@arnilo/prism 0.4.0 → 0.5.1

package/docs/work-connectors.md

@@ -1,6 +1,6 @@
 # Work connectors
 
-Least-privilege Microsoft 365 and Google Workspace connectors live in `@arnilo/prism-work-tools`.
+Least-privilege Microsoft 365 and Google Workspace connectors live in `@arnilo/prism-core/integrations/work`.
 
 ## Principles
 
@@ -13,19 +13,19 @@ Least-privilege Microsoft 365 and Google Workspace connectors live in `@arnilo/p
 
 ## Microsoft 365
 
-See [Work tools](work-tools.md). Adapter: `createMicrosoft365CliAdapter` / subpath `@arnilo/prism-work-tools/microsoft365`.
+See [Work tools](work-tools.md). Adapter: `createMicrosoft365CliAdapter` / subpath `@arnilo/prism-core/integrations/work/microsoft365`.
 
 Uses [@pnp/cli-microsoft365](https://pnp.github.io/cli-microsoft365/) commands such as `outlook message list|get`, `outlook mail send`, `outlook event list|add`, `file list|add`, `spo file sharinglink add`. To Do / Planner / Teams remain capability-gated.
 
 ## Google Workspace
 
-See [Work tools](work-tools.md). Adapter: `createGoogleWorkspaceCliAdapter` / subpath `@arnilo/prism-work-tools/google-workspace`.
+See [Work tools](work-tools.md). Adapter: `createGoogleWorkspaceCliAdapter` / subpath `@arnilo/prism-core/integrations/work/google-workspace`.
 
 Uses [`@googleworkspace/cli` (`gws`)](https://github.com/googleworkspace/cli): `gmail users messages list|get`, `gmail +send`, `calendar events list|insert`, `drive files list|create`, `drive permissions create`, `tasks tasks *`. Docs/Sheets/Slides create remain capability-gated. Discovery `schema` and `auth`/`login`/`setup` are forbidden from Prism argv.
 
 ## Scoped OAuth establishment (0.0.14)
 
-Hosts establish, refresh, and revoke scoped OAuth credentials for these workloads through the existing `OAuthProvider` / credential-store seams (`@arnilo/prism-credentials-node`): `createMicrosoft365OAuthProvider` / `createGoogleWorkspaceOAuthProvider` (PKCE + device code), least-privilege scope bundles per capability (`resolveMicrosoft365Scopes` / `resolveGoogleWorkspaceScopes`, read vs mutation). Connectors consume a per-identity token via a late-bound `tokenProvider` injected as an env var — never argv, never model context; revocation fails closed. See [Credential storage](credential-storage.md) and [Work tools](work-tools.md).
+Hosts establish, refresh, and revoke scoped OAuth credentials for these workloads through the existing `OAuthProvider` / credential-store seams (`@arnilo/prism-core/credentials/node`): `createMicrosoft365OAuthProvider` / `createGoogleWorkspaceOAuthProvider` (PKCE + device code), least-privilege scope bundles per capability (`resolveMicrosoft365Scopes` / `resolveGoogleWorkspaceScopes`, read vs mutation). Connectors consume a per-identity token via a late-bound `tokenProvider` injected as an env var — never argv, never model context; revocation fails closed. See [Credential storage](credential-storage.md) and [Work tools](work-tools.md).
 
 ## Out of scope
 

package/docs/work-tools.md

@@ -1,6 +1,6 @@
 # Work tools
 
-Optional `@arnilo/prism-work-tools` package: identity-scoped Microsoft 365 and Google Workspace connectors. Host-pinned CLI binaries only; hard-coded `execFile` argv templates; draft-then-approve mutations; side-effect idempotency; shared mail/calendar/file/task result shapes.
+Optional `@arnilo/prism-core/integrations/work` package: identity-scoped Microsoft 365 and Google Workspace connectors. Host-pinned CLI binaries only; hard-coded `execFile` argv templates; draft-then-approve mutations; side-effect idempotency; shared mail/calendar/file/task result shapes.
 
