@arnilo/prism 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [0.2.1] - 2026-08-13
+
+### Changed
+- **Release 0.2.1 (plan 021)** is the provider-completion and outbound-trust-boundaries cut on the 0.2.x review-remediation line. API surface **additive-only** vs 0.2.0 (plain reviewed compat gate at 0.2.1: deltas are the version literal plus `@arnilo/prism-mcp` transport helpers re-exported from the lifted core primitives — same names/signatures, no removal; no `--allow-break`), five documented security-motivated behavior tightenings in `docs/migration.md` `0.2.0 → 0.2.1`: (1) **strict stream completion is the shared default** (`strict-completion`, core `createOpenAICompatibleProvider`) — `strictCompletion` defaults to `true` (explicit `false` stays the documented opt-out): a stream ending without `[DONE]` plus a choice-level `finish_reason` now fails with `ProviderTransportError` `incomplete_delta` instead of a successful `providerDone`, and done events carry usage only with completion evidence; applies to Azure, Bedrock, Vertex, OpenRouter, ZAI, NeuralWatt (Alibaba/Kimi/Ollama/OpenCode-go had already opted in). (2) **bounded success bodies** (`bounded-bodies`, core `@arnilo/prism/providers/transport`) — additive `readBoundedResponseJson` (65,536-byte UTF-8 ceiling, max JSON depth 32, max properties 4096, caller shape gate, abort, redacted errors, new `ProviderTransportError` code `response_body_shape`) replaces unbounded `response.json()` at all ten model-discovery sites plus NeuralWatt quota, Alibaba embeddings, OpenAI uploads, and both OAuth success paths. (3) **DNS-pinned OIDC/OPA/content fetch, redirects rejected** (`dns-pinning`, core `src/pinned-fetch.ts` + `@arnilo/prism-credentials-node`, `@arnilo/prism-policy`, `@arnilo/prism-mcp`) — `pinnedFetch`/`resolvePinnedAddress`/`requestPinned` lift the MCP pinning algorithm (one resolve, 1–32 bound, family check, loopback confinement, per-candidate `assertSsrfAllowedUrl`, pinned-lookup socket) into core; default JWKS, OPA decision, and content/media fetches route through it and **reject 3xx redirects outright** (`MediaContentError` code `redirect`); private/metadata/loopback answers fail closed `ssrf_denied`; MCP re-exports the lifted helpers with byte-identical behavior; egress `dns-pin.ts` deliberately NOT converged (0.3.x candidate). (4) **shared bounded OAuth device/token polling** (`oauth-consolidation`, core `src/oauth-device-code.ts`) — `pollDeviceCodeToken` serves both `@arnilo/prism-provider-openai` and `@arnilo/prism-credentials-node` device flows (RFC 8628 poll, `slow_down` +5 s, expiry deadline, cancellation, bounded reads, fail-closed token shape, `[REDACTED]` redaction); adapter fields stay plain options; behavior equivalent. (5) **edge fixes** (`edge-fixes`) — Azure/Vertex resolve rotating credentials **once per request** (inner provider re-created with the resolved token; never consumed twice); Bedrock SigV4 merges duplicate-case headers last-wins and sorts query params by encoded key then value (malformed duplicate-case signatures eliminated, single-case byte-identical); OpenAI upload cleanup retains file ids until their `DELETE` succeeds (no remote-file leak on failed cleanup); cache-telemetry `__overflow__` never carries cost (requests + token totals only). New regression surface: `scripts/phase21-security.test.mjs` (10 conformance tests over built public entrypoints covering all five items, wired into `security:threat-suites`) plus a packed plain-JS `security21.mjs` consumer in install-smoke; phase-21 freeze manifest `scripts/phase21-freeze-manifest.json` machine-checks each task's diff (preserved surface: egress dns-pin primitives, OAuth connector consumers, strictCompletion opt-in adapters, native streaming adapters). Release graph stays **50** publishable manifests (root + 49 workspace packages) at exact **0.2.1**; zero new runtime dependency names (core remains dependency-free). Store compatibility with 0.2.0: **compatible, no migration** (no persisted-shape change). Exit gate green (core + script gates incl. phase21-freeze done-phase, `sdk:ready`, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain reviewed compat gate at 0.2.1, live OIDC JWKS protected evidence + live OPA fail-closed evidence, evidence in `scripts/phase21-baseline.json`). **Publication remains the operator handoff** (`docs/release-and-install.md` `0.2.1 publish handoff` — signed `v0.2.1` tag + npm OIDC).
+
 ## [0.2.0] - 2026-08-13
 
 ### Changed

package/dist/cache-telemetry.js

@@ -72,7 +72,10 @@ export function createCacheTelemetry(options = {}) {
                 cacheReadTokens: sample.cacheReadTokens,
                 inputTokens: sample.inputTokens,
             });
-            if (model?.cost) {
+            // The __overflow__ bucket aggregates mixed provider/model tokens, so it
+            // never carries cost: one model's cost metadata must not be applied to
+            // other models' tokens. It reports requests and token totals only.
+            if (model?.cost && sample !== overflowSample) {
                 // cacheSavings depends only on read tokens + cost metadata, so the
                 // aggregate equals the sum of per-call savings; feed it the totals
                 // to reuse the exact cache-helpers math rather than reimplementing it.

package/dist/content.d.ts

@@ -104,8 +104,8 @@ export declare class UnsupportedModalityError extends Error {
     constructor(modality: ModelInputCapability, model: ModelConfig);
 }
 export declare class MediaContentError extends Error {
-    readonly code: "ambiguous_source" | "missing_source" | "item_too_large" | "request_too_large" | "too_many_items" | "audio_too_long" | "invalid_base64" | "ssrf_denied" | "fetch_failed" | "fetch_timeout" | "resource_required" | "mime_mismatch" | "unsupported_url_scheme";
-    constructor(code: MediaContentError["code"], message: string);
+    readonly code: "ambiguous_source" | "missing_source" | "item_too_large" | "request_too_large" | "too_many_items" | "audio_too_long" | "invalid_base64" | "ssrf_denied" | "redirect" | "fetch_failed" | "fetch_timeout" | "resource_required" | "mime_mismatch" | "unsupported_url_scheme";
+    constructor(code: MediaContentError["code"], message: string, options?: ErrorOptions);
 }
 export declare function contentBlockInputModality(block: ContentBlock): ModelInputCapability | undefined;
 export declare function collectMessageContentBlocks(messages: readonly Message[]): ContentBlock[];

package/dist/content.js

@@ -1,7 +1,6 @@
 import { lookup as dnsLookup } from "node:dns/promises";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
 import { isIP } from "node:net";
+import { pinnedFetch } from "./pinned-fetch.js";
 import { assertPermission } from "./security.js";
 /** Known model input capability tags for `ModelCapabilities.input`. */
 export const MODEL_INPUT_CAPABILITIES = ["text", "image", "audio", "file", "document"];
@@ -29,8 +28,8 @@ export class UnsupportedModalityError extends Error {
 }
 export class MediaContentError extends Error {
     code;
-    constructor(code, message) {
-        super(message);
+    constructor(code, message, options) {
+        super(message, options);
         this.name = "MediaContentError";
         this.code = code;
     }
@@ -310,22 +309,34 @@ async function fetchBoundedMediaUrl(url, options) {
     try {
         if (options.fetch)
             return await readFetchResponse(await options.fetch(url, { signal, redirect: "error" }), options.maxBytes);
-        const parsed = new URL(url);
-        const hostname = normalizeHostname(parsed.hostname);
-        const family = isIP(hostname);
-        const address = family
-            ? { address: hostname, family: family }
-            : await resolvePublicAddress(hostname, options.resolveHostname ?? defaultMediaHostnameResolver, signal, options.ssrf);
-        const bytes = await (options.requestUrl ?? requestPinnedMediaUrl)({
-            url: parsed,
-            address,
-            maxBytes: options.maxBytes,
-            signal,
-        });
-        if (bytes.byteLength > options.maxBytes) {
-            throw new MediaContentError("item_too_large", `Fetched media exceeded ${options.maxBytes} bytes`);
+        if (options.requestUrl) {
+            // Test/custom seam: explicit resolve + caller-provided requester. The default
+            // path below routes through the shared pinnedFetch primitive instead.
+            const parsed = new URL(url);
+            const hostname = normalizeHostname(parsed.hostname);
+            const family = isIP(hostname);
+            const address = family
+                ? { address: hostname, family: family }
+                : await resolvePublicAddress(hostname, options.resolveHostname ?? defaultMediaHostnameResolver, signal, options.ssrf);
+            const bytes = await options.requestUrl({
+                url: parsed,
+                address,
+                maxBytes: options.maxBytes,
+                signal,
+            });
+            if (bytes.byteLength > options.maxBytes) {
+                throw new MediaContentError("item_too_large", `Fetched media exceeded ${options.maxBytes} bytes`);
+            }
+            return bytes;
         }
-        return bytes;
+        // Default: one DNS-pinned, redirect-free, byte-bounded fetch (task 4).
+        const response = await pinnedFetch(new URL(url), { signal, redirect: "manual" }, {
+            errorPrefix: "Media",
+            hostnameErrorPrefix: "Media",
+            resolver: options.resolveHostname ?? defaultMediaHostnameResolver,
+            ssrf: options.ssrf,
+        });
+        return await readFetchResponse(response, options.maxBytes);
     }
     catch (error) {
         if (error instanceof MediaContentError)
@@ -411,37 +422,6 @@ async function readFetchResponse(response, maxBytes) {
     }
     return joinChunks(chunks, total);
 }
-function requestPinnedMediaUrl({ url, address, maxBytes, signal }) {
-    return new Promise((resolve, reject) => {
-        const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
-            agent: false,
-            family: address.family,
-            signal,
-            lookup: (_hostname, _options, callback) => callback(null, address.address, address.family),
-        }, (response) => readIncomingMessage(response, maxBytes).then(resolve, reject));
-        request.on("error", reject);
-        request.end();
-    });
-}
-async function readIncomingMessage(response, maxBytes) {
-    const status = response.statusCode ?? 0;
-    if (status < 200 || status >= 300) {
-        response.resume();
-        throw new MediaContentError("fetch_failed", `Media fetch failed with status ${status}`);
-    }
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of response) {
-        const bytes = typeof chunk === "string" ? new TextEncoder().encode(chunk) : new Uint8Array(chunk);
-        total += bytes.byteLength;
-        if (total > maxBytes) {
-            response.destroy();
-            throw new MediaContentError("item_too_large", `Fetched media exceeded ${maxBytes} bytes`);
-        }
-        chunks.push(bytes);
-    }
-    return joinChunks(chunks, total);
-}
 function joinChunks(chunks, total) {
     const bytes = new Uint8Array(total);
     let offset = 0;

