@arnilo/prism 0.6.0 → 0.8.0

package/templates/business-worker/manifest.json

@@ -0,0 +1,12 @@
+{
+  "name": "business-worker",
+  "description": "Multi-tenant business worker: durable storage, tenant isolation, verified identity, and governed invocation boundaries",
+  "version": "0.1.0",
+  "tags": ["business", "worker", "multi-tenant", "enterprise", "secure"],
+  "packages": [
+    "@arnilo/prism",
+    "@arnilo/prism-core",
+    "@arnilo/prism-providers",
+    "@arnilo/prism-work"
+  ]
+}

package/templates/business-worker/package.json.tmpl

@@ -0,0 +1,23 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test dist/__tests__/agent.test.js",
+    "start": "npm run build && node dist/index.js",
+    "dev": "prism dev"
+  },
+  "dependencies": {
+__DEPENDENCIES__
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/business-worker/src/agent.ts.tmpl

@@ -0,0 +1,92 @@
+import {
+  type Agent,
+  createMemoryCheckpointStore,
+  createMockProvider,
+  createSecretRedactor,
+  createSecureAgent,
+  createStaticPermissionPolicy,
+  createStaticTrustPolicy,
+  providerDone,
+  providerTextDelta,
+} from "@arnilo/prism";
+import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
+import { createMemoryWorkDraftStore, type SyncWorkDraftStore } from "@arnilo/prism-work/connectors";
+import type { AgentIdentity } from "@arnilo/prism";
+
+export interface CreateBusinessWorkerOptions {
+  readonly tenantId?: string;
+  readonly userId?: string;
+  readonly identity?: AgentIdentity;
+  readonly store?: import("@arnilo/prism").CheckpointStore;
+  readonly provider?: import("@arnilo/prism").AIProvider;
+  readonly model?: { readonly provider: string; readonly model: string };
+  readonly workspaceRoot?: string;
+}
+
+export function createAppAgent(options: CreateBusinessWorkerOptions = {}): Agent {
+  const tenantId = options.tenantId ?? "tenant-corp";
+  const userId = options.userId ?? "worker-1";
+
+  const identity: AgentIdentity = options.identity ?? {
+    tenantId,
+    userId,
+    principal: { kind: "user", id: userId },
+    scopes: ["worker:execute"],
+    verified: true,
+    issuedAt: new Date().toISOString(),
+  };
+
+  const redactor = createSecretRedactor(
+    [process.env.BUSINESS_API_KEY].filter((v): v is string => typeof v === "string" && v.length > 0),
+  );
+
+  const provider =
+    options.provider ??
+    createMockProvider([
+      providerTextDelta("Business worker ready for tenant tasks."),
+      providerDone(),
+    ]);
+
+  return createSecureAgent({
+    id: "business-worker",
+    definitionRevision: "1",
+    ownership: { tenantId, userId },
+    identity,
+    redactor,
+    permission: createStaticPermissionPolicy(true),
+    trust: createStaticTrustPolicy(true),
+    toolArgumentValidator: createJsonSchemaArgumentValidator(),
+    limits: { maxToolRounds: 15 },
+    runState: { checkpoints: options.store ?? createMemoryCheckpointStore() },
+    tools: [
+      {
+        name: "process_tenant_record",
+        description: "Processes a verified tenant batch item",
+        parameters: {
+          type: "object",
+          properties: {
+            recordId: { type: "string" },
+            action: { type: "string" },
+          },
+          required: ["recordId", "action"],
+          additionalProperties: false,
+        },
+        execute: async (args, ctx) => ({
+          toolCallId: ctx.toolCallId,
+          name: "process_tenant_record",
+          value: {
+            processed: true,
+            tenantId,
+            recordId: (args as { recordId: string }).recordId,
+          },
+        }),
+      },
+    ],
+    provider,
+    model: options.model ?? { provider: "mock", model: "corp-worker-model" },
+  });
+}
+
+export function createWorkerDraftStore(): SyncWorkDraftStore {
+  return createMemoryWorkDraftStore();
+}

package/templates/business-worker/src/index.ts.tmpl

@@ -0,0 +1,13 @@
+import { createAppAgent } from "./agent.js";
+
+async function main() {
+  const agent = createAppAgent({ tenantId: "tenant-acme", userId: "worker-prod-1" });
+  const session = agent.createSession({ id: "biz-session-1" });
+  const result = await session.run("Process batch queue item");
+  console.log(result.text);
+}
+
+main().catch((error) => {
+  console.error("Business worker failed:", error);
+  process.exit(1);
+});