 ## When to use
 
@@ -9,7 +9,7 @@ Use when agents must read or mutate tenant mail/calendar/files/tasks through the
 ## Install
 
 ```bash
-npm install @arnilo/prism-work-tools
+npm install @arnilo/prism-core/integrations/work
 # host separately:
 #   npm i -g @pnp/cli-microsoft365
 #   npm i -g @googleworkspace/cli
@@ -23,8 +23,8 @@ import {
   createMicrosoft365CliAdapter,
   createGoogleWorkspaceCliAdapter,
   createMemoryIdempotencyStore,
-} from "@arnilo/prism-work-tools";
-// or: import { createGoogleWorkspaceCliAdapter } from "@arnilo/prism-work-tools/google-workspace";
+} from "@arnilo/prism-core/integrations/work";
+// or: import { createGoogleWorkspaceCliAdapter } from "@arnilo/prism-core/integrations/work/google-workspace";
 
 const microsoft365 = createMicrosoft365CliAdapter({
   binary: process.env.M365_BIN!,
@@ -145,7 +145,7 @@ Approved mutations require core-derived `context.idempotencyKey` and a configure
 ## Security
 
 - Require host-verified `AgentIdentity`; no cross-identity configDir reuse.
-- Connector tokens (0.0.14): an optional `tokenProvider` resolves a per-identity access token into an env var per call — never argv, never model context. A missing/expired/revoked/cross-identity/wrong-tenant token fails the call closed before any exec. Refresh is late-bound and single-flighted per account (no refresh storm under reconnect). Build one with `createOAuthWorkTokenProvider()` from `@arnilo/prism-credentials-node`.
+- Connector tokens (0.0.14): an optional `tokenProvider` resolves a per-identity access token into an env var per call — never argv, never model context. A missing/expired/revoked/cross-identity/wrong-tenant token fails the call closed before any exec. Refresh is late-bound and single-flighted per account (no refresh storm under reconnect). Build one with `createOAuthWorkTokenProvider()` from `@arnilo/prism-core/credentials/node`.
 - External mail recipients fail closed unless `externalRecipients.allow` returns true.
 - Anonymous / `anyone` sharing denied.
 - CLI stdout/stderr capped (linear chunk capture, killed/rejected before bytes beyond the cap are retained); NDJSON page streams strictly parsed and page-capped; process killed on timeout/abort/overflow.

package/docs/workflow-orchestration-primitives.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-This page freezes the Plan 057 Task 0 inventory and Task 1 adapter-contract lock for workflow orchestration. It maps existing `@arnilo/prism` orchestration, CLI/RPC, event, approval, and persistence seams; records capability gap **C-009** (workflow/graph orchestration); pins performance and security limits for Tasks 2–7; and documents the final public design for `@arnilo/prism-workflows`.
+This page freezes the Plan 057 Task 0 inventory and Task 1 adapter-contract lock for workflow orchestration. It maps existing `@arnilo/prism` orchestration, CLI/RPC, event, approval, and persistence seams; records capability gap **C-009** (workflow/graph orchestration); pins performance and security limits for Tasks 2–7; and documents the final public design for `@arnilo/prism-core/runtime/workflows`.
 
 Interactive TUI (**C-012**) is **out of scope** for Plan 057 and deferred. Workflow start/status/cancel/resume is delivered through public package APIs and optional RPC/`CommandDefinition` bindings.
 
@@ -41,7 +41,7 @@ Static review of `src/agents.ts`, `src/agent-loops.ts`, `src/rpc.ts`, `src/cli-r
 | Middleware | `src/middleware.ts` | Ordered hooks at provider/input/tool/compaction/retry/session boundaries | Workflow does not need new hooks for v1 |
 | Compaction / retry | `src/compaction.ts`, `src/retry.ts` | Per-session/run policies | Workflow nodes inherit agent/session config; graph-level retry is package-owned |
 
-**Frozen boundary:** Core owns single-session run lifecycle, provider turns, tool dispatch, store append, redaction, and `AgentEvent` emission. Multi-node dependency scheduling, typed node I/O mapping, fan-out/join, workflow checkpoints, and workflow run control belong in `@arnilo/prism-workflows`.
+**Frozen boundary:** Core owns single-session run lifecycle, provider turns, tool dispatch, store append, redaction, and `AgentEvent` emission. Multi-node dependency scheduling, typed node I/O mapping, fan-out/join, workflow checkpoints, and workflow run control belong in `@arnilo/prism-core/runtime/workflows`.
 
 ### CLI/RPC host seam (shipped)
 
@@ -67,9 +67,9 @@ Static review of `src/agents.ts`, `src/agent-loops.ts`, `src/rpc.ts`, `src/cli-r
 | `redactAgentEvent` | `src/redaction.ts` | All subscriber/ledger events redacted when redactor active | Workflow persists only redacted node outputs/checkpoints |
 | `RunLedger` | `src/contracts.ts` | Durable `appendRun`, `appendEvent`, `appendToolCall`, `appendUsage` | Workflow run record + per-node run ids; serialized `ledgerChain` (R-004) |
 | Provider/tool metadata | `docs/observability.md` | `provider_turn_*`, `ToolExecutionMetadata` | Workflow progress / node diagnostics |
-| OpenTelemetry adapter | `@arnilo/prism-observability-opentelemetry` | Optional span/metric mapping | Workflow examples may attach |
+| OpenTelemetry adapter | `@arnilo/prism-core/governance/observability` | Optional span/metric mapping | Workflow examples may attach |
 
