@arnilo/prism 0.5.6 → 0.7.0

package/dist/input.js

@@ -1,3 +1,4 @@
+import { compileAttention, createAttentionCompiler } from "./attention-compiler.js";
 import { assertMessagesSupportModelCapabilities } from "./content.js";
 import { applyContextBudget, CONTEXT_BUDGET_REPORT_METADATA_KEY } from "./context-budget.js";
 import { runInstructionInjectors } from "./instruction-injection.js";
@@ -8,6 +9,12 @@ import { skillMessages as buildSkillMessages } from "./skill-disclosure.js";
 import { composeSystemPrompt } from "./system-prompts.js";
 import { foldToolResultHistory, foldToolResults } from "./tool-result-fold.js";
 import { selectDisclosedTools } from "./tool-search.js";
+/**
+ * Wire payload for a tool result that carries no `value`, no `type:text` content, and no error.
+ * Every provider route serializes a tool result from this block, so the empty case must be a
+ * constant non-empty string instead of an absent payload (strict providers reject empty results).
+ */
+export const EMPTY_TOOL_RESULT_TEXT = "(tool completed with no output)";
 export function createDefaultInputBuilder() {
     return {
         name: "default-input",
@@ -127,7 +134,41 @@ export async function assembleProviderInput(options) {
     }
     let demotedSkillBodies;
     let budgetReport;
-    if (options.contextBudget) {
+    if (options.attentionCompiler) {
+        if (options.contextBudget) {
+            throw new TypeError("attentionCompiler and contextBudget are mutually exclusive: the compiler raises AttentionBudgetError instead of evicting");
+        }
+        // Same default-groups path as the budget branch: the compiler needs the assembled groups
+        // (and the provider context blocks) to measure one cost for the whole request.
+        const groups = await buildDefaultInputMessageGroups(options.input, buildContext);
+        context = await resolveContextProviders({
+            providers: options.contextProviders,
+            messages: flattenInputGroups(groups, layout),
+            injectedBlocks: injectorContribs.contextBlocks.length ? injectorContribs.contextBlocks : undefined,
+            middleware: options.middleware,
+            ...baseContext,
+        });
+        const compiled = await compileAttention({
+            compiler: resolveAttentionCompiler(options.attentionCompiler, options.model),
+            groups,
+            context,
+            skills,
+            tools,
+            fold: options.toolResultFold,
+            frontier: options.attentionSticky,
+            redactor: options.redactor,
+            signal: options.signal,
+            turn,
+            sessionId: options.sessionId,
+            runId: options.runId,
+        });
+        if (compiled.mutated)
+            options.onAttentionReport?.(compiled.report);
+        messages = flattenInputGroups(compiled.groups, layout);
+        if (buildContext.middleware)
+            messages = await buildContext.middleware.run("input_assembly", messages);
+    }
+    else if (options.contextBudget) {
         // ponytail: budget path always uses default groups so eviction kinds stay deterministic;
         // custom inputBuilder still honored when contextBudget is absent.
         const groups = await buildDefaultInputMessageGroups(options.input, buildContext);
@@ -211,6 +252,10 @@ export async function assembleProviderInput(options) {
         signal: options.signal,
     }, { sessionId: options.sessionId });
 }
+/** A resolved handle is reused as-is; raw options are validated for this call only. */
+function resolveAttentionCompiler(value, model) {
+    return "inputCap" in value ? value : createAttentionCompiler(value, { model });
+}
 async function buildDefaultInputMessageGroups(input, context) {
     return {
         instructions: [
@@ -328,7 +373,12 @@ function toolResultPayload(result) {
         .map((block) => block.text)
         .filter(Boolean)
         .join("\n");
-    return text.length > 0 ? text : undefined;
+    if (text.length > 0)
+        return text;
+    // An error already carries the outcome; without one, send the constant sentinel so no route
+    // (JSON string content, a content string, a function response, or a typed output part) emits
+    // an empty or absent payload.
+    return result.error === undefined || result.error === null ? EMPTY_TOOL_RESULT_TEXT : undefined;
 }
 function toolResultMessages(results) {
     return (results ?? []).map(toToolResultMessage);

