@arnilo/prism 0.6.0 → 0.8.0

package/dist/index.js

@@ -4,7 +4,8 @@ export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOption
 export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
 export { AGENT_RUN_STATE_NAMESPACE, AGENT_RUN_STATE_SCHEMA_VERSION, agentFingerprint, DEFAULT_MAX_AGENT_RUN_STATE_BYTES, HARD_MAX_AGENT_RUN_STATE_BYTES, loadAgentRunState, } from "./agent-run-state.js";
 export { createAgent, createAgentSession, resumeAgentRun, resumeAgentRunStream } from "./agents.js";
-export { ARTIFACT_BODY_ERROR_CODES, ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactBodyStoreError, ArtifactError, artifactApprovalState, artifactCheckpointKey, } from "./artifacts.js";
+export { ARTIFACT_BODY_ERROR_CODES, ARTIFACT_CHECKPOINT_NAMESPACE, ArtifactBodyStoreError, ArtifactError, approvalEvidenceIntact, artifactApprovalState, artifactCheckpointKey, checkCitationIntegrity, citationBindingDigest, HARD_CITATION_EXCERPT_BYTES, } from "./artifacts.js";
+export { ATTENTION_BUDGET_ERROR_CODE, AttentionBudgetError, createAttentionCompiler, createAttentionTruncationTrigger, DEFAULT_ATTENTION_COMPACT_RATIO, DEFAULT_ATTENTION_KEEP_LAST, DEFAULT_ATTENTION_RESERVE_TOKENS, DEFAULT_ATTENTION_THINKING_KEEP_TURNS, DEFAULT_ATTENTION_TRIGGER_RATIO, DEFAULT_ATTENTION_TRUNCATION_THRESHOLD, isAttentionBudgetError, resolveAttentionReserveTokens, resolveInputCap, resolveRunAttentionCompiler, } from "./attention-compiler.js";
 export { applyCacheControl, cacheHitRate, cacheSavings, cacheUsageReport, mapCacheRetention, resolveBreakpoint, sanitizeCacheKey, systemCacheControlField, } from "./cache-helpers.js";
 export { CACHE_TELEMETRY_OVERFLOW_KEY, CacheTelemetryError, createCacheTelemetry, DEFAULT_CACHE_TELEMETRY_CAP, } from "./cache-telemetry.js";
 export { createProviderCapture } from "./capture.js";
@@ -13,7 +14,7 @@ export { createDefaultCompactionStrategy, isCompactionEntryData } from "./compac
 export { assertJsonObject, isJsonObject, loadConfigLayers, mergeConfigLayers } from "./config.js";
 export { assertDeclaredMediaTypeMatches, assertMediaBlocksWithinBounds, assertMessagesSupportModelCapabilities, assertModelSupportsContentBlocks, assertSsrfAllowedUrl, collectMessageContentBlocks, contentBlockInputModality, DEFAULT_MAX_AUDIO_DURATION_MS, DEFAULT_MAX_MEDIA_ITEM_BYTES, DEFAULT_MAX_MEDIA_ITEMS_PER_REQUEST, DEFAULT_MAX_MEDIA_REQUEST_BYTES, DEFAULT_MEDIA_FETCH_TIMEOUT_MS, loadBoundedBinaryResource, MediaContentError, MODEL_INPUT_CAPABILITIES, resolveMediaContentBlock, resolveMediaContentBlocks, sniffMediaMimeType, UnsupportedModalityError, } from "./content.js";
 export { applyContextBudget, CONTEXT_BUDGET_ERROR_CODE, CONTEXT_BUDGET_REPORT_METADATA_KEY, ContextBudgetError, DEFAULT_MAX_CONTEXT_BUDGET_OMISSIONS, estimateAssemblyTokens, estimateMessageBytes, estimateMessageTokens, estimateTextBytes, estimateTextTokens, getContextBudgetReport, HARD_MAX_CONTEXT_BUDGET_BYTES, HARD_MAX_CONTEXT_BUDGET_OMISSIONS, HARD_MAX_CONTEXT_BUDGET_TOKENS, isContextBudgetError, resolveContextBudget, } from "./context-budget.js";
-export { AgentDecisionError, AgentDelegationSuspendedError, AgentLoopStateError, AgentRunError, AgentRunStateError, assertBatchJobsSupported, assertEmbeddingsSupported, assertImageGenerationSupported, assertModerationSupported, assertSessionMetadataKey, assertSpeechSupported, assertTranscriptionSupported, assertVideoGenerationSupported, BatchJobsError, DEFAULT_MAX_PENDING_DECISIONS, DEFAULT_MAX_PENDING_STEER_BYTES, DEFAULT_MAX_PENDING_STEERS, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_STICKY_DECISIONS, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_SNAPSHOT_CACHE_TTL_MS, EmbeddingsError, HARD_MAX_ACTION_CONSTRAINT_BYTES, HARD_MAX_ACTION_CONSTRAINTS, HARD_MAX_DECISION_REASON_BYTES, HARD_MAX_ELICITATION_BYTES, HARD_MAX_PENDING_DECISIONS, HARD_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEERS, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SNAPSHOT_CACHE_TTL_MS, HARD_MAX_STICKY_DECISIONS, ImageGenerationError, isBatchJobTerminal, isSessionAppendConflict, isSessionEntryKind, isSessionMetadataConflict, isSessionSearchUnsupported, MAX_ACTION_CONSTRAINT_BYTES, MAX_ACTION_CONSTRAINTS, MAX_ATTRIBUTION_DEPTH, MAX_DECISION_REASON_BYTES, MAX_ELICITATION_BYTES, ModerationError, modelSupportsBatchJobs, modelSupportsEmbeddings, modelSupportsImageGeneration, modelSupportsModeration, modelSupportsSpeech, modelSupportsTranscription, modelSupportsVideoGeneration, pollBatch, resolveSessionSearchQuery, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SESSION_METADATA_CONFLICT_CODE, SESSION_SEARCH_UNSUPPORTED_CODE, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SessionAppendConflictError, SessionMetadataConflictError, SessionSearchUnsupportedError, SpeechError, TranscriptionError, VideoGenerationError, } from "./contracts.js";
