@arnilo/prism 0.7.0 → 0.9.0

package/dist/guardrail-packs/index.d.ts

@@ -0,0 +1,4 @@
+import type { GuardrailPackDefinition } from "./types.js";
+export declare const BUILT_IN_GUARDRAIL_PACKS: ReadonlyMap<string, GuardrailPackDefinition>;
+/** Built-in pack ids, in registry order. */
+export declare const BUILT_IN_GUARDRAIL_PACK_IDS: readonly string[];

package/dist/guardrail-packs/index.js

@@ -0,0 +1,15 @@
+/** Built-in guardrail pack registry (plan 092 Task 2). Definitions are pure data + pure factories. */
+import { codingStandardPack } from "./coding-standard.js";
+import { destructiveCommandsPack } from "./destructive-commands.js";
+import { secretsHygienePack } from "./secrets-hygiene.js";
+import { validationRespectPack } from "./validation-respect.js";
+const DEFINITIONS = [
+    codingStandardPack,
+    destructiveCommandsPack,
+    validationRespectPack,
+    secretsHygienePack,
+];
+export const BUILT_IN_GUARDRAIL_PACKS = new Map(DEFINITIONS.map((definition) => [definition.id, definition]));
+/** Built-in pack ids, in registry order. */
+export const BUILT_IN_GUARDRAIL_PACK_IDS = DEFINITIONS.map((definition) => definition.id);
+//# sourceMappingURL=index.js.map

package/dist/guardrail-packs/secrets-hygiene.d.ts

@@ -0,0 +1,3 @@
+import type { GuardrailPackDefinition } from "./types.js";
+/** Canned secret hygiene: any tool argument carrying credential-shaped material is denied. */
+export declare const secretsHygienePack: GuardrailPackDefinition;

package/dist/guardrail-packs/secrets-hygiene.js

@@ -0,0 +1,23 @@
+/**
+ * Known credential shapes, all quantifier-bounded so a hostile argument string cannot blow up the regex.
+ * Prism redaction matches exact known values only (plan 092 Task 1), so these patterns ship with the pack.
+ */
+const SECRET_PATTERN = /(?:sk-[A-Za-z0-9]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.|xox[baprs]-[A-Za-z0-9-]{10,})/;
+/** Canned secret hygiene: any tool argument carrying credential-shaped material is denied. */
+export const secretsHygienePack = {
+    id: "secrets-hygiene",
+    version: 1,
+    description: "Blocks tool calls whose arguments carry secret-shaped material (API keys, tokens, private keys).",
+    build() {
+        return {
+            rules: [
+                {
+                    id: "no-secret-material-in-arguments",
+                    pattern: SECRET_PATTERN,
+                    reason: "Tool arguments contain secret-shaped material",
+                },
+            ],
+        };
+    },
+};
+//# sourceMappingURL=secrets-hygiene.js.map

package/dist/guardrail-packs/types.d.ts

@@ -0,0 +1,16 @@
+/** Internal guardrail-pack definition types (plan 092 Task 2). Not SDK surface; hosts configure packs via `AgentSessionConfig.guardrailPacks`. */
+import type { GuardrailRule, GuardrailRuleContext } from "../contracts-core/guardrail-packs.js";
+import type { ToolResult } from "../contracts-protocol.js";
+/** What a pack's `build` returns: restrictive rules plus an optional pure result observer. */
+export interface GuardrailPackRules {
+    readonly rules: readonly GuardrailRule[];
+    /** Records tool results into pack-local state (never denies); a throw fails closed as a guardrail tripwire. */
+    readonly observe?: (state: Record<string, unknown>, result: ToolResult, context: GuardrailRuleContext) => void;
+}
+export interface GuardrailPackDefinition {
+    readonly id: string;
+    readonly version: number;
+    readonly description: string;
+    /** Pure factory: options in, rules out. No session access, no I/O. */
+    readonly build: (options: Readonly<Record<string, unknown>>) => GuardrailPackRules;
+}

package/dist/guardrail-packs/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/guardrail-packs/validation-respect.d.ts