package/templates/business-worker/src/tests/agent.test.ts.tmpl

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { assertHostCompositionReadiness, inspectHostComposition, HostCompositionError } from "@arnilo/prism";
+import { validateApproval } from "@arnilo/prism-work/connectors";
+import type { AgentIdentity } from "@arnilo/prism";
+import { createAppAgent, createWorkerDraftStore } from "../agent.js";
+
+describe("business worker template", () => {
+  it("creates agent and processes task with tenant context", async () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    const session = agent.createSession({ id: "test-biz-session" });
+    const result = await session.run("Run tenant task");
+    assert.ok(result.text.includes("Business worker ready"));
+  });
+
+  it("fails business readiness if memory-only store is configured", () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    assert.throws(
+      () => {
+        assertHostCompositionReadiness({
+          profile: "business",
+          agent,
+          store: { kind: "memory", durable: false },
+        });
+      },
+      (error) => error instanceof HostCompositionError && error.message.includes("durable storage"),
+    );
+  });
+
+  it("passes business readiness with durable store and isolated workspace", () => {
+    const agent = createAppAgent({ tenantId: "tenant-enterprise", userId: "worker-test" });
+    const report = inspectHostComposition({
+      profile: "business",
+      agent,
+      store: { kind: "postgres", durable: true },
+      workspaceRoot: "/var/tenant-enterprise",
+      sandboxRoots: ["/var/tenant-enterprise/tasks"],
+      credentialRefs: ["BUSINESS_API_KEY"],
+    });
+
+    assert.equal(report.profile, "business");
+    assert.equal(report.ownership.tenantId, "tenant-enterprise");
+    assert.equal(report.storage.durable, true);
+    assert.equal(report.sandbox.isolated, true);
+    assert.equal(report.readiness.ok, true);
+  });
+
+  it("rejects a stale draft revision after edit", () => {
+    const store = createWorkerDraftStore();
+    const identity: AgentIdentity = {
+      tenantId: "tenant-enterprise",
+      userId: "worker-test",
+      principal: { kind: "user", id: "worker-test" },
+      scopes: ["Mail.Send"],
+      issuedAt: new Date().toISOString(),
+      verified: true,
+    };
+    const draft = store.createDraft({
+      provider: "microsoft365",
+      op: "mail.send",
+      identity,
+      payload: { to: "a@contoso.com", subject: "v1" },
+    });
+    const approval = {
+      draftId: draft.draftId,
+      revision: draft.revision,
+      payloadDigest: draft.payloadDigest,
+    };
+    const updated = store.updateDraft({
+      draftId: draft.draftId,
+      identity,
+      payload: { to: "a@contoso.com", subject: "v2" },
+      expectedRevision: 1,
+    });
+    assert.throws(() => validateApproval(updated, approval), /does not match draft revision/);
+  });
+});

package/templates/business-worker/tsconfig.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"]
+}

package/templates/personal-assistant/README.md.tmpl

@@ -0,0 +1,18 @@
+# __PROJECT_NAME__
+
+Personal workstation assistant built with Prism. Features single-user ownership, local tools, credential references, and loopback dev inspection.
+
+## Quickstart
+
+```bash
+npm install
+npm test
+npm run dev    # Boots loopback dev inspector at http://127.0.0.1:4311
+```
+
+## Security Posture
+
+- **Single-User Ownership**: Bounded to the local workstation operator (`userId: process.env.USER`).
+- **Secret Redaction**: Environment secrets are redacted before persistence or logs.
+- **Durable Verification**: Uses memory/local storage; in-memory storage is recognized as non-durable.
+- **Containment**: Tool actions are contained to local workspace roots.

package/templates/personal-assistant/env.example.tmpl

@@ -0,0 +1 @@
+OPENAI_API_KEY=

package/templates/personal-assistant/gitignore.tmpl

@@ -0,0 +1,11 @@
+node_modules/
+dist/
+.env
+.env.local
+*.db
+*.sqlite
+*.sqlite3
+.prism/
+coverage/
+.DS_Store
+*.log

package/templates/personal-assistant/manifest.json

@@ -0,0 +1,11 @@
+{
+  "name": "personal-assistant",
+  "description": "Personal workstation assistant: local single-user agent with file tools, credential references, and loopback dev inspection",
+  "version": "0.1.0",
+  "tags": ["personal", "workstation", "assistant", "local", "secure"],
+  "packages": [
+    "@arnilo/prism",
+    "@arnilo/prism-core",
+    "@arnilo/prism-providers"
+  ]
+}

package/templates/personal-assistant/package.json.tmpl

@@ -0,0 +1,23 @@
+{
+  "name": "__PROJECT_NAME__",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test dist/__tests__/agent.test.js",
+    "start": "npm run build && node dist/index.js",
+    "dev": "prism dev"
+  },
+  "dependencies": {
+__DEPENDENCIES__
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/personal-assistant/src/agent.ts.tmpl