+export { AgentDecisionError, AgentDelegationSuspendedError, AgentLoopStateError, AgentRunError, AgentRunStateError, assertBatchJobsSupported, assertCompactionTrigger, assertEmbeddingsSupported, assertImageGenerationSupported, assertModerationSupported, assertSessionMetadataKey, assertSpeechSupported, assertTranscriptionSupported, assertVideoGenerationSupported, BatchJobsError, DEFAULT_MAX_PENDING_DECISIONS, DEFAULT_MAX_PENDING_STEER_BYTES, DEFAULT_MAX_PENDING_STEERS, DEFAULT_MAX_SESSION_SEARCH_CURSOR_BYTES, DEFAULT_MAX_SESSION_SEARCH_FTS_CANDIDATES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_BYTES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_ENTRIES, DEFAULT_MAX_SESSION_SEARCH_LINEAR_SESSIONS, DEFAULT_MAX_SESSION_SEARCH_QUERY_BYTES, DEFAULT_MAX_SESSION_SEARCH_SNIPPET_BYTES, DEFAULT_MAX_STICKY_DECISIONS, DEFAULT_SESSION_SEARCH_LIMIT, DEFAULT_SNAPSHOT_CACHE_TTL_MS, EmbeddingsError, HARD_MAX_ACTION_CONSTRAINT_BYTES, HARD_MAX_ACTION_CONSTRAINTS, HARD_MAX_DECISION_REASON_BYTES, HARD_MAX_ELICITATION_BYTES, HARD_MAX_PENDING_DECISIONS, HARD_MAX_PENDING_STEER_BYTES, HARD_MAX_PENDING_STEERS, HARD_MAX_SESSION_SEARCH_CURSOR_BYTES, HARD_MAX_SESSION_SEARCH_FTS_CANDIDATES, HARD_MAX_SESSION_SEARCH_LIMIT, HARD_MAX_SESSION_SEARCH_LINEAR_BYTES, HARD_MAX_SESSION_SEARCH_LINEAR_ENTRIES, HARD_MAX_SESSION_SEARCH_LINEAR_SESSIONS, HARD_MAX_SESSION_SEARCH_QUERY_BYTES, HARD_MAX_SESSION_SEARCH_SNIPPET_BYTES, HARD_MAX_SNAPSHOT_CACHE_TTL_MS, HARD_MAX_STICKY_DECISIONS, ImageGenerationError, isBatchJobTerminal, isSessionAppendConflict, isSessionEntryKind, isSessionMetadataConflict, isSessionSearchUnsupported, MAX_ACTION_CONSTRAINT_BYTES, MAX_ACTION_CONSTRAINTS, MAX_ATTRIBUTION_DEPTH, MAX_DECISION_REASON_BYTES, MAX_ELICITATION_BYTES, ModerationError, modelSupportsBatchJobs, modelSupportsEmbeddings, modelSupportsImageGeneration, modelSupportsModeration, modelSupportsSpeech, modelSupportsTranscription, modelSupportsVideoGeneration, pollBatch, resolveSessionSearchQuery, resolveShouldCompact, SESSION_APPEND_CONFLICT_CODE, SESSION_ENTRY_KINDS, SESSION_ENTRY_SCHEMA_VERSION, SESSION_METADATA_CONFLICT_CODE, SESSION_SEARCH_UNSUPPORTED_CODE, SESSION_SEARCH_WORKSPACE_METADATA_KEY, SessionAppendConflictError, SessionMetadataConflictError, SessionSearchUnsupportedError, SpeechError, TranscriptionError, VideoGenerationError, } from "./contracts.js";
 export { parseAgentFile, parseSkillFile } from "./contribution-parsing.js";
 export { createContributionRegistries, createContributionRegistry, registerDiscoveredContributions } from "./contributions.js";
 export { CONVERSATION_METADATA_KEY, ConversationError, conversationMarkerMetadata, conversationThreadFromRecord, DEFAULT_MAX_CONVERSATION_CURSOR_BYTES, decodeConversationReplayCursor, encodeConversationReplayCursor, HARD_MAX_CONVERSATION_CURSOR_BYTES, } from "./conversations.js";
@@ -21,6 +22,7 @@ export { createChainedCredentialResolver, createEnvCredentialResolver, createExp
 export { createDelegatedAgentStep, DelegatedAgentStepError, MAX_DELEGATED_AGENT_DURATION_MS, MAX_DELEGATED_AGENT_EVENT_BYTES, MAX_DELEGATED_AGENT_ID_BYTES, MAX_DELEGATED_AGENT_NAME_BYTES, MAX_DELEGATED_AGENT_STEP_INDEX, MAX_DELEGATED_AGENT_TOKEN_COUNT, } from "./delegated-agent-step.js";
 export { acceptDeviceChunk, assertDeviceAdmit, DEFAULT_DEVICE_MAX_CHUNK_BYTES, DEFAULT_DEVICE_MAX_CONCURRENT_SESSIONS, DevicePolicyError, HARD_DEVICE_MAX_CHUNK_BYTES, HARD_DEVICE_MAX_CONCURRENT_SESSIONS, redactDeviceTelemetry, resolveDevicePolicy, runDevicePolicyConformance, } from "./devices.js";
 export { createEventMultiplexer, EVENT_MULTIPLEXER_SINGLE_CONSUMER_CODE, EventMultiplexerError } from "./event-multiplexer.js";
+export { createClaimGroundingGuardrail } from "./evidence-grounding.js";
 export { applyExecutionDecision, assertExecutionAllowed, checkExecution, ExecutionDeniedError } from "./execution-policy.js";
 export { activateKernel, createExtensionEventBus, createExtensionKernel } from "./extensions.js";
 export { createMemoryRunFeedbackStore, prepareRunFeedback, RunFeedbackError, requireRunFeedbackOwnership, runFeedbackPageLimit, } from "./feedback.js";
@@ -46,9 +48,10 @@ export { createProviderRegistry, createProviderResolver } from "./providers.js";
 export { createSecretRedactor, errorToErrorInfo, redactAgentEvent, redactMessage, redactProviderRequest, redactRunLedgerRecord, redactSecrets, redactSessionEntry, resolveRedactor, } from "./redaction.js";
 export { loadBinaryResource, loadJsonResource, loadManifestResource, loadTextResource } from "./resources.js";
 export { createDefaultRetryPolicy, isTransientErrorInfo, waitForRetry } from "./retry.js";
+export { RUN_BUNDLE_SCHEMA_VERSION, snapshotRunBundle } from "./run-bundle.js";
 export { createBatchedRunLedger, DEFAULT_LEDGER_BATCH_BYTES, DEFAULT_LEDGER_BATCH_DELAY_MS, DEFAULT_LEDGER_BATCH_ENTRIES, HARD_LEDGER_BATCH_BYTES, HARD_LEDGER_BATCH_DELAY_MS, HARD_LEDGER_BATCH_ENTRIES, isFlushableRunLedger, } from "./run-ledger.js";
 export { createRunLimitTracker, DEFAULT_RUN_LIMITS, HARD_RUN_LIMITS, RunLimitError, RunLimitTracker, resolveRunLimits, } from "./run-limits.js";
-export { createSecureAgent } from "./secure-agent.js";
+export { assertHostCompositionReadiness, createSecureAgent, HostCompositionError, inspectHostComposition, } from "./secure-agent.js";
 export { assertPermission, assertTrusted, checkPermission, createStaticPermissionPolicy, createStaticTrustPolicy, denialToErrorInfo, isTrusted, PermissionDeniedError, TrustDeniedError, } from "./security.js";
 export { createMemorySessionStore, createSessionEntry, getSessionBranchEntries, listSessionBranches, rebuildSessionContext, } from "./session-stores.js";
 export { createChainedSettingsProvider, createStaticSettingsProvider } from "./settings.js";
@@ -66,6 +69,6 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export { trimTrailingSlashes } from "./trim-trailing-slashes.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.6.0";
+export const version = "0.8.0";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/input.d.ts