@@ -0,0 +1,3 @@
+import type { GuardrailPackDefinition } from "./types.js";
+/** Canned "respect failed validation": once a validation tool result fails, file mutations are denied until one passes. */
+export declare const validationRespectPack: GuardrailPackDefinition;

package/dist/guardrail-packs/validation-respect.js

@@ -0,0 +1,53 @@
+import { GuardrailPackError } from "./errors.js";
+const MUTATING_TOOLS = ["write", "edit", "delete", "move"];
+/** Validation-style tool names. `shell` is opt-in (`validationTools`): a non-zero shell exit is a failure signal too. */
+const DEFAULT_VALIDATION_TOOLS = ["test", "run_tests", "validate", "validation", "lint", "typecheck", "check"];
+const MAX_VALIDATION_TOOLS = 16;
+/** A tool result failed when it carries an error, or reported a non-zero `exitCode` (the shell tool's shape). */
+function resultFailed(result) {
+    if (result.error !== undefined)
+        return true;
+    const value = result.value;
+    if (!value || typeof value !== "object" || !("exitCode" in value))
+        return false;
+    const exitCode = value.exitCode;
+    return typeof exitCode === "number" && exitCode !== 0;
+}
+function readValidationTools(value) {
+    if (value === undefined)
+        return DEFAULT_VALIDATION_TOOLS;
+    if (!Array.isArray(value) || value.length === 0 || value.length > MAX_VALIDATION_TOOLS) {
+        throw new GuardrailPackError(`validation-respect options.validationTools must be a non-empty string array (max ${MAX_VALIDATION_TOOLS})`);
+    }
+    return value.map((name) => {
+        if (typeof name !== "string" || !name.trim()) {
+            throw new GuardrailPackError("validation-respect options.validationTools entries must be non-empty strings");
+        }
+        return name;
+    });
+}
+/** Canned "respect failed validation": once a validation tool result fails, file mutations are denied until one passes. */
+export const validationRespectPack = {
+    id: "validation-respect",
+    version: 1,
+    description: "Denies file mutations after a failed validation tool result until a later validation passes.",
+    build(options) {
+        const validationTools = readValidationTools(options.validationTools);
+        return {
+            observe(state, result, context) {
+                if (!validationTools.includes(context.toolName))
+                    return;
+                state.validationFailed = resultFailed(result) ? context.toolName : undefined;
+            },
+            rules: [
+                {
+                    id: "no-mutation-after-failed-validation",
+                    tool: MUTATING_TOOLS,
+                    reason: "A previous validation result failed; fix it before mutating files",
+                    deny: (_args, context) => context.state.validationFailed !== undefined,
+                },
+            ],
+        };
+    },
+};
+//# sourceMappingURL=validation-respect.js.map