-**Final architecture (Task 6):** Core exports generic `createEventMultiplexer<T>()`. `@arnilo/prism-workflows` keeps its domain `WorkflowEvent` union but delegates bounded queues, source fan-in, overflow, abort, and close behavior to the core primitive.
+**Final architecture (Task 6):** Core exports generic `createEventMultiplexer<T>()`. `@arnilo/prism-core/runtime/workflows` keeps its domain `WorkflowEvent` union but delegates bounded queues, source fan-in, overflow, abort, and close behavior to the core primitive.
 
 ### Approval and execution policy (shipped)
 
@@ -102,7 +102,7 @@ Static review of `src/agents.ts`, `src/agent-loops.ts`, `src/rpc.ts`, `src/cli-r
 
 | ID | Capability | Review rank | Status after Task 0 rework | Owner |
 | --- | --- | ---: | --- | --- |
-| C-009 | Workflow/graph orchestration | 9 | Task 7 shipped durable multi-process coordination (enqueue/claim/renew/takeover/fencing/cancel) | `@arnilo/prism-workflows` |
+| C-009 | Workflow/graph orchestration | 9 | Task 7 shipped durable multi-process coordination (enqueue/claim/renew/takeover/fencing/cancel) | `@arnilo/prism-core/runtime/workflows` |
 | C-012 | Interactive TUI | 12 | **Deferred / out of scope for Plan 057** | Future optional plan/package only |
 
 ## Rejected options
@@ -132,7 +132,7 @@ Static review of `src/agents.ts`, `src/agent-loops.ts`, `src/rpc.ts`, `src/cli-r
 
 ## Locked package adapter contracts (Task 1)
 
-These TypeScript shapes are the frozen public contracts for Tasks 2–3. Implementations live in `@arnilo/prism-workflows` only.
+These TypeScript shapes are the frozen public contracts for Tasks 2–3. Implementations live in `@arnilo/prism-core/runtime/workflows` only.
 
 ### Checkpoint adapter
 
@@ -398,9 +398,9 @@ import {
   createWorkflowCommands,
   agentNode,
   functionNode,
-} from "@arnilo/prism-workflows";
+} from "@arnilo/prism-core/runtime/workflows";
 import { runRpcServer } from "@arnilo/prism";
-import { createSqlitePersistence } from "@arnilo/prism-session-store-sqlite";
+import { createSqlitePersistence } from "@arnilo/prism-core/sessions/sqlite";
 
 const persistence = createSqlitePersistence({ filename: "prism.db" });
 const checkpoints = createWorkflowCheckpoints({ store: persistence.checkpoints });
@@ -502,7 +502,7 @@ runRpcServer({
 | Core event multiplexer | **Yes (Task 6)** | `createEventMultiplexer<T>()`; `WorkflowEventBus` delegates fan-in/overflow/abort/close | Removes duplicate queue logic and remains domain-neutral. |
 | Generic `LeaseStore` | **Yes (Task 7)** | Core contract/memory reference; optional `ProductionPersistenceStore.leases`; SQLite/PostgreSQL implementations | Reusable atomic ownership, expiry, opaque claims, and monotonic fencing for coordinators. |
 | Core `ApprovalHandler` | **No** | Host `ExecutionPolicy` / `CodingApprovalFn` with `workflowId`/`nodeId` metadata | Coding-security already owns interactive/async approve callbacks; workflow must not invent a parallel UI type. |
-| Core workflow types | **No** | Stay in `@arnilo/prism-workflows` | Prevents graph vocabulary leaking into non-workflow hosts. |
+| Core workflow types | **No** | Stay in `@arnilo/prism-core/runtime/workflows` | Prevents graph vocabulary leaking into non-workflow hosts. |
 | Interactive TUI package | **No (Plan 057)** | Deferred (C-012); APIs + optional RPC commands | CLI/RPC `CommandDefinition` already is the host control seam. |
 
 Task 1's original no-core choice was superseded by Task 6 after review. DAG, approval, and TUI decisions are unchanged.
@@ -584,11 +584,11 @@ await session.run("Hi", { signal: AbortSignal.timeout(60_000) });
 
 ## Extension and configuration notes
 
-- `@arnilo/prism-workflows` is an optional workspace member; core `package.json` does not depend on it.
+- `@arnilo/prism-core/runtime/workflows` is an optional workspace member; core `package.json` does not depend on it.
 - Workflow agent nodes call public `AgentSession` APIs only; no imports from `src/agents.ts` internals.
 - Workflow checkpoints adapt `ProductionPersistenceStore.checkpoints` (or any `CheckpointStore`); no raw database handles enter the workflow package.
 - Multimodal and credential packages from Plan 056 compose unchanged in workflow examples (Task 4).
-- `@arnilo/prism-workflows` is available directly and through `prism-sdk`/`prism-all`; installation does not start a worker or workflow.
+- `@arnilo/prism-core/runtime/workflows` is available directly and through `prism-sdk`/`prism-all`; installation does not start a worker or workflow.
 - C-012 interactive TUI remains a future optional package if needed; it is not required for workflow feature completeness.
 
 ## Related APIs

package/docs/workflows.md

@@ -2,7 +2,7 @@
 
 ## What it does
 
-`@arnilo/prism-workflows` is an optional package for typed, bounded DAG orchestration over Prism sessions, tools, events, and persistence seams. Hosts define acyclic workflows with agent/function/tool/conditional/fan-out/join/nested-workflow/loop nodes; the package runs a Kahn-style scheduler with a bounded worker pool, emits package-local `WorkflowEvent`s, checkpoints progress, can coordinate queued runs across multiple host processes using durable leases and fencing, and can run bounded linear sagas with durable compensation.