package/dist/media-types.d.ts

@@ -0,0 +1,34 @@
+export interface SsrfPolicy {
+    /** When true (default), deny private/link-local/metadata hostnames and IPs. */
+    readonly denyPrivateHosts?: boolean;
+    /** Optional hostname allow-list. When set, only listed hosts are permitted. */
+    readonly allowedHostnames?: readonly string[];
+    /**
+     * Optional IP-literal CIDR allow-list (IPv4 + IPv6, e.g. `"10.0.0.0/8"`). Checked
+     * after the hostname allow-list and the denied-name list, and applied to both URL
+     * literals and resolved DNS candidates. Membership bypasses **only** the private-IP
+     * block: metadata-style hostnames (`metadata.google.internal`), loopback names, and
+     * embedded credentials stay denied, and a hostname in the list can never match.
+     * An unparseable entry fails the check closed. Explicit host trust override — see
+     * `docs/multimodal-content.md` / `docs/host-security.md`.
+     */
+    readonly allowedCidrs?: readonly string[];
+}
+export interface MediaHostAddress {
+    readonly address: string;
+    readonly family: 4 | 6;
+}
+export type MediaHostnameResolver = (hostname: string, signal: AbortSignal) => Promise<readonly MediaHostAddress[]>;
+export declare class MediaContentError extends Error {
+    readonly code: "ambiguous_source" | "missing_source" | "item_too_large" | "request_too_large" | "too_many_items" | "audio_too_long" | "invalid_base64" | "ssrf_denied" | "redirect" | "fetch_failed" | "fetch_timeout" | "resource_required" | "mime_mismatch" | "unsupported_url_scheme";
+    constructor(code: MediaContentError["code"], message: string, options?: ErrorOptions);
+}
+export declare function assertSsrfAllowedUrl(url: string, policy?: SsrfPolicy): void;
+export declare function normalizeHostname(value: string): string;
+export declare function isBlockedIp(hostname: string): boolean;
+/**
+ * Membership test for `SsrfPolicy.allowedCidrs`. Non-IP hostnames can never match; an
+ * entry that does not parse as `address/prefix` throws `ssrf_denied` (fail closed,
+ * including entries of the other address family than the one being tested).
+ */
+export declare function isAllowedByCidr(hostname: string, allowedCidrs: readonly string[] | undefined): boolean;