@@ -1,5 +1,6 @@
+import { type AttentionStickyFrontier } from "./attention-compiler.js";
 import { type ContextBudget } from "./context-budget.js";
-import type { ContentBlock, ContextBlock, ContextProvider, ContextResolutionContext, InputBuildContext, InputBuilder, InstructionInjector, JsonObject, Message, ModelConfig, PromptBuilder, PromptBuildRequest, ProviderRequest, ProviderRequestOptions, ResourceLoader, Skill, ToolDefinition, ToolResult } from "./contracts.js";
+import type { AttentionCompiler, AttentionCompilerOptions, AttentionReport, ContentBlock, ContextBlock, ContextProvider, ContextResolutionContext, InputBuildContext, InputBuilder, InstructionInjector, JsonObject, Message, ModelConfig, PromptBuilder, PromptBuildRequest, ProviderRequest, ProviderRequestOptions, ResourceLoader, Skill, ToolDefinition, ToolResult } from "./contracts.js";
 import type { MiddlewareRegistry } from "./middleware.js";
 import type { SecretRedactor } from "./redaction.js";
 import { type LoadedSkillSet, type SkillsDisclosure } from "./skill-disclosure.js";
@@ -77,6 +78,17 @@ export interface AssembleProviderInputOptions extends DefaultInputBuildContext {
     readonly contextBudget?: ContextBudget;
     /** Resolved tool-result fold; projection-only, store untouched. */
     readonly toolResultFold?: ResolvedToolResultFoldOptions;
+    /**
+     * Opt-in attention compiler: options are validated here (per call) or pass an existing
+     * `AttentionCompiler` to reuse one validation. Mutually exclusive with `contextBudget`,
+     * which would otherwise evict as a silent last resort after the compiler's stages.
+     */
+    readonly attentionCompiler?: AttentionCompilerOptions | AttentionCompiler;
+    /** Per-session-leaf sticky frontier; omit for one-shot assemblies (no cross-turn stickiness). */
+    readonly attentionSticky?: AttentionStickyFrontier;
+    /** Called once per *mutated* turn with the report, so a host can emit telemetry: under-ratio
+     *  turns never call it, and it runs before `input_assembly` middleware. */
+    readonly onAttentionReport?: (report: AttentionReport) => void;
 }
 export declare function createDefaultInputBuilder(): DefaultInputBuilder;
 export declare function resolveContextProviders(options: ResolveContextOptions): Promise<readonly ContextBlock[]>;

