@arnilo/prism 0.5.6 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.5.6",
+  "version": "0.7.0",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -139,7 +139,7 @@
     "typecheck": "npm run build && npm run typecheck --workspaces --if-present && tsc -p examples --noEmit",
     "sweep:unused": "node scripts/sweep-unused.mjs --json",
     "test:live": "node scripts/live-matrix.mjs",
-    "test": "npm run build && node scripts/with-build-lock.mjs node --test dist/__tests__/*.test.js && node scripts/with-build-lock.mjs node --test scripts/release-gate.test.mjs scripts/tooling-gate.test.mjs scripts/budget-gate.test.mjs scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/benchmark-0.1.0.test.mjs scripts/benchmark-multi-agent.test.mjs scripts/benchmark-tool-search.test.mjs scripts/benchmark-workflow-loop.test.mjs scripts/sweep-unused.test.mjs scripts/dead-export-verify.test.mjs scripts/e2e-enterprise-journey.test.mjs scripts/e2e-coding-journey.test.mjs scripts/e2e-full-surface.test.mjs scripts/phase23-quality-gates.test.mjs scripts/phase24-truth.test.mjs scripts/phase25-bounded-accumulation.test.mjs scripts/phase27-ha.test.mjs scripts/phase27-erp-journey.test.mjs scripts/phase37-provider-matrix.test.mjs scripts/phase26-index-benchmark.test.mjs scripts/obscura-host-conformance.test.mjs scripts/phase54-package-map.test.mjs scripts/phase54-legacy-registry.test.mjs scripts/truth-current.test.mjs scripts/packaging-current.test.mjs scripts/import-hygiene.test.mjs scripts/live-matrix.test.mjs scripts/e2e-coverage.test.mjs scripts/live-doc-check.test.mjs && node --test scripts/phase23-build-race.test.mjs && npm run test --workspaces --if-present",
+    "test": "node scripts/run-all-tests.mjs",
     "test:coverage": "node scripts/with-build-lock.mjs node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-functions=70 --test-coverage-branches=75 --test-coverage-exclude='**/__tests__/**' --test-coverage-exclude='**/node_modules/**' --test-coverage-exclude='**/scripts/**' --test-coverage-exclude='**/packages/**' --test-coverage-exclude='**/examples/**' dist/__tests__/*.test.js && node scripts/with-build-lock.mjs node scripts/coverage-summary.mjs && node --test scripts/phase23-coverage.test.mjs && node --test scripts/phase23-skip-manifest.test.mjs",
     "coverage:summary": "node scripts/with-build-lock.mjs node scripts/coverage-summary.mjs",
     "lint": "biome lint . --reporter=sarif --reporter-file=scripts/lint-report.sarif",
@@ -157,12 +157,12 @@
     "security:threat-suites": "node --test scripts/phase8-conformance.test.mjs scripts/phase9-conformance.test.mjs scripts/phase10-conformance.test.mjs scripts/phase11-conformance.test.mjs scripts/phase20-security.test.mjs scripts/phase21-security.test.mjs scripts/phase22-security.test.mjs scripts/phase23-security.test.mjs scripts/phase38-codeql-regression.test.mjs scripts/phase40-security.test.mjs scripts/phase46-webhooks-security.test.mjs dist/__tests__/pinned-fetch.test.js packages/prism-core/dist/runtime/server/__tests__/webhooks.test.js"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.5.11",
-    "@types/node": "^26.1.1",
+    "@biomejs/biome": "^2.5.13",
+    "@types/node": "^22.20.0",
     "typescript": "^7.0.2"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "license": "MIT",
   "repository": {

package/templates/README.md

@@ -8,6 +8,8 @@ Ready-to-run project templates for `prism init --template <name>`.
 | --- | --- | --- |
 | `init` | Minimal starter Prism agent with one selected provider and offline mock test | `@arnilo/prism` |
 | `deep-research` | Flagship deep research agent: plan -> search -> extract -> refine loop -> citations -> HITL clarify | `@arnilo/prism`, `@arnilo/prism-web-tools`, `@arnilo/prism-memory`, `@arnilo/prism-workflows` |
+| `personal-assistant` | Personal workstation assistant: single-user ownership, local tools, credential references, and dev inspection | `@arnilo/prism`, `@arnilo/prism-core`, `@arnilo/prism-providers` |
+| `business-worker` | Multi-tenant business worker: durable storage, tenant isolation, verified identity, and governed boundaries | `@arnilo/prism`, `@arnilo/prism-core`, `@arnilo/prism-providers` |
 