package/dist/media-types.js

@@ -0,0 +1,158 @@
+/**
+ * SSRF policy, host/address types, `MediaContentError`, and the URL gate shared by the
+ * media content pipeline (`content.ts`) and the DNS-pinned fetch primitive
+ * (`pinned-fetch.ts`).
+ *
+ * Leaf module: it imports nothing from either consumer, which is what keeps the two off
+ * each other's import graph (plan 070 Task 10, shipped in 0.6.0 — the pair previously formed
+ * a deliberate ESM cycle where each module referenced the other's exports only inside
+ * function bodies). Declarations moved here verbatim; `assertSsrfAllowedUrl` is
+ * re-exported from `content.ts` so every import path and the class identity stay put.
+ */
+import { isIP } from "node:net";
+export class MediaContentError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = "MediaContentError";
+        this.code = code;
+    }
+}
+export function assertSsrfAllowedUrl(url, policy = {}) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new MediaContentError("ssrf_denied", "Media URL is not a valid absolute URL");
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new MediaContentError("unsupported_url_scheme", `Media URL scheme ${parsed.protocol} is not allowed`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new MediaContentError("ssrf_denied", "Media URL must not embed credentials");
+    }
+    const hostname = normalizeHostname(parsed.hostname);
+    // Parsed up front so a malformed policy entry always fails closed, even when another
+    // allow-list short-circuits below. Membership only matters after the denied-name list.
+    const cidrAllowed = isAllowedByCidr(hostname, policy.allowedCidrs);
+    if (policy.allowedHostnames?.length) {
+        if (!policy.allowedHostnames.some((allowed) => hostname === normalizeHostname(allowed))) {
+            throw new MediaContentError("ssrf_denied", `Media URL host ${hostname} is not allow-listed`);
+        }
+        return;
+    }
+    if (policy.denyPrivateHosts === false)
+        return;
+    if (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname.endsWith(".local") ||
+        hostname === "metadata" ||
+        hostname === "metadata.google.internal" ||
+        hostname === "instance-data") {
+        throw new MediaContentError("ssrf_denied", `Media URL host ${hostname} is not allowed`);
+    }
+    // Validates the CIDR list even for a denied/absent IP: an unparseable entry fails closed.
+    if (cidrAllowed)
+        return;
+    if (isBlockedIp(hostname)) {
+        throw new MediaContentError("ssrf_denied", `Media URL host ${hostname} is not allowed`);
+    }
+}
+export function normalizeHostname(value) {
+    return value
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "")
+        .replace(/\.$/, "");
+}
+export function isBlockedIp(hostname) {
+    const normalized = normalizeHostname(hostname);
+    const family = isIP(normalized);
+    if (family === 4)
+        return isBlockedIpv4(normalized);
+    if (family === 6)
+        return isBlockedIpv6(normalized);
+    return false;
+}
+/**
+ * Membership test for `SsrfPolicy.allowedCidrs`. Non-IP hostnames can never match; an
+ * entry that does not parse as `address/prefix` throws `ssrf_denied` (fail closed,
+ * including entries of the other address family than the one being tested).
+ */
+export function isAllowedByCidr(hostname, allowedCidrs) {
+    if (!allowedCidrs?.length)
+        return false;
+    const ranges = allowedCidrs.map((entry) => {
+        const range = parseCidr(entry);
+        if (!range)
+            throw new MediaContentError("ssrf_denied", `SSRF policy CIDR '${entry}' is not a valid range`);
+        return range;
+    });
+    const address = normalizeHostname(hostname);
+    const family = isIP(address);
+    if (family !== 4 && family !== 6)
+        return false;
+    const bits = family === 4 ? 32 : 128;
+    const target = addressToBigInt(address, family);
+    return ranges.some((range) => range.bits === bits && target >> BigInt(bits - range.prefix) === range.base >> BigInt(bits - range.prefix));
+}
+function parseCidr(value) {
+    const [address, prefixText, ...rest] = value.split("/");
+    if (rest.length > 0 || address === undefined || prefixText === undefined)
+        return undefined;
+    const family = isIP(normalizeHostname(address));
+    if (family !== 4 && family !== 6)
+        return undefined;
+    const prefix = Number(prefixText);
+    const bits = family === 4 ? 32 : 128;
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > bits)
+        return undefined;
+    return { base: addressToBigInt(normalizeHostname(address), family), bits, prefix };
+}
+function addressToBigInt(address, family) {
+    const words = family === 4 ? address.split(".").map(Number) : (parseIpv6Words(address) ?? []);
+    return words.reduce((accumulator, word) => (accumulator << BigInt(family === 4 ? 8 : 16)) | BigInt(word), 0n);
+}
+function isBlockedIpv4(address) {
+    const [a, b] = address.split(".").map(Number);
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && (b === 0 || b === 168)) ||
+        (a === 198 && (b === 18 || b === 19 || b === 51)) ||
+        (a === 203 && b === 0) ||
+        a >= 224);
+}
+function isBlockedIpv6(address) {
+    const words = parseIpv6Words(address);
+    if (!words)
+        return true;
+    if (words.every((word) => word === 0) || (words.slice(0, 7).every((word) => word === 0) && words[7] === 1))
+        return true;
+    if ((words[0] & 0xfe00) === 0xfc00)
+        return true;
+    if ((words[0] & 0xffc0) === 0xfe80 || (words[0] & 0xffc0) === 0xfec0)
+        return true;
+    if ((words[0] & 0xff00) === 0xff00)
+        return true;
+    if (words[0] === 0x2001 && words[1] === 0x0db8)
+        return true;
+    const mapped = words.slice(0, 5).every((word) => word === 0) && (words[5] === 0 || words[5] === 0xffff);
+    return mapped && isBlockedIpv4(`${words[6] >> 8}.${words[6] & 0xff}.${words[7] >> 8}.${words[7] & 0xff}`);
+}
+function parseIpv6Words(address) {
+    const parts = address.split("::");
+    if (parts.length > 2)
+        return undefined;
+    const left = parts[0] ? parts[0].split(":") : [];
+    const right = parts[1] ? parts[1].split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if (missing < 0 || (parts.length === 1 && missing !== 0))
+        return undefined;
+    const words = [...left, ...Array.from({ length: missing }, () => "0"), ...right].map((part) => Number.parseInt(part, 16));
+    return words.length === 8 && words.every((word) => Number.isInteger(word) && word >= 0 && word <= 0xffff) ? words : undefined;
+}
+//# sourceMappingURL=media-types.js.map

