@arnilo/prism 0.7.0 → 0.9.0

package/docs/work-sandbox.md

@@ -0,0 +1,115 @@
+# Work sandbox (`@arnilo/prism-work/sandbox`)
+
+## What it does
+
+Host-built Docker image and in-process composition for document work. `WORK_SANDBOX_IMAGE` is a digest-pinned fixture (`name@sha256:<64-hex>`); hosts replace the zero digest after `docker build`. `createWorkComposition({ sandbox })` takes an injected `DisposableSandbox` (from `createDockerSandbox`, never forked here), copies its capability attestation, wires `createOfficeTools` filesystem mode plus `work_exec`, and optionally host-side `createWorkTools`. Connectors stay on the host. Default env has no `M365_*` / `GOOGLE_*` keys.
+
+## When to use it
+
+Use when Office parse/generate and Python/LibreOffice/poppler scripts must run inside a network-none container. Do **not** put Graph/Gmail tokens in the sandbox. Do not import `@arnilo/prism-coding-tools` from this package — the host constructs `createDockerSandbox({ image: WORK_SANDBOX_IMAGE, user: "65532:65532", network: { mode: "none" } })` and injects the session.
+
+## Inputs / request
+
+`createWorkComposition(options)`:
+
+| Field | Meaning |
+| --- | --- |
+| `sandbox` | Injected adapter with `execFile` and optional `readFile`/`writeFile`/`root`. Required. |
+| `connectors?` | `WorkToolsOptions` for host-side M365/GWS tools. |
+| `office?` | Extra `createOfficeTools` options (caps, artifacts, redactor). |
+| `reader?` | Host-built `DocumentReader`; exposed on the composition, not turned into tools. |
+| `filesystem?` | `WorkSandboxFilesystem` when the sandbox has no `readFile`/`writeFile`. |
+| `env?` | Extra container env. `M365_*` and `GOOGLE_*` names throw. |
+
+Image build context: `packages/prism-work` (`sandbox/Dockerfile` + `sandbox/soffice.sh` + `vendor/hermes-agent`). Vendored Hermes scripts land at `/opt/prism-work/skills`.
+
+## Outputs / response / events
+
+`{ tools, composition }`. `tools` always include `office_*` and `work_exec`. `composition.capabilities` is a frozen copy of the sandbox attestation (malformed metadata → every field `false`). `networkIsolated` is true only when the sandbox attests it — Docker reports that solely for `network: { mode: "none" }`. `composition.execFile` strips token env names and forces LibreOffice `-env:UserInstallation=file:///tmp/lo-profile` without `--accept` / macro flags.
+
+## Request/response example
+
+```ts
+import { createDockerSandbox } from "@arnilo/prism-coding-tools/security";
+import { createWorkComposition, WORK_SANDBOX_IMAGE } from "@arnilo/prism-work/sandbox";
+
+const sandbox = await createDockerSandbox({
+  docker: "/usr/bin/docker",
+  image: WORK_SANDBOX_IMAGE, // replace zeros with the host-built digest
+  sourceRoot: workdir,
+  user: "65532:65532",
+  network: { mode: "none" },
+});
+const { tools, composition } = createWorkComposition({ sandbox, connectors });
+```
+
+## Implementation example
+
+```ts
+import { createWorkComposition, WORK_SANDBOX_IMAGE } from "@arnilo/prism-work/sandbox";
+
+const { tools, composition } = createWorkComposition({
+  sandbox: fakeDisposableSandbox, // tests inject this; no Docker
+});
+composition.capabilities.networkIsolated; // copied, never invented
+```
+
+Build:
+
+```bash
+docker build -f packages/prism-work/sandbox/Dockerfile -t prism-work-sandbox packages/prism-work
+docker image inspect --format '{{index .RepoDigests 0}}' prism-work-sandbox
+```
+
+## Extension and configuration notes
+
+- Do not fork `createDockerSandbox`. Image pull/build stays outside Prism (`--pull=never`).