package/dist/guardrails.d.ts

@@ -1,6 +1,10 @@
-import type { AgentEvent, GuardrailContext, GuardrailRecord, GuardrailStage, Guardrails, GuardrailValue } from "./contracts.js";
+import type { AgentEvent, GuardrailContext, GuardrailPackRef, GuardrailRecord, GuardrailStage, Guardrails, GuardrailValue } from "./contracts.js";
+export { GuardrailPackError } from "./guardrail-packs/errors.js";
 import type { SecretRedactor } from "./redaction.js";
 export declare const MAX_GUARDRAIL_CONCURRENCY = 16;
+/** Guardrail pack compile bounds (plan 092 Task 2). All ceilings are config-shape limits, not runtime budgets. */
+export declare const MAX_GUARDRAIL_PACKS = 8;
+export declare const MAX_GUARDRAIL_PACK_RULES = 64;
 export declare class GuardrailError extends Error {
     readonly code: string;
     readonly record: GuardrailRecord;
@@ -23,3 +27,18 @@ export interface GuardrailRunResult {
 /** Evaluate one typed stage. Default is declaration-order sequential; bounded parallel mode still reports declaration order. */
 export declare function runGuardrails<S extends GuardrailStage>(options: RunGuardrailsOptions<S>): Promise<GuardrailRunResult>;
 export declare function assertGuardrailsAllowed(result: GuardrailRunResult): void;
+/** One `guardrail:<stage>` identity row of a compiled pack, for run-bundle fingerprints. */
+export interface GuardrailPackRow {
+    readonly name: string;
+    readonly stage: "tool_input" | "tool_output";
+    readonly revision: string | null;
+}
+/**
+ * Compiles `guardrailPacks` config onto the existing tool interception seams: one `tool_input`
+ * guardrail per rule (`name = pack:<pack>/<rule>`), plus one `tool_output` recorder for packs that
+ * observe results. Compiled once per session — patterns are compiled here, never per tool call.
+ * Throws `GuardrailPackError` on malformed config (fail closed); returns `undefined` when unset.
+ */
+export declare function compileGuardrailPacks(refs: readonly GuardrailPackRef[] | undefined, registry?: ReadonlyMap<string, import("./guardrail-packs/types.js").GuardrailPackDefinition>): Guardrails | undefined;
+/** Stable identity rows for the same config `compileGuardrailPacks` accepts (no state, no guardrails built). */
+export declare function describeGuardrailPacks(refs: readonly GuardrailPackRef[] | undefined, registry?: ReadonlyMap<string, import("./guardrail-packs/types.js").GuardrailPackDefinition>): readonly GuardrailPackRow[];