package/dist/pinned-fetch.d.ts

@@ -1,4 +1,5 @@
-import { type MediaHostAddress, type MediaHostnameResolver, type SsrfPolicy } from "./content.js";
+import { type MediaHostAddress, type MediaHostnameResolver, normalizeHostname, type SsrfPolicy } from "./media-types.js";
+export { normalizeHostname };
 export interface PinnedFetchOptions {
     /** Prefix for request-level error messages ("redirects are not allowed", "response exceeds", ...). Default "Request". */
     readonly errorPrefix?: string;
@@ -20,6 +21,5 @@ export declare function defaultResolver(hostname: string): Promise<readonly Medi
 export declare function requestPinned(url: URL, address: MediaHostAddress, init: RequestInit | undefined, errorPrefix?: string): Promise<Response>;
 export declare function boundResponse(response: Response, maxBytes: number, errorPrefix?: string): Response;
 export declare function raceAbort<T>(promise: Promise<T>, signal: AbortSignal | null | undefined): Promise<T>;
-export declare function normalizeHostname(value: string): string;
 export declare function isLoopbackHostname(value: string): boolean;
 export declare function isLoopbackAddress(value: string): boolean;

package/dist/pinned-fetch.js

@@ -11,15 +11,17 @@
  * for 3xx). Error messages are parameterized by `errorPrefix` so each caller
  * (MCP, OIDC, OPA, content) keeps its own taxonomy and message text.
  *
- * NOTE: imports from ./content.js and is imported by it (content's default
- * media fetch routes through here) — a deliberate ESM cycle; both modules only
- * reference the other's exports inside function bodies, never at module scope.
+ * The SSRF gate, `MediaContentError`, and the host/address types come from the leaf
+ * module `./media-types.js` — shared with `content.ts`, which routes its default media
+ * fetch through here. This module transitively imports nothing from `content.ts` (plan
+ * 070 Task 10 broke the deliberate ESM cycle that used to sit between the two).
  */
 import { lookup as dnsLookup } from "node:dns/promises";
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { isIP } from "node:net";
-import { assertSsrfAllowedUrl, MediaContentError } from "./content.js";
+import { assertSsrfAllowedUrl, MediaContentError, normalizeHostname, } from "./media-types.js";
+export { normalizeHostname };
 /** One DNS-pinned, redirect-free, byte-bounded fetch. See module comment. */
 export async function pinnedFetch(url, init, options) {
     const errorPrefix = options?.errorPrefix ?? "Request";
@@ -72,8 +74,11 @@ export async function resolvePinnedAddress(url, resolver, signal, allowLoopback,
         }
         const literal = candidate.family === 6 ? `[${normalized}]` : normalized;
         // Fail closed on resolved candidates: an explicit hostname allow-list is honored
-        // for the URL itself, but every resolved address is still private-checked.
-        const candidatePolicy = ssrf?.allowedHostnames?.length ? { denyPrivateHosts: ssrf.denyPrivateHosts } : ssrf;
+        // for the URL itself, but every resolved address is still private-checked. An
+        // allowed CIDR is a range rule, so it does apply to resolved addresses.
+        const candidatePolicy = ssrf?.allowedHostnames?.length
+            ? { denyPrivateHosts: ssrf.denyPrivateHosts, ...(ssrf.allowedCidrs ? { allowedCidrs: ssrf.allowedCidrs } : {}) }
+            : ssrf;
         try {
             assertSsrfAllowedUrl(`${url.protocol}//${literal}`, candidatePolicy);
         }
@@ -250,12 +255,6 @@ export async function raceAbort(promise, signal) {
         promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
     });
 }
-export function normalizeHostname(value) {
-    return value
-        .toLowerCase()
-        .replace(/^\[|\]$/g, "")
-        .replace(/\.$/, "");
-}
 export function isLoopbackHostname(value) {
     const hostname = normalizeHostname(value);
     return hostname === "localhost" || hostname.endsWith(".localhost") || isLoopbackAddress(hostname);

