyFieldPolicy } from "./field-policy.js";
 const REDACTED = "[REDACTED]";
 // Depth bound matching agent-run-state.ts; hostile deep structures yield a placeholder
 // instead of a stack overflow.
@@ -5,20 +6,27 @@ const MAX_REDACT_DEPTH = 32;
 export function createSecretRedactor(secrets) {
     return { redact: (value) => redactSecrets(value, secrets) };
 }
-export function redactMessage(message, redactor) {
-    return redactor?.redact(message) ?? message;
+/** Applies a field policy after secret redaction; identity when absent (compat). */
+function afterSecrets(value, redactor, policy, destination, labelFor) {
+    const secretRedacted = redactor?.redact(value) ?? value;
+    return policy
+        ? applyFieldPolicy(secretRedacted, policy, { destination, direction: "outbound", ...(labelFor ? { labelFor } : {}) })
+        : secretRedacted;
 }
-export function redactAgentEvent(event, redactor) {
-    return redactor?.redact(event) ?? event;
+export function redactMessage(message, redactor, fieldPolicy, destination = "prompt", labelFor) {
+    return afterSecrets(message, redactor, fieldPolicy, destination, labelFor);
 }
-export function redactSessionEntry(entry, redactor) {
-    return redactor?.redact(entry) ?? entry;
+export function redactAgentEvent(event, redactor, fieldPolicy, destination = "telemetry", labelFor) {
+    return afterSecrets(event, redactor, fieldPolicy, destination, labelFor);
 }
-export function redactProviderRequest(request, redactor) {
-    return redactor?.redact(request) ?? request;
+export function redactSessionEntry(entry, redactor, fieldPolicy, destination = "persistence", labelFor) {
+    return afterSecrets(entry, redactor, fieldPolicy, destination, labelFor);
 }
-export function redactRunLedgerRecord(record, redactor) {
-    return redactor?.redact(record) ?? record;
+export function redactProviderRequest(request, redactor, fieldPolicy, destination = "prompt", labelFor) {
+    return afterSecrets(request, redactor, fieldPolicy, destination, labelFor);
+}
+export function redactRunLedgerRecord(record, redactor, fieldPolicy, destination = "run-ledger", labelFor) {
+    return afterSecrets(record, redactor, fieldPolicy, destination, labelFor);
 }
 export function resolveRedactor(redactor, secrets) {
     return redactor ?? (secrets?.some((secret) => Boolean(secret)) ? createSecretRedactor(secrets) : undefined);

package/dist/tools.d.ts

@@ -1,4 +1,4 @@
-import type { AgentEvent, ErrorInfo, Guardrails, JsonObject, OwnershipScope, RunLedger, ToolCallContent, ToolDefinition, ToolExecutionContext, ToolEffectDeclaration, ToolEffectStore, ToolRegistry, ToolResult } from "./contracts.js";
+import type { AgentEvent, ErrorInfo, Guardrails, JsonObject, OwnershipScope, RunLedger, ToolCallContent, ToolDefinition, ToolEffectDeclaration, ToolEffectStore, ToolExecutionContext, ToolRegistry, ToolResult } from "./contracts.js";
 import type { MiddlewareRegistry } from "./middleware.js";
 import { type SecretRedactor } from "./redaction.js";
 import { type DuplicateRegistrationOptions } from "./registry-options.js";

package/dist/tools.js

@@ -5,7 +5,7 @@ import { createId } from "./ids.js";
 import { errorToErrorInfo, redactRunLedgerRecord, redactSecrets } from "./redaction.js";
 import { assertCanRegister } from "./registry-options.js";
 import { assertPermission, assertTrusted } from "./security.js";
-import { deriveToolEffectKey, toolEffectArgumentsHash, ToolEffectError } from "./tool-effects.js";
+import { deriveToolEffectKey, ToolEffectError, toolEffectArgumentsHash } from "./tool-effects.js";
 /** Wrap a schema adapter as the existing `ToolValidator` seam used by dispatch and the agent runtime. */
 export function createToolParameterValidator(validator, options = {}) {
     const missingSchema = options.missingSchema ?? "allow";

package/docs/0.1.0-readiness.md

@@ -1,6 +1,6 @@
 # 0.1.0 / 1.0 Readiness Gates
 
-Status: **0.2.6** is the current release line (the 0.2.x review-remediation line: fail-closed runtime/sandbox security, provider completion and outbound trust boundaries, concurrent-state/durability integrity, build/coverage/release-evidence integrity, package/documentation/compatibility truth, maintainability and bounded performance, fully featured coding-agent readiness); **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
+Status: **0.2.8** is the current release line (the 0.2.x review-remediation line: fail-closed runtime/sandbox security, provider completion and outbound trust boundaries, concurrent-state/durability integrity, build/coverage/release-evidence integrity, package/documentation/compatibility truth, maintainability and bounded performance, fully featured coding-agent readiness, enterprise ERP production readiness, ACP adoption fixes); **0.1.7** was the terminal 0.1.x baseline; **1.0** readiness remains operator-gated, not automatic.
 