package/dist/guardrails.js

@@ -1,6 +1,22 @@
+import { GuardrailPackError } from "./guardrail-packs/errors.js";
+export { GuardrailPackError } from "./guardrail-packs/errors.js";
+import { BUILT_IN_GUARDRAIL_PACKS } from "./guardrail-packs/index.js";
 export const MAX_GUARDRAIL_CONCURRENCY = 16;
 const MAX_REASON_BYTES = 4 * 1024;
 const MAX_METADATA_BYTES = 16 * 1024;
+/** Guardrail pack compile bounds (plan 092 Task 2). All ceilings are config-shape limits, not runtime budgets. */
+export const MAX_GUARDRAIL_PACKS = 8;
+export const MAX_GUARDRAIL_PACK_RULES = 64;
+const MAX_PACK_ID_BYTES = 96;
+const MAX_RULE_ID_BYTES = 96;
+const MAX_RULE_REASON_BYTES = 512;
+const MAX_RULE_ARG_PATHS = 8;
+const MAX_PATTERN_BYTES = 4 * 1024;
+const MAX_ARG_SCAN_DEPTH = 8;
+const MAX_ARG_SCAN_STRINGS = 64;
+const MAX_ARG_STRING_BYTES = 16 * 1024;
+const MAX_PACK_NAME_BYTES = 128;
+const OBSERVE_RULE_ID = "observe";
 export class GuardrailError extends Error {
     code;
     record;
@@ -60,6 +76,258 @@ export function assertGuardrailsAllowed(result) {
     if (result.terminal)
         throw new GuardrailError(result.terminal);
 }
+/**
+ * Compiles `guardrailPacks` config onto the existing tool interception seams: one `tool_input`
+ * guardrail per rule (`name = pack:<pack>/<rule>`), plus one `tool_output` recorder for packs that
+ * observe results. Compiled once per session — patterns are compiled here, never per tool call.
+ * Throws `GuardrailPackError` on malformed config (fail closed); returns `undefined` when unset.
+ */
+export function compileGuardrailPacks(refs, registry = BUILT_IN_GUARDRAIL_PACKS) {
+    const packs = resolveGuardrailPacks(refs, registry);
+    if (packs.length === 0)
+        return undefined;
+    const toolInput = [];
+    const toolOutput = [];
+    for (const pack of packs) {
+        const state = {};
+        if (pack.observe)
+            toolOutput.push(observeGuardrail(pack, pack.observe, state));
+        for (const resolved of pack.rules)
+            toolInput.push(ruleGuardrail(pack, resolved, state));
+    }
+    return toolOutput.length > 0 ? { toolInput, toolOutput } : { toolInput };
+}
+/** Stable identity rows for the same config `compileGuardrailPacks` accepts (no state, no guardrails built). */
+export function describeGuardrailPacks(refs, registry = BUILT_IN_GUARDRAIL_PACKS) {
+    const rows = [];
+    for (const pack of resolveGuardrailPacks(refs, registry)) {
+        if (pack.observe)
+            rows.push({ name: packRuleName(pack.id, OBSERVE_RULE_ID), stage: "tool_output", revision: packRevision(pack) });
+        for (const resolved of pack.rules)
+            rows.push({ name: packRuleName(pack.id, resolved.rule.id), stage: "tool_input", revision: packRevision(pack) });
+    }
+    return rows;
+}
+function packRevision(pack) {
+    return `${pack.id}@${pack.version}`;
+}
+function packRuleName(packId, ruleId) {
+    return `pack:${packId}/${ruleId}`;
+}
+function resolveGuardrailPacks(refs, registry) {
+    if (refs === undefined)
+        return [];
+    if (!Array.isArray(refs))
+        throw new GuardrailPackError("guardrailPacks must be an array of pack ids or pack input objects");
+    if (refs.length > MAX_GUARDRAIL_PACKS)
+        throw new GuardrailPackError(`guardrailPacks accepts at most ${MAX_GUARDRAIL_PACKS} packs`);
+    const seenPacks = new Set();
+    return refs.map((ref) => {
+        const input = (typeof ref === "string" ? { id: ref } : ref) ?? {};
+        if (typeof input.id !== "string" || !input.id.trim() || byteLength(input.id) > MAX_PACK_ID_BYTES) {
+            throw new GuardrailPackError(`guardrail pack ids must be non-empty strings of at most ${MAX_PACK_ID_BYTES} bytes`);
+        }
+        if (seenPacks.has(input.id))
+            throw new GuardrailPackError(`duplicate guardrail pack id "${input.id}"`);
+        seenPacks.add(input.id);
+        if (input.version !== undefined && (!Number.isSafeInteger(input.version) || input.version < 1)) {
+            throw new GuardrailPackError(`guardrail pack "${input.id}" version must be a positive integer`);
+        }
+        const definition = registry.get(input.id);
+        if (definition === undefined && input.rules === undefined) {
+            throw new GuardrailPackError(`unknown guardrail pack "${input.id}"; known packs: ${[...registry.keys()].join(", ") || "none"}`);
+        }
+        let built;
+        if (input.rules !== undefined) {
+            if (input.options !== undefined)
+                throw new GuardrailPackError(`inline guardrail pack "${input.id}" cannot set options`);
+            built = { rules: input.rules };
+        }
+        else {
+            built = definition.build(Object.freeze({ ...input.options }));
+        }
+        if (!built || !Array.isArray(built.rules) || built.rules.length === 0) {
+            throw new GuardrailPackError(`guardrail pack "${input.id}" must declare at least one rule`);
+        }
+        if (built.rules.length > MAX_GUARDRAIL_PACK_RULES) {
+            throw new GuardrailPackError(`guardrail pack "${input.id}" accepts at most ${MAX_GUARDRAIL_PACK_RULES} rules`);
+        }
+        if (built.observe !== undefined && typeof built.observe !== "function") {
+            throw new GuardrailPackError(`guardrail pack "${input.id}" observe must be a function`);
+        }
+        const seenRules = new Set();
+        const rules = built.rules.map((rule) => resolveRule(input.id, rule, seenRules));
+        if (built.observe && byteLength(packRuleName(input.id, OBSERVE_RULE_ID)) > MAX_PACK_NAME_BYTES) {
+            throw new GuardrailPackError(`guardrail pack "${input.id}" name exceeds ${MAX_PACK_NAME_BYTES} bytes`);
+        }
+        return {
+            id: input.id,
+            version: input.version ?? definition?.version ?? 1,
+            rules,
+            ...(built.observe ? { observe: built.observe } : {}),
+        };
+    });
+}
+function resolveRule(packId, rule, seenRules) {
+    const where = `guardrail pack "${packId}"`;
+    if (!rule || typeof rule.id !== "string" || !rule.id.trim() || byteLength(rule.id) > MAX_RULE_ID_BYTES) {
+        throw new GuardrailPackError(`${where} rule ids must be non-empty strings of at most ${MAX_RULE_ID_BYTES} bytes`);
+    }
+    if (seenRules.has(rule.id))