+`@arnilo/prism-core/runtime/workflows` is an optional package for typed, bounded DAG orchestration over Prism sessions, tools, events, and persistence seams. Hosts define acyclic workflows with agent/function/tool/conditional/fan-out/join/nested-workflow/loop nodes; the package runs a Kahn-style scheduler with a bounded worker pool, emits package-local `WorkflowEvent`s, checkpoints progress, can coordinate queued runs across multiple host processes using durable leases and fencing, and can run bounded linear sagas with durable compensation.
 
 Primary exports:
 
@@ -21,7 +21,7 @@ Primary exports:
 | `createWorkflowSchedules` | Explicit ownership-scoped one-time/interval/host-calculated schedules over existing checkpoint/lease stores |
 | `createProactiveScheduleCapabilities` | Scoped, expiring, revocable capability tokens that enable proactive schedules; revocation stops firing fail-closed |
 
-Included through `@arnilo/prism-sdk` and `@arnilo/prism-all`; installing either profile does not start workflows. Interactive TUI is out of scope (C-012 deferred).
+Included through the `@arnilo/prism` / `@arnilo/prism-core` family packages; installing them does not start workflows. Interactive TUI is out of scope (C-012 deferred).
 
 ## When to use it
 
@@ -114,7 +114,7 @@ Saga statuses are `running → completed`, `running → compensating → compens
 
 `createWorkflowSchedules({ store, leases, checkpoints, workflows, ownership, ownerId, calculators? })` is inert until its host calls `pollOnce()` or `run({ signal })`). Ownership requires `tenantId` plus `accountId` or `userId`. Methods are `create`, `get`, `list`, `pause`, `resume`, `trigger`, `delete`, `pollOnce`, and `run`. A record has one required `nextRunAt`, optional fixed `intervalMs` or registered `calculatorId` (never both), bounded input/metadata, status, version, and last-fire attribution. Manual trigger requires an idempotency key. Scheduled run IDs derive from schedule ID plus fire timestamp, so retry after enqueue-before-advance finds the same queued checkpoint instead of duplicating it. Defaults: page 100/hard 500, due claims 16/hard 256, input 256 KiB/hard 1 MiB, poll 1s, fire lease 30s.
 
-`createProactiveScheduleCapabilities({ schedules, store, ownership, ownerId, defaultTtlMs?, maxTtlMs?, onCapability? })` wraps a `WorkflowSchedules` facade in explicit user enablement. `enable({ workflowId, scope, actor, nextRunAt, intervalMs?|calculatorId?, input?, ttlMs? })` creates the schedule plus a scoped, expiring `ScheduleCapabilityToken` (default TTL 24h / hard 31d, record ≤ 16 KiB) stamped with redacted actor refs. `revoke(tokenId, actor)` marks the token revoked and pauses the underlying schedule so `pollOnce()` never fires it (fail-closed). `assertActive(tokenId)` is a fail-closed guard for manual trigger paths — it throws on missing/revoked/expired tokens. `onCapability` emits `capability_enabled` / `capability_revoked` / `capability_denied` events (redacted refs only) that hosts bridge to `@arnilo/prism-policy` for an auditable ledger. Tokens are ownership-scoped checkpoint records; no cron expression or secret is persisted.
+`createProactiveScheduleCapabilities({ schedules, store, ownership, ownerId, defaultTtlMs?, maxTtlMs?, onCapability? })` wraps a `WorkflowSchedules` facade in explicit user enablement. `enable({ workflowId, scope, actor, nextRunAt, intervalMs?|calculatorId?, input?, ttlMs? })` creates the schedule plus a scoped, expiring `ScheduleCapabilityToken` (default TTL 24h / hard 31d, record ≤ 16 KiB) stamped with redacted actor refs. `revoke(tokenId, actor)` marks the token revoked and pauses the underlying schedule so `pollOnce()` never fires it (fail-closed). `assertActive(tokenId)` is a fail-closed guard for manual trigger paths — it throws on missing/revoked/expired tokens. `onCapability` emits `capability_enabled` / `capability_revoked` / `capability_denied` events (redacted refs only) that hosts bridge to `@arnilo/prism-core/governance/policy` for an auditable ledger. Tokens are ownership-scoped checkpoint records; no cron expression or secret is persisted.
 
 ## Outputs / response / events
 
@@ -192,9 +192,9 @@ import {
   runSaga,
   workflowNode,
   suspend,
-} from "@arnilo/prism-workflows";
+} from "@arnilo/prism-core/runtime/workflows";
 import { runRpcServer } from "@arnilo/prism";
-import { createSqlitePersistence } from "@arnilo/prism-session-store-sqlite";
+import { createSqlitePersistence } from "@arnilo/prism-core/sessions/sqlite";
 
 const research = agentNode({
   agent: "researcher",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -122,14 +122,15 @@
     "CHANGELOG.md"
   ],
   "workspaces": [
-    "packages/acp-agent",
-    "packages/ag-ui",
-    "packages/antigravity-agent",
     "packages/mcp",
+    "packages/prism-providers",
     "packages/memory",
+    "packages/prism-core",
+    "packages/prism-coding-tools",
     "packages/office",
-    "packages/prism-*",
-    "packages/web-tools"
+    "packages/ag-ui",
+    "packages/web-tools",
+    "packages/acp-agent"
   ],
   "scripts": {
     "build:core": "node scripts/with-build-lock.mjs tsc",
@@ -137,7 +138,8 @@
     "build": "npm run build:core && npm run build --workspaces --if-present",