+- Connectors optional and host-side. Bytes move via sandbox import/export and office filesystem tools.
+- `work_exec` is argv-only (`file` + `args`); no model-supplied shell string.
+- Protected image check: `PRISM_TEST_WORK_SANDBOX=1` runs `scripts/work-sandbox-image.test.mjs` and sandbox recalc/render/legacy-convert tests. Default `npm test` does not spawn `soffice`.
+
+## Recalc and visual QA
+
+In-process `SheetModel` does not evaluate formulas. Cached values are filled only by LibreOffice in this image (`network: none`, isolated `/tmp/lo-profile`, deleted with the container). Vendored scripts:
+
+```bash
+python3 /opt/prism-work/skills/skills/productivity/xlsx/scripts/xlsx_recalc.py /workspace/out.xlsx --timeout 60
+python3 /opt/prism-work/skills/skills/productivity/powerpoint/scripts/pptx_render.py /workspace/deck.pptx --outdir /workspace/render
+```
+
+Equivalent argv (wrapper already injects `-env:UserInstallation=file:///tmp/lo-profile --headless`):
+
+```bash
+soffice --headless -env:UserInstallation=file:///tmp/lo-profile --convert-to pdf --outdir /tmp/out /workspace/out.xlsx
+pdftoppm -png -r 100 /tmp/out/out.pdf /tmp/out/page
+```
+
+External workbook links cannot be fetched. Recalc then fails closed: formula stays, cached value missing or error — Prism does not invent a number. `soffice` timeout ≤ 60 s.
+
+## Legacy convert
+
+Prism AST still refuses non-ZIP packages. Convert OLE `.doc` / `.xls` / `.ppt` inside this image (`network: none`, isolated `/tmp/lo-profile`, macros refused), then `office_parse`:
+
+```bash
+soffice --headless -env:UserInstallation=file:///tmp/lo-profile --convert-to docx --outdir /workspace /workspace/legacy.doc
+soffice --headless -env:UserInstallation=file:///tmp/lo-profile --convert-to xlsx --outdir /workspace /workspace/legacy.xls
+soffice --headless -env:UserInstallation=file:///tmp/lo-profile --convert-to pptx --outdir /workspace /workspace/legacy.ppt
+```
+
+Do not enable macros. Encrypted OOXML stays dropped. No in-process OLE parser.
+
+## Security and performance notes
+
+- Default network none. Composition does not claim isolation the sandbox did not attest.
+- Token env keys denied by name (`M365_*`, `GOOGLE_*`) at composition construct and `execFile`.
+- LibreOffice wrapper: private `/tmp/lo-profile`, `--headless`, no macro enable, `--accept` refused. No listening socket. Legacy convert uses the same wrapper.
+- Zip bombs: existing office parse caps; sandbox export uses existing export caps.
+- Image build is CI/protected, not default unit tests. Composition construct is in-process with a fake sandbox.
+
+## Related APIs
+
+- [Coding security](coding-security.md) — `createDockerSandbox` digest pin, user, network none
+- [Work tools](work-tools.md) — host-side connectors
+- [Documents](documents.md) — `createOfficeTools`
+- [Document reader](document-reader.md) — optional `reader` injection
+- [Context and skills](context-and-skills.md) — `loadWorkSkills()` (`docx`, `xlsx`, `powerpoint`, `pdf`)

package/docs/work-tools.md

@@ -1,15 +1,15 @@
 # Work tools
 
-Optional `@arnilo/prism-core/integrations/work` subpath: identity-scoped Microsoft 365 and Google Workspace connectors. Host-pinned CLI binaries only; hard-coded `execFile` argv templates; draft-then-approve mutations; side-effect idempotency; shared mail/calendar/file/task result shapes.
+Optional `@arnilo/prism-work/connectors` subpath: identity-scoped Microsoft 365 and Google Workspace connectors. Host-pinned CLI binaries or pinned HTTP adapters; hard-coded operation maps; draft-then-approve mutations; side-effect idempotency; shared mail/calendar/file/task result shapes. HTTP file gets persist untrusted bytes to a host artifact store or contained filesystem, never the transcript.