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { resolveAgentDefinition } from "./agent-definitions.js";
+export { abortableSleep, pollDeviceCodeToken, redactOAuthError, throwIfAborted, type OAuthTokenSuccessPayload, type PollDeviceCodeTokenOptions, } from "./oauth-device-code.js";
+export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, type PinnedFetchOptions, } from "./pinned-fetch.js";
 export type { AgentEventSourceErrorCode } from "./agent-event-source.js";
 export { AgentEventSourceError, createMemoryAgentEventSource } from "./agent-event-source.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop, } from "./agent-loops.js";
@@ -107,5 +109,5 @@ export { createToolParameterValidator, createToolRegistry, dispatchToolCall, fil
 export type { ResolvedUseCaseModel, ResolveUseCaseModelInput, UseCaseModelBinding, } from "./use-case-model.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export declare const name = "prism";
-export declare const version = "0.2.0";
+export declare const version = "0.2.1";
 export declare const description = "Agent harness for AI providers, agents, sessions, and tools.";

package/dist/index.js

@@ -1,4 +1,6 @@
 export { resolveAgentDefinition } from "./agent-definitions.js";
+export { abortableSleep, pollDeviceCodeToken, redactOAuthError, throwIfAborted, } from "./oauth-device-code.js";
+export { boundResponse, defaultResolver, isLoopbackAddress, isLoopbackHostname, normalizeHostname, pinnedFetch, raceAbort, requestPinned, resolvePinnedAddress, } from "./pinned-fetch.js";
 export { AgentEventSourceError, createMemoryAgentEventSource } from "./agent-event-source.js";
 export { dispatchToolCallsInOrder, generateValidateReviseLoop, isAgentLoopOptions, resolveLoop, resolveToolConcurrency, singleShotLoop, } from "./agent-loops.js";
 export { createAgentRunLifecycle } from "./agent-run-lifecycle.js";
@@ -58,6 +60,6 @@ export { DEFAULT_TOOL_RESULT_FOLD_MAX_SUMMARY_BYTES, DEFAULT_TOOL_RESULT_FOLD_MI
 export { createToolParameterValidator, createToolRegistry, dispatchToolCall, filterTools } from "./tools.js";
 export { resolveUseCaseModel, resolveUseCaseModelBinding, useCaseCredentialProviderId, } from "./use-case-model.js";
 export const name = "prism";
-export const version = "0.2.0";
+export const version = "0.2.1";
 export const description = "Agent harness for AI providers, agents, sessions, and tools.";
 //# sourceMappingURL=index.js.map

package/dist/oauth-device-code.d.ts

@@ -0,0 +1,58 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "./contracts-core.js";
+/**
+ * Shared RFC 8628 device-code flow used by both the OpenAI Codex OAuth provider
+ * (provider-openai) and the generic OAuth 2.0 provider (credentials-node).
+ * Owns the device-code request, the poll loop (authorization_pending continue,
+ * slow_down backoff, expiry deadline), cancellation, bounded success/error
+ * body reads, secret redaction, and token-shape parsing. Adapter-specific
+ * fields are parameters/callbacks, not subclasses.
+ */
+export declare const REDACTED = "[REDACTED]";
+export declare const DEFAULT_DEVICE_POLL_INTERVAL_MS = 5000;
+export declare const SLOW_DOWN_INCREMENT_MS = 5000;
+export interface OAuthDeviceCodePayload {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly expires_in?: number;
+    readonly interval?: number;
+}
+export interface OAuthTokenSuccessPayload {
+    readonly access_token?: string;
+    readonly refresh_token?: string;
+    readonly expires_in?: number;
+    readonly account_id?: string;
+}
+export interface OAuthTokenErrorPayload {
+    readonly error?: string;
+    readonly error_description?: string;
+}
+export interface PollDeviceCodeTokenOptions {
+    readonly fetchImpl: typeof fetch;
+    readonly deviceCodeUrl: string;
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly scope?: string;
+    /** Extra token-request params merged into every poll body (e.g. client_secret, audience). Never logged. */
+    readonly extraTokenParams?: Readonly<Record<string, string>>;
+    readonly callbacks?: Pick<OAuthLoginCallbacks, "onDeviceCode" | "signal">;
+    /** Message prefix, e.g. "OpenAI" or the adapter id. */
+    readonly errorPrefix: string;
+    /** Test seam: override wall clock for device-code expiry. */
+    readonly now?: () => number;
+    /** Test seam: override poll delay between device-code token requests. */
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    /** Token-shape parsing; adapter-specific fields (e.g. accountId fallback) applied here. */
+    readonly parseTokenCredentials: (json: OAuthTokenSuccessPayload) => OAuthCredentials;
+}
+export declare function throwIfAborted(signal?: AbortSignal): void;
+export declare function abortableSleep(ms: number, signal?: AbortSignal): Promise<void>;
+export declare function redactOAuthError(error: Error, secrets: readonly (string | undefined)[]): Error;
+/**
+ * Request a device code, surface it through `onDeviceCode`, then poll the token
+ * endpoint until success, expiry, a terminal OAuth error, or abort. All response
+ * bodies are read under the shared byte ceiling; success bodies must be bounded
+ * JSON with an `access_token` string (fail closed otherwise); error bodies are
+ * bounded text parsed as JSON with a redacted-text fallback.
+ */
+export declare function pollDeviceCodeToken(options: PollDeviceCodeTokenOptions): Promise<OAuthCredentials>;

package/dist/oauth-device-code.js

@@ -0,0 +1,119 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { readBoundedResponseJson, readBoundedResponseText } from "./providers/transport.js";
+/**
+ * Shared RFC 8628 device-code flow used by both the OpenAI Codex OAuth provider
+ * (provider-openai) and the generic OAuth 2.0 provider (credentials-node).
+ * Owns the device-code request, the poll loop (authorization_pending continue,
+ * slow_down backoff, expiry deadline), cancellation, bounded success/error
+ * body reads, secret redaction, and token-shape parsing. Adapter-specific
+ * fields are parameters/callbacks, not subclasses.
+ */
+export const REDACTED = "[REDACTED]";
+export const DEFAULT_DEVICE_POLL_INTERVAL_MS = 5_000;
+export const SLOW_DOWN_INCREMENT_MS = 5_000;
+export function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new Error("OAuth login aborted");
+}
+export async function abortableSleep(ms, signal) {
+    if (ms <= 0)
+        return;
+    throwIfAborted(signal);
+    await delay(ms, undefined, { signal });
+}
+export function redactOAuthError(error, secrets) {
+    let message = error.message;
+    for (const secret of secrets) {
+        if (secret)
+            message = message.split(secret).join(REDACTED);
+    }
+    return new Error(message);
+}
+const isDeviceCodePayload = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    return (typeof candidate.device_code === "string" &&
+        candidate.device_code.length > 0 &&
+        typeof candidate.user_code === "string" &&
+        candidate.user_code.length > 0 &&
+        typeof candidate.verification_uri === "string" &&
+        candidate.verification_uri.length > 0);
+};
+const isTokenSuccessPayload = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    return typeof value.access_token === "string";
+};
+/**
+ * Request a device code, surface it through `onDeviceCode`, then poll the token
+ * endpoint until success, expiry, a terminal OAuth error, or abort. All response
+ * bodies are read under the shared byte ceiling; success bodies must be bounded
+ * JSON with an `access_token` string (fail closed otherwise); error bodies are
+ * bounded text parsed as JSON with a redacted-text fallback.
+ */
+export async function pollDeviceCodeToken(options) {
+    const { fetchImpl, deviceCodeUrl, tokenUrl, clientId, scope, extraTokenParams, callbacks, errorPrefix, parseTokenCredentials } = options;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? abortableSleep;
+    const requestBody = { client_id: clientId };
+    if (scope)
+        requestBody.scope = scope;
+    const response = await fetchImpl(deviceCodeUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(requestBody),
+        signal: callbacks?.signal,
+    });
+    if (!response.ok) {
+        const detail = await readBoundedResponseText(response);
+        throw redactOAuthError(new Error(`${errorPrefix} device code failed: ${response.status}${detail ? ` ${detail}` : ""}`), []);
+    }
+    const json = await readBoundedResponseJson(response, { shape: isDeviceCodePayload });
+    const secrets = [json.device_code, json.user_code];
+    const expiresAtMs = now() + (json.expires_in ?? 0) * 1_000;
+    await callbacks?.onDeviceCode?.({
+        userCode: json.user_code,
+        verificationUri: json.verification_uri,
+        expiresAt: json.expires_in ? new Date(expiresAtMs).toISOString() : undefined,
+    });
+    let intervalMs = Math.max(1, (json.interval ?? DEFAULT_DEVICE_POLL_INTERVAL_MS / 1_000) * 1_000);
+    while (now() < expiresAtMs) {
+        throwIfAborted(callbacks?.signal);
+        await sleep(intervalMs, callbacks?.signal);
+        throwIfAborted(callbacks?.signal);
+        const tokenResponse = await fetchImpl(tokenUrl, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                client_id: clientId,
+                device_code: json.device_code,
+                ...extraTokenParams,
+            }),
+            signal: callbacks?.signal,
+        });
+        if (tokenResponse.ok) {
+            const payload = await readBoundedResponseJson(tokenResponse, { shape: isTokenSuccessPayload });
+            return parseTokenCredentials(payload);
+        }
+        const errorText = await readBoundedResponseText(tokenResponse, { secrets });
+        let errorPayload;
+        try {
+            errorPayload = JSON.parse(errorText);
+        }
+        catch {
+            errorPayload = { error: "invalid_token_response", error_description: errorText };
+        }
+        const code = errorPayload.error ?? "unknown_error";
+        if (code === "authorization_pending")
+            continue;
+        if (code === "slow_down") {
+            intervalMs += SLOW_DOWN_INCREMENT_MS;
+            continue;
+        }
+        throw redactOAuthError(new Error(`${errorPrefix} device code login failed: ${code}${errorPayload.error_description ? ` ${errorPayload.error_description}` : ""}`), secrets);
+    }
+    throw redactOAuthError(new Error(`${errorPrefix} device code login expired before authorization completed`), secrets);
+}
+//# sourceMappingURL=oauth-device-code.js.map

package/dist/pinned-fetch.d.ts

@@ -0,0 +1,25 @@
+import { type MediaHostAddress, type MediaHostnameResolver, type SsrfPolicy } from "./content.js";
+export interface PinnedFetchOptions {
+    /** Prefix for request-level error messages ("redirects are not allowed", "response exceeds", ...). Default "Request". */
+    readonly errorPrefix?: string;
+    /** Prefix for hostname-resolution error messages. Default: `errorPrefix`. */
+    readonly hostnameErrorPrefix?: string;
+    /** Custom resolver; defaults to `node:dns/promises` lookup (all answers, verbatim). */
+    readonly resolver?: MediaHostnameResolver;
+    /** Allow loopback destinations only when the requested hostname is itself loopback AND this is true. */
+    readonly allowLoopback?: boolean;
+    /** SSRF policy applied to the URL precheck and to every resolved candidate. */
+    readonly ssrf?: SsrfPolicy;
+    /** Byte ceiling for the response stream (content-length precheck + streaming bound). */
+    readonly maxResponseBytes?: number;
+}
+/** One DNS-pinned, redirect-free, byte-bounded fetch. See module comment. */
+export declare function pinnedFetch(url: URL, init: RequestInit | undefined, options?: PinnedFetchOptions): Promise<Response>;
+export declare function resolvePinnedAddress(url: URL, resolver: MediaHostnameResolver, signal: AbortSignal | null | undefined, allowLoopback: boolean, ssrf: SsrfPolicy | undefined, hostnameErrorPrefix?: string): Promise<MediaHostAddress>;
+export declare function defaultResolver(hostname: string): Promise<readonly MediaHostAddress[]>;
+export declare function requestPinned(url: URL, address: MediaHostAddress, init: RequestInit | undefined, errorPrefix?: string): Promise<Response>;
+export declare function boundResponse(response: Response, maxBytes: number, errorPrefix?: string): Response;
+export declare function raceAbort<T>(promise: Promise<T>, signal: AbortSignal | null | undefined): Promise<T>;
+export declare function normalizeHostname(value: string): string;
+export declare function isLoopbackHostname(value: string): boolean;
+export declare function isLoopbackAddress(value: string): boolean;

