@arnilo/prism 0.0.96 → 0.1.0

package/docs/work-connectors.md

@@ -0,0 +1,32 @@
+# Work connectors
+
+Least-privilege Microsoft 365 and Google Workspace connectors live in `@arnilo/prism-work-tools`.
+
+## Principles
+
+1. **Host-pinned binary** — Prism never downloads or shells an untrusted CLI path.
+2. **Hard-coded argv templates** — models choose typed tool args; they never supply command strings.
+3. **Draft-then-approve** — mutations create a draft; side effects run only after host approval.
+4. **Idempotent retries** — `IdempotencyStore` keyed by identity + operation key.
+5. **Isolated config** — per-identity `configDir` (CLI `HOME`); no credential argv.
+6. **Shared result shapes** — mail/calendar/file/task list/get tools normalize onto `WorkMailMessage` / `WorkCalendarEvent` / `WorkFileItem` / `WorkTaskItem` without hiding provider-specific ops.
+
+## Microsoft 365
+
+See [Work tools](work-tools.md). Adapter: `createMicrosoft365CliAdapter` / subpath `@arnilo/prism-work-tools/microsoft365`.
+
+Uses [@pnp/cli-microsoft365](https://pnp.github.io/cli-microsoft365/) commands such as `outlook message list|get`, `outlook mail send`, `outlook event list|add`, `file list|add`, `spo file sharinglink add`. To Do / Planner / Teams remain capability-gated.
+
+## Google Workspace
+
+See [Work tools](work-tools.md). Adapter: `createGoogleWorkspaceCliAdapter` / subpath `@arnilo/prism-work-tools/google-workspace`.
+
+Uses [`@googleworkspace/cli` (`gws`)](https://github.com/googleworkspace/cli): `gmail users messages list|get`, `gmail +send`, `calendar events list|insert`, `drive files list|create`, `drive permissions create`, `tasks tasks *`. Docs/Sheets/Slides create remain capability-gated. Discovery `schema` and `auth`/`login`/`setup` are forbidden from Prism argv.
+
+## Scoped OAuth establishment (0.0.14)
+
+Hosts establish, refresh, and revoke scoped OAuth credentials for these workloads through the existing `OAuthProvider` / credential-store seams (`@arnilo/prism-credentials-node`): `createMicrosoft365OAuthProvider` / `createGoogleWorkspaceOAuthProvider` (PKCE + device code), least-privilege scope bundles per capability (`resolveMicrosoft365Scopes` / `resolveGoogleWorkspaceScopes`, read vs mutation). Connectors consume a per-identity token via a late-bound `tokenProvider` injected as an env var — never argv, never model context; revocation fails closed. See [Credential storage](credential-storage.md) and [Work tools](work-tools.md).
+
+## Out of scope
+
+Local Office binaries, model-controlled CLI, generic Graph/Discovery free-form calls, tenant-admin/login/debug from Prism. **Slack/Teams chat-channel adapters are not shipped** (demand-gated until web/AG-UI usage is measured); the M365 `teams` capability op is a separate gated workload op, not a channel adapter.