 
 ## When to use
 
-Use when agents must read or mutate tenant mail/calendar/files/tasks through the enterprise CLI the host already operates — not through model-built shell strings or generic Graph/Discovery free-form calls.
+Use when agents must read or mutate tenant mail/calendar/files/tasks through a host-pinned enterprise CLI or a pinned HTTP adapter — not through model-built shell strings, model-supplied URLs, or generic Graph/Discovery free-form calls.
 
 ## Install
 
 ```bash
-npm install @arnilo/prism-core
+npm install @arnilo/prism @arnilo/prism-work
 # host separately:
 #   npm i -g @pnp/cli-microsoft365
 #   npm i -g @googleworkspace/cli
@@ -20,26 +20,28 @@ npm install @arnilo/prism-core
 ```ts
 import {
   createWorkTools,
-  createMicrosoft365CliAdapter,
+  createMicrosoft365HttpAdapter,
   createGoogleWorkspaceCliAdapter,
+  createGoogleWorkspaceHttpAdapter,
   createMemoryIdempotencyStore,
-} from "@arnilo/prism-core/integrations/work";
-// or: import { createGoogleWorkspaceCliAdapter } from "@arnilo/prism-core/integrations/work/google-workspace";
+} from "@arnilo/prism-work/connectors";
+import { createOAuthWorkTokenProvider } from "@arnilo/prism-core/credentials/node";
+// or: import { createGoogleWorkspaceCliAdapter } from "@arnilo/prism-work/connectors/google-workspace";
 
-const microsoft365 = createMicrosoft365CliAdapter({
-  binary: process.env.M365_BIN!,
-  configDir: `/var/prism/m365/${tenant}/${user}`,
+const microsoft365 = createMicrosoft365HttpAdapter({
   identity,
-  // Optional late-bound per-identity token (0.0.14): env var only, never argv/model context.
-  // tokenProvider: createOAuthWorkTokenProvider({ provider: m365OAuth, store, envVar: "M365_ACCESSTOKEN" }),
+  tokenProvider: createOAuthWorkTokenProvider({ provider: m365OAuth, store, envVar: "M365_ACCESSTOKEN" }),
+  accessEnvVar: "M365_ACCESSTOKEN",
 });
+// Or retain createMicrosoft365CliAdapter({ binary, configDir, identity }) for host-pinned m365.
 
-const googleWorkspace = createGoogleWorkspaceCliAdapter({
-  binary: process.env.GWS_BIN!,
-  configDir: `/var/prism/gws/${tenant}/${user}`,
+const googleWorkspace = createGoogleWorkspaceHttpAdapter({
   identity,
+  tokenProvider: createOAuthWorkTokenProvider({ provider: gwsOAuth, store, envVar: "GOOGLE_ACCESS_TOKEN" }),
+  accessEnvVar: "GOOGLE_ACCESS_TOKEN",
   // allowedOps: add docs.create / sheets.create / slides.create when gated
 });
+// Or retain createGoogleWorkspaceCliAdapter({ binary, configDir, identity }) for host-pinned gws.