 This page distills runnable readiness gates into one command-per-gate table.
 The **Last evidence** column records the 0.1.0-tree snapshot (plan 012 Tasks
@@ -20,15 +20,15 @@ Historical release lines (0.0.16 floor → 0.0.27 Phase 10 ACP interop → 0.1.0
 keep their per-phase evidence in the pages above; this page records the 0.2.6
 snapshot (plan 026) with the 0.1.x tables below as the historical record.
 
-## Current line (0.2.6)
+## Current line (0.2.8)
 
 | Item | Status |
 |---|---|
-| Published graph | **50** publishable manifests at exact **0.2.6** (root + 49 workspace packages: 14 provider adapters + 9 `prism-*` family/profile + 26 capability; generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json`) |
-| Current-line cut | The 0.2.x review-remediation line, additive-only vs the frozen 0.1.x contract: 0.2.0 fail-closed runtime/sandbox security (durable-resume decision validation, work-tool env isolation, explicit sandbox capabilities), 0.2.1 provider completion + outbound trust boundaries (strict stream completion, bounded success bodies, DNS-pinned OIDC/OPA fetches), 0.2.2 concurrent-state/durability integrity (model-budget reservation, conversation-metadata CAS, single-consumer EventMultiplexer, NATS durable identity), 0.2.3 build/coverage/release-evidence integrity (build single-flight, corrected coverage denominators, release skip manifest, stabilized quality gates), 0.2.4 package/documentation/compatibility truth (umbrella wording matches manifests, manifest-derived package truth, peer-version policy Decision A, current-line truth), 0.2.5 maintainability and bounded performance (god-module splits into cohesive family files behind preserved barrels, persistence-mechanics dedup into `session-store-codecs`, quadratic `Buffer.concat` removed from framing/tar, dead-code cleanup internal-only, 76 behavior-backed coverage regressions), 0.2.6 fully featured coding-agent readiness (host-selected PTY backend, scalable indexed code-search seam, multi-worktree/repository lifecycle, forge breadth demand-gated, durable ACP/process recovery, patch review + incremental diagnostics, protected real coding journey) |
-| Upgrade path | `docs/migration.md` `0.2.5 → 0.2.6` (additive; three new versioned record namespaces + optional ACP `activeRun` ref; rollback = stop 0.2.6 workers, mark active records unknown, restore 0.2.5 manifests/tag); store-compatible throughout 0.2.x |
-| Compat promise | Additive-only vs the frozen 0.1.x contract; `scripts/compat-baseline` regenerated at 0.2.6 (version literal + additive PTY/index/workspace/recovery/review exports), zero breaking deltas |
-| Security policy | `npm audit --audit-level=moderate` 0 at 0.2.6; threat-suites legs (phase8–11 + phase20–26) green; protected Postgres recovery/workspace conformance, PTY, real coding journey, NATS/live-canary legs operator-gated |
+| Published graph | **51** publishable manifests at exact **0.2.8** (root + 50 workspace packages: 14 provider adapters + 9 `prism-*` family/profile + 27 capability; generated by `node scripts/package-truth.mjs` → `scripts/package-truth.json`) |
+| Current-line cut | The 0.2.x review-remediation line, additive-only vs the frozen 0.1.x contract: 0.2.0 fail-closed runtime/sandbox security, 0.2.1 provider completion + outbound trust boundaries, 0.2.2 concurrent-state/durability integrity, 0.2.3 build/coverage/release-evidence integrity, 0.2.4 package/documentation/compatibility truth, 0.2.5 maintainability and bounded performance, 0.2.6 fully featured coding-agent readiness, 0.2.7 enterprise ERP production readiness, 0.2.8 ACP adoption fixes (client-neutrality guard, truthful ACP wire, spawnable `@arnilo/prism-acp-agent`, thought/plan/title/image/command updates) |
+| Upgrade path | `docs/migration.md` `0.2.7 → 0.2.8` (additive; no store migration; rollback = restore 0.2.7 manifests/tag); store-compatible throughout 0.2.x |
+| Compat promise | Additive-only vs the frozen 0.1.x contract; `scripts/compat-baseline` regenerated at 0.2.8 (version literal + additive ACP/agent exports), zero breaking deltas |
+| Security policy | `npm audit --audit-level=moderate` 0 at 0.2.8; threat-suites legs (phase8–11 + phase20–26) green; protected Postgres recovery/workspace conformance, PTY, real coding journey, NATS/live-canary legs operator-gated |
 | Docs freeze | tripwires green including the canonical manifest-count tripwire (50/49/14/9/26), the plan 024 package-truth tests (generator reproducibility + artifact equality + closure asserts + derived docs truth), the plan 025 bounded-accumulation near-limit probe, and the plan 026 freeze tripwires (per-task markers, threat T1–T8 test mapping, exit gate green) |
 | 0.1.x line | **0.1.7** (plan 019) is the terminal 0.1.x baseline; the 0.1.1 table below keeps the plan 013 snapshot; the 0.1.0 table keeps the plan 012 snapshot; the **0.0.16** values remain the historical network-free floor |