package/dist/pinned-fetch.js

@@ -0,0 +1,246 @@
+/**
+ * DNS-pinned outbound fetch primitive (0.2.1 task 4).
+ *
+ * One resolve per request, bounded to 1..32 addresses, family-verified, and
+ * every candidate checked against `assertSsrfAllowedUrl` BEFORE the connect —
+ * the connect itself uses a node lookup hook that returns exactly the pinned
+ * address, so the socket cannot re-resolve (DNS-rebinding defense). Redirects
+ * are rejected outright (3xx), and the response stream is byte-bounded.
+ *
+ * Throws `MediaContentError` (`ssrf_denied` for address violations, `redirect`
+ * for 3xx). Error messages are parameterized by `errorPrefix` so each caller
+ * (MCP, OIDC, OPA, content) keeps its own taxonomy and message text.
+ *
+ * NOTE: imports from ./content.js and is imported by it (content's default
+ * media fetch routes through here) — a deliberate ESM cycle; both modules only
+ * reference the other's exports inside function bodies, never at module scope.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { assertSsrfAllowedUrl, MediaContentError } from "./content.js";
+/** One DNS-pinned, redirect-free, byte-bounded fetch. See module comment. */
+export async function pinnedFetch(url, init, options) {
+    const errorPrefix = options?.errorPrefix ?? "Request";
+    const hostnameErrorPrefix = options?.hostnameErrorPrefix ?? errorPrefix;
+    if (url.username || url.password)
+        throw new MediaContentError("ssrf_denied", `${errorPrefix} URL must not embed credentials`);
+    if (url.hash)
+        throw new MediaContentError("ssrf_denied", `${errorPrefix} URL must not contain a fragment`);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new MediaContentError("ssrf_denied", `${errorPrefix} URL must use https: (got ${url.protocol})`);
+    }
+    if (url.protocol === "http:" && !(options?.allowLoopback === true && isLoopbackHostname(url.hostname))) {
+        throw new MediaContentError("ssrf_denied", `Plaintext ${errorPrefix} is allowed only for an explicitly enabled loopback endpoint`);
+    }
+    if (!(options?.allowLoopback === true && isLoopbackHostname(url.hostname))) {
+        try {
+            assertSsrfAllowedUrl(url.href, options?.ssrf);
+        }
+        catch (error) {
+            if (error instanceof MediaContentError && error.code === "unsupported_url_scheme")
+                throw error;
+            throw new MediaContentError("ssrf_denied", `${errorPrefix} URL is not public`, { cause: error });
+        }
+    }
+    const signal = init?.signal;
+    const address = await resolvePinnedAddress(url, options?.resolver ?? defaultResolver, signal, options?.allowLoopback === true, options?.ssrf);
+    const response = await requestPinned(url, address, init, errorPrefix);
+    if (response.status >= 300 && response.status < 400) {
+        await response.body?.cancel();
+        throw new MediaContentError("redirect", `${errorPrefix} redirects are not allowed (status ${response.status})`);
+    }
+    return options?.maxResponseBytes === undefined ? response : boundResponse(response, options.maxResponseBytes, errorPrefix);
+}
+export async function resolvePinnedAddress(url, resolver, signal, allowLoopback, ssrf, hostnameErrorPrefix = "Request") {
+    signal?.throwIfAborted();
+    const hostname = normalizeHostname(url.hostname);
+    const family = isIP(hostname);
+    const addresses = family
+        ? [{ address: hostname, family: family }]
+        : await raceAbort(resolver(hostname, signal ?? new AbortController().signal), signal);
+    if (addresses.length < 1 || addresses.length > 32)
+        throw new MediaContentError("fetch_failed", `${hostnameErrorPrefix} hostname returned an invalid address count`);
+    for (const candidate of addresses) {
+        const normalized = normalizeHostname(candidate.address);
+        if (isIP(normalized) !== candidate.family)
+            throw new MediaContentError("fetch_failed", `${hostnameErrorPrefix} hostname resolver returned an invalid address`);
+        if (allowLoopback && isLoopbackHostname(hostname)) {
+            if (!isLoopbackAddress(normalized))
+                throw new MediaContentError("ssrf_denied", `${hostnameErrorPrefix} loopback hostname resolved outside loopback`);
+            continue;
+        }
+        const literal = candidate.family === 6 ? `[${normalized}]` : normalized;
+        // Fail closed on resolved candidates: an explicit hostname allow-list is honored
+        // for the URL itself, but every resolved address is still private-checked.
+        const candidatePolicy = ssrf?.allowedHostnames?.length ? { denyPrivateHosts: ssrf.denyPrivateHosts } : ssrf;
+        try {
+            assertSsrfAllowedUrl(`${url.protocol}//${literal}`, candidatePolicy);
+        }
+        catch (error) {
+            throw new MediaContentError("ssrf_denied", `${hostnameErrorPrefix} hostname resolved to a private or non-public address`, {
+                cause: error,
+            });
+        }
+    }
+    // ponytail: pin first validated address; add bounded public-address retry only if availability data requires it.
+    const selected = addresses[0];
+    return { address: normalizeHostname(selected.address), family: selected.family };
+}
+export async function defaultResolver(hostname) {
+    return dnsLookup(hostname, { all: true, verbatim: true });
+}
+export async function requestPinned(url, address, init, errorPrefix = "Request") {
+    const body = await requestBody(init?.body, errorPrefix);
+    const headers = new Headers(init?.headers);
+    const method = init?.method ?? "GET";
+    const request = url.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+        const nodeRequest = request(url, {
+            method,
+            headers: Object.fromEntries(headers.entries()),
+            signal: init?.signal ?? undefined,
+            lookup: ((_hostname, options, callback) => {
+                if (options.all)
+                    callback(null, [{ address: address.address, family: address.family }]);
+                else
+                    callback(null, address.address, address.family);
+            }),
+        }, (incoming) => {
+            const responseHeaders = new Headers();
+            for (const [name, value] of Object.entries(incoming.headers)) {
+                if (Array.isArray(value))
+                    for (const item of value)
+                        responseHeaders.append(name, item);
+                else if (value !== undefined)
+                    responseHeaders.set(name, value);
+            }
+            const noBody = method === "HEAD" || incoming.statusCode === 204 || incoming.statusCode === 304;
+            const iterator = incoming[Symbol.asyncIterator]();
+            const stream = noBody
+                ? null
+                : new ReadableStream({
+                    async pull(controller) {
+                        try {
+                            const next = await iterator.next();
+                            if (next.done)
+                                controller.close();
+                            else
+                                controller.enqueue(new Uint8Array(next.value));
+                        }
+                        catch (error) {
+                            controller.error(error);
+                        }
+                    },
+                    cancel(reason) {
+                        incoming.destroy(reason instanceof Error ? reason : undefined);
+                    },
+                });
+            resolve(new Response(stream, {
+                status: incoming.statusCode ?? 500,
+                statusText: incoming.statusMessage,
+                headers: responseHeaders,
+            }));
+        });
+        nodeRequest.on("error", reject);
+        if (body)
+            nodeRequest.end(body);
+        else
+            nodeRequest.end();
+    });
+}
+async function requestBody(body, errorPrefix) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return new TextEncoder().encode(body);
+    if (body instanceof URLSearchParams)
+        return new TextEncoder().encode(body.toString());
+    if (body instanceof ArrayBuffer)
+        return new Uint8Array(body);
+    if (ArrayBuffer.isView(body))
+        return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+    if (body instanceof Blob)
+        return new Uint8Array(await body.arrayBuffer());
+    throw new MediaContentError("ssrf_denied", `${errorPrefix} request body type is not supported by the pinned transport`);
+}
+export function boundResponse(response, maxBytes, errorPrefix = "Request") {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        void response.body?.cancel();
+        throw new MediaContentError("ssrf_denied", `${errorPrefix} response exceeds ${maxBytes} bytes`);
+    }
+    if (!response.body)
+        return response;
+    const reader = response.body.getReader();
+    let bytes = 0;
+    const body = new ReadableStream({
+        async pull(controller) {
+            try {
+                const next = await reader.read();
+                if (next.done) {
+                    reader.releaseLock();
+                    controller.close();
+                    return;
+                }
+                bytes += next.value.byteLength;
+                if (bytes > maxBytes) {
+                    await reader.cancel();
+                    reader.releaseLock();
+                    controller.error(new MediaContentError("ssrf_denied", `${errorPrefix} response exceeds ${maxBytes} bytes`));
+                    return;
+                }
+                controller.enqueue(next.value);
+            }
+            catch (error) {
+                try {
+                    reader.releaseLock();
+                }
+                catch {
+                    /* Already released after EOF/overflow. */
+                }
+                controller.error(error);
+            }
+        },
+        async cancel(reason) {
+            await reader.cancel(reason);
+            try {
+                reader.releaseLock();
+            }
+            catch {
+                /* Already released after EOF/overflow. */
+            }
+        },
+    });
+    return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}
+export async function raceAbort(promise, signal) {
+    if (!signal)
+        return promise;
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+export function normalizeHostname(value) {
+    return value
+        .toLowerCase()
+        .replace(/^\[|\]$/g, "")
+        .replace(/\.$/, "");
+}
+export function isLoopbackHostname(value) {
+    const hostname = normalizeHostname(value);
+    return hostname === "localhost" || hostname.endsWith(".localhost") || isLoopbackAddress(hostname);
+}
+export function isLoopbackAddress(value) {
+    const address = normalizeHostname(value);
+    if (address === "::1")
+        return true;
+    if (isIP(address) !== 4)
+        return false;
+    return Number(address.split(".", 1)[0]) === 127;
+}
+//# sourceMappingURL=pinned-fetch.js.map

package/dist/providers/openai-compatible.d.ts

@@ -21,7 +21,7 @@ export interface OpenAICompatibleProviderOptions {
     readonly extraHeaders?: (request: ProviderRequest) => Record<string, string>;
     /** Final body transform applied last (token limits, compat stripping). Wins over everything. */
     readonly transformBody?: (body: JsonObject, request: ProviderRequest) => JsonObject;
-    /** Require `[DONE]` and a `finish_reason` before emitting `done`; truncated streams yield an error. `done` then carries the final usage. */
+    /** Require `[DONE]` and a `finish_reason` before emitting `done`; truncated streams yield an error. `done` then carries the final usage. Default `true` (fail-closed); set `false` explicitly to accept streams that end without completion evidence. */
     readonly strictCompletion?: boolean;
     /** Emit the final stream usage on the `done` event (without strict completion checks). */
     readonly doneUsage?: boolean;
@@ -34,7 +34,7 @@ export interface OpenAICompatibleProviderOptions {
 }
 export interface OpenAIChatEventsOptions {
     readonly signal?: AbortSignal;
-    /** Require `[DONE]` and a `finish_reason`; `done` then carries the final usage. */
+    /** Require `[DONE]` and a `finish_reason`; `done` then carries the final usage. Default `true` (fail-closed); set `false` explicitly to accept streams that end without completion evidence. */
     readonly strictCompletion?: boolean;
     /** Emit the final stream usage on the `done` event. */
     readonly doneUsage?: boolean;

package/dist/providers/openai-compatible.js

@@ -72,7 +72,7 @@ export async function* openAIChatEvents(body, options = {}) {
         yield providerError(new ProviderTransportError("incomplete_delta", `Incomplete tool call delta at index ${incomplete[0]}`));
         return;
     }
-    if (options.strictCompletion && (!sawDoneMarker || !sawFinishReason)) {
+    if ((options.strictCompletion ?? true) && (!sawDoneMarker || !sawFinishReason)) {
         // Truncated streams must fail loudly — emitting done would mark partial output as succeeded.
         yield providerError(new Error(`Chat stream ended without completion evidence ` +
             `([DONE]: ${sawDoneMarker ? "received" : "missing"}, ` +
@@ -82,7 +82,7 @@ export async function* openAIChatEvents(body, options = {}) {
     for (const call of tools.values()) {
         yield providerToolCall(toolCallFromArgumentsText(call.id, call.name, call.argumentsText));
     }
-    yield providerDone(options.strictCompletion || options.doneUsage ? usage : undefined);
+    yield providerDone((options.strictCompletion ?? true) || options.doneUsage ? usage : undefined);
 }
 export function createOpenAICompatibleProvider(options) {
     const providerId = options.id ?? "openai-compatible";

package/dist/providers/transport.d.ts

@@ -14,7 +14,7 @@ export interface SseEvent {
     readonly data: string;
     readonly comments?: readonly string[];
 }
-export type ProviderTransportErrorCode = "sse_buffer_overflow" | "sse_event_overflow" | "response_body_overflow" | "aborted" | "invalid_json_arguments" | "incomplete_delta";
+export type ProviderTransportErrorCode = "sse_buffer_overflow" | "sse_event_overflow" | "response_body_overflow" | "aborted" | "invalid_json_arguments" | "incomplete_delta" | "response_body_shape";
 export declare class ProviderTransportError extends Error {
     readonly code: ProviderTransportErrorCode;
     readonly limitBytes?: number;
@@ -32,6 +32,15 @@ export interface ReadSseEventsOptions extends BoundedStreamLimits {
 export interface ReadBoundedResponseTextOptions extends BoundedStreamLimits {
     readonly secrets?: readonly (string | undefined)[];
 }
+export interface ReadBoundedResponseJsonOptions extends ReadBoundedResponseTextOptions {
+    /** Max JSON nesting depth. Default: 32. */
+    readonly maxDepth?: number;
+    /** Max object properties / array elements per container. Default: 4_096. */
+    readonly maxProperties?: number;
+    /** Caller-supplied shape gate; failure throws `response_body_shape`. */
+    readonly shape?: (value: unknown) => boolean;
+    readonly signal?: AbortSignal;
+}
 export interface ParseJsonObjectArgumentsOptions {
     readonly toolName?: string;
     readonly maxBytes?: number;
@@ -42,6 +51,10 @@ export declare function readSseEvents(body: ReadableStream<Uint8Array>, options?
 export declare function readSseData(body: ReadableStream<Uint8Array>, options?: ReadSseEventsOptions): AsyncGenerator<string>;
 /** Read a response body with a hard byte ceiling; redacts optional secrets. */
 export declare function readBoundedResponseText(response: Response, options?: ReadBoundedResponseTextOptions): Promise<string>;
+/** Read a success body with the same byte ceiling as {@link readBoundedResponseText}, then parse it as JSON
+ *  with depth/property caps and an optional caller-supplied shape gate. Malformed JSON, over-limit nesting,
+ *  or shape failure throw `ProviderTransportError` with code `response_body_shape`. */
+export declare function readBoundedResponseJson<T>(response: Response, options?: ReadBoundedResponseJsonOptions): Promise<T>;
 export type ParseJsonObjectArgumentsResult = {
     readonly ok: true;
     readonly value: JsonObject;