+        throw new GuardrailPackError(`${where} has a duplicate rule id "${rule.id}"`);
+    seenRules.add(rule.id);
+    const action = rule.action ?? "deny";
+    if (action !== "deny" && action !== "tripwire") {
+        throw new GuardrailPackError(`${where} rule "${rule.id}" action must be "deny" or "tripwire" ("ask" has no deterministic seam)`);
+    }
+    const hasPattern = rule.pattern !== undefined;
+    const hasDeny = rule.deny !== undefined;
+    if (hasPattern === hasDeny) {
+        throw new GuardrailPackError(`${where} rule "${rule.id}" requires exactly one of "pattern" or "deny"`);
+    }
+    if (hasDeny && typeof rule.deny !== "function")
+        throw new GuardrailPackError(`${where} rule "${rule.id}" deny must be a function`);
+    if (rule.reason !== undefined && (typeof rule.reason !== "string" || byteLength(rule.reason) > MAX_RULE_REASON_BYTES)) {
+        throw new GuardrailPackError(`${where} rule "${rule.id}" reason must be a string of at most ${MAX_RULE_REASON_BYTES} bytes`);
+    }
+    let tools;
+    if (rule.tool !== undefined) {
+        tools = typeof rule.tool === "string" ? [rule.tool] : [...rule.tool];
+        if (tools.length === 0 || tools.length > MAX_GUARDRAIL_PACK_RULES || tools.some((name) => typeof name !== "string" || !name.trim())) {
+            throw new GuardrailPackError(`${where} rule "${rule.id}" tool must be a non-empty tool name or array of names`);
+        }
+    }
+    if (rule.argPath !== undefined) {
+        const paths = typeof rule.argPath === "string" ? [rule.argPath] : [...rule.argPath];
+        if (paths.length === 0 || paths.length > MAX_RULE_ARG_PATHS || paths.some((path) => typeof path !== "string" || !path.trim())) {
+            throw new GuardrailPackError(`${where} rule "${rule.id}" argPath must be a non-empty dot path or array of paths`);
+        }
+    }
+    if (byteLength(packRuleName(packId, rule.id)) > MAX_PACK_NAME_BYTES) {
+        throw new GuardrailPackError(`${where} rule "${rule.id}" name exceeds ${MAX_PACK_NAME_BYTES} bytes`);
+    }
+    return {
+        rule,
+        action,
+        reason: rule.reason ?? `guardrail pack rule ${packId}/${rule.id}`,
+        ...(tools ? { tools } : {}),
+        ...(hasPattern ? { regex: compileRulePattern(packId, rule.id, rule.pattern) } : {}),
+    };
+}
+function compileRulePattern(packId, ruleId, pattern) {
+    const where = `guardrail pack "${packId}" rule "${ruleId}"`;
+    if (pattern instanceof RegExp)
+        return new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
+    if (typeof pattern !== "string" || !pattern)
+        throw new GuardrailPackError(`${where} pattern must be a non-empty string or RegExp`);
+    if (byteLength(pattern) > MAX_PATTERN_BYTES)
+        throw new GuardrailPackError(`${where} pattern exceeds ${MAX_PATTERN_BYTES} bytes`);
+    try {
+        return new RegExp(pattern);
+    }
+    catch (error) {
+        throw new GuardrailPackError(`${where} has an invalid pattern`, { cause: error });
+    }
+}
+function ruleGuardrail(pack, resolved, state) {
+    return {
+        name: packRuleName(pack.id, resolved.rule.id),
+        revision: packRevision(pack),
+        stage: "tool_input",
+        evaluate(context) {
+            if (resolved.tools && !resolved.tools.includes(context.toolName ?? ""))
+                return { action: "allow" };
+            const args = context.value.arguments;
+            const matched = resolved.rule.deny
+                ? Boolean(resolved.rule.deny(args, ruleContext(context, state)))
+                : patternMatches(resolved.regex, argumentStrings(args, resolved.rule.argPath));
+            if (!matched)
+                return { action: "allow" };
+            return {
+                // Pack vocabulary is `deny`; the core guardrail action for a denial is `block`.
+                action: resolved.action === "deny" ? "block" : "tripwire",
+                reason: resolved.reason,
+                metadata: { pack: pack.id, rule: resolved.rule.id, version: pack.version },
+            };
+        },
+    };
+}
+function observeGuardrail(pack, observe, state) {
+    return {
+        name: packRuleName(pack.id, OBSERVE_RULE_ID),
+        revision: packRevision(pack),
+        stage: "tool_output",
+        evaluate(context) {
+            observe(state, context.value, ruleContext(context, state));
+            return { action: "allow" };
+        },
+    };
+}
+function ruleContext(context, state) {
+    return {
+        toolName: context.toolName ?? "",
+        toolCallId: context.toolCallId ?? "",
+        sessionId: context.sessionId,
+        runId: context.runId,
+        metadata: context.metadata,
+        state,
+    };
+}
+function patternMatches(regex, values) {
+    for (const value of values) {
+        if (regex.test(value.length > MAX_ARG_STRING_BYTES ? value.slice(0, MAX_ARG_STRING_BYTES) : value))
+            return true;
+    }
+    return false;
+}
+function argumentStrings(args, argPath) {
+    if (argPath === undefined) {
+        const all = [];
+        for (const value of Object.values(args))
+            pushStrings(value, all, 0);
+        return all;
+    }
+    const out = [];
+    for (const path of typeof argPath === "string" ? [argPath] : argPath) {
+        walkPath(args, path.split("."), out);
+        if (out.length >= MAX_ARG_SCAN_STRINGS)
+            break;
+    }
+    return out;
+}
+function walkPath(value, segments, out) {
+    if (out.length >= MAX_ARG_SCAN_STRINGS)
+        return;
+    if (segments.length === 0) {
+        pushStrings(value, out, 0);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            walkPath(item, segments, out);
+        return;
+    }
+    if (value && typeof value === "object") {
+        walkPath(value[segments[0]], segments.slice(1), out);
+    }
+}
+function pushStrings(value, out, depth) {
+    if (out.length >= MAX_ARG_SCAN_STRINGS || depth > MAX_ARG_SCAN_DEPTH)
+        return;
+    if (typeof value === "string") {
+        out.push(value);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            pushStrings(item, out, depth + 1);
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const item of Object.values(value))
+            pushStrings(item, out, depth + 1);
+    }
+}
 function stageGuards(guardrails, stage) {
     if (!guardrails)
         return [];