package/docs/work-tools.md

@@ -0,0 +1,137 @@
+# Work tools
+
+Optional `@arnilo/prism-work-tools` package: identity-scoped Microsoft 365 and Google Workspace connectors. Host-pinned CLI binaries only; hard-coded `execFile` argv templates; draft-then-approve mutations; side-effect idempotency; shared mail/calendar/file/task result shapes.
+
+## When to use
+
+Use when agents must read or mutate tenant mail/calendar/files/tasks through the enterprise CLI the host already operates — not through model-built shell strings or generic Graph/Discovery free-form calls.
+
+## Install
+
+```bash
+npm install @arnilo/prism-work-tools
+# host separately:
+#   npm i -g @pnp/cli-microsoft365
+#   npm i -g @googleworkspace/cli
+```
+
+## API
+
+```ts
+import {
+  createWorkTools,
+  createMicrosoft365CliAdapter,
+  createGoogleWorkspaceCliAdapter,
+  createMemoryIdempotencyStore,
+} from "@arnilo/prism-work-tools";
+// or: import { createGoogleWorkspaceCliAdapter } from "@arnilo/prism-work-tools/google-workspace";
+
+const microsoft365 = createMicrosoft365CliAdapter({
+  binary: process.env.M365_BIN!,
+  configDir: `/var/prism/m365/${tenant}/${user}`,
+  identity,
+  // Optional late-bound per-identity token (0.0.14): env var only, never argv/model context.
+  // tokenProvider: createOAuthWorkTokenProvider({ provider: m365OAuth, store, envVar: "M365_ACCESSTOKEN" }),
+});
+
+const googleWorkspace = createGoogleWorkspaceCliAdapter({
+  binary: process.env.GWS_BIN!,
+  configDir: `/var/prism/gws/${tenant}/${user}`,
+  identity,
+  // allowedOps: add docs.create / sheets.create / slides.create when gated
+});
+
+const tools = createWorkTools({
+  microsoft365,
+  googleWorkspace,
+  idempotencyStore: createMemoryIdempotencyStore(),
+  approval: { isApproved: ({ draftId }) => hostHasApproved(draftId) },
+  externalRecipients: { allow: (addr) => addr.endsWith("@contoso.com") },
+});
+```
+
+List/get tools return shared `WorkPage` / `WorkMailMessage` / `WorkCalendarEvent` / `WorkFileItem` / `WorkTaskItem` shapes (`untrusted: true`) via package normalizers — provider-specific fields are not hidden; they are mapped onto the common denominator.
+
+### Hard-coded Microsoft 365 ops
+
+Verified against [CLI for Microsoft 365](https://pnp.github.io/cli-microsoft365/) (2026-07-23):
+
+| Prism op | CLI |
+| --- | --- |
+| `mail.list` | `m365 outlook message list --output json` |
+| `mail.get` | `m365 outlook message get --output json --id …` |
+| `mail.send` | `m365 outlook mail send --output json --to … --subject … --bodyContents …` |
+| `calendar.list` | `m365 outlook event list --output json` |
+| `calendar.add` | `m365 outlook event add --output json --subject … --start … --end …` |
+| `file.list` | `m365 file list --output json --webUrl … --folderUrl …` |
+| `file.add` | `m365 file add --output json --folderUrl … --filePath …` |
+| `file.share` | `m365 spo file sharinglink add` (`--scope organization` only) |
+| `todo.*` / `planner.*` | capability-gated via `allowedOps` |
+
+### Hard-coded Google Workspace ops
+
+Verified against [`@googleworkspace/cli` / `gws`](https://github.com/googleworkspace/cli) (2026-07-24):
+
+| Prism op | CLI |
+| --- | --- |
+| `mail.list` | `gws gmail users messages list --params … --fields …` |
+| `mail.get` | `gws gmail users messages get --params …` |
+| `mail.send` | `gws gmail +send --to … --subject … --body …` |
+| `calendar.list` | `gws calendar events list --params … --fields …` |
+| `calendar.add` | `gws calendar events insert --params … --json …` |
+| `file.list` | `gws drive files list --params … [--page-all]` (NDJSON when paginated) |
+| `file.add` | `gws drive files create --json … --upload …` |