package/dist/input.js

@@ -1,3 +1,4 @@
+import { compileAttention, createAttentionCompiler } from "./attention-compiler.js";
 import { assertMessagesSupportModelCapabilities } from "./content.js";
 import { applyContextBudget, CONTEXT_BUDGET_REPORT_METADATA_KEY } from "./context-budget.js";
 import { runInstructionInjectors } from "./instruction-injection.js";
@@ -133,7 +134,41 @@ export async function assembleProviderInput(options) {
     }
     let demotedSkillBodies;
     let budgetReport;
-    if (options.contextBudget) {
+    if (options.attentionCompiler) {
+        if (options.contextBudget) {
+            throw new TypeError("attentionCompiler and contextBudget are mutually exclusive: the compiler raises AttentionBudgetError instead of evicting");
+        }
+        // Same default-groups path as the budget branch: the compiler needs the assembled groups
+        // (and the provider context blocks) to measure one cost for the whole request.
+        const groups = await buildDefaultInputMessageGroups(options.input, buildContext);
+        context = await resolveContextProviders({
+            providers: options.contextProviders,
+            messages: flattenInputGroups(groups, layout),
+            injectedBlocks: injectorContribs.contextBlocks.length ? injectorContribs.contextBlocks : undefined,
+            middleware: options.middleware,
+            ...baseContext,
+        });
+        const compiled = await compileAttention({
+            compiler: resolveAttentionCompiler(options.attentionCompiler, options.model),
+            groups,
+            context,
+            skills,
+            tools,
+            fold: options.toolResultFold,
+            frontier: options.attentionSticky,
+            redactor: options.redactor,
+            signal: options.signal,
+            turn,
+            sessionId: options.sessionId,
+            runId: options.runId,
+        });
+        if (compiled.mutated)
+            options.onAttentionReport?.(compiled.report);
+        messages = flattenInputGroups(compiled.groups, layout);
+        if (buildContext.middleware)
+            messages = await buildContext.middleware.run("input_assembly", messages);
+    }
+    else if (options.contextBudget) {
         // ponytail: budget path always uses default groups so eviction kinds stay deterministic;
         // custom inputBuilder still honored when contextBudget is absent.
         const groups = await buildDefaultInputMessageGroups(options.input, buildContext);
@@ -217,6 +252,10 @@ export async function assembleProviderInput(options) {
         signal: options.signal,
     }, { sessionId: options.sessionId });
 }
+/** A resolved handle is reused as-is; raw options are validated for this call only. */
+function resolveAttentionCompiler(value, model) {
+    return "inputCap" in value ? value : createAttentionCompiler(value, { model });
+}
 async function buildDefaultInputMessageGroups(input, context) {
     return {
         instructions: [

package/dist/provider-events.d.ts

@@ -14,7 +14,9 @@ export declare function providerContinuationRequired(cursor: string, reason?: st
 export declare function reconstructToolCallDeltas(events: readonly ProviderEvent[]): readonly ToolCallContent[];
 export declare function providerUsage(usage: Usage): ProviderEvent;
 export declare function providerDone(usage?: Usage): ProviderEvent;
-export declare function providerError(error: unknown, secrets?: readonly (string | undefined)[]): ProviderEvent;
+export declare function providerError(error: unknown, secrets?: readonly (string | undefined)[]): Extract<ProviderEvent, {
+    type: "error";
+}>;
 export declare function toolCallContent(id: string, name: string, args?: JsonObject): ToolCallContent;
 /** Build a tool call from streamed arguments text; malformed JSON becomes a blocked call (no throw). */
 export declare function toolCallFromArgumentsText(id: string, name: string, argumentsText: string): ToolCallContent;

package/dist/provider-events.js

@@ -1,4 +1,4 @@
-import { ProviderTransportError, tryParseJsonObjectArguments } from "./providers/transport.js";
+import { classifyProviderFailure, ProviderTransportError, tryParseJsonObjectArguments } from "./providers/transport.js";
 import { errorToErrorInfo } from "./redaction.js";
 export function providerTextDelta(text) {
     return { type: "content_delta", content: { type: "text", text } };
@@ -51,7 +51,7 @@ export function providerDone(usage) {
 }
 export function providerError(error, secrets = []) {
     const info = errorToErrorInfo(error, secrets);
-    return { type: "error", error: info };
+    return { type: "error", error: info.failureClass ? info : { ...info, failureClass: classifyProviderFailure(error) } };
 }
 export function toolCallContent(id, name, args = {}) {
     return { type: "tool_call", id, name, arguments: args };

package/dist/providers/transport.d.ts

@@ -1,4 +1,4 @@
-import type { JsonObject } from "../contracts.js";
+import type { JsonObject, ProviderFailureClass } from "../contracts.js";
 export declare const DEFAULT_MAX_EVENT_BYTES = 262144;
 export declare const DEFAULT_MAX_BUFFER_BYTES = 524288;
 export declare const DEFAULT_MAX_RESPONSE_BODY_BYTES = 65536;
@@ -15,6 +15,8 @@ export interface SseEvent {
     readonly comments?: readonly string[];
 }
 export type ProviderTransportErrorCode = "sse_buffer_overflow" | "sse_event_overflow" | "response_body_overflow" | "aborted" | "invalid_json_arguments" | "incomplete_delta" | "response_body_shape";
+/** Maps already-captured provider transport evidence to advisory outcome metadata. */
+export declare function classifyProviderFailure(error: unknown): ProviderFailureClass;
 export declare class ProviderTransportError extends Error {
     readonly code: ProviderTransportErrorCode;
     readonly limitBytes?: number;