package/dist/providers/transport.js

@@ -218,6 +218,49 @@ export async function readBoundedResponseText(response, options) {
         }
     }
 }
+function assertJsonBounds(value, maxDepth, maxProperties, depth = 0) {
+    if (depth > maxDepth) {
+        throw new ProviderTransportError("response_body_shape", `JSON nesting exceeded ${maxDepth} levels`);
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        if (value.length > maxProperties) {
+            throw new ProviderTransportError("response_body_shape", `JSON array exceeded ${maxProperties} elements`);
+        }
+        for (const entry of value)
+            assertJsonBounds(entry, maxDepth, maxProperties, depth + 1);
+        return;
+    }
+    const keys = Object.keys(value);
+    if (keys.length > maxProperties) {
+        throw new ProviderTransportError("response_body_shape", `JSON object exceeded ${maxProperties} properties`);
+    }
+    for (const key of keys)
+        assertJsonBounds(value[key], maxDepth, maxProperties, depth + 1);
+}
+/** Read a success body with the same byte ceiling as {@link readBoundedResponseText}, then parse it as JSON
+ *  with depth/property caps and an optional caller-supplied shape gate. Malformed JSON, over-limit nesting,
+ *  or shape failure throw `ProviderTransportError` with code `response_body_shape`. */
+export async function readBoundedResponseJson(response, options) {
+    throwIfAborted(options?.signal);
+    const text = await readBoundedResponseText(response, options);
+    throwIfAborted(options?.signal);
+    const maxDepth = options?.maxDepth ?? 32;
+    const maxProperties = options?.maxProperties ?? 4_096;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new ProviderTransportError("response_body_shape", "Response body is not valid JSON");
+    }
+    assertJsonBounds(parsed, maxDepth, maxProperties);
+    if (options?.shape && !options.shape(parsed)) {
+        throw new ProviderTransportError("response_body_shape", "Response body does not match the expected shape");
+    }
+    return parsed;
+}
 /** Parse streamed tool arguments without throwing; prefer this for recoverable tool-call recovery. */
 export function tryParseJsonObjectArguments(text, options) {
     const maxBytes = options?.maxBytes ?? DEFAULT_MAX_ARGUMENT_BYTES;

package/docs/credential-storage.md

@@ -248,6 +248,7 @@ const providers = createOpenAIProviderPackage({ apiKey });
 - Never log passphrases, derived keys, or decrypted credential payloads.
 - Optional host KMS: `encryptWithHostKms` / `decryptWithHostKms` wrap a random AES-256-GCM DEK via host `HostKms.wrapKey`/`unwrapKey` (timeout ≤ 60 s). Envelope sizes reuse vault/file caps. Keys are never logged. `createMemoryHostKms` is for tests only.
 - Storage is not OAuth eligibility. A durable store may persist credentials for a provider only after the host selects a provider-authorized flow; it must not be used to piggyback on a vendor CLI or consumer subscription.
+- OIDC JWKS fetches (0.2.1) are DNS-pinned through the core `pinnedFetch` primitive: one resolve per request, every resolved address SSRF-checked before the connect (rebinding defense), redirects rejected outright, and the JWKS body read under a hard byte ceiling; oversized documents fail closed as a parse error, never as a rotatable transport failure.
 - Live keychain tests are opt-in (`PRISM_TEST_KEYCHAIN=1`); default `npm test` stays offline.
 
 ## MCP authentication boundary

package/docs/credentials-and-redaction.md

@@ -124,6 +124,7 @@ A future provider-local OAuth adapter needs published permission for third-party
 - `resolveCredentialValue()` and `createExplicitCredentialResolver()` do not cache values. Add host-side caching only if a real credential source needs it.
 - `refreshOAuthCredential()` only calls the supplied OAuth provider and optional store; it has no built-in persistence or retry loop.
 - OpenAI Codex device-code OAuth polls inside `createOpenAICodexOAuthProvider().login()` with bounded delays and abort support via `OAuthLoginCallbacks.signal`. Token-endpoint failures redact authorization codes, PKCE verifiers, device/user codes, and access/refresh tokens when those values are known.
+- The shared bounded device/token flow lives in core `pollDeviceCodeToken` (0.2.1) and is used by the OpenAI Codex provider and the credentials-node OAuth 2.0 provider (Microsoft 365 / Google Workspace). It owns the RFC 8628 device-code request and poll loop (`authorization_pending` continue, `slow_down` +5s backoff, expiry deadline, abort), reads every response body under the shared byte ceiling, parses success bodies with a fail-closed shape gate (an `access_token` string is required), and redacts device/user codes, authorization codes, PKCE verifiers, and tokens from every thrown error. Adapter-specific fields (message prefix, extra token params, account binding) are plain options, never subclasses.
 
 ## Related APIs
 

package/docs/index.md

@@ -7,7 +7,7 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 
 ## Identity and governance
 - [Agent identity](agent-identity.md): host-verified `Principal` / `AgentIdentity`, delegation narrowing, ownership projection, and redacted telemetry refs for enterprise runs/tools/MCP/A2A/workflows; optional OIDC/JWKS verifier adapter (`@arnilo/prism-credentials-node/oidc` — pinned issuer/audience/JWKS, bounded claims, fail closed).
-- [Policy and audit](policy-and-audit.md): optional `@arnilo/prism-policy` decision ledger (allow/deny/modify/approval), evidence refs only, cursor-paginated WORM export, and durable PostgreSQL composition; 0.0.28 adds the OPA REST evaluator (`@arnilo/prism-policy/opa` — pinned SSRF-checked endpoint, redacted input, fail-closed deny, optional bundle-revision pin).
+- [Policy and audit](policy-and-audit.md): optional `@arnilo/prism-policy` decision ledger (allow/deny/modify/approval), evidence refs only, cursor-paginated WORM export, and durable PostgreSQL composition; 0.0.28 adds the OPA REST evaluator (`@arnilo/prism-policy/opa` — pinned SSRF-checked endpoint, redacted input, fail-closed deny, optional bundle-revision pin); 0.2.1 makes the OPA decision fetch DNS-pinned (core `pinnedFetch`).
 - [Model routing](model-routing.md): optional `@arnilo/prism-model-router` allow-list/residency/budget/rate/circuit/fallback governance with redacted diagnostics; durable state requires awaited identity-scoped calls; host-configurable selection policies (reference cost/latency policy ranks by `ModelCost` then in-memory latency EMA fed from `recordOutcome`).
 
 ## Agent/session runtime
@@ -40,23 +40,23 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - [Persistence, credentials, and multimodality primitives](persistence-credentials-multimodality-primitives.md): Plan 056 inventory — session/run-ledger/persistence contracts, credential/OAuth seams, content/resource/model capabilities, package dependency matrix, conformance matrix, and threat model for production adapters.
 
 ## Provider and model connection
-- [Provider primitives](provider-primitives.md): shared bounded transport and OpenAI serialization helpers — migrated across first-party providers; native structured-output and observability contracts.
+- [Provider primitives](provider-primitives.md): shared bounded transport and OpenAI serialization helpers — migrated across first-party providers; bounded success-body reader for all non-stream JSON endpoints; native structured-output and observability contracts.
 - [Provider layer](provider-layer.md): register and resolve host-owned providers/models, choose replace-or-error duplicate policy, create provider events, stream/reconstruct tool-call deltas, use generic provider request options, and test with the mock provider; deprecated provider-level timeout/retry hints point to runtime abort/retry.
 - [Model registry](model-registry.md): register and resolve `ModelConfig` records with capabilities, limits, cost, cache support metadata, compat data, and duplicate policy.
-- [Provider caching](provider-caching.md): use `PromptCacheHints`, `PromptCacheBreakpoint`, `ModelCacheCapabilities`, cache-aware stable-prefix guidance, and shared cache diagnostics helpers; includes the complete per-provider explicit/implicit cache matrix plus no-Prism-cache entries (including Anthropic, Google, Alibaba, Ollama, cloud adapters, and host-owned AI SDK); cache hints are best-effort and cache keys are never secrets; `createCacheTelemetry()` aggregates per-provider/model hit rate and cache-token totals from the `usage` event stream for tuning the `cache_aware` layout.
+- [Provider caching](provider-caching.md): use `PromptCacheHints`, `PromptCacheBreakpoint`, `ModelCacheCapabilities`, cache-aware stable-prefix guidance, and shared cache diagnostics helpers; includes the complete per-provider explicit/implicit cache matrix plus no-Prism-cache entries (including Anthropic, Google, Alibaba, Ollama, cloud adapters, and host-owned AI SDK); cache hints are best-effort and cache keys are never secrets; `createCacheTelemetry()` aggregates per-provider/model hit rate and cache-token totals from the `usage` event stream for tuning the `cache_aware` layout — the `__overflow__` bucket reports requests/token totals only, never mixed-model cost.
 - [Thinking and reasoning](thinking-and-reasoning.md): portable `ThinkingLevel` helpers (`applyThinkingLevel` / `thinkingCompatFor`) map per-turn effort into provider `compat` fields; model defaults stay on `ModelConfig.compat`; no second options tree.
 - [Use-case model selection](use-case-model-selection.md): bind `{ model?, provider?, thinkingLevel? }` for observational memory, LLM compaction, and other non-session LLM jobs with explicit session-model fallback via `resolveUseCaseModel`.
 - [Provider request policies](provider-request-policies.md): chain `ProviderRequestPolicy` hooks, use `createSessionCachePolicy`, and merge legacy/structured cache options safely.
 - [Provider packages](provider-packages.md): define explicit provider packages, model metadata, auth descriptors, request/cache policies, provider-owned header precedence, the provider-authorized OAuth matrix, and the Phase 10 first-party compatibility matrix without package discovery or provider-specific core behavior; includes a cache behavior summary and **caller-gated on-demand model discovery** (`list*Models`, setup zero-fetch).
   - Phase 12 package workspaces: [`@arnilo/prism-provider-openai`](providers/openai.md) (Responses hosted-tool attribution, bounded continuation, Realtime session seam), [`@arnilo/prism-provider-anthropic`](providers/anthropic.md) (native Messages, `cache_control`, thinking, caller-gated `listAnthropicModels`), [`@arnilo/prism-provider-google`](providers/google.md) (native Gemini `generateContent` SSE, caller-gated `listGoogleModels`), [`@arnilo/prism-provider-opencode-go`](providers/opencode-go.md) (official Go open models, dual-route Anthropic/OpenAI, caller-gated `listOpenCodeGoModels`, `reasoning_content`/thinking preserve), [`@arnilo/prism-provider-openrouter`](providers/openrouter.md) (app-controlled catalog, caller-gated `listOpenRouterModels`, `reasoning` merge/preserve, `cache_control` + sticky `session_id`), [`@arnilo/prism-provider-zai`](providers/zai.md) (official `thinking`/`reasoning_effort`/`tool_stream`, implicit cache, caller-gated `listZaiModels`), [`@arnilo/prism-provider-kimi`](providers/kimi.md), [`@arnilo/prism-provider-alibaba`](providers/alibaba.md) (Alibaba Cloud Model Studio / DashScope + Coding Plan, OpenAI-compatible, caller-gated `listAlibabaModels`, implicit + explicit `cache_control` caching, Qwen `enable_thinking`), [`@arnilo/prism-provider-ollama`](providers/ollama.md) (Ollama Cloud + local, OpenAI-compatible, caller-gated `listOllamaModels`, implicit-only caching, `reasoning_effort`), and [`@arnilo/prism-provider-neuralwatt`](providers/neuralwatt.md) with implicit vLLM prefix caching, reasoning controls (`reasoning_effort`/`thinking_token_budget`/`enable_thinking`/`preserve_thinking`/`clear_thinking`), reasoning preservation, OpenAI-style tool-call loop, quota, telemetry, and retry classification helpers.
-  - Phase 8 enterprise cloud (workload identity; separate from consumer Anthropic/Google): [`@arnilo/prism-provider-azure`](providers/azure.md) (Entra / Foundry), [`@arnilo/prism-provider-bedrock`](providers/bedrock.md) (IAM/IRSA + region/PrivateLink), [`@arnilo/prism-provider-vertex`](providers/vertex.md) (ADC / Vertex OpenAPI).
+  - Phase 8 enterprise cloud (workload identity; separate from consumer Anthropic/Google): [`@arnilo/prism-provider-azure`](providers/azure.md) (Entra / Foundry, credential once per request), [`@arnilo/prism-provider-bedrock`](providers/bedrock.md) (IAM/IRSA + region/PrivateLink, duplicate-case-safe SigV4 signing), [`@arnilo/prism-provider-vertex`](providers/vertex.md) (ADC / Vertex OpenAPI, credential once per request).
   - Optional AI SDK adapter: [`@arnilo/prism-provider-ai-sdk`](providers/ai-sdk.md) maps host-owned pinned `LanguageModelV4` models onto Prism `AIProvider` streams (offline-tested `@ai-sdk/provider` version matrix; no Prism catalog; maps metadata/tool authority/`finish.usage` cache tokens; reasoning is host-model-owned).
-- [OpenAI-compatible provider](providers/openai-compatible.md): optional provider subpath using native or injected `fetch` for Chat Completions streaming (`chatCompletionsUrl` / `authStyle` overrides for enterprise adapters; `buildBodyExtra` / `mapMessages` / `mapUsage` / `extraHeaders` hooks for vendor variants).
+- [OpenAI-compatible provider](providers/openai-compatible.md): optional provider subpath using native or injected `fetch` for Chat Completions streaming (`chatCompletionsUrl` / `authStyle` overrides for enterprise adapters; `buildBodyExtra` / `mapMessages` / `mapUsage` / `extraHeaders` hooks for vendor variants; **strict completion is the shared default** — streams ending without `[DONE]` + `finish_reason` fail closed instead of emitting a successful `done`, with explicit `strictCompletion: false` as the documented opt-out).
 