+| `file.share` | `gws drive permissions create` (`type=domain\|user` only; `anyone` denied) |
+| `task.*` | `gws tasks tasks list\|insert\|patch` |
+| `docs.create` / `sheets.create` / `slides.create` | capability-gated via `allowedOps` |
+
+Startup: M365 `version --output json`; GWS `--version`. Forbidden: `login`, `setup`, `auth`, `schema`, `doctor`, `--debug`, `--verbose`, credentials in argv, anonymous share, model-supplied command strings / free-form Discovery.
+
+### Draft → approve → execute
+
+Mutation tools (`*_mail_draft_send`, `*_draft_*`) create an in-adapter draft and return `{ status: "pending_approval", draftId }` until `approval.isApproved` is true.
+
+### Durable idempotency (0.0.23)
+
+`createMemoryIdempotencyStore()` remains for tests and a single process. For production replicas, use `createPostgresEnterpriseState({ pool }).workIdempotency`. It changes the old `get`/`put` replay abstraction to explicit async state transitions:
+
+| Observable state | Meaning / host action |
+| --- | --- |
+| absent | `begin()` atomically acquires the first claim. |
+| `in_progress` | Another worker owns the claim; do not dispatch a second connector effect. |
+| `completed` | Return the bounded stored `{ draftId, resourceId? }` duplicate summary. |
+| `failed_retryable` | A later `begin()` may reclaim it within the capped attempt policy. |
+| `failed_terminal` | Do not retry; surface the bounded failure. |
+| `unknown` | External result is ambiguous; reconcile with the connector/operator through `resolveUnknown()`. Never auto-replay. |
+
+Call `begin({ identity, key, op })` **before** the external effect. After it succeeds, call `complete`, `fail`, or `markUnknown` with the returned claim token and version. The connector effect stays outside the database transaction, so this is claim-before-effect/deduplication—not exactly-once delivery. Claims default to 15 minutes (hard 60 minutes); expired claims transition to `unknown`; attempts default to 3 (hard 5). Stored rows contain no request body, token, raw provider response, or unrestricted payload.
+
+## Limits
+
+| Resource | Default / hard |
+| --- | ---: |
+| Pagination pages | 20 / 100 |
+| Items / aggregate | 50/500 ; 200/2000 |
+| Body / stdout | 256 KiB–2 MiB / 2–16 MiB |
+| Process wall time | 60 s / 10 min |
+| Concurrent CLI / identity | 2 / 8 |
+
+## Tool effects
+
+Approved mutations require core-derived `context.idempotencyKey` and a configured store (`effect: external_mutation/tool_managed`). Model-supplied idempotency keys are ignored. Ambiguous connector outcomes stay `unknown` — never auto-replayed (not exactly-once). See [tool effects](tool-effects.md).
+
+## Security
+
+- Require host-verified `AgentIdentity`; no cross-identity configDir reuse.
+- Connector tokens (0.0.14): an optional `tokenProvider` resolves a per-identity access token into an env var per call — never argv, never model context. A missing/expired/revoked/cross-identity/wrong-tenant token fails the call closed before any exec. Refresh is late-bound and single-flighted per account (no refresh storm under reconnect). Build one with `createOAuthWorkTokenProvider()` from `@arnilo/prism-credentials-node`.
+- External mail recipients fail closed unless `externalRecipients.allow` returns true.
+- Anonymous / `anyone` sharing denied.
+- CLI stdout/stderr capped; NDJSON page streams strictly parsed and page-capped; process killed on timeout/abort/overflow.
+
+## Related
+
+- [Enterprise PostgreSQL state](enterprise-postgres-state.md): durable claim/CAS store, cleanup, and operator reconciliation.
+- [Work connectors](work-connectors.md)
+- [Agent identity](agent-identity.md)
+- [Host security](host-security.md)
+- [Credential storage](credential-storage.md)