package/dist/providers/transport.js

@@ -3,6 +3,22 @@ export const DEFAULT_MAX_EVENT_BYTES = 262_144;
 export const DEFAULT_MAX_BUFFER_BYTES = 524_288;
 export const DEFAULT_MAX_RESPONSE_BODY_BYTES = 65_536;
 export const DEFAULT_MAX_ARGUMENT_BYTES = 262_144;
+const QUOTA_BODY = /quota|usage[\s_-]*limit|insufficient[\s_-]*(?:quota|credit|balance)|billing[\s_-]*(?:limit|quota)/i;
+const TRANSIENT_NETWORK_CODES = new Set(["ECONNRESET", "ECONNREFUSED", "EAI_AGAIN", "ENETUNREACH", "ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"]);
+/** Maps already-captured provider transport evidence to advisory outcome metadata. */
+export function classifyProviderFailure(error) {
+    const status = readHttpStatus(error);
+    if (status === 401 || status === 403)
+        return "auth";
+    if (status === 429)
+        return QUOTA_BODY.test(errorMessage(error)) ? "quota" : "rate_limited";
+    if (status !== undefined)
+        return status >= 500 ? "transient" : status >= 400 ? "permanent" : "unknown";
+    const cause = readField(error, "cause");
+    if (isTransientNetworkCode(readField(error, "code")) || isTransientNetworkCode(readField(cause, "code")))
+        return "transient";
+    return "unknown";
+}
 export class ProviderTransportError extends Error {
     code;
     limitBytes;
@@ -22,8 +38,28 @@ export function httpStatusError(prefix, response, bodyText) {
     const hint = parseRetryAfterMs(response.headers.get("retry-after"));
     if (hint !== undefined)
         error.retryAfterMs = hint;
+    Object.defineProperty(error, "failureClass", { value: classifyProviderFailure(error), enumerable: true });
     return error;
 }
+function readHttpStatus(error) {
+    for (const key of ["code", "status", "statusCode"]) {
+        const value = readField(error, key);
+        const status = typeof value === "number" ? value : typeof value === "string" && /^\d{3}$/.test(value) ? Number(value) : undefined;
+        if (status !== undefined && status >= 100 && status <= 599)
+            return status;
+    }
+    return undefined;
+}
+function readField(error, key) {
+    return error && typeof error === "object" && key in error ? error[key] : undefined;
+}
+function isTransientNetworkCode(value) {
+    return typeof value === "string" && TRANSIENT_NETWORK_CODES.has(value.toUpperCase());
+}
+function errorMessage(error) {
+    const cause = readField(error, "cause");
+    return [readField(error, "message"), readField(cause, "message")].filter((value) => typeof value === "string").join(" ");
+}
 /** Parse a `Retry-After` header (delay-seconds or HTTP-date) into milliseconds. */
 export function parseRetryAfterMs(value, now = Date.now()) {
     if (!value)

package/dist/redaction.js

@@ -167,19 +167,22 @@ export function errorToErrorInfo(error, secrets = []) {
     const code = readErrorCode(error);
     const retry = readRetryAfterMs(error);
     const retryAfter = retry !== undefined ? { retryAfterMs: retry } : {};
+    const failureClass = readProviderFailureClass(error);
+    const failure = failureClass === undefined ? {} : { failureClass };
     if (error instanceof Error) {
         return {
             name: error.name,
             message: redactSecrets(error.message, secrets),
             code,
+            ...failure,
             ...retryAfter,
             cause: error.cause ? redactSecrets(String(error.cause), secrets) : undefined,
         };
     }
     if (error && typeof error === "object" && "message" in error) {
-        return { message: redactSecrets(String(error.message), secrets), code, ...retryAfter };
+        return { message: redactSecrets(String(error.message), secrets), code, ...failure, ...retryAfter };
     }
-    return { message: redactSecrets(String(error), secrets), code, ...retryAfter };
+    return { message: redactSecrets(String(error), secrets), code, ...failure, ...retryAfter };
 }
 function readErrorCode(error) {
     if (!error || typeof error !== "object" || !("code" in error))
@@ -193,4 +196,17 @@ function readRetryAfterMs(error) {
     const value = error.retryAfterMs;
     return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
 }
+function readProviderFailureClass(error) {
+    if (!error || typeof error !== "object" || !("failureClass" in error))
+        return undefined;
+    const value = error.failureClass;
+    return value === "quota" ||
+        value === "auth" ||
+        value === "rate_limited" ||
+        value === "transient" ||
+        value === "permanent" ||
+        value === "unknown"
+        ? value
+        : undefined;
+}
 //# sourceMappingURL=redaction.js.map