package/dist/redaction.js

@@ -3,6 +3,18 @@ const REDACTED = "[REDACTED]";
 // Depth bound matching agent-run-state.ts; hostile deep structures yield a placeholder
 // instead of a stack overflow.
 const MAX_REDACT_DEPTH = 32;
+// Plan 070 Task 9: single-pass fast path. One left-to-right alternation replaces every
+// occurrence of every needle in a single scan, instead of one split/join pass per needle.
+// It is only equivalent to the ordered reduce below when no needle occurrence can overlap
+// another needle's occurrence or a produced placeholder, so `singlePassMatcher` returns
+// null for such sets and the loop stays authoritative. Below this length the set check
+// costs more than the passes it saves (measured crossover ~4 KB, so the fast path only
+// engages with a wide margin).
+const SINGLE_PASS_MIN_CHARS = 16 * 1024;
+// ponytail: bound the fast path to this needle count. The set check is O(k²) and the
+// alternation compile grows with k, so the loop is no slower beyond it. Raise if a host
+// redacts with much larger secret sets.
+const SINGLE_PASS_MAX_NEEDLES = 32;
 export function createSecretRedactor(secrets) {
     return { redact: (value) => redactSecrets(value, secrets) };
 }
@@ -35,7 +47,18 @@ export function redactSecrets(value, secrets) {
     const needles = secrets.filter((secret) => Boolean(secret));
     if (needles.length === 0)
         return value;
-    const redactString = (text) => needles.reduce((current, secret) => current.split(secret).join(REDACTED), text);
+    // Decided lazily on the first large string, and only once per call: a redaction of many
+    // small strings never pays the set check and never regresses against the loop.
+    let singlePass;
+    const redactString = (text) => {
+        if (text.length >= SINGLE_PASS_MIN_CHARS) {
+            if (singlePass === undefined)
+                singlePass = singlePassMatcher(needles);
+            if (singlePass)
+                return text.replace(singlePass, REDACTED);
+        }
+        return needles.reduce((current, secret) => current.split(secret).join(REDACTED), text);
+    };
     const redactKey = (key) => {
         if (typeof key === "string")
             return redactString(key);
@@ -90,6 +113,56 @@ export function redactSecrets(value, secrets) {
     };
     return redact(value);
 }
+function escapeRegExpLiteral(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Compiled single-pass matcher for `needles`, or null when the set is not provably
+ * equivalent to the ordered reduce/split/join in `redactSecrets`. Equivalence holds when
+ * no needle occurrence can overlap another needle's occurrence (overlap would make the
+ * result depend on which needle is mentioned first rather than on position) and no needle
+ * can occur inside or across the edges of a produced "[REDACTED]" placeholder (a later
+ * pass would then redact text the single scan never sees). Both checks are conservative:
+ * a false negative only costs the fast path.
+ */
+function singlePassMatcher(needles) {
+    if (needles.length < 2 || needles.length > SINGLE_PASS_MAX_NEEDLES)
+        return null;
+    for (const needle of needles) {
+        if (needleTouchesPlaceholder(needle))
+            return null;
+    }
+    for (const left of needles) {
+        for (const right of needles) {
+            if (left !== right && needlesOverlap(left, right))
+                return null;
+        }
+    }
+    return new RegExp(needles.map(escapeRegExpLiteral).join("|"), "g");
+}
+/** A placeholder-relative occurrence: needle inside "[REDACTED]", or a needle prefix equal
+ * to a placeholder suffix / needle suffix equal to a placeholder prefix (a match spanning
+ * the placeholder's edge that the ordered passes would create). */
+function needleTouchesPlaceholder(needle) {
+    if (REDACTED.includes(needle))
+        return true;
+    for (let n = 1; n < needle.length; n += 1) {
+        if (REDACTED.endsWith(needle.slice(0, n)) || REDACTED.startsWith(needle.slice(n)))
+            return true;
+    }
+    return false;
+}
+/** One occurrence of `left` overlapping one of `right`: containment either way, or a proper
+ * suffix of `left` equal to a proper prefix of `right` (callers check both directions). */
+function needlesOverlap(left, right) {
+    if (right.includes(left))
+        return true;
+    for (let n = 1; n < left.length && n < right.length; n += 1) {
+        if (right.startsWith(left.slice(left.length - n)))
+            return true;
+    }
+    return false;
+}
 export function errorToErrorInfo(error, secrets = []) {
     const code = readErrorCode(error);
     const retry = readRetryAfterMs(error);