package/docs/workflows.md

@@ -18,6 +18,7 @@ Primary exports:
 | `createWorkflowCommands` | Optional `CommandDefinition[]` for direct/background/replay/status/list/cancel/resume and, when selected, schedule control |
 | `enqueueWorkflow` / `startWorkflowBackground` / `createWorkflowCoordinator` | Persist queued work and atomically claim/renew/execute it across processes using `LeaseStore` |
 | `createWorkflowSchedules` | Explicit ownership-scoped one-time/interval/host-calculated schedules over existing checkpoint/lease stores |
+| `createProactiveScheduleCapabilities` | Scoped, expiring, revocable capability tokens that enable proactive schedules; revocation stops firing fail-closed |
 
 Included through `@arnilo/prism-sdk` and `@arnilo/prism-all`; installing either profile does not start workflows. Interactive TUI is out of scope (C-012 deferred).
 
@@ -72,6 +73,8 @@ All workflow limits and runtime `concurrency` reject non-safe integers, zero, ne
 
 A function node returns `suspend({ reason, data?, resumeSchema? })` to persist `status: "suspended"`. Its next invocation receives `ctx.resume` only after an approved resume. `resumeWorkflow(workflow, { runId }, options)` validates schema/version/ownership/`definitionHash`, claims the checkpoint before node execution, and continues the suspended node. Denial persists terminal `denied` status without invoking it. Existing failed/aborted checkpoint resume remains available without a human decision.
 
+Coding-agent ask-user glue (opt-in, no Goal DB): `suspendAskUserDecision(request)` wraps `suspend` with durable question/options/`selectionMode`/`allowCustom` data + resume schema; resume with `createAskUserDecisionResumeValidator()` or `validateAskUserDecisionResume`. Goal→verify: `runCodingGoalVerify` / `createCodingGoalVerifyWorkflow` compose plan Markdown → named checks → approve suspend → bounded handoff over the same primitives (`examples/coding-goal-verify.ts`). When a workflow node wraps a durable agent run, that run's shared pending-decision batch (Task 2) is the approval authority — workflow `suspend`/`resume` stay workflow-scoped and do not mint a parallel decision store.
+
 Every node receives bounded `ctx.state`, `ctx.stateVersion`, and async `ctx.updateState(patch, { mode: "merge" | "replace" })`. Updates serialize, validate, redact, and snapshot before checkpoint save. `workflowNode({ workflow })` runs its child with the same ownership, agent/tool registries, execution policy, redactor, signal, checkpoints, and event bus; child state replaces parent state after success.
 
 `replayWorkflow(workflow, { sourceRunId, fromNodeId, runId? }, options)` requires a succeeded source/node, creates a new checkpoint, copies terminal evidence outside the selected node's downstream closure, restores selected-node pre-state, and records `{ sourceRunId, fromNodeId, rootRunId, depth }`. Source evidence is untouched. Copying any prior nested/tool approval is rejected; replay from that approval node or earlier so Phase 8 approval executes again.
@@ -80,6 +83,8 @@ Every node receives bounded `ctx.state`, `ctx.stateVersion`, and async `ctx.upda
 
 `createWorkflowSchedules({ store, leases, checkpoints, workflows, ownership, ownerId, calculators? })` is inert until its host calls `pollOnce()` or `run({ signal })`. Ownership requires `tenantId` plus `accountId` or `userId`. Methods are `create`, `get`, `list`, `pause`, `resume`, `trigger`, `delete`, `pollOnce`, and `run`. A record has one required `nextRunAt`, optional fixed `intervalMs` or registered `calculatorId` (never both), bounded input/metadata, status, version, and last-fire attribution. Manual trigger requires an idempotency key. Scheduled run IDs derive from schedule ID plus fire timestamp, so retry after enqueue-before-advance finds the same queued checkpoint instead of duplicating it. Defaults: page 100/hard 500, due claims 16/hard 256, input 256 KiB/hard 1 MiB, poll 1s, fire lease 30s.
 