package/dist/host-composition.d.ts

@@ -24,6 +24,10 @@ export interface HostCompositionOptions {
     readonly workspaceRoot?: string;
     readonly sandboxRoots?: readonly string[];
     readonly credentialRefs?: readonly string[];
+    readonly connectedApps?: {
+        readonly appIds: readonly string[];
+        readonly serverIds: readonly string[];
+    };
     readonly governance?: HostCompositionGovernance;
     readonly redactor?: SecretRedactor;
     /** Explicit opt-in for live network checks; inert by default. */
@@ -38,6 +42,10 @@ export interface HostCompositionReport {
     readonly profile: "personal" | "business";
     readonly effectiveTools: readonly HostCompositionToolReport[];
     readonly credentialReferences: readonly string[];
+    readonly connectedApps?: {
+        readonly appIds: readonly string[];
+        readonly serverIds: readonly string[];
+    };
     readonly ownership: {
         readonly tenantId?: string;
         readonly accountId?: string;
@@ -66,6 +74,11 @@ export interface HostCompositionReport {
         readonly warnings: readonly string[];
     };
 }
+/** Classifies a store by declared kind/durability and constructor name — never reads contents or connection strings (plan 084 Task 4 reuses it for run-bundle snapshots). */
+export declare function describeStorage(store: unknown, checkpoints: unknown): {
+    kind: string;
+    durable: boolean;
+};
 /**
  * Inspects a host composition in an inert, bounded, and secret-redacting manner.
  * Performs zero network calls by default.