 ## Usage
 

package/templates/business-worker/README.md.tmpl

@@ -0,0 +1,19 @@
+# __PROJECT_NAME__
+
+Multi-tenant business worker built with Prism. Features strict tenant isolation, verified identities, durable persistence, and governed invocation boundaries.
+
+## Quickstart
+
+```bash
+npm install
+npm test
+npm start
+```
+
+## Production Readiness Requirements
+
+- **Tenant Isolation**: Non-empty `tenantId` in ownership; tenant-scoped stores and workspaces.
+- **Verified Identity**: Host-verified principal matching tenant ownership; no fabricated identities.
+- **Durable Persistence**: Production readiness strictly rejects in-memory stores; PostgreSQL or SQLite durable stores required.
+- **Workspace Containment**: Execution confined to authorized tenant sandbox directories.
+- **Governed Invocation**: Permission policies, trust verification, parameter validation, and secret redaction enforced.

package/templates/business-worker/env.example.tmpl

@@ -0,0 +1 @@
+BUSINESS_API_KEY=

package/templates/business-worker/gitignore.tmpl

@@ -0,0 +1,11 @@
+node_modules/
+dist/
+.env
+.env.local
+*.db
+*.sqlite
+*.sqlite3
+.prism/
+coverage/
+.DS_Store
+*.log

package/templates/business-worker/manifest.json

@@ -0,0 +1,11 @@
+{
+  "name": "business-worker",
+  "description": "Multi-tenant business worker: durable storage, tenant isolation, verified identity, and governed invocation boundaries",
+  "version": "0.1.0",
+  "tags": ["business", "worker", "multi-tenant", "enterprise", "secure"],
+  "packages": [
+    "@arnilo/prism",
+    "@arnilo/prism-core",
+    "@arnilo/prism-providers"
+  ]
+}

package/templates/business-worker/package.json.tmpl

@@ -0,0 +1,23 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test dist/__tests__/agent.test.js",
+    "start": "npm run build && node dist/index.js",
+    "dev": "prism dev"
+  },
+  "dependencies": {
+__DEPENDENCIES__
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/business-worker/src/agent.ts.tmpl

@@ -0,0 +1,92 @@
+import {
+  type Agent,
+  createMemoryCheckpointStore,
+  createMockProvider,
+  createSecretRedactor,
+  createSecureAgent,
+  createStaticPermissionPolicy,
+  createStaticTrustPolicy,
+  providerDone,
+  providerTextDelta,
+} from "@arnilo/prism";
+import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
+import { createMemoryWorkDraftStore, type SyncWorkDraftStore } from "@arnilo/prism-core/integrations/work";
+import type { AgentIdentity } from "@arnilo/prism";
+
+export interface CreateBusinessWorkerOptions {
+  readonly tenantId?: string;
+  readonly userId?: string;
+  readonly identity?: AgentIdentity;
+  readonly store?: import("@arnilo/prism").CheckpointStore;
+  readonly provider?: import("@arnilo/prism").AIProvider;
+  readonly model?: { readonly provider: string; readonly model: string };
+  readonly workspaceRoot?: string;
+}
+
+export function createAppAgent(options: CreateBusinessWorkerOptions = {}): Agent {
+  const tenantId = options.tenantId ?? "tenant-corp";
+  const userId = options.userId ?? "worker-1";
+
+  const identity: AgentIdentity = options.identity ?? {
+    tenantId,
+    userId,
+    principal: { kind: "user", id: userId },
+    scopes: ["worker:execute"],
+    verified: true,
+    issuedAt: new Date().toISOString(),
+  };
+
+  const redactor = createSecretRedactor(
+    [process.env.BUSINESS_API_KEY].filter((v): v is string => typeof v === "string" && v.length > 0),
+  );
+
+  const provider =
+    options.provider ??
+    createMockProvider([
+      providerTextDelta("Business worker ready for tenant tasks."),
+      providerDone(),
+    ]);
+
+  return createSecureAgent({
+    id: "business-worker",
+    definitionRevision: "1",
+    ownership: { tenantId, userId },
+    identity,
+    redactor,
+    permission: createStaticPermissionPolicy(true),
+    trust: createStaticTrustPolicy(true),
+    toolArgumentValidator: createJsonSchemaArgumentValidator(),
+    limits: { maxToolRounds: 15 },
+    runState: { checkpoints: options.store ?? createMemoryCheckpointStore() },
+    tools: [
+      {
+        name: "process_tenant_record",
+        description: "Processes a verified tenant batch item",
+        parameters: {
+          type: "object",
+          properties: {
+            recordId: { type: "string" },
+            action: { type: "string" },
+          },
+          required: ["recordId", "action"],
+          additionalProperties: false,
+        },
+        execute: async (args, ctx) => ({
+          toolCallId: ctx.toolCallId,
+          name: "process_tenant_record",
+          value: {
+            processed: true,
+            tenantId,
+            recordId: (args as { recordId: string }).recordId,
+          },
+        }),
+      },
+    ],
+    provider,
+    model: options.model ?? { provider: "mock", model: "corp-worker-model" },
+  });
+}
+
+export function createWorkerDraftStore(): SyncWorkDraftStore {
+  return createMemoryWorkDraftStore();
+}