+`createProactiveScheduleCapabilities({ schedules, store, ownership, ownerId, defaultTtlMs?, maxTtlMs?, onCapability? })` wraps a `WorkflowSchedules` facade in explicit user enablement. `enable({ workflowId, scope, actor, nextRunAt, intervalMs?|calculatorId?, input?, ttlMs? })` creates the schedule plus a scoped, expiring `ScheduleCapabilityToken` (default TTL 24h / hard 31d, record ≤ 16 KiB) stamped with redacted actor refs. `revoke(tokenId, actor)` marks the token revoked and pauses the underlying schedule so `pollOnce()` never fires it (fail-closed). `assertActive(tokenId)` is a fail-closed guard for manual trigger paths — it throws on missing/revoked/expired tokens. `onCapability` emits `capability_enabled` / `capability_revoked` / `capability_denied` events (redacted refs only) that hosts bridge to `@arnilo/prism-policy` for an auditable ledger. Tokens are ownership-scoped checkpoint records; no cron expression or secret is persisted.
+
 ## Outputs / response / events
 
 `runWorkflow` / `resumeWorkflow` resolve to `WorkflowRunResult`:
@@ -278,6 +283,7 @@ runRpcServer({
 - Nested workflows inherit host registries/policies and cannot inject broader tools, agents, ownership, or credentials. Nested depth is inherited; child suspension bubbles to the parent review cursor.
 - Replay source ownership/hash/status/node eligibility are checked before a new checkpoint is created. Source records are immutable, lineage is bounded, and copied approval-bearing paths are rejected.
 - Schedule services are ownership-scoped and explicitly started. Per-fire leases plus deterministic run IDs/CAS prevent duplicate enqueue across coordinators and crash retry. Host calculator IDs resolve only from the supplied map; no callback or cron expression is persisted.
+- Proactive schedules require an explicit capability grant. Revocation pauses the schedule (never fired by `pollOnce`) and `assertActive` fails closed on missing/revoked/expired tokens; enable/revoke/deny events carry redacted actor refs for the host policy ledger. Capability TTL is capped (default 24h / hard 31d) and the token record is byte-bounded (≤ 16 KiB); tokens are ownership-scoped, so foreign access fails closed rather than leaking existence.
 - Scheduler stores O(nodes + active outputs + bounded state history); ready-node work uses indegree maps, not repeated full scans.
 - Lease acquisition is atomic; opaque tokens protect renew/release; monotonically increasing fencing tokens plus checkpoint compare-and-swap prevent expired workers from committing after takeover. Node functions must honor `ctx.signal` for prompt cooperative cancellation.
 

package/docs/working-and-semantic-memory.md

@@ -23,19 +23,44 @@ Ordinary Prism sessions do not require this package or any vector backend.
 | `vectorStore` / `workingStore` | no | Defaults to in-memory adapters |
 | `schema` / `validateWorkingMemory` | no | Working-memory shape checks (JSON Schema subset or host hook) |
 | `workingMemoryTemplate` | no | `{{path}}` template for context injection |
-| `limits` | no | top-K, adjacent range, batch, payload, injected-token caps |
+| `limits` | no | top-K, adjacent range, batch, payload, injected-token, export, and rebuild caps |
 | `redactor` / `secrets` | no | Redact text/metadata before persist/inject |
+| `requireConsent` | no | Strict mode: recall/injection excludes entries lacking explicit consent |
 
-Semantic indexing:
+Semantic indexing (entries carry `MemoryConsent` source/visibility; unset defaults to `{ source: "user", scope: "thread", visible: true }`):
+
+| `MemoryConsent` field | Meaning |
+| --- | --- |
+| `source` | `"user"`, `"agent"`, or `"system"` provenance. |
+| `scope` | `"thread"`, `"profile"`, or `"user"` control scope. |
+| `visible` | `false` immediately excludes the record from recall, injection, export, and telemetry. |
+| `grantedAt` / `revokedAt` | Optional host/audit timestamps; a revocation excludes the record. |
+
+```ts
+await memory.remember({ entries: [{ id, text, metadata?, consent?, sequence? }] }, { wait?: boolean })
+```
+
+Semantic recall (honors consent/visibility at assembly time):
 
 ```ts
-await memory.remember({ entries: [{ id, text, metadata?, sequence? }] }, { wait?: boolean })
+await memory.recall(query, { topK?, messageRange?, requireConsent?, signal? })
 ```
 