 
 const tools = createWorkTools({
   microsoft365,
@@ -47,6 +49,9 @@ const tools = createWorkTools({
   idempotencyStore: createMemoryIdempotencyStore(),
   approval: { isApproved: ({ draftId }) => hostHasApproved(draftId) },
   externalRecipients: { allow: (addr) => addr.endsWith("@contoso.com") },
+  scanAttachment: ({ bytes }) => hostScan(bytes), // required before file-get persistence
+  artifacts: hostWorkArtifacts, // creates ArtifactBodyRef values and owns body storage
+  filesystem: containedFilesystem, // optional destination/source for work-sandbox files
 });
 ```
 
@@ -64,7 +69,9 @@ Verified against [CLI for Microsoft 365](https://pnp.github.io/cli-microsoft365/
 | `calendar.list` | `m365 outlook event list --output json` |
 | `calendar.add` | `m365 outlook event add --output json --subject … --start … --end …` |
 | `file.list` | `m365 file list --output json --webUrl … --folderUrl …` |
+| `file.get` | HTTP only: `GET /me/drive/items/{id}/content` on `graph.microsoft.com` |
 | `file.add` | `m365 file add --output json --folderUrl … --filePath …` |
+| `file.copy` | `m365 file copy --output json --webUrl … --sourceUrl … --targetUrl …` (draft-then-approve) |
 | `file.share` | `m365 spo file sharinglink add` (`--scope organization` only) |
 | `todo.*` / `planner.*` | capability-gated via `allowedOps` |
 
@@ -80,12 +87,22 @@ Verified against [`@googleworkspace/cli` / `gws`](https://github.com/googleworks
 | `calendar.list` | `gws calendar events list --params … --fields …` |
 | `calendar.add` | `gws calendar events insert --params … --json …` |
 | `file.list` | `gws drive files list --params … [--page-all]` (NDJSON when paginated) |
+| `file.get` | HTTP only: `GET /drive/v3/files/{id}?alt=media` on `www.googleapis.com` |
 | `file.add` | `gws drive files create --json … --upload …` |
 | `file.share` | `gws drive permissions create` (`type=domain\|user` only; `anyone` denied) |
 | `task.*` | `gws tasks tasks list\|insert\|patch` |
 | `docs.create` / `sheets.create` / `slides.create` | capability-gated via `allowedOps` |
+| `docs.update` / `sheets.update` / `slides.update` | capability-gated fixed-shape updates; never free-form batch requests |
 
-Startup: M365 `version --output json`; GWS `--version`. Forbidden: `login`, `setup`, `auth`, `schema`, `doctor`, `--debug`, `--verbose`, credentials in argv, anonymous share, model-supplied command strings / free-form Discovery.
+### Microsoft 365 HTTP adapter
+
+`createMicrosoft365HttpAdapter()` uses host-provided OAuth tokens only in the `Authorization` header and pinned fetch against `graph.microsoft.com`. Its fixed map covers Outlook messages/events, draft-then-approve OneDrive copy/sharing, and capability-gated To Do/Planner tasks. `ensureReady()` performs a bounded Graph `/me` request. `m365_file_get` accepts only an item ID and uses fixed `/me/drive/items/{id}/content`; it writes untrusted bytes to an artifact and/or contained filesystem after `scanAttachment`, returning only `{ artifact?, path?, byteLength, contentHash, untrusted: true }`. File list/upload/copy accepts an HTTPS Graph Drive-item URL; arbitrary SharePoint links are rejected rather than resolved with an extra request. The CLI adapter remains available for CLI-specific SharePoint paths.
+
+### Google Workspace HTTP adapter
+
+`createGoogleWorkspaceHttpAdapter()` uses host-provided OAuth tokens only in the `Authorization` header and pinned fetch against `docs.googleapis.com`, `gmail.googleapis.com`, `sheets.googleapis.com`, `slides.googleapis.com`, `www.googleapis.com`, and `tasks.googleapis.com`. Its operation map is fixed: Gmail messages, Calendar events, Drive files/permissions, Google Tasks, and capability-gated native Docs/Sheets/Slides creates plus draft-then-approve fixed-shape updates. Docs accepts only replace-text and insert-text requests; Sheets PUTs a string matrix with `valueInputOption=RAW`; Slides accepts only shape text insertion. No tool accepts a free-form `requests[]`. `ensureReady()` performs a bounded Gmail profile request; `gws_file_get` accepts only an item ID and uses fixed `Drive files.get?alt=media`, persisting untrusted bytes exactly like `m365_file_get`. `file.add` accepts a host-local path, `ArtifactBodyRef`, or contained sandbox path; its approved draft binds the content SHA-256 and rejects changed bytes. The CLI adapter remains available.