 ## Input, prompt, and context assembly
 - [SDK customization guide](customization.md): map provider resolution, middleware, context, builders, injectors, loops, compaction, retry, stores, and skills to explicit host-wired APIs.
 - [Input and prompt assembly](input-and-prompt-assembly.md): render tiny prompt templates and turn common host input, history, attachments, explicit resources, summaries, and tool results into messages with replaceable builders, provider-input assembly, cache-aware default order, opt-in legacy ordering, and optional `contextBudget` eviction + omission reports. Audio/file/document `ContentBlock` types and capability checks are documented there.
-- [Multimodal content](multimodal-content.md): complete-request media resolution and aggregate bounds, DNS-classified/address-pinned URLs, SSRF/MIME policy, `ModelCapabilities.input` tags, and first-party content-type mapping.
+- [Multimodal content](multimodal-content.md): complete-request media resolution and aggregate bounds, DNS-classified/address-pinned URLs, SSRF/MIME policy, `ModelCapabilities.input` tags, and first-party content-type mapping; 0.2.1 routes media URL fetches through the core DNS-pinned fetch primitive.
 - [System prompts](system-prompts.md): compose explicit user/package/app/run system prompt layers, auto-load the standard `AGENTS.md` (workspace) / `SYSTEM.md` prompt files via the Node `loadSystemPromptFiles` loader (trust-gated for `AGENTS.md`), and append `SYSTEM.md` → per-agent `AGENT.md` body → repo `AGENTS.md` layers from a discovered agent bundle via `resolveAgentBundle`.
 - [Instruction injection](instruction-injection.md): register package injectors that layer redacted instructions/context blocks without granting tools, permissions, or resource escapes.
 - [Context and skills](context-and-skills.md): resolve ordered context providers; progressive skill catalog (`skillsDisclosure`, default catalog-only), `load_skill` on-demand bodies, fail-closed registry activation (`activateAllSkills` migration opt-in), `toolNames` fail closed before provider turns, priority-aware budget demotion, and optional `toolResultFold`.
@@ -68,7 +68,7 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - [OpenAPI tools adapter](openapi-tools.md): optional `@arnilo/prism-openapi-tools` `createOpenApiTools` — compile host-selected OpenAPI 3.1 operationIds into bounded `ToolDefinition`s (allow-list only, pinned origin, resolved/bounded schemas, approval + effect-store idempotency on mutations, bounded body/response/retries/pagination, host credential resolver, untrusted output).
 - [Tool execution primitives](tool-execution-primitives.md): finite JSON Schema LRU validation, exclusive-aware bounded parallel dispatch, MCP bridge mapping, coding execution policy, and image-read bounds.
 - [Tool validator JSON Schema package](../packages/tool-validator-json-schema/README.md): optional `@arnilo/prism-tool-validator-json-schema` adapter for `tool.parameters`.
-- [MCP client bridge and server exposure](mcp-tools.md): SDK-1.30.0 bounded tools/resources/prompts, host-owned roots/sampling/elicitation, exact-origin DNS-pinned client transport, and principal-bound opt-in Streamable HTTP sessions. 0.0.28 adds MCP OAuth: `createMcpOAuthTransport`/`createMcpOAuthFetch`/`createMcpClientAuth` (RFC 9728/8414 discovery, PKCE, RFC 8707 audience binding, RFC 7009 revocation, host-owned bounded state) and server `protectedResource` metadata + `WWW-Authenticate` challenges.
+- [MCP client bridge and server exposure](mcp-tools.md): SDK-1.30.0 bounded tools/resources/prompts, host-owned roots/sampling/elicitation, exact-origin DNS-pinned client transport, and principal-bound opt-in Streamable HTTP sessions. 0.0.28 adds MCP OAuth: `createMcpOAuthTransport`/`createMcpOAuthFetch`/`createMcpClientAuth` (RFC 9728/8414 discovery, PKCE, RFC 8707 audience binding, RFC 7009 revocation, host-owned bounded state) and server `protectedResource` metadata + `WWW-Authenticate` challenges; 0.2.1 re-routes the client transport through the shared core DNS-pinned fetch primitive.
 - [Web search, fetch, and extraction](web-tools.md): optional host-selected Brave/Exa discovery and Firecrawl Markdown/schema tools with native fetch, stable citations, late credentials, finite limits, and explicit untrusted-content boundaries.
 - [Work tools](work-tools.md): optional `@arnilo/prism-work-tools` identity-scoped M365 + GWS connectors (hard-coded CLI argv, draft-then-approve, state-machine idempotency, shared result shapes); 0.0.14 adds a late-bound per-identity `tokenProvider` (env-only, fail-closed); 0.2.0 plan 020 Task 3 provides an isolated subprocess environment (fixed allow-listed base + explicit env + late-bound token env, forced `HOME`/telemetry controls, 64-name/64-KiB caps) and requires host-pinned **absolute** binary/configDir paths.
 - [Work connectors](work-connectors.md): connector principles, capability gates, scoped OAuth establishment (0.0.14), and out-of-scope boundaries (Slack/Teams channels not shipped) for Microsoft 365 / Google Workspace.
@@ -111,8 +111,8 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 ## Security and credentials
 - [Host security guide](host-security.md): fail-closed checklist for supply-chain/attestation/canary isolation, bounded credentials, AG-UI/ACP/A2A/web remote boundaries, untrusted external content, settings, redaction, trust roots, workflow ownership, coding I/O, permissions, PostgreSQL TLS/roles/cleanup, persistence, extensions, and tool validation; **0.1.0 security evidence** (plan 012 Task 6): moderate audit policy, named threat-suites leg (`npm run security:threat-suites`), supply-chain negative fixtures, blocked-gate canary semantics.
 - [Security/auth/trust](settings-auth-trust-security.md): settings providers, credential helpers, trust/permission policies, redaction controls, host-owned settings/credentials wiring outside `AgentConfig`, and security-boundary hardening summary.
-- [Credentials and redaction](credentials-and-redaction.md): compose explicit credential resolver order, use caller-supplied env objects/OAuth refresh + revoke helpers, resolve credentials only at the provider edge, redact known secret values, and follow the provider-authorized subscription OAuth matrix.
-- [Credential storage](credential-storage.md): optional `@arnilo/prism-credentials-node` adapter with strict bounded AES-GCM envelopes, async finite scrypt, restrictive Unix files, abort-aware bounded system-keychain calls, optional host-KMS wrap (`encryptWithHostKms`), and 0.0.14 Microsoft 365 / Google Workspace OAuth providers (PKCE/device-code, least-privilege scope bundles, per-identity work-token bridge); `./oidc` subpath adds the OIDC/JWKS identity verifier.
+- [Credentials and redaction](credentials-and-redaction.md): compose explicit credential resolver order, use caller-supplied env objects/OAuth refresh + revoke helpers, resolve credentials only at the provider edge, redact known secret values, and follow the provider-authorized subscription OAuth matrix; 0.2.1 adds the shared bounded device/token flow (core `pollDeviceCodeToken`, fail-closed token shape) behind both the OpenAI Codex and OAuth 2.0 providers.
+- [Credential storage](credential-storage.md): optional `@arnilo/prism-credentials-node` adapter with strict bounded AES-GCM envelopes, async finite scrypt, restrictive Unix files, abort-aware bounded system-keychain calls, optional host-KMS wrap (`encryptWithHostKms`), and 0.0.14 Microsoft 365 / Google Workspace OAuth providers (PKCE/device-code, least-privilege scope bundles, per-identity work-token bridge); `./oidc` subpath adds the OIDC/JWKS identity verifier; 0.2.1 makes the JWKS fetch DNS-pinned (core `pinnedFetch`, redirect-free, byte-bounded).
 
 ## Testing and examples
 - Provider test doubles: `createMockProvider()` and provider event helpers are documented on the canonical Provider layer page above.
@@ -129,7 +129,7 @@ Prism is a TypeScript/Node.js agent harness. Host apps and extension packages ow
 - [Ponytail behavior integration](ponytail.md): optional `@arnilo/prism-ponytail` — upstream Ponytail skills/commands, `ponytail-mode` injector, session `ponytail-mode` persistence; resolves peer `@dietrichgebert/ponytail` or `upstreamPath`; opt-in (not in code/sdk profiles).
 