-Semantic recall:
+Consent + lifecycle (real grant/correct/delete/retention on stored entries):
 
 ```ts
-await memory.recall(query, { topK?, messageRange?, signal? })
+await memory.setConsent(entryId, { visible?: boolean, source?, scope? }) // grant/revoke; no re-embed
+await memory.correct(entryId, text)                                       // re-embeds, preserves consent
+await memory.forget({ ids? })                                             // real delete (whole thread if no ids)
+await memory.applyRetention({ maxAgeDays?, maxEntries?, batchSize? })     // bounded real-delete sweep
+
+const page = await memory.exportMemory({
+  identity: { tenantId, resourceId, threadId }, // exact host-verified owner
+  cursor?, limit?, maxBytes?, maxMs?, signal?,
+}); // visible, explicitly consented, redacted records only
+
+const rebuilt = await memory.rebuildIndex({ cursor?, batchSize?, maxMs?, signal? });
+// re-embeds one page; save rebuilt.nextCursor and call again to resume
 ```
 
 ## Outputs / response / events
@@ -44,7 +69,12 @@ await memory.recall(query, { topK?, messageRange?, signal? })
 | --- | --- |
 | `updateWorking` / `getWorking` | Versioned `WorkingMemoryRecord` |
 | `remember` | `{ accepted, pending, done }` — default `wait: false` indexes asynchronously |
-| `recall` | `{ hits, adjacent }` tenant/thread scoped |
+| `recall` | `{ hits, adjacent }` tenant/thread scoped; invisible/revoked entries excluded |
+| `setConsent` / `correct` | Updated `MemoryVectorRecord` with stamped grant/revoke times |
+| `forget` | Removed count (real delete) |
+| `applyRetention` | `{ deleted, scanned }` bounded real-delete sweep |
+| `exportMemory` | `{ entries, bytes, nextCursor? }` redacted, explicitly consented, identity-bound page |
+| `rebuildIndex` | `{ rebuilt, nextCursor? }` re-embedded bounded page; caller owns resume scheduling |
 | `createContextProvider()` | Inert `ContextProvider` blocks for working and/or semantic text |
 | `createWorkingMemoryProcessor({ extract })` | Explicit host-invoked updater; never auto-runs |
 
@@ -131,6 +161,8 @@ const memory = createMemory({
 - The working-memory processor is opt-in and host-invoked; middleware is not required.
 - `createHashEmbedder()` is for tests/demos only; production hosts supply a real `Embedder`.
 - Observational memory (`@arnilo/prism-compaction-observational-memory`) remains unchanged and composable.
+- Consent is enforced at the single `recall()` gate, so both direct recall and `createContextProvider()` injection honor it; `visible: false` (or a revoked grant) keeps an entry out of prompts, events, exports, and telemetry. `setConsent`/`correct` re-upsert in place (consent change does not re-embed); `forget`/`applyRetention` are real deletes, not tombstones. Retention uses indexed oldest-first pages plus a scoped count, deleting one default-500/hard-5000 batch without reading a corpus into memory. The PostgreSQL adapter persists consent in a `consent JSONB` column added by `buildMemoryDdl`.
+- `exportMemory()` requires an exact `{ tenantId, resourceId, threadId }` identity equal to its `createMemory()` scope. It excludes legacy consent-less, invisible, and revoked records even when normal recall allows legacy entries. It returns a stable sequence cursor page, redacted before response, with defaults/hard caps of 100/200 entries, 4/32 MiB, and 10/60 seconds. `rebuildIndex()` uses the same stable cursor shape to re-embed one 32/128-record page under a 10/60-second cap; save the cursor durably to resume. Both APIs require a store implementing bounded `listByThread()`; retention also requires `countByThread()`. PostgreSQL/pgvector and the in-memory reference adapter conform; SQLite persistence stores sessions, not semantic vectors.
 - Profile bundles do not include this package yet.
 