package/dist/run-bundle.d.ts

@@ -0,0 +1,89 @@
+import type { Agent, AgentSessionConfig, GuardrailStage, RunOptions } from "./contracts.js";
+/** Report format revision. Any shape change bumps this so pinned digests cannot compare across formats. */
+export declare const RUN_BUNDLE_SCHEMA_VERSION = 1;
+/** Inspectable projection of the inputs a run actually resolves to. Frozen JSON, safe to persist and diff. */
+export interface RunBundleSnapshot {
+    readonly schemaVersion: number;
+    /** `sha256:<64 hex>` over the canonicalized, redacted snapshot (this field excluded). */
+    readonly digest: string;
+    /** `agentFingerprint()` of the same agent/revision: the durable-resume identity behind this snapshot. */
+    readonly fingerprint: string;
+    readonly agent: {
+        readonly id: string;
+        readonly definitionRevision: string | null;
+    };
+    readonly systemPrompt: {
+        readonly disabled: boolean;
+        /** Digest of `AgentConfig.instructions`; the body never leaves the process. */
+        readonly instructionsDigest: string | null;
+        readonly contributions: readonly {
+            readonly id: string;
+            readonly mode: string | null;
+            readonly source: string | null;
+            readonly digest: string;
+        }[];
+    };
+    readonly skills: readonly {
+        readonly name: string;
+        readonly instructionsDigest: string | null;
+        readonly toolNames: readonly string[];
+    }[];
+    /** Effective tool set: `run.toolNames` narrowing already applied, schemas reduced to digests. */
+    readonly tools: readonly {
+        readonly name: string;
+        readonly schemaDigest: string;
+        readonly exclusive: boolean;
+        readonly effect: string | null;
+    }[];
+    readonly activeSkills: readonly string[] | null;
+    readonly guardrails: readonly {
+        readonly name: string;
+        readonly stage: GuardrailStage;
+        readonly revision: string | null;
+    }[];
+    readonly loop: {
+        readonly strategy: string;
+        readonly revision: string | null;
+    };
+    readonly thinkingLevel: string | null;
+    readonly limits: Readonly<import("./contracts.js").ResolvedRunLimits>;
+    /** Host-shaped JSON as configured (`true`/`false`/options); `null` when unset. */
+    readonly attentionCompiler: unknown;
+    readonly model: {
+        readonly provider: string | null;
+        readonly model: string | null;
+    };
+    readonly requestPolicies: readonly string[];
+    /** Kinds only — never a connection string, path, or credential. */
+    readonly storage: {
+        readonly sessionStore: {
+            readonly kind: string;
+            readonly durable: boolean;
+        };
+        readonly checkpoints: {
+            readonly kind: string;
+            readonly durable: boolean;
+        };
+        readonly effectStore: {
+            readonly kind: string;
+            readonly durable: boolean;
+        };
+        readonly memory: {
+            readonly kind: string;
+            readonly durable: boolean;
+        };
+    };
+}
+export interface RunBundleSnapshotInput {
+    readonly agent: Agent;
+    /** Session-level inputs (store, leaf, cache TTL) that change what the run reads and writes. */
+    readonly config?: AgentSessionConfig;
+    readonly run?: RunOptions;
+    /** Optional memory store instance; only its kind/durability label is read, never its contents. */
+    readonly memory?: unknown;
+}
+/**
+ * Snapshots the effective run bundle: synchronous, in-memory, zero network and zero store reads.
+ * The counterpart of `agentFingerprint` for humans — same inputs, named fields, one stable digest to pin.
+ */
+export declare function snapshotRunBundle(input: RunBundleSnapshotInput): RunBundleSnapshot;

