# `@oshun/prompt-trust`

Typed prompt-boundary rendering for model-controlled data.

The package separates branded authority fields from non-instruction trust zones.
System policy, tool authority, source scope, rights, and release law can only be
rendered as system authority. User/source/retrieval/canon/world/memory,
prior-model/critique/tool/artifact data is always fenced as non-instruction
content, even when the data is trusted context.

```ts
import {
  definePromptAuthorityField,
  recordPromptCompletion,
  renderTrustPrompt,
} from '@oshun/prompt-trust';

const rendered = renderTrustPrompt({
  authority: [
    definePromptAuthorityField({
      id: 'policy',
      kind: 'system-policy',
      text: 'Return a grounded JSON answer.',
      version: 'answer-policy.v3',
    }),
  ],
  zones: [
    {
      id: 'retrieval-1',
      label: 'RETRIEVED SOURCE',
      origin: 'retrieval',
      trust: 'untrusted',
      content: retrievedText,
      sourceRefs: [{ ref: 'document:123' }],
    },
  ],
});

const completionAudit = recordPromptCompletion(
  rendered,
  {
    provider: 'provider-name',
    providerVersion: null,
    model: 'model-id',
    modelVersion: null,
  },
  rawResponse,
  { version: 'product-privacy.v1', rawResponse: 'omit' }
);
```

Every render records the exact prompt hash, renderer version, raw and rendered
content hashes, origin/trust labels, truncation, transformations, and source
references. Literal, HTML/percent/Unicode-escaped, full-width, and base64
delimiter forms are neutralized. Raw response retention, redaction, omission,
and optional hashing are controlled by the supplied privacy policy.

Do not concatenate model-controlled text into authority field `text`, zone
labels, or around the returned prompt. Put it in a zone so the renderer can
preserve its evidence identity and enforce the prompt-size budget.