package/templates/business-worker/src/index.ts.tmpl

@@ -0,0 +1,13 @@
+import { createAppAgent } from "./agent.js";
+
+async function main() {
+  const agent = createAppAgent({ tenantId: "tenant-acme", userId: "worker-prod-1" });
+  const session = agent.createSession({ id: "biz-session-1" });
+  const result = await session.run("Process batch queue item");
+  console.log(result.text);
+}
+
+main().catch((error) => {
+  console.error("Business worker failed:", error);
+  process.exit(1);
+});

package/templates/business-worker/src/tests/agent.test.ts.tmpl

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { assertHostCompositionReadiness, inspectHostComposition, HostCompositionError } from "@arnilo/prism";
+import { validateApproval } from "@arnilo/prism-core/integrations/work";
+import type { AgentIdentity } from "@arnilo/prism";
+import { createAppAgent, createWorkerDraftStore } from "../agent.js";
+
+describe("business worker template", () => {
+  it("creates agent and processes task with tenant context", async () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    const session = agent.createSession({ id: "test-biz-session" });
+    const result = await session.run("Run tenant task");
+    assert.ok(result.text.includes("Business worker ready"));
+  });
+
+  it("fails business readiness if memory-only store is configured", () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    assert.throws(
+      () => {
+        assertHostCompositionReadiness({
+          profile: "business",
+          agent,
+          store: { kind: "memory", durable: false },
+        });
+      },
+      (error) => error instanceof HostCompositionError && error.message.includes("durable storage"),
+    );
+  });
+
+  it("passes business readiness with durable store and isolated workspace", () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    const report = inspectHostComposition({
+      profile: "business",
+      agent,
+      store: { kind: "postgres", durable: true },
+      workspaceRoot: "/var/tenant-enterprise",
+      sandboxRoots: ["/var/tenant-enterprise/tasks"],
+      credentialRefs: ["BUSINESS_API_KEY"],
+    });
+
+    assert.equal(report.profile, "business");
+    assert.equal(report.ownership.tenantId, "tenant-enterprise");
+    assert.equal(report.storage.durable, true);
+    assert.equal(report.sandbox.isolated, true);
+    assert.equal(report.readiness.ok, true);
+  });
+
+  it("rejects a stale draft revision after edit", () => {
+    const store = createWorkerDraftStore();
+    const identity: AgentIdentity = {
+      tenantId: "tenant-enterprise",
+      userId: "worker-test",
+      principal: { kind: "user", id: "worker-test" },
+      scopes: ["Mail.Send"],
+      issuedAt: new Date().toISOString(),
+      verified: true,
+    };
+    const draft = store.createDraft({
+      provider: "microsoft365",
+      op: "mail.send",
+      identity,
+      payload: { to: "a@contoso.com", subject: "v1" },
+    });
+    const approval = {
+      draftId: draft.draftId,
+      revision: draft.revision,
+      payloadDigest: draft.payloadDigest,
+    };
+    const updated = store.updateDraft({
+      draftId: draft.draftId,
+      identity,
+      payload: { to: "a@contoso.com", subject: "v2" },
+      expectedRevision: 1,
+    });
+    assert.throws(() => validateApproval(updated, approval), /does not match draft revision/);
+  });
+});

package/templates/business-worker/tsconfig.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"]
+}

package/templates/personal-assistant/README.md.tmpl

@@ -0,0 +1,18 @@
+# __PROJECT_NAME__
+
+Personal workstation assistant built with Prism. Features single-user ownership, local tools, credential references, and loopback dev inspection.
+
+## Quickstart
+
+```bash
+npm install
+npm test
+npm run dev    # Boots loopback dev inspector at http://127.0.0.1:4311
+```
+
+## Security Posture
+
+- **Single-User Ownership**: Bounded to the local workstation operator (`userId: process.env.USER`).
+- **Secret Redaction**: Environment secrets are redacted before persistence or logs.
+- **Durable Verification**: Uses memory/local storage; in-memory storage is recognized as non-durable.
+- **Containment**: Tool actions are contained to local workspace roots.