 Shared conformance:
@@ -149,10 +181,11 @@ await runMemoryConformance(() => ({
 
 - Every write/query/delete requires `tenantId` + `resourceId`; semantic paths also require `threadId`.
 - Cross-tenant and cross-thread access is denied.
+- Revoked/invisible/non-consented memories never enter prompts, events, exports, or telemetry; `requireConsent: true` additionally drops consent-less (legacy) entries. Consent checks are O(hits) at recall, within the existing injected-token cap.
 - Configure `secrets` / `redactor` so memory text and metadata cannot persist or inject raw canaries.
 - Injected context is inert text — it cannot grant tools or permissions.
 - Hard caps: top-K ≤ 32, messageRange ≤ 4, embed batch ≤ 128, injected tokens ≤ 8000, payload/working-memory byte limits enforced.
-- Every embedding is a non-empty finite number vector. `embedBatched()`, in-memory `VectorStore` upserts/queries, and PostgreSQL/pgvector parameters reject NaN, ±Infinity, non-numbers, and wrong configured dimensions before similarity scoring or SQL. Custom adapters can call `assertFiniteVector(vector, label, expectedLength?)` at their trust boundary.
+- Every embedding is a non-empty finite number vector. `embedBatched()`, in-memory `VectorStore` upserts/queries, PostgreSQL/pgvector parameters, and export/rebuild page boundaries reject NaN, ±Infinity, non-numbers, and wrong configured dimensions before similarity scoring, SQL, response, or re-indexing. Custom adapters can call `assertFiniteVector(vector, label, expectedLength?)` at their trust boundary.
 - Default `remember()` does not block agent completion; pass `{ wait: true }` when indexing must finish first.
 - PostgreSQL live suite is gated by `PRISM_TEST_POSTGRES_URL` and requires the `vector` extension.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.0.96",
+  "version": "0.1.0",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,6 +30,10 @@
       "types": "./dist/testing/provider-conformance.d.ts",
       "default": "./dist/testing/provider-conformance.js"
     },
+    "./testing/agent-event-source-conformance": {
+      "types": "./dist/testing/agent-event-source-conformance.d.ts",
+      "default": "./dist/testing/agent-event-source-conformance.js"
+    },
     "./testing/session-store-conformance": {
       "types": "./dist/testing/session-store-conformance.d.ts",
       "default": "./dist/testing/session-store-conformance.js"
@@ -42,6 +46,10 @@
       "types": "./dist/testing/tool-conformance.d.ts",
       "default": "./dist/testing/tool-conformance.js"
     },
+    "./testing/tool-effect-store-conformance": {
+      "types": "./dist/testing/tool-effect-store-conformance.d.ts",
+      "default": "./dist/testing/tool-effect-store-conformance.js"
+    },
     "./testing/extension-conformance": {
       "types": "./dist/testing/extension-conformance.d.ts",
       "default": "./dist/testing/extension-conformance.js"
@@ -99,6 +107,7 @@
     "!dist/__tests__",
     "!dist/**/*.map",
     "docs",
+    "!docs/review-coverage-*",
     "templates",
     "CHANGELOG.md"
   ],
@@ -111,32 +120,45 @@
     "packages/credentials-node",
     "packages/mcp",
     "packages/evals",
+    "packages/workflows",
     "packages/coding-agent",
     "packages/coding-security",
-    "packages/workflows",
     "packages/memory",
     "packages/rag",
     "packages/server",
     "packages/supervisor",
     "packages/web-tools",
+    "packages/work-tools",
+    "packages/policy",
+    "packages/model-router",
+    "packages/enterprise-postgres",
     "packages/browser",
+    "packages/ag-ui",
     "packages/prism-*"
   ],
   "scripts": {
     "build:core": "tsc",
-    "build": "npm run build:core && npm run build --workspaces --if-present",
+    "clean": "rm -rf dist packages/*/dist",
+    "build": "npm run clean && npm run build:core && npm run build --workspaces --if-present",
     "typecheck": "npm run build && npm run typecheck --workspaces --if-present && tsc -p examples --noEmit",
-    "test": "npm run build && node --test dist/__tests__/*.test.js && npm run test --workspaces --if-present",
+    "test": "npm run build && node --test dist/__tests__/*.test.js && node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase11-freeze.test.mjs scripts/phase12-freeze.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs && npm run test --workspaces --if-present",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' --test-coverage-exclude='**/packages/**' --test-coverage-exclude='**/examples/**' dist/__tests__/*.test.js",
+    "lint": "biome lint .",
+    "format": "biome format --write .",
+    "format:check": "biome format .",
     "pack:dry-run": "npm pack --dry-run && npm run pack:dry-run --workspaces --if-present",
-    "test:postgres": "npm run test:postgres --workspace @arnilo/prism-session-store-postgres && npm run test:postgres --workspace @arnilo/prism-memory",
+    "test:postgres": "node scripts/require-postgres-url.mjs && npm run test:postgres --workspace @arnilo/prism-session-store-postgres && npm run test:postgres --workspace @arnilo/prism-memory && npm run test:postgres --workspace @arnilo/prism-enterprise-postgres && node --test scripts/phase7-conformance.test.mjs scripts/phase12-restart-recovery.test.mjs",
     "release:dry-run": "npm run sdk:ready",
     "release:check": "node scripts/release.mjs check",
     "release:publish": "node scripts/release.mjs publish",
-    "sdk:ready": "npm run typecheck && npm test && npm run pack:dry-run"
+    "sdk:ready": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run test:coverage && npm run pack:dry-run && npm run release:gate",
+    "release:gate": "node scripts/release.mjs gate",
+    "security:threat-suites": "node --test scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs"
   },
   "devDependencies": {
-    "typescript": "^7.0.2",
-    "@types/node": "^26.1.1"
+    "@biomejs/biome": "^2.5.5",
+    "@types/node": "^26.1.1",
+    "typescript": "^7.0.2"
   },
   "engines": {
     "node": ">=20"