@@ -0,0 +1,65 @@
+import {
+  type Agent,
+  createMemoryCheckpointStore,
+  createMockProvider,
+  createSecretRedactor,
+  createSecureAgent,
+  createStaticPermissionPolicy,
+  createStaticTrustPolicy,
+  providerDone,
+  providerTextDelta,
+} from "@arnilo/prism";
+import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
+
+export interface CreatePersonalAgentOptions {
+  readonly userId?: string;
+  readonly provider?: import("@arnilo/prism").AIProvider;
+  readonly model?: { readonly provider: string; readonly model: string };
+  readonly workspaceRoot?: string;
+}
+
+export function createAppAgent(options: CreatePersonalAgentOptions = {}): Agent {
+  const userId = options.userId ?? process.env.USER ?? "local-user";
+  const redactor = createSecretRedactor(
+    [process.env.OPENAI_API_KEY].filter((v): v is string => typeof v === "string" && v.length > 0),
+  );
+
+  const provider =
+    options.provider ??
+    createMockProvider([
+      providerTextDelta("Personal Assistant ready. How can I help you today?"),
+      providerDone(),
+    ]);
+
+  return createSecureAgent({
+    id: "personal-assistant",
+    definitionRevision: "1",
+    ownership: { userId },
+    redactor,
+    permission: createStaticPermissionPolicy(true),
+    trust: createStaticTrustPolicy(true),
+    toolArgumentValidator: createJsonSchemaArgumentValidator(),
+    limits: { maxToolRounds: 10 },
+    runState: { checkpoints: createMemoryCheckpointStore() },
+    tools: [
+      {
+        name: "workspace_status",
+        description: "Reports the local workspace status and configuration",
+        parameters: {
+          type: "object",
+          properties: {
+            details: { type: "boolean", description: "Include detailed status" },
+          },
+          additionalProperties: false,
+        },
+        execute: async (_args, ctx) => ({
+          toolCallId: ctx.toolCallId,
+          name: "workspace_status",
+          value: { ok: true, user: userId, status: "active" },
+        }),
+      },
+    ],
+    provider,
+    model: options.model ?? { provider: "mock", model: "personal-default" },
+  });
+}

package/templates/personal-assistant/src/index.ts.tmpl

@@ -0,0 +1,13 @@
+import { createAppAgent } from "./agent.js";
+
+async function main() {
+  const agent = createAppAgent();
+  const session = agent.createSession({ id: "personal-session-1" });
+  const result = await session.run("Check workspace status");
+  console.log(result.text);
+}
+
+main().catch((error) => {
+  console.error("Personal assistant failed:", error);
+  process.exit(1);
+});

package/templates/personal-assistant/src/tests/agent.test.ts.tmpl

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { assertHostCompositionReadiness, inspectHostComposition } from "@arnilo/prism";
+import { createAppAgent } from "../agent.js";
+
+describe("personal assistant template", () => {
+  it("creates agent and runs an offline turn", async () => {
+    const agent = createAppAgent({ userId: "test-user" });
+    const session = agent.createSession({ id: "test-session" });
+    const result = await session.run("Hello");
+    assert.ok(result.text.includes("Personal Assistant ready"));
+  });
+
+  it("passes personal host composition readiness inspection", () => {
+    const agent = createAppAgent({ userId: "test-user" });
+    const report = inspectHostComposition({
+      profile: "personal",
+      agent,
+      credentialRefs: ["OPENAI_API_KEY"],
+    });
+
+    assert.equal(report.profile, "personal");
+    assert.equal(report.ownership.userId, "test-user");
+    assert.equal(report.readiness.ok, true);
+    assert.equal(report.storage.durable, false, "in-memory store is non-durable");
+    assert.doesNotThrow(() => assertHostCompositionReadiness({ profile: "personal", agent }));
+  });
+});

package/templates/personal-assistant/tsconfig.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["src"]
+}