package/dist/secure-agent.d.ts

@@ -1,3 +1,5 @@
 import type { Agent, SecureAgentOptions } from "./contracts.js";
+import { assertHostCompositionReadiness, HostCompositionError, type HostCompositionGovernance, type HostCompositionOptions, type HostCompositionProfile, type HostCompositionReport, type HostCompositionToolReport, inspectHostComposition } from "./host-composition.js";
+export { assertHostCompositionReadiness, HostCompositionError, type HostCompositionGovernance, type HostCompositionOptions, type HostCompositionProfile, type HostCompositionReport, type HostCompositionToolReport, inspectHostComposition, };
 /** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
 export declare function createSecureAgent(options: SecureAgentOptions): Agent;

package/dist/secure-agent.js

@@ -1,8 +1,10 @@
 import { validateRunStateOptions } from "./agent-run-state.js";
 import { createAgent } from "./agents.js";
+import { assertHostCompositionReadiness, HostCompositionError, inspectHostComposition, } from "./host-composition.js";
 import { assertIdentityActive, assertIdentityMatchesOwnership } from "./identity.js";
 import { resolveRunLimits } from "./run-limits.js";
 import { createToolParameterValidator, createToolRegistry } from "./tools.js";
+export { assertHostCompositionReadiness, HostCompositionError, inspectHostComposition, };
 /** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
 export function createSecureAgent(options) {
     if (!options.id.trim())
@@ -32,6 +34,9 @@ export function createSecureAgent(options) {
         assertIdentityActive(options.identity);
         assertIdentityMatchesOwnership(options.identity, options.ownership);
     }
+    if (options.composition) {
+        assertHostCompositionReadiness({ ...options.composition, agent: options });
+    }
     const runState = Object.freeze({ ...options.runState, definitionRevision: options.definitionRevision, interruptBeforeTool: true });
     validateRunStateOptions(runState);
     const config = Object.freeze({
@@ -52,7 +57,7 @@ export function createSecureAgent(options) {
     return createAgent(config);
 }
 function withoutSecureFields(options) {
-    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, identity: _identity, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, ...config } = options;
+    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, identity: _identity, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, composition: _composition, ...config } = options;
     return config;
 }
 function freezeGuardrails(guardrails) {

package/dist/session-stores.d.ts

@@ -28,5 +28,16 @@ export type MemorySessionSearchMode = "linear" | "unsupported";
 export interface CreateMemorySessionStoreOptions {
     /** Default `"linear"`: capped in-process scan. `"unsupported"`: typed throw. */
     readonly sessionSearchMode?: MemorySessionSearchMode;
+    /**
+     * Optional overrides for the capped in-process scan. Hosts with a small session set can
+     * raise the caps (bounded by the contract `HARD_MAX_SESSION_SEARCH_LINEAR_*` values);
+     * defaults are the contract `DEFAULT_MAX_SESSION_SEARCH_LINEAR_*` caps. Values below 1
+     * or above the hard cap fail store construction closed with a `TypeError`.
+     */
+    readonly search?: {
+        readonly maxLinearSessions?: number;
+        readonly maxLinearEntries?: number;
+        readonly maxLinearBytes?: number;
+    };
 }
 export declare function createMemorySessionStore(initialEntries?: readonly SessionEntry[], options?: CreateMemorySessionStoreOptions): SessionStore;