     "typecheck": "npm run build && npm run typecheck --workspaces --if-present && tsc -p examples --noEmit",
     "sweep:unused": "node scripts/sweep-unused.mjs --json",
-    "test": "npm run build && node scripts/with-build-lock.mjs node --test dist/__tests__/*.test.js && node scripts/with-build-lock.mjs node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase11-freeze.test.mjs scripts/phase12-freeze.test.mjs scripts/phase13-freeze.test.mjs scripts/phase14-freeze.test.mjs scripts/phase15-freeze.test.mjs scripts/phase16-freeze.test.mjs scripts/phase17-freeze.test.mjs scripts/phase18-freeze.test.mjs scripts/phase19-freeze.test.mjs scripts/phase20-freeze.test.mjs scripts/phase21-freeze.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/benchmark-multi-agent.test.mjs scripts/benchmark-tool-search.test.mjs scripts/benchmark-workflow-loop.test.mjs scripts/sweep-unused.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs scripts/phase23-quality-gates.test.mjs scripts/phase24-truth.test.mjs scripts/phase25-bounded-accumulation.test.mjs scripts/phase26-freeze.test.mjs scripts/phase27-freeze.test.mjs scripts/phase27-ha.test.mjs scripts/phase27-erp-journey.test.mjs scripts/phase27-release.test.mjs scripts/phase29-freeze.test.mjs scripts/phase30-freeze.test.mjs scripts/phase30-release.test.mjs scripts/phase34-freeze.test.mjs scripts/phase37-provider-matrix.test.mjs scripts/phase26-index-benchmark.test.mjs scripts/obscura-host-conformance.test.mjs scripts/phase54-package-map.test.mjs scripts/phase54-legacy-registry.test.mjs && node --test scripts/phase23-build-race.test.mjs && npm run test --workspaces --if-present",
+    "test:live": "node scripts/live-matrix.mjs",
+    "test": "npm run build && node scripts/with-build-lock.mjs node --test dist/__tests__/*.test.js && node scripts/with-build-lock.mjs node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/benchmark-multi-agent.test.mjs scripts/benchmark-tool-search.test.mjs scripts/benchmark-workflow-loop.test.mjs scripts/sweep-unused.test.mjs scripts/dead-export-verify.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs scripts/e2e-full-surface.test.mjs scripts/phase23-quality-gates.test.mjs scripts/phase24-truth.test.mjs scripts/phase25-bounded-accumulation.test.mjs scripts/phase27-ha.test.mjs scripts/phase27-erp-journey.test.mjs scripts/phase37-provider-matrix.test.mjs scripts/phase26-index-benchmark.test.mjs scripts/obscura-host-conformance.test.mjs scripts/phase54-package-map.test.mjs scripts/phase54-legacy-registry.test.mjs scripts/truth-current.test.mjs scripts/packaging-current.test.mjs scripts/import-hygiene.test.mjs scripts/live-matrix.test.mjs scripts/e2e-coverage.test.mjs scripts/live-doc-check.test.mjs && node --test scripts/phase23-build-race.test.mjs && npm run test --workspaces --if-present",
     "test:coverage": "node scripts/with-build-lock.mjs node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' --test-coverage-exclude='**/packages/**' --test-coverage-exclude='**/examples/**' dist/__tests__/*.test.js && node scripts/with-build-lock.mjs node scripts/coverage-summary.mjs && node --test scripts/phase23-coverage.test.mjs && node --test scripts/phase23-skip-manifest.test.mjs",
     "coverage:summary": "node scripts/with-build-lock.mjs node scripts/coverage-summary.mjs",
     "lint": "biome lint . --reporter=sarif --reporter-file=scripts/lint-report.sarif",
@@ -145,6 +147,7 @@
     "format:check": "biome format .",
     "pack:dry-run": "npm pack --dry-run && npm run pack:dry-run --workspaces --if-present",
     "test:postgres": "node scripts/require-postgres-url.mjs && npm run test:postgres --workspace @arnilo/prism-core --if-present && npm run test:postgres --workspace @arnilo/prism-memory && node --test scripts/phase7-conformance.test.mjs scripts/phase12-restart-recovery.test.mjs scripts/phase22-conformance.test.mjs",
+    "test:nats": "node scripts/require-nats-url.mjs && npm run test:nats --workspace @arnilo/prism-core --if-present",
     "release:dry-run": "npm run sdk:ready",
     "release:check": "node scripts/release.mjs check",
     "release:publish": "node scripts/release.mjs publish",
@@ -154,7 +157,7 @@
     "security:threat-suites": "node --test scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase20-security.test.mjs scripts/phase21-security.test.mjs scripts/phase22-security.test.mjs scripts/phase23-security.test.mjs scripts/phase38-codeql-regression.test.mjs scripts/phase40-security.test.mjs scripts/phase46-webhooks-security.test.mjs dist/__tests__/pinned-fetch.test.js packages/prism-core/dist/runtime/server/__tests__/webhooks.test.js"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.5",
+    "@biomejs/biome": "^2.5.11",
     "@types/node": "^26.1.1",
     "typescript": "^7.0.2"
   },

package/templates/init/providers.json

@@ -16,7 +16,9 @@
     "modelName": "gpt-5.1",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport { createOpenAIResponsesProvider } from \"@arnilo/prism-providers/openai\";",
     "providerExpression": "createOpenAIResponsesProvider({\n    apiKey: () => process.env.OPENAI_API_KEY,\n  })",
-    "modelExpression": "{ provider: \"openai\", model: \"gpt-5.1\" }"
+    "modelExpression": "{ provider: \"openai\", model: \"gpt-5.1\" }",
+    "factoryModule": "@arnilo/prism-providers/openai",