+
+Startup: M365 CLI uses `version --output json`; M365 HTTP `ensureReady()` uses Graph `/me`; GWS CLI uses `--version`; GWS HTTP `ensureReady()` uses Gmail profile. Forbidden: `login`, `setup`, `auth`, `schema`, `doctor`, `--debug`, `--verbose`, credentials in argv, anonymous share, model-supplied command strings / URLs / free-form Discovery.
 
 ### Draft → approve → execute (0.7.0, R02)
 
@@ -99,6 +116,7 @@ In Prism 0.7.0, draft lifecycles are durably managed:
 - **Resuming approved drafts**: Mutation tools accept `{ draftId, revision }` without requiring callers to re-supply the full payload. The tool loads the stored draft, validates approval status and digest, reauthorizes immediately before execution, and executes the effect.
 - **Idempotent duplicate approvals**: Re-approving an approved draft with the same approval object is idempotent. Submitting an approval with a mismatched revision or payload digest is rejected with `ERR_PRISM_WORK_DRAFT_STALE` or `ERR_PRISM_WORK_DRAFT_DIGEST`.
 - **Ambiguous failure handling**: If a connector call fails ambiguously after dispatch, both the idempotency record and the draft are marked `unknown`. Re-running with that draft ID or idempotency key fails closed (`ERR_PRISM_WORK_IDEMPOTENCY_UNKNOWN`) and never auto-replays without explicit operator reconciliation.
+- **File-byte binding**: `*_file_draft_upload` accepts a host-local path, `ArtifactBodyRef`, or contained sandbox path. Its payload digest includes `contentHash`; execution re-hashes bytes and rejects a changed source. Artifact reads verify their hash/size through `ArtifactBodyStore`.
 - **Optional body offloading**: Supplying `bodies: ArtifactBodyStore` automatically stores large draft message/file bodies in the object store with an `ArtifactBodyRef` recorded on the draft metadata.
 
 ### Durable idempotency (0.0.23)
@@ -116,6 +134,8 @@ In Prism 0.7.0, draft lifecycles are durably managed:
 
 Call `begin({ identity, key, op })` **before** the external effect. After it succeeds, call `complete`, `fail`, or `markUnknown` with the returned claim token and version. The connector effect stays outside the database transaction, so this is claim-before-effect/deduplication—not exactly-once delivery. Claims default to 15 minutes (hard 60 minutes); expired claims transition to `unknown`; attempts default to 3 (hard 5). Stored rows contain no request body, token, raw provider response, or unrestricted payload.
 
+Durable adapters reject with the portable codes `ERR_PRISM_WORK_IDEMPOTENCY` (a claim or payload the adapter refuses) and `ERR_PRISM_WORK_IDEMPOTENCY_CONFLICT` (a lost race, a stale claim token, or a transition out of order). Match on `error.code`: the error *class* is adapter-specific — the in-memory store raises `WorkToolError`, `createPostgresEnterpriseState(...).workIdempotency` raises `EnterprisePostgresError`, because `@arnilo/prism-core` cannot depend on `@arnilo/prism-work` at runtime — so an `instanceof` check that worked against the pre-move import path will silently stop matching. `packages/prism-core/src/enterprise/postgres/__tests__/work-idempotency.integration.test.ts` drives both adapters through the same conflict scenarios and asserts they report the same codes.
+
 ## Subprocess environment isolation (0.2.0, plan 020 Task 3)
 
 `createCliRunner` never inherits the host environment. The child process receives only:
@@ -145,6 +165,7 @@ Environment maps are validated before spawn: NUL-free, `[A-Za-z_][A-Za-z0-9_]*`
 | Pagination pages | 20 / 100 |
 | Items / aggregate | 50/500 ; 200/2000 |
 | Body / stdout | 256 KiB–2 MiB / 2–16 MiB |
+| Download / upload file | 10 MiB / 50 MiB |
 | Process wall time | 60 s / 10 min |
 | Concurrent CLI / identity | 2 / 8 |
 
@@ -155,9 +176,10 @@ Approved mutations require core-derived `context.idempotencyKey` and a configure
 ## Security
 
 - Require host-verified `AgentIdentity`; no cross-identity configDir reuse.