package/dist/session-stores.js

@@ -1,4 +1,4 @@
-import { DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, resolveSessionSearchQuery, SESSION_APPEND_CONFLICT_CODE, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SessionAppendConflictError, SessionSearchUnsupportedError, } from "./contracts.js";
+import { DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, resolveSessionSearchQuery, SESSION_APPEND_CONFLICT_CODE, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SessionAppendConflictError, SessionSearchUnsupportedError, } from "./contracts.js";
 import { createId } from "./ids.js";
 export function createSessionEntry(options) {
     const { createId, now, ...entry } = options;
@@ -96,12 +96,27 @@ function rebuildSessionContextCore(entries, options = {}) {
     }
     return { leafId: branch.at(-1)?.id, entries: branch, messages, summaries };
 }
+function resolveLinearSearchCaps(search) {
+    return {
+        sessions: assertLinearCap(search?.maxLinearSessions, "maxLinearSessions", DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS),
+        entries: assertLinearCap(search?.maxLinearEntries, "maxLinearEntries", DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES),
+        bytes: assertLinearCap(search?.maxLinearBytes, "maxLinearBytes", DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES),
+    };
+}
+function assertLinearCap(value, name, fallback, hardMax) {
+    const cap = value ?? fallback;
+    if (!Number.isSafeInteger(cap) || cap < 1 || cap > hardMax) {
+        throw new TypeError(`CreateMemorySessionStoreOptions.search.${name} must be a safe integer from 1 to ${hardMax}`);
+    }
+    return cap;
+}
 export function createMemorySessionStore(initialEntries = [], options = {}) {
     const byId = new Map();
     const bySession = new Map();
     const leafBySession = new Map();
     const idempotencySeen = new Set();
     const mode = options.sessionSearchMode ?? "linear";
+    const searchCaps = resolveLinearSearchCaps(options.search);
     for (const entry of initialEntries)
         add(entry);
     return {
@@ -118,7 +133,7 @@ export function createMemorySessionStore(initialEntries = [], options = {}) {
         async searchSessions(query) {
             if (mode === "unsupported")
                 throw new SessionSearchUnsupportedError();
-            return searchMemorySessionsLinear(bySession, leafBySession, query);
+            return searchMemorySessionsLinear(bySession, leafBySession, query, searchCaps);
         },
     };
     function add(entry, options) {
@@ -160,7 +175,7 @@ export function createMemorySessionStore(initialEntries = [], options = {}) {
         leafBySession.set(entry.sessionId, entry.id);
     }
 }
-function searchMemorySessionsLinear(bySession, leafBySession, query) {
+function searchMemorySessionsLinear(bySession, leafBySession, query, caps) {
     const q = resolveSessionSearchQuery(query);
     q.signal?.throwIfAborted();
     let sessionsScanned = 0;
@@ -168,11 +183,11 @@ function searchMemorySessionsLinear(bySession, leafBySession, query) {
     let bytesScanned = 0;
     const matches = [];
     for (const [sessionId, entries] of bySession) {
-        if (sessionsScanned >= DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS)
+        if (sessionsScanned >= caps.sessions)
             break;
-        if (entriesScanned >= DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES)
+        if (entriesScanned >= caps.entries)
             break;
-        if (bytesScanned >= DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES)
+        if (bytesScanned >= caps.bytes)
             break;
         q.signal?.throwIfAborted();
         sessionsScanned += 1;
@@ -190,9 +205,9 @@ function searchMemorySessionsLinear(bySession, leafBySession, query) {
         let matchedModel = false;
         let snippetSource;
         for (const entry of entries) {
-            if (entriesScanned >= DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES)
+            if (entriesScanned >= caps.entries)
                 break;
-            if (bytesScanned >= DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES)
+            if (bytesScanned >= caps.bytes)
                 break;
             entriesScanned += 1;
             const text = entrySearchText(entry);