+    "factoryExport": "createOpenAIResponsesProvider"
   },
   "openrouter": {
     "id": "openrouter",
@@ -27,7 +29,9 @@
     "modelName": "anthropic/claude-sonnet-4",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createOpenRouterProvider,\n  defineOpenRouterModel,\n} from \"@arnilo/prism-providers/openrouter\";",
     "providerExpression": "createOpenRouterProvider({\n    apiKey: () => process.env.OPENROUTER_API_KEY,\n  })",
-    "modelExpression": "defineOpenRouterModel({ model: \"anthropic/claude-sonnet-4\" })"
+    "modelExpression": "defineOpenRouterModel({ model: \"anthropic/claude-sonnet-4\" })",
+    "factoryModule": "@arnilo/prism-providers/openrouter",
+    "factoryExport": "createOpenRouterProvider"
   },
   "kimi": {
     "id": "kimi",
@@ -38,7 +42,9 @@
     "modelName": "kimi-k2.7-code",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport { createKimiCodingProvider } from \"@arnilo/prism-providers/kimi\";",
     "providerExpression": "createKimiCodingProvider({\n    apiKey: () => process.env.KIMI_API_KEY,\n  })",
-    "modelExpression": "{ provider: \"kimi-coding\", model: \"kimi-k2.7-code\" }"
+    "modelExpression": "{ provider: \"kimi-coding\", model: \"kimi-k2.7-code\" }",
+    "factoryModule": "@arnilo/prism-providers/kimi",
+    "factoryExport": "createKimiCodingProvider"
   },
   "zai": {
     "id": "zai",
@@ -49,7 +55,9 @@
     "modelName": "glm-4.7",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport { createZaiProvider } from \"@arnilo/prism-providers/zai\";",
     "providerExpression": "createZaiProvider({\n    apiKey: () => process.env.ZAI_API_KEY,\n  })",
-    "modelExpression": "{ provider: \"zai\", model: \"glm-4.7\" }"
+    "modelExpression": "{ provider: \"zai\", model: \"glm-4.7\" }",
+    "factoryModule": "@arnilo/prism-providers/zai",
+    "factoryExport": "createZaiProvider"
   },
   "opencode-go": {
     "id": "opencode-go",
@@ -60,7 +68,9 @@
     "modelName": "gpt-5.1-go",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport { createOpenCodeGoProvider } from \"@arnilo/prism-providers/opencode-go\";",
     "providerExpression": "createOpenCodeGoProvider({\n    apiKey: () => process.env.OPENCODE_API_KEY,\n  })",
-    "modelExpression": "{ provider: \"opencode-go\", model: \"gpt-5.1-go\", compat: { route: \"openai\" } }"
+    "modelExpression": "{ provider: \"opencode-go\", model: \"gpt-5.1-go\", compat: { route: \"openai\" } }",
+    "factoryModule": "@arnilo/prism-providers/opencode-go",
+    "factoryExport": "createOpenCodeGoProvider"
   },
   "neuralwatt": {
     "id": "neuralwatt",
@@ -71,7 +81,9 @@
     "modelName": "glm-5.2",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createNeuralWattProvider,\n  defineNeuralWattModel,\n} from \"@arnilo/prism-providers/neuralwatt\";",
     "providerExpression": "createNeuralWattProvider({\n    apiKey: () => process.env.NEURALWATT_API_KEY,\n  })",
-    "modelExpression": "defineNeuralWattModel({\n    model: \"glm-5.2\",\n    cache: { kind: \"implicit\" },\n  })"
+    "modelExpression": "defineNeuralWattModel({\n    model: \"glm-5.2\",\n    cache: { kind: \"implicit\" },\n  })",
+    "factoryModule": "@arnilo/prism-providers/neuralwatt",
+    "factoryExport": "createNeuralWattProvider"
   },
   "alibaba": {
     "id": "alibaba",
@@ -82,7 +94,9 @@
     "modelName": "qwen-plus",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createAlibabaProvider,\n  defineAlibabaModel,\n} from \"@arnilo/prism-providers/alibaba\";",
     "providerExpression": "createAlibabaProvider({\n    apiKey: () => process.env.DASHSCOPE_API_KEY,\n  })",
-    "modelExpression": "defineAlibabaModel({ model: \"qwen-plus\" })"
+    "modelExpression": "defineAlibabaModel({ model: \"qwen-plus\" })",
+    "factoryModule": "@arnilo/prism-providers/alibaba",
+    "factoryExport": "createAlibabaProvider"
   },
   "ollama": {
     "id": "ollama",
@@ -93,6 +107,8 @@
     "modelName": "gpt-oss:20b",
     "imports": "import { createAgent } from \"@arnilo/prism\";\nimport {\n  createOllamaProvider,\n  defineOllamaModel,\n} from \"@arnilo/prism-providers/ollama\";",
     "providerExpression": "createOllamaProvider({\n    apiKey: () => process.env.OLLAMA_API_KEY,\n  })",
-    "modelExpression": "defineOllamaModel({ model: \"gpt-oss:20b\" })"
+    "modelExpression": "defineOllamaModel({ model: \"gpt-oss:20b\" })",
+    "factoryModule": "@arnilo/prism-providers/ollama",
+    "factoryExport": "createOllamaProvider"
   }
 }

package/docs/antigravity-agent.md

@@ -1,207 +0,0 @@
-# Antigravity delegated agent
-
-## What it does
-
-`@arnilo/prism-antigravity-agent` provides a delegated agent adapter for the official [Google Antigravity CLI (`agy`)](https://github.com/google/antigravity). It enables Prism applications to delegate complex, multi-step coding tasks to an authenticated Antigravity CLI runner while exposing host-owned Prism tools, resources, and prompts over a per-run Model Context Protocol (MCP) server.
-
-The package handles the end-to-end delegated execution lifecycle:
-- Spawns the official headless CLI (`agy --agent <name> --workspace <dir>`) as a managed subprocess.
-- Starts a run-bound loopback HTTP MCP server (`http://127.0.0.1:<port>/mcp`) authorized with an ephemeral Bearer token.