package/templates/personal-assistant/env.example.tmpl

@@ -0,0 +1 @@
+OPENAI_API_KEY=

package/templates/personal-assistant/gitignore.tmpl

@@ -0,0 +1,11 @@
+node_modules/
+dist/
+.env
+.env.local
+*.db
+*.sqlite
+*.sqlite3
+.prism/
+coverage/
+.DS_Store
+*.log

package/templates/personal-assistant/manifest.json

@@ -0,0 +1,11 @@
+{
+  "name": "personal-assistant",
+  "description": "Personal workstation assistant: local single-user agent with file tools, credential references, and loopback dev inspection",
+  "version": "0.1.0",
+  "tags": ["personal", "workstation", "assistant", "local", "secure"],
+  "packages": [
+    "@arnilo/prism",
+    "@arnilo/prism-core",
+    "@arnilo/prism-providers"
+  ]
+}

package/templates/personal-assistant/package.json.tmpl

@@ -0,0 +1,23 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test dist/__tests__/agent.test.js",
+    "start": "npm run build && node dist/index.js",
+    "dev": "prism dev"
+  },
+  "dependencies": {
+__DEPENDENCIES__
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/personal-assistant/src/agent.ts.tmpl

@@ -0,0 +1,65 @@
+import {
+  type Agent,
+  createMemoryCheckpointStore,
+  createMockProvider,
+  createSecretRedactor,
+  createSecureAgent,
+  createStaticPermissionPolicy,
+  createStaticTrustPolicy,
+  providerDone,
+  providerTextDelta,
+} from "@arnilo/prism";
+import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
+
+export interface CreatePersonalAgentOptions {
+  readonly userId?: string;
+  readonly provider?: import("@arnilo/prism").AIProvider;
+  readonly model?: { readonly provider: string; readonly model: string };
+  readonly workspaceRoot?: string;
+}
+
+export function createAppAgent(options: CreatePersonalAgentOptions = {}): Agent {
+  const userId = options.userId ?? process.env.USER ?? "local-user";
+  const redactor = createSecretRedactor(
+    [process.env.OPENAI_API_KEY].filter((v): v is string => typeof v === "string" && v.length > 0),
+  );
+
+  const provider =
+    options.provider ??
+    createMockProvider([
+      providerTextDelta("Personal Assistant ready. How can I help you today?"),
+      providerDone(),
+    ]);
+
+  return createSecureAgent({
+    id: "personal-assistant",
+    definitionRevision: "1",
+    ownership: { userId },
+    redactor,
+    permission: createStaticPermissionPolicy(true),
+    trust: createStaticTrustPolicy(true),
+    toolArgumentValidator: createJsonSchemaArgumentValidator(),
+    limits: { maxToolRounds: 10 },
+    runState: { checkpoints: createMemoryCheckpointStore() },
+    tools: [
+      {
+        name: "workspace_status",
+        description: "Reports the local workspace status and configuration",
+        parameters: {
+          type: "object",
+          properties: {
+            details: { type: "boolean", description: "Include detailed status" },
+          },
+          additionalProperties: false,
+        },
+        execute: async (_args, ctx) => ({
+          toolCallId: ctx.toolCallId,
+          name: "workspace_status",
+          value: { ok: true, user: userId, status: "active" },
+        }),
+      },
+    ],
+    provider,
+    model: options.model ?? { provider: "mock", model: "personal-default" },
+  });
+}

package/templates/personal-assistant/src/index.ts.tmpl

@@ -0,0 +1,13 @@
+import { createAppAgent } from "./agent.js";
+
+async function main() {
+  const agent = createAppAgent();
+  const session = agent.createSession({ id: "personal-session-1" });
+  const result = await session.run("Check workspace status");
+  console.log(result.text);
+}
+
+main().catch((error) => {
+  console.error("Personal assistant failed:", error);
+  process.exit(1);
+});

package/templates/personal-assistant/src/tests/agent.test.ts.tmpl

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { assertHostCompositionReadiness, inspectHostComposition } from "@arnilo/prism";
+import { createAppAgent } from "../agent.js";
+
+describe("personal assistant template", () => {
+  it("creates agent and runs an offline turn", async () => {
+    const agent = createAppAgent({ userId: "test-user" });
+    const session = agent.createSession({ id: "test-session" });
+    const result = await session.run("Hello");
+    assert.ok(result.text.includes("Personal Assistant ready"));
+  });
+
+  it("passes personal host composition readiness inspection", () => {
+    const agent = createAppAgent({ userId: "test-user" });
+    const report = inspectHostComposition({
+      profile: "personal",
+      agent,
+      credentialRefs: ["OPENAI_API_KEY"],
+    });
+
+    assert.equal(report.profile, "personal");
+    assert.equal(report.ownership.userId, "test-user");
+    assert.equal(report.readiness.ok, true);
+    assert.equal(report.storage.durable, false, "in-memory store is non-durable");
+    assert.doesNotThrow(() => assertHostCompositionReadiness({ profile: "personal", agent }));
+  });
+});

package/templates/personal-assistant/tsconfig.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"]
+}