 ## Release and install
-- [Release and install](release-and-install.md): current **0.2.0** 50-package graph (root + 49 workspace packages) — plan 020 the fail-closed runtime-and-sandbox-security cut on the 0.2.x review-remediation line: durable-resume decision validation in core (`assertValidAgentRunResume` — unknown decisions/malformed batches fail closed with `ERR_PRISM_DECISION_*` before any state claim, checkpoint write, or tool execution; server parser remains defense in depth), isolated work-tool subprocess environments (`@arnilo/prism-work-tools` — fixed base allow-list + explicit env + forced HOME/telemetry + late-bound per-identity tokens, 64-name/64-KiB caps, absolute binary/configDir, linear output capture), and explicit sandbox capabilities (`@arnilo/prism-coding-security` — `SandboxAdapter.capabilities` with omission-is-false fail-closed resolution, `SandboxCodingComposition.capabilities` from verified wiring, `containmentClaim` deprecated as the conservative projection; Docker reports only verified controls, native reports filesystem/process/privilege `false`); public-entrypoint security conformance (`scripts/phase20-security.test.mjs`, wired into `security:threat-suites`), packed plain-JS consumer regressions, and the sandbox-browser workflow's fail-loud Docker/native capability evidence gate — 0.2.0 never ships while a blocker is skipped; migration and rollback notes in `docs/migration.md` `0.1.7 → 0.2.0`, store-compatible with 0.1.7 in both directions; 0.1.7 was the performance-and-DX patch — dependency-free `createCacheTelemetry()` per-provider/model cache hit/miss aggregator (bounded cardinality with `__overflow__`, token counters/rates only, host-activated), host-configurable `ModelRouterSelectionPolicy` on `createModelRouter` with the reference `createCostLatencySelection` (ModelCost rank then in-memory latency EMA, default ordered behavior byte-identical), `prism providers add <name>` OpenAI-compatible provider scaffold (manifest/provider/models/cache/conformance test/docs stub, npm-name + traversal + symlink-escape validation, placeholders only), and the async `AgUiProjection` verification closeout (plan 009 Task 15 evidence recorded, no new code); plan 017 the documented breaking cut — deprecated-option removal with `docs/migration.md` `0.1.4 → 0.1.5` section and reviewed compat-baseline regeneration via `--allow-break` then `--update-baseline`: the inert provider request knobs, `RunOptions.maxToolRounds`, observational-memory flat settings keys + top-level worker aliases, `ReadToolOptions.autoResizeImages`, `INIT_PROVIDERS`; all removals fail closed naming their replacement; plan 016 internal god-module split — `agents.ts`/`contracts.ts` reorganized behind barrel re-exports with a byte-identical public entry surface, measured tree-shaking improvement in `scripts/phase16-baseline.json`, and additive `@arnilo/prism-browser` Chrome DevTools Protocol capabilities — `browser_evaluate`/`browser_observe` and `block_urls`/`unblock_urls`/`throttle`/`emulate` act actions; plan 015 dead-code and deprecation hygiene on the frozen 0.1.x line — parameterized benchmark runner `scripts/benchmark.mjs` absorbing the per-version runners, archived review-coverage evidence in `docs/_evidence/`, non-blocking unused-code sweep `npm run sweep:unused`, opt-in checkpoint persistence for loaded-skill names and read-path sets; plan 014 Alibaba provider enrichment — embeddings, video input, verified compatible-mode surface decision table; plan 013 post-release hardening — build single-flight, MCP SSE relay test, combined coverage summary, canonical manifest-count narrative, ACP modes/config persistence guidance; Phase 12 release-candidate hardening; plan 012 — freeze manifest, compatibility matrix, upgrade matrix, packed-install e2e journeys, restart-recovery evidence, capacity envelopes, security policy), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, frozen 0.1.x compatibility and support matrix (Node/PostgreSQL/platform/provider/protocol pins and unsupported combinations, machine-checked against `scripts/phase12-freeze-manifest.json`), protected PostgreSQL gate, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix, and sandbox-browser Docker/Playwright gates.
+- [Release and install](release-and-install.md): current **0.2.1** 50-package graph (root + 49 workspace packages) — plan 021 the provider-completion-and-outbound-trust-boundaries cut: strict stream completion is the shared OpenAI-compatible default (truncated streams fail `incomplete_delta`, explicit `strictCompletion: false` opt-out), bounded success bodies via `readBoundedResponseJson` on all discovery/quota/embeddings/upload/OAuth JSON endpoints (65,536-byte ceiling, depth/property/shape caps), DNS-pinned OIDC JWKS/OPA/content fetches through the core `pinnedFetch` primitive with 3xx redirects rejected outright (private/metadata answers fail closed `ssrf_denied`), shared bounded OAuth device/token polling (`pollDeviceCodeToken`) across provider-openai and credentials-node, and the four edge fixes (Azure/Vertex credential-once, Bedrock duplicate-case/repeated-query SigV4 canonicalization, OpenAI upload failed-DELETE retention, cache `__overflow__` tokens-only); public-entrypoint threat-suite `scripts/phase21-security.test.mjs` + packed plain-JS consumer; additive-only compat (MCP transport helpers re-exported from core, no removals); migration `0.2.0 → 0.2.1`; then plan 020 the fail-closed runtime-and-sandbox-security cut on the 0.2.x review-remediation line: durable-resume decision validation in core (`assertValidAgentRunResume` — unknown decisions/malformed batches fail closed with `ERR_PRISM_DECISION_*` before any state claim, checkpoint write, or tool execution; server parser remains defense in depth), isolated work-tool subprocess environments (`@arnilo/prism-work-tools` — fixed base allow-list + explicit env + forced HOME/telemetry + late-bound per-identity tokens, 64-name/64-KiB caps, absolute binary/configDir, linear output capture), and explicit sandbox capabilities (`@arnilo/prism-coding-security` — `SandboxAdapter.capabilities` with omission-is-false fail-closed resolution, `SandboxCodingComposition.capabilities` from verified wiring, `containmentClaim` deprecated as the conservative projection; Docker reports only verified controls, native reports filesystem/process/privilege `false`); public-entrypoint security conformance (`scripts/phase20-security.test.mjs`, wired into `security:threat-suites`), packed plain-JS consumer regressions, and the sandbox-browser workflow's fail-loud Docker/native capability evidence gate — 0.2.0 never ships while a blocker is skipped; migration and rollback notes in `docs/migration.md` `0.1.7 → 0.2.0`, store-compatible with 0.1.7 in both directions; 0.1.7 was the performance-and-DX patch — dependency-free `createCacheTelemetry()` per-provider/model cache hit/miss aggregator (bounded cardinality with `__overflow__`, token counters/rates only, host-activated), host-configurable `ModelRouterSelectionPolicy` on `createModelRouter` with the reference `createCostLatencySelection` (ModelCost rank then in-memory latency EMA, default ordered behavior byte-identical), `prism providers add <name>` OpenAI-compatible provider scaffold (manifest/provider/models/cache/conformance test/docs stub, npm-name + traversal + symlink-escape validation, placeholders only), and the async `AgUiProjection` verification closeout (plan 009 Task 15 evidence recorded, no new code); plan 017 the documented breaking cut — deprecated-option removal with `docs/migration.md` `0.1.4 → 0.1.5` section and reviewed compat-baseline regeneration via `--allow-break` then `--update-baseline`: the inert provider request knobs, `RunOptions.maxToolRounds`, observational-memory flat settings keys + top-level worker aliases, `ReadToolOptions.autoResizeImages`, `INIT_PROVIDERS`; all removals fail closed naming their replacement; plan 016 internal god-module split — `agents.ts`/`contracts.ts` reorganized behind barrel re-exports with a byte-identical public entry surface, measured tree-shaking improvement in `scripts/phase16-baseline.json`, and additive `@arnilo/prism-browser` Chrome DevTools Protocol capabilities — `browser_evaluate`/`browser_observe` and `block_urls`/`unblock_urls`/`throttle`/`emulate` act actions; plan 015 dead-code and deprecation hygiene on the frozen 0.1.x line — parameterized benchmark runner `scripts/benchmark.mjs` absorbing the per-version runners, archived review-coverage evidence in `docs/_evidence/`, non-blocking unused-code sweep `npm run sweep:unused`, opt-in checkpoint persistence for loaded-skill names and read-path sets; plan 014 Alibaba provider enrichment — embeddings, video input, verified compatible-mode surface decision table; plan 013 post-release hardening — build single-flight, MCP SSE relay test, combined coverage summary, canonical manifest-count narrative, ACP modes/config persistence guidance; Phase 12 release-candidate hardening; plan 012 — freeze manifest, compatibility matrix, upgrade matrix, packed-install e2e journeys, restart-recovery evidence, capacity envelopes, security policy), exact-peer/install/tarball rules, deterministic resumable publication and publish dry-run, frozen 0.1.x compatibility and support matrix (Node/PostgreSQL/platform/provider/protocol pins and unsupported combinations, machine-checked against `scripts/phase12-freeze-manifest.json`), protected PostgreSQL gate, pinned supply-chain gates, offline tests, the 0.0.15 provider/AI-SDK/RAG/memory protected live-canary matrix, and sandbox-browser Docker/Playwright gates.
 - [0.1.0 / 1.0 readiness gates](0.1.0-readiness.md): command-per-gate 1.0 readiness table — frozen API surface + compat gate, migration/docs tripwires, budget table, live-suite matrix, security matrix, current-line status (**0.0.23** published target), signed-publication/live-canary prerequisites for 1.0, and Phase 12 demand-evidence entry criteria.
 - [Review coverage archive](_evidence/): per-phase evidence freezes (plans 067–079, releases 0.0.4–0.0.16) — traceability matrices, provider validation, capability/primitive/limit matrices, benchmark budgets, and artifact-diet findings; tarball-excluded, kept in-repo for audit.
 

package/docs/mcp-tools.md

@@ -208,7 +208,7 @@ Remote MCP tools default to `external_mutation`/`unsupported` unless the host `e
 | Risk | Mitigation |
 | --- | --- |
 | Untrusted subprocess (stdio) | Explicit `command` / `args` / `env` / `cwd`; review before deploy |
-| SSRF / DNS rebinding / redirects (HTTP) | Exact HTTPS origins; credentials/fragments/redirects denied; every DNS answer public; one address pinned per request; explicit loopback-only HTTP escape hatch |
+| SSRF / DNS rebinding / redirects (HTTP) | Exact HTTPS origins; credentials/fragments/redirects denied; every DNS answer public; one address pinned per request; explicit loopback-only HTTP escape hatch. Since 0.2.1 the client transport re-routes through the shared core `pinnedFetch` primitive (DNS-pinned fetch) with byte-identical `McpBridgeError`/`McpOAuthError` wrapping |
 | Hostile discovery / schema compilation | Raw SDK `tools/list` requests avoid SDK Ajv output-schema compilation; finite pages/tools/cursors/metadata/schema totals; failed refresh leaves previous tools unchanged |
 | Tool-name shadowing | Prefixed names + `createToolRegistry({ duplicate: "error" })` |
 | MCP Apps metadata/HTML | Explicit extension acknowledgement; bounded nested metadata; app-only tools absent from model list; only linked `ui://` HTML/MIME resource body reaches the host renderer |