-- Connector tokens (0.0.14): an optional `tokenProvider` resolves a per-identity access token into an env var per call — never argv, never model context. A missing/expired/revoked/cross-identity/wrong-tenant token fails the call closed before any exec. Refresh is late-bound and single-flighted per account (no refresh storm under reconnect). Build one with `createOAuthWorkTokenProvider()` from `@arnilo/prism-core/credentials/node`.
+- Connector tokens: a `tokenProvider` resolves a per-identity access token only at the connector edge — into CLI env for CLI adapters or an `Authorization` header for HTTP adapters, never argv or model context. A missing/expired/revoked/cross-identity/wrong-tenant token fails the call closed before dispatch. Refresh is late-bound and single-flighted per account. Build one with `createOAuthWorkTokenProvider()` from `@arnilo/prism-core/credentials/node`.
 - External mail recipients fail closed unless `externalRecipients.allow` returns true.
 - Anonymous / `anyone` sharing denied.
+- File gets accept IDs, never URLs; their response stream is cancelled at `maxFileBytes`, scanned before persistence, and returned only as artifact/path metadata with `untrusted: true`.
 - CLI stdout/stderr capped (linear chunk capture, killed/rejected before bytes beyond the cap are retained); NDJSON page streams strictly parsed and page-capped; process killed on timeout/abort/overflow.
 - Subprocess environment isolated (0.2.0): fixed allow-listed base + explicit `env` + late-bound token env; `HOME`/telemetry controls forced; reserved/duplicate/NUL/over-cap env and non-absolute binary/configDir fail before spawn. See [Subprocess environment isolation](#subprocess-environment-isolation-020-plan-020-task-3).
 

package/docs/workflows.md

@@ -88,11 +88,16 @@ All workflow limits and runtime `concurrency` reject non-safe integers, zero, ne
 | `runId` | Caller-supplied id; otherwise generated (`wfr_…`) |
 | `resume` | For suspended runs: `{ decision: "approve" | "deny", input?, expectedVersion }`; version is mandatory for an exact-once CAS claim |
 | `validateResume` | Host validator for resume input; required when `suspend()` declares `resumeSchema` |
+| `metadata` | Sidecar map (`Record<string, unknown>`) persisted on the checkpoint value; a resume that does not re-state it keeps the recorded map |
+| `restoreHooks` | External-state restore hooks (`CheckpointRestoreHook`) run sequentially on every resume before the scheduler writes; the first failure/timeout throws `CheckpointRestoreError` (`ERR_PRISM_CHECKPOINT_RESTORE`) and leaves the checkpoint untouched |
+| `restoreHookTimeoutMs` | Per-hook restore ceiling in ms; defaults to `DEFAULT_CHECKPOINT_RESTORE_TIMEOUT_MS` (10 s) |
 | `validateState` | Host validator for every initial/restored/updated state; required when workflow declares `state.schema` |
 | `initialState` | Optional host initial state override; nested workflows receive parent state automatically |
 
 A function node returns `suspend({ reason, data?, resumeSchema? })` to persist `status: "suspended"`. Its next invocation receives `ctx.resume` only after an approved resume. `resumeWorkflow(workflow, { runId }, options)` validates schema/version/ownership/`definitionHash`, claims the checkpoint before node execution, and continues the suspended node. Denial persists terminal `denied` status without invoking it. Existing failed/aborted checkpoint resume remains available without a human decision.
 
+Restore hooks make the resume all-or-nothing across layers: workflow checkpoints carry the host's `metadata` (git commit, document version, workspace fingerprint), `restoreHooks` put each recorded layer back, and only when every hook succeeds does the scheduler claim the checkpoint and continue. Each hook receives `{ workflowId, runId, version, status, metadata, checkpoint }` and an `AbortSignal`; the successful run's `workflow_resumed` event carries `restore: { hooks: [{ hook, durationMs }], durationMs }`. No hooks ⇒ no hook call and no `restore` field.