package/dist/run-bundle.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { agentFingerprint, BUILT_IN_LOOP_REVISIONS } from "./agent-run-state.js";
+import { describeStorage } from "./host-composition.js";
+import { canonicalizeJsonSchema } from "./providers/schema.js";
+import { resolveRunLimits } from "./run-limits.js";
+import { selectRunTools } from "./tools.js";
+/** Report format revision. Any shape change bumps this so pinned digests cannot compare across formats. */
+export const RUN_BUNDLE_SCHEMA_VERSION = 1;
+/** Bounded by construction; a bundle larger than this is a host bug, not a snapshot to retain. */
+const MAX_RUN_BUNDLE_BYTES = 512 * 1024;
+/**
+ * Snapshots the effective run bundle: synchronous, in-memory, zero network and zero store reads.
+ * The counterpart of `agentFingerprint` for humans — same inputs, named fields, one stable digest to pin.
+ */
+export function snapshotRunBundle(input) {
+    const config = input.agent.config;
+    const run = input.run;
+    const redactor = run?.redactor ?? config.redactor;
+    const definitionRevision = run?.runState?.definitionRevision ?? config.runState?.definitionRevision ?? null;
+    const tools = selectRunTools(listTools(config.tools), run?.toolNames).tools;
+    const skills = listSkills(config.skills, run?.skills);
+    const model = run?.model ?? config.model;
+    const effectiveLoop = run?.loop ?? config.loop;
+    const systemPrompt = run?.systemPrompt ?? config.systemPrompt;
+    const policies = run?.providerRequestPolicies ?? config.providerRequestPolicies;
+    const snapshot = {
+        schemaVersion: RUN_BUNDLE_SCHEMA_VERSION,
+        fingerprint: agentFingerprint(input.agent, definitionRevision ?? ""),
+        agent: { id: agentId(input.agent), definitionRevision },
+        systemPrompt: {
+            disabled: systemPrompt === false,
+            instructionsDigest: hashText(config.instructions),
+            contributions: systemPrompt === false || systemPrompt === undefined
+                ? []
+                : (Array.isArray(systemPrompt) ? systemPrompt : [systemPrompt]).map((contribution) => ({
+                    id: contribution.id,
+                    mode: contribution.mode ?? null,
+                    source: contribution.source ?? null,
+                    digest: hashText(contribution.text) ?? "",
+                })),
+        },
+        skills: skills.map((skill) => ({
+            name: skill.name,
+            instructionsDigest: hashText(skill.instructions),
+            toolNames: skill.toolNames ?? [],
+        })),
+        tools: tools.map((tool) => ({
+            name: tool.name,
+            schemaDigest: hashJson(canonicalizeJsonSchema(tool.parameters ?? { type: "object" })),
+            exclusive: tool.exclusive === true,
+            effect: tool.effect === undefined ? null : typeof tool.effect === "function" ? "classifier" : tool.effect.kind,
+        })),
+        activeSkills: run?.activeSkills ?? null,
+        guardrails: guardrailRows(config.guardrails, run?.guardrails),
+        loop: loopIdentity(effectiveLoop),
+        thinkingLevel: run?.thinkingLevel ?? config.thinkingLevel ?? null,
+        limits: resolveRunLimits(config.limits, run?.limits),
+        attentionCompiler: run?.attentionCompiler ?? config.attentionCompiler ?? null,
+        model: {
+            provider: typeof model === "string" ? (config.provider?.id ?? null) : (model?.provider ?? null),
+            model: typeof model === "string" ? model : (model?.model ?? null),
+        },
+        requestPolicies: policies === undefined ? [] : (Array.isArray(policies) ? policies : [policies]).map((policy) => policy.name),
+        storage: {
+            sessionStore: kindOf(describeStorage(input.config?.store ?? config.store, undefined)),
+            checkpoints: kindOf(describeStorage(undefined, (run?.runState ?? config.runState)?.checkpoints)),
+            effectStore: kindOf(describeStorage(run?.effectStore ?? config.effectStore, undefined)),
+            memory: kindOf(describeStorage(input.memory, undefined)),
+        },
+    };
+    const redacted = redactStrings(snapshot, redactor);
+    const bundle = deepFreeze({ ...redacted, digest: hashJson(canonicalizeJsonSchema(redacted)) });
+    const bytes = Buffer.byteLength(JSON.stringify(bundle), "utf8");
+    if (bytes > MAX_RUN_BUNDLE_BYTES) {
+        throw new TypeError(`Run bundle snapshot exceeds ${MAX_RUN_BUNDLE_BYTES} bytes`);
+    }
+    return bundle;
+}
+/** Keeps a store label a label: a declared `kind` that is really a connection string or path becomes `custom`. */
+function kindOf(described) {
+    const raw = described.kind.toLowerCase();
+    return { kind: /^[a-z0-9_.-]{1,64}$/.test(raw) ? raw : "custom", durable: described.durable };
+}
+function agentId(agent) {
+    return agent.config.id ?? agent.config.name ?? "agent";
+}
+function listTools(tools) {
+    if (!tools)
+        return [];
+    return "list" in tools ? tools.list() : tools;
+}
+function listSkills(skills, runSkills) {
+    const listed = !skills ? [] : "list" in skills ? skills.list() : skills;
+    const byName = new Map(listed.map((skill) => [skill.name, skill]));
+    for (const skill of runSkills ?? [])
+        byName.set(skill.name, skill);
+    return [...byName.values()];
+}
+function guardrailRows(configGuardrails, runGuardrails) {
+    const rows = [];
+    for (const guardrails of [configGuardrails, runGuardrails]) {
+        if (!guardrails)
+            continue;
+        for (const stage of ["input", "output", "tool_input", "tool_output"]) {
+            const key = stage === "tool_input" ? "toolInput" : stage === "tool_output" ? "toolOutput" : stage;
+            for (const guardrail of guardrails[key] ?? []) {
+                rows.push({ name: guardrail.name, stage, revision: guardrail.revision ?? null });
+            }
+        }
+    }
+    return rows;
+}
+function loopIdentity(loop) {
+    if (typeof loop === "object" && loop && "strategy" in loop) {
+        return { strategy: loop.strategy, revision: BUILT_IN_LOOP_REVISIONS[loop.strategy] ?? null };
+    }
+    return {
+        strategy: loop?.name ?? "single-shot",
+        revision: loop?.revision ?? BUILT_IN_LOOP_REVISIONS["single-shot"] ?? null,
+    };
+}
+/** `sha256:<64 hex>` over UTF-8 text — the same convention as `hashPromptBody` in `@arnilo/prism-core`. */
+function hashText(text) {
+    if (text === undefined)
+        return null;
+    return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function hashJson(value) {
+    return `sha256:${createHash("sha256").update(JSON.stringify(value), "utf8").digest("hex")}`;
+}
+/** Redacts every string field so a pinned snapshot can never carry a secret. */
+function redactStrings(value, redactor) {
+    if (typeof value === "string")
+        return redactor ? redactor.redact(value) : value;
+    if (!value || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => redactStrings(item, redactor));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactStrings(item, redactor)]));
+}
+function deepFreeze(value) {
+    if (value && typeof value === "object" && !Object.isFrozen(value)) {
+        Object.freeze(value);
+        for (const item of Object.values(value))
+            deepFreeze(item);
+    }
+    return value;
+}
+//# sourceMappingURL=run-bundle.js.map