-- Writes ephemeral workspace configuration (`.agents/mcp_config.json` and custom agent instructions) with automatic backup and fail-safe restoration.
-- Parses the CLI's NDJSON output stream and projects steps into standard Prism `AgentEvent`s and [AG-UI](ag-ui.md) timeline activities.
-- Persists and resumes multi-turn conversations via `--conversation <id>`.
-- Provides an optional `createAntigravityDelegationTool` for Prism [supervisors](supervisors.md) and orchestrating agents.
-
-Prism does not manage Google OAuth tokens, cookies, or credentials; the host environment owns the official `agy` binary and interactive authentication state (`agy login` / Google AI Pro subscription).
-
-## When to use it
-
-Use `@arnilo/prism-antigravity-agent` when:
-- You want to delegate autonomous coding sessions to Google Antigravity while exposing host-owned Prism tools and capabilities via MCP.
-- You need structured event streaming, token telemetry, and [AG-UI](ag-ui.md) visual timeline integration for Antigravity executions.
-- You are orchestrating multi-agent workflows where a Prism supervisor or coding agent needs to delegate specialized subtasks to Antigravity.
-- You want conversation continuation across multiple user turns in a persistent session.
-
-Do **not** use it:
-- As a generic LLM model provider. For direct Gemini API or Vertex AI foundation model inference without an autonomous loop, use [`@arnilo/prism-providers/google`](providers/google.md) or [`@arnilo/prism-providers/vertex`](providers/vertex.md).
-- If you require step-by-step turn replacement of Antigravity's internal model loop, compaction, or planning strategy.
-- If you require unreleased raw internal chain-of-thought text. Antigravity reasoning effort is projected as token counts and timeline activity steps, not raw hidden thoughts.
-
-## Inputs / request
-
-`createAntigravityCliAgent(options)` accepts agent configuration:
-
-| Field | Type | Default | Purpose |
-| --- | --- | --- | --- |
-| `command` | `string` | `"agy"` | Path to the official `agy` executable on the host. |
-| `args` | `readonly string[]` | `[]` | Additional command-line arguments passed to the CLI. |
-| `cwd` | `string` | `process.cwd()` | Working directory for the runner process. |
-| `env` | `Record<string, string | undefined>` | `process.env` | Process environment variables. |
-| `timeoutMs` | `number` | `300000` (5m) | Maximum process execution time. |
-| `toolPolicy` | `AntigravityToolPolicy` | `"hybrid"` | Built-in CLI tool permissions (`"hybrid"`, `"all"`, `"none"`, or custom). |
-| `tools` | `ToolDefinition[]` | `[]` | Prism tools exposed to the agent via loopback MCP. |
-| `resources` | `ResourceDefinition[]` | `[]` | Prism resources exposed via loopback MCP. |
-| `prompts` | `PromptDefinition[]` | `[]` | Prism prompt templates exposed via loopback MCP. |
-| `exposure` | `AntigravityMcpExposure` | auto-created | Custom MCP server exposure handle if sharing an external server. |
-| `conversationStore` | `AntigravityConversationStore` | in-memory | Store for persisting conversation IDs across turns. |
-| `redactor` | `SecretRedactor` | auto | Secret redactor applied to events and process output. |
-| `agentName` | `string` | `"prism-agent"` | Ephemeral agent definition identifier. |
-| `systemPrompt` | `string` | built-in instructions | Custom instructions appended to the agent definition. |
-
-`agent.run(runOptions)` executes a prompt run:
-
-| Field | Type | Default | Purpose |
-| --- | --- | --- | --- |
-| `prompt` | `string` | required | User task or instruction for Antigravity. |
-| `workspace` | `string` | `agent.cwd` | Target workspace directory path for file modifications. |
-| `sessionId` | `string` | auto-generated | Prism session identifier for conversation persistence. |
-| `branchId` | `string` | `"main"` | Branch identifier for conversation isolation. |
-| `conversationId` | `string` | auto-resolved | Existing Antigravity conversation ID to resume. |
-| `signal` | `AbortSignal` | omitted | Cancellation signal to abort execution and clean up. |
-| `eventSink` | `(event: AgentEvent) => void` | omitted | Real-time event listener for streaming UI updates. |
-| `toolPolicy` | `AntigravityToolPolicy` | agent default | Per-run override for built-in tool policy. |
-
-## Outputs / response / events
-
-`agent.run()` returns a promise resolving to an `AntigravityRunResult`:
-
-| Field | Type | Purpose |
-| --- | --- | --- |
-| `text` | `string` | Final synthesized response text from the Antigravity CLI. |
-| `conversationId` | `string` | Antigravity conversation ID for subsequent multi-turn resumption. |
-| `exitCode` | `number` | Process exit status code (0 for success). |
-| `durationMs` | `number` | Total elapsed execution time in milliseconds. |
-| `events` | `readonly AgentEvent[]` | Complete sequence of projected Prism events emitted during the run. |
-| `usage` | `UsageReport` | Aggregated prompt, completion, total, and thinking token counts. |
-| `subagents` | `readonly AntigravitySubagentSummary[]` | Subagents spawned and completed during execution. |
-
-### Streamed events
-
-The runner emits standardized Prism `AgentEvent` objects to the provided `eventSink`:
-- `delegated_agent_step`: High-level step progression with step name, status, and duration.