+
 > **Contract — resume-aware nodes.** After an approved resume, the **same** node's `execute` is re-invoked with `ctx.resume`. Returning `suspend(...)` unconditionally re-suspends silently; downstream nodes never run. Branch on `ctx.resume`:
 >
 > ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Agent harness for AI providers, agents, sessions, and tools.",
   "type": "module",
   "main": "./dist/index.js",
@@ -50,6 +50,10 @@
       "types": "./dist/testing/compaction-conformance.d.ts",
       "default": "./dist/testing/compaction-conformance.js"
     },
+    "./testing/prefix-stability-conformance": {
+      "types": "./dist/testing/prefix-stability-conformance.d.ts",
+      "default": "./dist/testing/prefix-stability-conformance.js"
+    },
     "./testing/tool-conformance": {
       "types": "./dist/testing/tool-conformance.d.ts",
       "default": "./dist/testing/tool-conformance.js"
@@ -125,9 +129,10 @@
     "packages/mcp",
     "packages/prism-providers",
     "packages/memory",
+    "packages/prism-work",
     "packages/prism-core",
+    "packages/prism-channels",
     "packages/prism-coding-tools",
-    "packages/office",
     "packages/ag-ui",
     "packages/web-tools",
     "packages/acp-agent"
@@ -146,7 +151,8 @@
     "format": "biome format --write .",
     "format:check": "biome format .",
     "pack:dry-run": "npm pack --dry-run && npm run pack:dry-run --workspaces --if-present",
-    "test:postgres": "node scripts/require-postgres-url.mjs && npm run test:postgres --workspace @arnilo/prism-core --if-present && npm run test:postgres --workspace @arnilo/prism-memory && node --test scripts/phase7-conformance.test.mjs scripts/phase12-restart-recovery.test.mjs scripts/phase22-conformance.test.mjs",
+    "test:postgres": "node scripts/postgres-evidence.mjs",
+    "test:postgres:run": "node scripts/require-postgres-url.mjs && npm run test:postgres --workspace @arnilo/prism-core --if-present && npm run test:postgres --workspace @arnilo/prism-memory && npm run test:postgres --workspace @arnilo/prism-channels && node --test scripts/phase7-conformance.test.mjs scripts/phase12-restart-recovery.test.mjs scripts/phase22-conformance.test.mjs",
     "test:nats": "node scripts/require-nats-url.mjs && npm run test:nats --workspace @arnilo/prism-core --if-present",
     "release:dry-run": "npm run sdk:ready",
     "release:check": "node scripts/release.mjs check",

package/templates/business-worker/manifest.json

@@ -6,6 +6,7 @@
   "packages": [
     "@arnilo/prism",
     "@arnilo/prism-core",
-    "@arnilo/prism-providers"
+    "@arnilo/prism-providers",
+    "@arnilo/prism-work"
   ]
 }

package/templates/business-worker/src/agent.ts.tmpl

@@ -10,7 +10,7 @@ import {
   providerTextDelta,
 } from "@arnilo/prism";
 import { createJsonSchemaArgumentValidator } from "@arnilo/prism-core/validation/json-schema";
-import { createMemoryWorkDraftStore, type SyncWorkDraftStore } from "@arnilo/prism-core/integrations/work";
+import { createMemoryWorkDraftStore, type SyncWorkDraftStore } from "@arnilo/prism-work/connectors";
 import type { AgentIdentity } from "@arnilo/prism";
 
 export interface CreateBusinessWorkerOptions {

package/templates/business-worker/src/tests/agent.test.ts.tmpl

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { assertHostCompositionReadiness, inspectHostComposition, HostCompositionError } from "@arnilo/prism";
-import { validateApproval } from "@arnilo/prism-core/integrations/work";
+import { validateApproval } from "@arnilo/prism-work/connectors";
 import type { AgentIdentity } from "@arnilo/prism";
 import { createAppAgent, createWorkerDraftStore } from "../agent.js";