package/dist/tool-result-fold.d.ts

@@ -38,3 +38,15 @@ export declare function foldToolResultHistory(history: readonly Message[], optio
 export declare function foldToolResults(results: readonly ToolResult[], options: ResolvedToolResultFoldOptions, context: FoldToolResultsContext): Promise<readonly ToolResult[]>;
 export declare function formatFoldedToolResult(summary: string): string;
 export declare function foldedToolResultHeader(toolName: string, toolCallId: string, summary: string): string;
+/** Text the fold summarizes for one tool result: the payload JSON, then any text blocks.
+ *  Shared with the attention compiler so both hash/summarize the same bytes. */
+export declare function toolResultFoldText(result: unknown, error: unknown, extra?: readonly {
+    readonly type: string;
+}[]): string;
+/** UTF-8 cap that never splits a multi-byte character. Shared with the attention
+ *  compiler's host-summarize path so both cap host text identically. */
+export declare function capToolResultSummary(summary: string, maxBytes: number): string;
+/** Provider turn per history index: assistant messages advance the turn, tool rows use
+ *  their `prismToolResultTurn` stamp when present and the last assistant turn otherwise.
+ *  Shared with the attention compiler so age gates match the fold exactly. */
+export declare function inferToolResultTurns(history: readonly Message[]): readonly number[];

package/dist/tool-result-fold.js

@@ -58,7 +58,7 @@ async function foldToolResultMessage(message, options, context) {
     const block = message.content.find((part) => part.type === "tool_result");
     if (block?.type !== "tool_result")
         return message;
-    const text = toolResultText(block.result, block.error, message.content);
+    const text = toolResultFoldText(block.result, block.error, message.content);
     const folded = await maybeFold({
         options,
         context,
@@ -80,7 +80,7 @@ async function foldToolResultMessage(message, options, context) {
     return folded ?? message;
 }
 async function foldToolResultValue(result, options, context) {
-    const text = toolResultText(result.value, result.error, result.content);
+    const text = toolResultFoldText(result.value, result.error, result.content);
     const folded = await maybeFold({
         options,
         context,
@@ -112,7 +112,7 @@ async function maybeFold(input) {
             toolName: input.toolName,
             text: input.text,
         });
-        return input.apply(capSummaryBytes(String(summary), input.options.maxSummaryBytes));
+        return input.apply(capToolResultSummary(String(summary), input.options.maxSummaryBytes));
     }
     catch {
         return undefined;
@@ -124,7 +124,9 @@ export function formatFoldedToolResult(summary) {
 export function foldedToolResultHeader(toolName, toolCallId, summary) {
     return `Tool result ${toolName} [${toolCallId}]: ${summary}`;
 }
-function toolResultText(result, error, extra) {
+/** Text the fold summarizes for one tool result: the payload JSON, then any text blocks.
+ *  Shared with the attention compiler so both hash/summarize the same bytes. */
+export function toolResultFoldText(result, error, extra) {
     const parts = [JSON.stringify(error ?? result ?? null)];
     for (const block of extra ?? []) {
         if (block.type === "text" && "text" in block && typeof block.text === "string")
@@ -132,7 +134,9 @@ function toolResultText(result, error, extra) {
     }
     return parts.join("\n");
 }
-function capSummaryBytes(summary, maxBytes) {
+/** UTF-8 cap that never splits a multi-byte character. Shared with the attention
+ *  compiler's host-summarize path so both cap host text identically. */
+export function capToolResultSummary(summary, maxBytes) {
     const bytes = estimateTextBytes(summary);
     if (bytes <= maxBytes)
         return summary;
@@ -143,7 +147,10 @@ function capSummaryBytes(summary, maxBytes) {
         end--;
     return `${new TextDecoder().decode(encoded.slice(0, end))}…`;
 }
-function inferToolResultTurns(history) {
+/** Provider turn per history index: assistant messages advance the turn, tool rows use
+ *  their `prismToolResultTurn` stamp when present and the last assistant turn otherwise.
+ *  Shared with the attention compiler so age gates match the fold exactly. */
+export function inferToolResultTurns(history) {
     const turns = new Array(history.length).fill(1);
     let providerTurn = 0;
     let toolTurn = 1;