package/docs/migration.md

@@ -1,5 +1,36 @@
 # Migration guide
 
+## 0.2.0 → 0.2.1 provider completion and outbound trust boundaries (plan 021)
+
+Release **0.2.1** (plan 021) tightens the streaming-completion, outbound-fetch, and credential/signing/upload boundaries. The API surface is **additive-only** (plain reviewed compat gate at 0.2.1: the only deltas are the version literal and `@arnilo/prism-mcp` transport helpers `boundResponse`/`defaultResolver`/`isLoopbackAddress`/`isLoopbackHostname`/`normalizeHostname`/`raceAbort`/`requestPinned`/`resolvePinnedAddress` becoming re-exports of the lifted core primitives — same names, same signatures, no removal; no `--allow-break`), with five documented security-motivated behavior tightenings. Untyped/legacy callers may now fail where 0.2.0 silently proceeded:
+
+1. **Strict stream completion is the shared default (all OpenAI-compatible adapters).** `createOpenAICompatibleProvider` now defaults `strictCompletion: true` — a stream that ends without a `[DONE]` marker AND a choice-level `finish_reason` (EOF, network cut, provider truncation) emits a `ProviderTransportError` (`incomplete_delta`) instead of a successful `providerDone`, and a successful done never fabricates usage. This applies to every inheriting adapter: Azure, Bedrock, Vertex, OpenRouter, ZAI, NeuralWatt (Alibaba/Kimi/Ollama/OpenCode-go had already opted in).
+
+   ```js
+   // 0.2.1: truncated stream fails closed
+   for await (const event of provider.generate(request)) {
+     if (event.type === "error") {
+       event.error.code; // "incomplete_delta"
+     }
+   }
+   // explicit opt-out stays available where hosts own truncation detection:
+   createOpenAICompatibleProvider({ ..., strictCompletion: false });
+   ```
+
+2. **Bounded success bodies on non-stream JSON endpoints.** `readBoundedResponseJson` (exported from `@arnilo/prism/providers/transport`) replaces unbounded `response.json()` on all model-discovery `/models` calls, NeuralWatt quota, Alibaba embeddings, OpenAI uploads, and the OAuth success paths. Defaults: 65,536-byte UTF-8 ceiling, max JSON depth 32, max properties 4096, caller-supplied shape gate, abort support, secret-redacted errors. Oversized or malformed bodies abort with `ProviderTransportError` `response_body_overflow`/`response_body_shape` instead of buffering unbounded input.
+
+3. **DNS-pinned OIDC JWKS, OPA, and content fetches; redirects rejected.** The default fetch paths of `credentials-node` JWKS (`@arnilo/prism-credentials-node/oidc`), `policy` OPA decisions, and core content/media fetches now resolve the hostname once (1–32 addresses), validate every candidate against the SSRF policy, and connect only to a pinned address via a lookup-hook socket (no re-resolution). **3xx redirects are rejected outright** (`MediaContentError` code `redirect`) — a redirected fetch is never re-validated or followed. Private/metadata/loopback addresses fail closed (`MediaContentError` `ssrf_denied`). The MCP transport helpers were lifted to the shared core primitive (`pinnedFetch`, `resolvePinnedAddress`, `requestPinned` from `@arnilo/prism`) with byte-identical behavior and are re-exported from `@arnilo/prism-mcp`.
+
+4. **Shared bounded OAuth device/token polling.** Core OpenAI OAuth (`@arnilo/prism-provider-openai`) and `@arnilo/prism-credentials-node` now share `pollDeviceCodeToken` (RFC 8628 poll loop with `authorization_pending` continue, `slow_down` +5 s backoff, expiry deadline, cancellation, bounded success/error reads, fail-closed token-shape gates, `[REDACTED]` secret redaction). No public change — the device/token flows keep their messages and cadence; provider-specific fields stay adapter options.
+
+5. **Credential, signing, upload, and cache edge fixes.** (a) Azure and Vertex resolve a rotating/single-use credential **exactly once per request** — the inner provider signs with the same token the wrapper validated (a `CredentialValueSource` is never consumed twice). (b) Bedrock SigV4 canonicalization lowercases and merges duplicate-case request headers last-wins and sorts query parameters by encoded key then value — duplicate-case or reordered input can no longer produce a malformed signature. (c) OpenAI upload cleanup retains a file id until its `DELETE` succeeds — a failed/skipped cleanup leaves the id registered for a retried cleanup instead of leaking the remote file. (d) The cache-telemetry `__overflow__` bucket never carries cost — it reports requests and token totals only, so one model's cost metadata cannot mix into mixed-model overflow tokens.
+
+**Store compatibility:** 0.2.1 is store-compatible with 0.2.0 in both directions — no persisted-shape change, no migration step. Checkpoint, session-store, approval, and registry payloads are byte-identical; only fetch/stream/credential behavior changed.
+
+**Rollout:** upgrade core first (strict completion and bounded readers apply to all hosts immediately; truncated-stream callers must add `strictCompletion: false` only if they intentionally accept incomplete streams), then `@arnilo/prism-credentials-node` + `@arnilo/prism-policy` (DNS-pinned fetches; ensure JWKS/OPA hosts resolve to public addresses and never redirect), then the provider adapters (Azure/Vertex credential handling, Bedrock signing), then `@arnilo/prism-mcp` (re-export-only change).
+
+**Rollback risk:** restoring 0.2.0 restores all five boundary gaps — rollback is **not** a mitigation. Hosts that must roll back should disable truncated-stream acceptance, unbounded-body endpoints, redirect-following fetches, rotating-credential reuse, and upload cleanup at their own boundary until they can return to 0.2.1.
+
 ## 0.1.7 → 0.2.0 fail-closed runtime and sandbox security (plan 020)
 
 Release **0.2.0** (plan 020) is the first cut of the 0.2.x review-remediation line: it closes the three security blockers found in the 2026-08-12 comprehensive review. The API surface is **additive-only** (plain compat gate at 0.2.0 shows zero removed/changed declarations; no `--allow-break`), but three behaviors are deliberately tightened for security, so untyped/legacy callers may now fail where 0.1.7 silently proceeded:

package/docs/multimodal-content.md

@@ -145,6 +145,7 @@ try {
 - SSRF deny-by-default blocks IPv4/IPv6 loopback, private/unique-local, link-local, unspecified, multicast, IPv4-mapped private, and cloud metadata targets. DNS answers are all classified before one public address is pinned; mixed public/private answers fail closed.
 - `allowedHostnames` is an explicit trust override and may permit a private destination. `denyPrivateHosts: false` is broader and should be reserved for hosts that intentionally own private-network access.
 - DNS lookup, connection, and body streaming share `fetchTimeoutMs` and caller abort; more than 32 resolved addresses, redirects, and oversized response bodies are rejected.
+- Media URL fetches (0.2.1) route through the core `pinnedFetch` primitive — DNS-pinned resolution with per-answer SSRF checks (rebinding defense) and outright 3xx rejection — while keeping the `fetch`/`resolveHostname`/`requestUrl` host seams and the existing byte budgets.
 - MIME validation rejects common magic-byte spoofing; extensions alone are never trusted.
 - Byte budgets use base64 size estimates before decode and re-check decoded bytes after every read/fetch. Complete-request resolution keeps at most the configured request budget plus one bounded item in memory and performs no provider upload/request until validation succeeds.
 - Media errors omit raw bytes/base64 payloads from messages.

package/docs/policy-and-audit.md

@@ -115,6 +115,7 @@ Policy is optional. Hosts wire `record*` helpers or `evaluateAndAppend` at permi
 - Policy version pin fails closed on mismatch.
 - Unrestricted payload field names (`prompt`, `body`, `toolArguments`, …) are rejected before append.
 - Evaluate/append are O(fields) and network-free in-package; remote WORM I/O stays in the host sink/adapter.
+- The OPA decision fetch (0.2.1) is DNS-pinned through the core `pinnedFetch` primitive: one resolve per request, every resolved address SSRF-checked before the connect (rebinding defense), redirects rejected outright, timeouts/retries unchanged, and private-answer denials surface `MediaContentError` (`ssrf_denied`) rather than a transport error.
 - Export never full-scans: page size is capped; raise hard caps only with Phase 8 freeze + tests + docs updates.
 
 ## OPA external policy adapter (`@arnilo/prism-policy/opa`, 0.0.28)

package/docs/provider-caching.md

@@ -279,7 +279,10 @@ for (const sample of report.samples) {
 - Cardinality is bounded: beyond `maxKeys` distinct provider/model keys, excess
   keys accumulate in a single `__overflow__` bucket; memory cannot grow with
   hostile model names (`ponytail:` ceiling — upgrade to host-configurable caps
-  or LRU eviction only if a real deployment exceeds it).
+  or LRU eviction only if a real deployment exceeds it). The `__overflow__`
+  bucket aggregates mixed provider/model tokens, so it never carries cost
+  metadata: `estimatedSavings`/`currency` are unset there and it reports
+  requests and token totals only.
 - `record()` is O(1) per usage event; `report()` is O(keys). No secrets or
   cache keys are accepted or stored.
 