-- `message_delta`: Incremental response text chunks.
-- `tool_call_start` / `tool_call_delta` / `tool_call_result`: MCP tool invocations and results.
-- `agent_thought_chunk`: Thinking activity indicators with token counts.
-- `usage`: Token usage telemetry updates.
-- `subagent_spawn` / `subagent_finish`: Internal subagent hierarchy lifecycle.
-
-## Request/response example
-
-```json
-{
-  "prompt": "Inspect the repository and add unit tests for the auth helper.",
-  "workspace": "/home/user/project",
-  "sessionId": "session-101",
-  "toolPolicy": "hybrid"
-}
-```
-
-```json
-{
-  "text": "Added 4 unit tests covering token refresh and validation in auth.test.ts.",
-  "conversationId": "conv_9876543210",
-  "exitCode": 0,
-  "durationMs": 4250,
-  "usage": {
-    "promptTokens": 1520,
-    "completionTokens": 380,
-    "totalTokens": 1900,
-    "thinkingTokens": 640
-  },
-  "subagents": []
-}
-```
-
-## Implementation example
-
-### Direct runner
-
-```ts
-import { createAntigravityCliAgent } from "@arnilo/prism-antigravity-agent";
-import { createReadTool, createWriteTool } from "@arnilo/prism-coding-agent";
-
-// Configure agent with host-owned Prism tools exposed over MCP
-const agent = createAntigravityCliAgent({
-  command: "agy",
-  tools: [
-    createReadTool({ workspaceRoot: "/home/user/project" }),
-    createWriteTool({ workspaceRoot: "/home/user/project" }),
-  ],
-  toolPolicy: "hybrid", // Built-in bash/editor tools enabled; Prism MCP tools added
-});
-
-// Run a task with real-time event streaming
-const result = await agent.run({
-  prompt: "Refactor error handling in src/utils.ts to use typed AppError",
-  workspace: "/home/user/project",
-  sessionId: "session-42",
-  eventSink: (event) => {
-    if (event.type === "message_delta") {
-      process.stdout.write(event.delta.text);
-    }
-  },
-});
-
-console.log(`\nCompleted in ${result.durationMs}ms with conversation ${result.conversationId}`);
-```
-
-### Supervisor delegation tool
-
-```ts
-import { createSupervisor } from "@arnilo/prism-supervisor";
-import {
-  createAntigravityCliAgent,
-  createAntigravityDelegationTool,
-} from "@arnilo/prism-antigravity-agent";
-
-const antigravity = createAntigravityCliAgent({
-  workspace: "/home/user/project",
-  toolPolicy: "hybrid",
-});
-
-const supervisor = createSupervisor({
-  tools: [
-    createAntigravityDelegationTool({
-      agent: antigravity,
-      name: "delegate_to_antigravity",
-      description: "Delegate complex coding tasks to Google Antigravity CLI",
-    }),
-  ],
-});
-```
-
-## Extension and configuration notes
-
-### Ephemeral workspace configuration
-
-During each execution, the adapter dynamically constructs:
-1. `.agents/mcp_config.json`: Configures the local loopback MCP server endpoint (`http://127.0.0.1:<port>/mcp`) and authorization header.
-2. `.agents/agents/<name>/agent.md`: Configures custom instructions and tool permissions.
-
-If pre-existing configuration files exist in `.agents/`, they are backed up before the run and restored atomically upon completion, failure, or cancellation.
-
-### Tool policies
-
-The `toolPolicy` setting controls built-in CLI capabilities:
-- `"hybrid"` (default): Enables built-in editor, terminal, and search tools while exposing configured Prism MCP tools.
-- `"all"`: Enables all built-in CLI tools and MCP tools.
-- `"none"`: Disables built-in tools; the agent relies exclusively on exposed Prism MCP tools.
-- Custom object `{ allow?: string[], deny?: string[] }`: Explicit allow/deny lists for fine-grained governance.
-
-## Security and performance notes
-
-- **Host-owned authentication**: Prism does not read, store, or forward Google credentials. Authentication state resides in the official `agy` CLI's session store managed via `agy login`.
-- **Loopback isolation**: The ephemeral MCP HTTP server binds exclusively to `127.0.0.1` on a dynamically assigned port, secured with a cryptographically random Bearer token.
-- **Fail-safe cleanup**: Workspace configuration files and HTTP listener ports are cleaned up in `finally` blocks under all exit conditions, including `SIGINT`, timeouts, and unhandled errors.
-- **Secret redaction**: All stdout, stderr, event payloads, and tool arguments are processed through Prism's secret redactor before event emission.
-- **Terms and quota**: Antigravity CLI execution utilizes Google AI Pro subscription quotas through the authenticated official binary. Host operators should verify compliance with their organization's terms of service.
-
-## Related APIs
-
-- [Frontend interoperability (AG-UI and ACP)](ag-ui.md): Connect Antigravity event streams to AG-UI and web interfaces.
-- [MCP client bridge and server exposure](mcp-tools.md): Core Model Context Protocol integration in Prism.
-- [Supervisor delegation](supervisors.md): Hierarchical multi-agent delegation patterns.
-- [Coding agent tools](coding-agent-tools.md): Native Prism file, edit, and terminal tools.
-- [Google Gemini provider](providers/google.md): Direct Gemini API model inference without CLI delegation.
-- [Google Vertex AI provider](providers/vertex.md): Enterprise cloud Vertex AI model inference.
-- [Public contracts](public-contracts.md): Core message, event, tool, and session types.