package/templates/init/providers.json

@@ -72,5 +72,27 @@
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createNeuralWattProvider,\n  defineNeuralWattModel,\n} from \"@arnilo/prism-provider-neuralwatt\";",
     "providerExpression": "createNeuralWattProvider({\n    apiKey: () => process.env.NEURALWATT_API_KEY,\n  })",
     "modelExpression": "defineNeuralWattModel({\n    model: \"glm-5.2\",\n    cache: { kind: \"implicit\" },\n  })"
+  },
+  "alibaba": {
+    "id": "alibaba",
+    "packageName": "@arnilo/prism-provider-alibaba",
+    "envKey": "DASHSCOPE_API_KEY",
+    "envPlaceholder": "sk-...",
+    "modelProvider": "alibaba",
+    "modelName": "qwen-plus",
+    "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createAlibabaProvider,\n  defineAlibabaModel,\n} from \"@arnilo/prism-provider-alibaba\";",
+    "providerExpression": "createAlibabaProvider({\n    apiKey: () => process.env.DASHSCOPE_API_KEY,\n  })",
+    "modelExpression": "defineAlibabaModel({ model: \"qwen-plus\" })"
+  },
+  "ollama": {
+    "id": "ollama",
+    "packageName": "@arnilo/prism-provider-ollama",
+    "envKey": "OLLAMA_API_KEY",
+    "envPlaceholder": "your-ollama-api-key",
+    "modelProvider": "ollama",
+    "modelName": "gpt-oss:20b",
+    "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createOllamaProvider,\n  defineOllamaModel,\n} from \"@arnilo/prism-provider-ollama\";",
+    "providerExpression": "createOllamaProvider({\n    apiKey: () => process.env.OLLAMA_API_KEY,\n  })",
+    "modelExpression": "defineOllamaModel({ model: \"gpt-oss:20b\" })"
   }
 }