package/dist/host-composition.js

@@ -56,11 +56,37 @@ function sanitizeCredentialRefs(refs = [], redactor) {
     }
     return Object.freeze(sanitized);
 }
+const HARD_MAX_CONNECTED_APPS = 32;
+const MAX_CONNECTED_APP_IDENTIFIER_BYTES = 128;
+function copyConnectedApps(value) {
+    if (value === undefined)
+        return undefined;
+    if (!value || typeof value !== "object")
+        throw new HostCompositionError("Connected apps must provide identifier arrays");
+    return Object.freeze({
+        appIds: copyConnectedAppIdentifiers(value.appIds, "appIds"),
+        serverIds: copyConnectedAppIdentifiers(value.serverIds, "serverIds"),
+    });
+}
+function copyConnectedAppIdentifiers(value, name) {
+    if (!Array.isArray(value) || value.length > HARD_MAX_CONNECTED_APPS) {
+        throw new HostCompositionError(`Connected app ${name} must contain at most ${HARD_MAX_CONNECTED_APPS} identifiers`);
+    }
+    return Object.freeze(value.map((identifier) => {
+        if (typeof identifier !== "string" ||
+            !identifier.trim() ||
+            Buffer.byteLength(identifier, "utf8") > MAX_CONNECTED_APP_IDENTIFIER_BYTES) {
+            throw new HostCompositionError(`Connected app ${name} must contain 1..${MAX_CONNECTED_APP_IDENTIFIER_BYTES} byte identifiers`);
+        }
+        return identifier;
+    }));
+}
 function isContainedPath(parent, child) {
     const rel = relative(parent, child);
     return !rel.startsWith("..") && !isAbsolute(rel);
 }
-function resolveStorage(store, checkpoints) {
+/** Classifies a store by declared kind/durability and constructor name — never reads contents or connection strings (plan 084 Task 4 reuses it for run-bundle snapshots). */
+export function describeStorage(store, checkpoints) {
     const target = store ?? checkpoints;
     if (!target || typeof target !== "object") {
         return { kind: "none", durable: false };
@@ -111,6 +137,7 @@ export function inspectHostComposition(options) {
     }));
     // 2. Credential references (identifier references only, raw values redacted)
     const credRefs = sanitizeCredentialRefs(options.credentialRefs, redactor);
+    const connectedApps = copyConnectedApps(options.connectedApps);
     // 3. Ownership
     const rawOwnership = config?.ownership;
     const ownership = {
@@ -119,7 +146,7 @@ export function inspectHostComposition(options) {
         userId: typeof rawOwnership?.userId === "string" ? rawOwnership.userId.trim() : undefined,
     };
     // 4. Storage durability
-    const storage = resolveStorage(options.store, options.checkpoints ?? config?.runState?.checkpoints);
+    const storage = describeStorage(options.store, options.checkpoints ?? config?.runState?.checkpoints);
     // 5. Sandbox capabilities
     const workspaceRoot = options.workspaceRoot;
     const sandboxRoots = options.sandboxRoots ?? [];
@@ -180,6 +207,9 @@ export function inspectHostComposition(options) {
         }
         // Verified identity verification
         const identity = config?.identity;
+        if (connectedApps !== undefined && identity?.verified !== true) {
+            errors.push("Business connected apps require a verified identity");
+        }
         if (identity) {
             if (!identity.principal?.id || !identity.tenantId) {
                 errors.push("Business worker identity cannot be empty or fabricated");
@@ -219,6 +249,7 @@ export function inspectHostComposition(options) {
         profile: normalizedProfile,
         effectiveTools: Object.freeze(effectiveTools),
         credentialReferences: credRefs,
+        ...(connectedApps === undefined ? {} : { connectedApps }),
         ownership: Object.freeze(ownership),
         storage: Object.freeze(storage),
         sandbox: Object.freeze({