package/docs/provider-primitives.md

@@ -137,10 +137,27 @@ export function tryParseJsonObjectArguments(
   text: string,
   options?: { toolName?: string; maxBytes?: number },
 ): { ok: true; value: JsonObject } | { ok: false; error: ProviderTransportError };
+
+/** Read a success body with the same byte ceiling as `readBoundedResponseText`, then parse it as JSON
+ *  with depth/property caps and an optional caller-supplied shape gate. Malformed JSON, over-limit
+ *  nesting/width, or shape failure throw `ProviderTransportError` (code `response_body_shape`). */
+export async function readBoundedResponseJson<T>(
+  response: Response,
+  options?: {
+    secrets?: readonly (string | undefined)[];
+    maxResponseBodyBytes?: number;
+    maxDepth?: number;      // default 32
+    maxProperties?: number; // default 4_096 per object/array
+    shape?: (value: unknown) => boolean; // caller-supplied shape gate, fails closed
+    signal?: AbortSignal;
+  },
+): Promise<T>;
 ```
 
 **Performance:** Single pass over chunks; retained memory is `O(min(buffer, maxBufferBytes))`, not `O(stream)`. No full-stream accumulation.
 
+**Security:** the bounded success-body reader (added in 0.2.1) caps every non-stream JSON response: a hard UTF-8 byte ceiling (`maxResponseBodyBytes`, default 65_536) that cancels the body before full buffering, a nesting depth cap (default 32), a per-container property/element cap (default 4_096), and a caller-supplied shape gate. Malformed JSON, over-limit nesting or width, and shape mismatches all fail closed with `ProviderTransportError` code `response_body_shape`; errors are static text and never embed body content or secrets. It replaces the former unbounded `response.json()` in all ten model-discovery implementations, NeuralWatt quota, Alibaba embeddings, OpenAI uploads (0.2.1 task 6), and the shared OAuth device/token flows (0.2.1 task 5); per-adapter post-parse validation stays as defense in depth.
+
 ### `@arnilo/prism/providers/openai` — **shipped**
 
 Import:

package/docs/providers/azure.md

@@ -60,7 +60,7 @@ Register via `createExtensionKernel().load([createAzureOpenAIProviderPackage(...
 
 ## Security and performance notes
 
-- No credential prefetch at import; resolve per request.
+- No credential prefetch at import; the credential is resolved exactly once per request (a rotating `CredentialValueSource` is never consumed twice — the same resolved token drives the wrapper check and the inner auth header).
 - Endpoint host is never rewritten to public DNS.
 - Errors redact credential values via shared transport helpers.
 - No Azure SDK dependency.

package/docs/providers/bedrock.md

@@ -60,6 +60,7 @@ Uses Bedrock’s OpenAI-compatible runtime route (not Converse eventstream). Hos
 ## Security and performance notes
 
 - No AWS SDK; package-local SigV4 only for `bedrock` service.
+- Input headers are normalized once before signing: names are lowercased and duplicate-case keys merge last-wins, so the canonical request always matches the signed header list (no duplicate-case mismatch); query parameters are canonicalized sorted by encoded key then value.
 - Private endpoint hosts are not rewritten to public DNS.
 - Credential secrets are redacted from provider errors.
 - No credential prefetch at import.

package/docs/providers/openai-compatible.md

@@ -41,12 +41,12 @@ Options:
 | `onComment` | `(text) => ProviderEvent \| undefined` | Handle SSE comment lines (text after `:`), e.g. NeuralWatt `: energy` / `: cost` telemetry. Returned events are yielded in stream order. |
 | `extraHeaders` | `(request) => Record<string, string>` | Optional extra request headers; provider auth and `content-type` still win. |
 | `transformBody` | `(body, request) => JsonObject` | Optional final body transform, applied last (token limits, compat stripping); wins over everything. |
-| `strictCompletion` | `boolean` | Require `[DONE]` and a `finish_reason`; truncated streams yield an `error` and `done` carries the final usage. |
+| `strictCompletion` | `boolean` | Require `[DONE]` **and** a `finish_reason` before emitting `done`; truncated streams yield an `error` and `done` carries the final usage. **Default `true`** (fail-closed); set `false` explicitly to accept streams that end without completion evidence — the documented downgrade whose risk the opting host owns. |
 | `requestFailedPrefix` | `string` | Prefix for HTTP error messages. Default `OpenAI-compatible request failed`. |
 
 The subpath also exports the building blocks for provider packages that keep public body/stream helpers:
 
-- `openAIChatEvents(body, { signal, strictCompletion, doneUsage, mapUsage, onComment })`: the shared SSE stream loop as an `AsyncIterable<ProviderEvent>`.
+- `openAIChatEvents(body, { signal, strictCompletion, doneUsage, mapUsage, onComment })`: the shared SSE stream loop as an `AsyncIterable<ProviderEvent>`. `strictCompletion` defaults to `true` (see the Security notes).
 - `buildOpenAIChatBody(request, { mapMessages, serializeMessage, buildBodyExtra, transformBody })`: the base Chat Completions request body builder.
 
 Provider requests use the standard `ProviderRequest` shape: `model`, `messages`, optional `tools`, `metadata`, and `signal`.
@@ -62,7 +62,7 @@ The returned provider emits normalized `ProviderEvent` values:
 | streamed `tool_calls` fragments | `tool_call_delta` events. |
 | complete accumulated tool call | final `tool_call` event. |
 | `usage` | `usage` event. |
-| `[DONE]` or stream end | `done` event. |
+| `[DONE]` + `finish_reason` | `done` event. A stream ending without either terminal variant yields an `error` instead (strict default). |
 | HTTP/stream/parsing error | `error` event with redacted `ErrorInfo`. |
 
 The adapter passes `request.signal` to `fetch` for abort propagation; an already-aborted signal throws before fetch.
@@ -146,6 +146,7 @@ const provider = createOpenAICompatibleProvider({
 - Redaction only removes known values supplied to the helper. Avoid logging raw provider requests/responses.
 - `fetch` receives the request `AbortSignal`.
 - SSE and HTTP error bodies are read through bounded `@arnilo/prism/providers/transport` helpers (`readSseData`, `readBoundedResponseText`) with configurable byte ceilings.
+- **Strict completion is the shared default (since 0.2.1):** a chat stream is complete only when both `[DONE]` and a `finish_reason` were observed. EOF without either is treated as truncation and emits an `error` ("Chat stream ended without completion evidence"), never a successful `done` — a partial answer can no longer be mistaken for a completed one. Providers that legitimately omit one of the terminal markers must pass `strictCompletion: false` explicitly, accepting the truncation-detection downgrade. `done` carries the final stream usage when the stream was strict (or `doneUsage` is set).
 - Tests should use injected `fetch` and never make real network calls.
 - Tool-call arguments are accumulated as streamed text, parsed with `parseJsonObjectArguments` when the final tool call is emitted; empty argument text yields `{}`, malformed JSON yields an `error` event.
 

package/docs/providers/vertex.md

@@ -59,7 +59,7 @@ const provider = createVertexProvider({
 
 - No Google Cloud SDK dependency in the package.
 - Custom/private endpoint hosts are preserved.
-- Tokens redacted from errors; no import-time credential prefetch.
+- Tokens redacted from errors; no import-time credential prefetch — the credential is resolved exactly once per request (a rotating `CredentialValueSource` is never consumed twice; the same resolved token drives the wrapper check and the inner auth header).
 - Pair with model-router residency allow-lists on `location`.
 
 ## Related APIs

package/docs/release-and-install.md

@@ -274,6 +274,25 @@ git push origin v0.1.2        # tag push triggers release.yml publish job (prove
 
 **Rollback notes.** `release:publish --version 0.1.2 --resume --report release-artifacts/publish-report.json` resumes an interrupted publication and skips only registry versions whose internal dependency fingerprint matches the local manifest. A failed package aborts the run with its status written to the report; re-run after fixing the cause. npm cannot unpublish the `0.1.2` line after 72 hours — a post-publication defect ships as a `0.1.x` patch (additive-only compat promise, `release:gate` enforced), or as a documented break in the next line with a `docs/migration.md` entry. `0.1.2` is store-compatible with `0.1.1` in **both directions** (no migration ran — same checksum-protected contract), so an operator may defer or roll back the patch without a database rollback.
 
+### 0.2.1 publish handoff (plan 021 Task 8)
+
+**Decision: GO when the operator prerequisites below are recorded.** Release **0.2.1** (plan 021) is the provider-completion and outbound-trust-boundaries cut on the 0.2.x review-remediation line. API surface **additive-only** vs 0.2.0 (plain reviewed compat gate at 0.2.1: the only deltas are the version literal and `@arnilo/prism-mcp` transport helpers `boundResponse`/`defaultResolver`/`isLoopbackAddress`/`isLoopbackHostname`/`normalizeHostname`/`raceAbort`/`requestPinned`/`resolvePinnedAddress` becoming re-exports of the lifted core primitives — same names/signatures, no removal; baselines regenerated with `--update-baseline`, no `--allow-break`; freeze manifest `scripts/phase21-freeze-manifest.json` machine-checks each task's diff and the preserved surface). Five documented security-motivated behavior tightenings in `docs/migration.md` `0.2.0 → 0.2.1`: (1) **strict stream completion is the shared default** (`strictCompletion: true` in `createOpenAICompatibleProvider`; explicit `false` stays the documented opt-out; truncated streams fail `ProviderTransportError` `incomplete_delta` instead of a successful `providerDone`; applies to Azure/Bedrock/Vertex/OpenRouter/ZAI/NeuralWatt); (2) **bounded success bodies** — additive `readBoundedResponseJson` (65,536-byte ceiling, depth 32, properties 4096, shape gate, abort, redacted errors, `response_body_shape` code) replaces unbounded `response.json()` on all ten model-discovery sites plus NeuralWatt quota, Alibaba embeddings, OpenAI uploads, and both OAuth success paths; (3) **DNS-pinned OIDC JWKS/OPA/content fetch, redirects rejected** — core `pinnedFetch` (one resolve, 1–32 bound, per-candidate SSRF validation, pinned-lookup socket) serves the default JWKS, OPA decision, and content/media paths; 3xx fails `MediaContentError` `redirect`; private/metadata/loopback fails `ssrf_denied`; MCP re-exports the lifted helpers byte-identically; (4) **shared bounded OAuth device/token polling** — core `pollDeviceCodeToken` serves provider-openai and credentials-node with equivalent cadence/backoff/redaction; (5) **edge fixes** — Azure/Vertex credential-once, Bedrock duplicate-case/repeated-query SigV4 canonicalization, OpenAI upload failed-DELETE retention, cache `__overflow__` tokens-only. New regression surface: `scripts/phase21-security.test.mjs` (10 conformance tests over built public entrypoints, wired into `security:threat-suites`) and a packed plain-JS `security21.mjs` consumer in install-smoke. Store compatibility with 0.2.0: **compatible, no migration**. Exit gate green: npm test core + script gates (incl. phase21-freeze done-phase), `sdk:ready` exit 0, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain reviewed compat gate at 0.2.1, live OIDC JWKS + live OPA protected evidence; evidence in `scripts/phase21-baseline.json` `exitGate`. Rollback = restore the 0.2.0 manifests/tag — but rollback restores the five boundary gaps, so hosts should disable truncated-stream acceptance, unbounded-body endpoints, redirect-following fetches, rotating-credential reuse, and upload cleanup at their own boundary if rollback is unavoidable.
+
+```bash
+# Operator prerequisites recorded: clean tree at the v0.2.1 tag candidate, GPG key, npm OIDC publisher.
+npm test                                        # core + workspace suites + all script gates
+npm run security:threat-suites                  # phase8-11 + phase20 + phase21 public-entry conformance
+npm run sdk:ready                               # typecheck, lint, format, test, coverage, pack, release:gate
+node scripts/release.mjs gate --version 0.2.1   # plain reviewed additive gate, 0 breaking deltas
+npm run pack:dry-run                            # twice; diff reports — deterministic
+npm audit --audit-level=moderate
+npm run release:check -- --version 0.2.1 --report /tmp/prism-0.2.1-preflight.json
+npm run release:publish -- --version 0.2.1 --dry-run --allow-dirty --allow-untagged --report /tmp/prism-0.2.1-dry-run.json
+#   run the dry-run twice and diff the reports: deterministic, byte-identical
+```
+
+Protected evidence (never a passing skip): live OIDC JWKS through the default pinned path (`createOidcIdentityVerifier` against a real public IdP — real DNS/TLS/JWKS document, e.g. `https://login.microsoftonline.com/common/discovery/v2.0/keys`, success proven by a key-lookup miss after a 200 fetch) and live OPA (`docker run -p 127.0.0.1:8181:8181 openpolicyagent/opa run --server`, push a policy, then prove the default pinned path fails closed `ssrf_denied` against the real server; decision-success behavior is covered by the built public conformance suite since the pinned path refuses private addresses by design). Missing protected evidence records 0.2.1 as **blocked**, never a passing skip.
+
 ### 0.2.0 publish handoff (plan 020 Task 6)
 
 **Decision: GO when the operator prerequisites below are recorded.** Release **0.2.0** (plan 020) is the first cut of the 0.2.x review-remediation line — fail-closed runtime and sandbox security. API surface **additive-only** vs 0.1.7 (plain compat gate at 0.2.0: 0 breaking declaration deltas — the three blockers are behavior tightenings, not removals; `containmentClaim` retained deprecated; baseline text regenerated with `--update-baseline`, no `--allow-break` anywhere; freeze manifest `scripts/phase20-freeze-manifest.json` machine-checks each task's diff stayed inside its allowed files). Shipped: (1) **durable-resume input validation** — `assertValidAgentRunResume` at the top of `prepareAgentRunResume` covers all four public resume entrypoints; unknown legacy decisions (`"sideways"`), malformed batches, oversized reasons/elicitation, duplicate approval ids fail closed `ERR_PRISM_DECISION_*` with zero checkpoint writes/tool calls (server parser stays defense in depth); (2) **work-tool environment isolation** — `createCliRunner` children get a fixed base allow-list + explicit env + forced HOME/telemetry controls + late-bound per-identity tokens, 64-name/64-KiB caps `ERR_PRISM_WORK_ENV`, absolute binary/configDir, linear output capture; (3) **explicit sandbox capabilities** — `SandboxAdapter.capabilities` (six immutable booleans, omission/malformed ⇒ all false), composition capabilities from verified wiring, `containmentClaim` deprecated as the conservative projection; Docker reports only verified controls, native reports filesystem/process/privilege false; docs/coding-security.md capability table, docs/host-security.md authorization guidance. New regression surface: `scripts/phase20-security.test.mjs` (public built entrypoints, wired into `security:threat-suites`), packed plain-JS consumer regressions in install-smoke, and the sandbox-browser workflow's fail-loud 0.2.0 blocker gate recording Docker/native capability evidence — **0.2.0 does not ship while any blocker is skipped**. Store compatibility with 0.1.7: **compatible, no migration** (no persisted-shape change; `docs/migration.md` `0.1.7 → 0.2.0` section). Exit gate green: npm test core + script gates (incl. phase20-freeze done-phase), `sdk:ready` exit 0, audit 0 moderate, pack dry-run 50/50 twice byte-identical, plain reviewed compat gate at 0.2.0, Docker daemon + native netns protected evidence; evidence in `scripts/phase20-baseline.json` `exitGate`. Rollback = restore the 0.1.7 manifests/tag — but rollback restores the three defects, so hosts should disable resume side effects and work-tool execution at their own boundary if rollback is unavoidable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -143,7 +143,7 @@
     "build": "npm run build:core && npm run build --workspaces --if-present",
     "typecheck": "npm run build && npm run typecheck --workspaces --if-present && tsc -p examples --noEmit",
     "sweep:unused": "node scripts/sweep-unused.mjs",
-    "test": "npm run build && node --test dist/__tests__/*.test.js && node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase11-freeze.test.mjs scripts/phase12-freeze.test.mjs scripts/phase13-freeze.test.mjs scripts/phase14-freeze.test.mjs scripts/phase15-freeze.test.mjs scripts/phase16-freeze.test.mjs scripts/phase17-freeze.test.mjs scripts/phase18-freeze.test.mjs scripts/phase19-freeze.test.mjs scripts/phase20-freeze.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/sweep-unused.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs && npm run test --workspaces --if-present",
+    "test": "npm run build && node --test dist/__tests__/*.test.js && node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase11-freeze.test.mjs scripts/phase12-freeze.test.mjs scripts/phase13-freeze.test.mjs scripts/phase14-freeze.test.mjs scripts/phase15-freeze.test.mjs scripts/phase16-freeze.test.mjs scripts/phase17-freeze.test.mjs scripts/phase18-freeze.test.mjs scripts/phase19-freeze.test.mjs scripts/phase20-freeze.test.mjs scripts/phase21-freeze.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/sweep-unused.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs && npm run test --workspaces --if-present",
     "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' --test-coverage-exclude='**/packages/**' --test-coverage-exclude='**/examples/**' dist/__tests__/*.test.js && node scripts/coverage-summary.mjs",
     "coverage:summary": "node scripts/coverage-summary.mjs",
     "lint": "biome lint .",
@@ -156,7 +156,7 @@
     "release:publish": "node scripts/release.mjs publish",
     "sdk:ready": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run test:coverage && npm run pack:dry-run && npm run release:gate",
     "release:gate": "node scripts/release.mjs gate",
-    "security:threat-suites": "node --test scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase20-security.test.mjs"
+    "security:threat-suites": "node --test scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase20-security.test.mjs scripts/phase21-security.test.mjs"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.5",