package/dist/secure-agent.d.ts

@@ -1,3 +1,5 @@
 import type { Agent, SecureAgentOptions } from "./contracts.js";
+import { assertHostCompositionReadiness, HostCompositionError, type HostCompositionGovernance, type HostCompositionOptions, type HostCompositionProfile, type HostCompositionReport, type HostCompositionToolReport, inspectHostComposition } from "./host-composition.js";
+export { assertHostCompositionReadiness, HostCompositionError, type HostCompositionGovernance, type HostCompositionOptions, type HostCompositionProfile, type HostCompositionReport, type HostCompositionToolReport, inspectHostComposition, };
 /** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
 export declare function createSecureAgent(options: SecureAgentOptions): Agent;

package/dist/secure-agent.js

@@ -1,8 +1,10 @@
 import { validateRunStateOptions } from "./agent-run-state.js";
 import { createAgent } from "./agents.js";
+import { assertHostCompositionReadiness, HostCompositionError, inspectHostComposition, } from "./host-composition.js";
 import { assertIdentityActive, assertIdentityMatchesOwnership } from "./identity.js";
 import { resolveRunLimits } from "./run-limits.js";
 import { createToolParameterValidator, createToolRegistry } from "./tools.js";
+export { assertHostCompositionReadiness, HostCompositionError, inspectHostComposition, };
 /** Build an opt-in agent whose security-critical defaults cannot be replaced per run. */
 export function createSecureAgent(options) {
     if (!options.id.trim())
@@ -32,6 +34,9 @@ export function createSecureAgent(options) {
         assertIdentityActive(options.identity);
         assertIdentityMatchesOwnership(options.identity, options.ownership);
     }
+    if (options.composition) {
+        assertHostCompositionReadiness({ ...options.composition, agent: options });
+    }
     const runState = Object.freeze({ ...options.runState, definitionRevision: options.definitionRevision, interruptBeforeTool: true });
     validateRunStateOptions(runState);
     const config = Object.freeze({
@@ -52,7 +57,7 @@ export function createSecureAgent(options) {
     return createAgent(config);
 }
 function withoutSecureFields(options) {
-    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, identity: _identity, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, ...config } = options;
+    const { tools: _tools, toolArgumentValidator: _validator, redactor: _redactor, permission: _permission, trust: _trust, ownership: _ownership, identity: _identity, limits: _limits, guardrails: _guardrails, definitionRevision: _revision, runState: _runState, composition: _composition, ...config } = options;
     return config;
 }
 function freezeGuardrails(guardrails) {

package/dist/testing/state-concurrency-conformance.js

@@ -68,7 +68,11 @@ async function checkpointCasProbe(checkpoints) {
     const loaded = await checkpoints.loadCheckpoint(key);
     assert.equal(loaded?.version, 4, "winning version must persist");
     assert.equal(loaded?.fencingToken, 6, "winning fence must persist");
-    await assertRejects(() => checkpoints.loadCheckpoint({ ...key, tenantId: "tenant-b" }), /ownership|tenant/i, "foreign checkpoint access must fail closed");
+    const foreign = await checkpoints.loadCheckpoint({ ...key, tenantId: "tenant-b" });
+    assert.equal(foreign, null, "a foreign checkpoint lands as a miss, not an ownership-shaped existence oracle");
+    await assertRejectsCode(() => checkpoints.saveCheckpoint({ ...key, tenantId: "tenant-b", version: 99, expectedVersion: 0, value: { evil: true } }), "ERR_PRISM_CHECKPOINT_CONFLICT", "a foreign checkpoint save must fail closed as a CAS conflict");
+    const intact = await checkpoints.loadCheckpoint(key);
+    assert.equal(intact?.version, 4, "a foreign writer must not disturb the owner's record");
 }
 /**
  * Approval determinism: concurrent approve/deny of the same pending decision
@@ -334,15 +338,4 @@ async function assertRejectsCode(action, code, message) {
     }
     throw new Error(`${message}; expected a rejection with code ${code}`);
 }
-async function assertRejects(action, pattern, message) {
-    try {
-        await action();
-    }
-    catch (error) {
-        if (pattern.test(String(error)))
-            return;
-        throw new Error(`${message}; rejection did not match ${pattern}: ${String(error)}`);
-    }
-    throw new Error(`${message}; expected a rejection matching ${pattern}`);
-}
 //# sourceMappingURL=state-concurrency-conformance.js.map

package/dist/tool-result-fold.d.ts

@@ -38,3 +38,15 @@ export declare function foldToolResultHistory(history: readonly Message[], optio
 export declare function foldToolResults(results: readonly ToolResult[], options: ResolvedToolResultFoldOptions, context: FoldToolResultsContext): Promise<readonly ToolResult[]>;
 export declare function formatFoldedToolResult(summary: string): string;
 export declare function foldedToolResultHeader(toolName: string, toolCallId: string, summary: string): string;
+/** Text the fold summarizes for one tool result: the payload JSON, then any text blocks.
+ *  Shared with the attention compiler so both hash/summarize the same bytes. */
+export declare function toolResultFoldText(result: unknown, error: unknown, extra?: readonly {
+    readonly type: string;
+}[]): string;
+/** UTF-8 cap that never splits a multi-byte character. Shared with the attention
+ *  compiler's host-summarize path so both cap host text identically. */
+export declare function capToolResultSummary(summary: string, maxBytes: number): string;
+/** Provider turn per history index: assistant messages advance the turn, tool rows use
+ *  their `prismToolResultTurn` stamp when present and the last assistant turn otherwise.
+ *  Shared with the attention compiler so age gates match the fold exactly. */
+export declare function inferToolResultTurns(history: readonly Message[]): readonly number[];