@arnilo/prism-server 0.0.23 → 0.0.24

package/CHANGELOG.md

@@ -1,11 +1,20 @@
 # Changelog
 
+## [0.0.24] - 2026-08-04
+
+### Added
+- Durable `AgentEventSource` (memory + PostgreSQL LISTEN/NOTIFY), recoverable `ToolEffectStore`, and AG-UI MCP/MCP Apps/A2A fronting for Phase 7.
+
+### Changed
+- Publishable graph remains **47** manifests at **0.0.24**; peers and lockfile move together.
+
+See [migration guide](../../docs/migration.md) for the 0.0.23 → 0.0.24 notes.
+
 ## [0.0.23] - 2026-08-03
 
 ### Changed
 - Released with exact 0.0.23 graph.
 
-
 ## [0.0.22] - 2026-07-31
 
 ### Changed
@@ -16,14 +25,11 @@
 ### Changed
 - Released with exact 0.0.21 graph.
 
-
-
 ## [0.0.20] - 2026-07-31
 
 ### Changed
 - Released with exact 0.0.20 graph.
 
-
 ## [0.0.19] - 2026-07-30
 
 ### Changed

package/README.md

@@ -24,7 +24,7 @@ const response = await handler(new Request("https://api.example.test/prism/agent
 }));
 ```
 
-Routes: direct/SSE agent run, explicitly selected durable agent status/resume through `agentRuns`, direct/SSE workflow run, durable workflow enqueue/status/cancel/resume/replay, and optional ownership-scoped schedule create/list/pause/resume/trigger/delete. `agentRuns` uses core `createAgentRunLifecycle()`; no lifecycle route exists by default. All bodies, responses, events, queues, concurrency, and timeouts are bounded.
+Routes: direct/SSE agent run, cross-replica durable event reconnect through object agent exposures with `events` + `resolveRun`, explicitly selected durable agent status/resume through `agentRuns`, direct/SSE workflow run, durable workflow enqueue/status/cancel/resume/replay, and optional ownership-scoped schedule create/list/pause/resume/trigger/delete. `agentRuns` uses core `createAgentRunLifecycle()`; no lifecycle route exists by default. All bodies, responses, events, queues, concurrency, and timeouts are bounded.
 
 Optional 0.0.14 co-work handlers (mount beside the API handler): `createConversationHandler` (durable user-scoped conversation threads with reconnectable redacted replay — `createConversationService`) and `createArtifactHandler` (artifact revisions, approve/reject review, expiring authorized delivery links — `createArtifactService` over the existing checkpoint store). Both are ownership-scoped and fail closed without authorization.
 

package/dist/handler.js

@@ -28,7 +28,7 @@ export function createPrismHandler(options) {
                     headers: {
                         "access-control-allow-origin": origin,
                         "access-control-allow-methods": "GET, POST, DELETE, OPTIONS",
-                        "access-control-allow-headers": "content-type, authorization",
+                        "access-control-allow-headers": "content-type, authorization, last-event-id",
                         vary: "origin",
                     },
                 }));
@@ -111,6 +111,35 @@ export function createPrismHandler(options) {
                     owned.dispose();
                 }
             }
+            if (route.kind === "agent-events") {
+                const exposure = options.agents?.[route.capabilityId];
+                if (!exposure || !("sessionFactory" in exposure) || !exposure.events || !exposure.resolveRun) {
+                    throw new PrismServerError("Not found", 404, "ERR_PRISM_SERVER_NOT_FOUND");
+                }
+                if (!authorization.ownership.tenantId)
+                    throw new PrismServerError("Forbidden", 403, "ERR_PRISM_SERVER_FORBIDDEN");
+                acquire();
+                const owned = ownedSignal(request, limits.requestTimeoutMs, options.disconnectAborts ?? true);
+                try {
+                    const run = await awaitWithSignal(Promise.resolve(exposure.resolveRun({ runId: route.runId, authorization, signal: owned.signal })), owned.signal);
+                    if (!run?.sessionId)
+                        throw new PrismServerError("Not found", 404, "ERR_PRISM_SERVER_NOT_FOUND");
+                    const after = replayCursor(request, limits.maxReplayCursorBytes);
+                    const events = exposure.events.subscribe({
+                        ownership: authorization.ownership,
+                        sessionId: run.sessionId,
+                        runId: run.runId,
+                        after,
+                        signal: owned.signal,
+                    });
+                    return respond(sseAgentEvents(events, owned, limits, options, release));
+                }
+                catch (error) {
+                    owned.dispose();
+                    release();
+                    throw error;
+                }
+            }
             if (route.kind === "agent-status" || route.kind === "agent-resume") {
                 const exposure = options.agentRuns?.[route.capabilityId];
                 if (!exposure)
@@ -378,6 +407,8 @@ function parseRoute(request, base) {
             return { kind: "agent-status", operation: "agent.status", capabilityId: id, runId };
         if (parts.length === 5 && action === "resume" && request.method === "POST")
             return { kind: "agent-resume", operation: "agent.resume", capabilityId: id, runId };
+        if (parts.length === 5 && action === "events" && request.method === "GET")
+            return { kind: "agent-events", operation: "agent.events", capabilityId: id, runId };
     }
     if (group !== "workflows")
         return undefined;
@@ -592,6 +623,18 @@ function readOptionalId(value, name) {
 function validId(value) {
     return value.length <= 128 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value);
 }
+function replayCursor(request, maxBytes) {
+    const query = new URL(request.url).searchParams.get("cursor") ?? undefined;
+    const header = request.headers.get("last-event-id") ?? undefined;
+    if (query !== undefined && header !== undefined && query !== header) {
+        throw new PrismServerError("Conflicting event cursors", 400, "ERR_PRISM_SERVER_REPLAY_CURSOR");
+    }
+    const cursor = header ?? query;
+    if (cursor !== undefined && (Buffer.byteLength(cursor, "utf8") > maxBytes || /\r|\n|\0/.test(cursor))) {
+        throw new PrismServerError("Invalid event cursor", 400, "ERR_PRISM_SERVER_REPLAY_CURSOR");
+    }
+    return cursor;
+}
 function normalizeBasePath(value) {
     if (!value.startsWith("/") || value.includes("?") || value.includes("#"))
         throw new RangeError("basePath must be an absolute URL path");
@@ -638,7 +681,19 @@ function ownedSignal(request, timeoutMs, disconnectAborts) {
         },
     };
 }
+function sseAgentEvents(source, owned, limits, options, release) {
+    return sseStream(source, ({ record, cursor }) => {
+        if (/\r|\n|\0/.test(cursor) || Buffer.byteLength(cursor, "utf8") > limits.maxReplayCursorBytes) {
+            throw new PrismServerError("Invalid event cursor", 500, "ERR_PRISM_SERVER_REPLAY_CURSOR");
+        }
+        const safe = options.redactor?.redact(record.event) ?? record.event;
+        return `id: ${cursor}\ndata: ${JSON.stringify(safe)}\n\n`;
+    }, owned, limits, release);
+}
 function sse(source, owned, limits, options, release) {
+    return sseStream(source, (value) => `data: ${JSON.stringify(options.redactor?.redact(value) ?? value)}\n\n`, owned, limits, release);
+}
+function sseStream(source, serialize, owned, limits, release) {
     const iterator = source[Symbol.asyncIterator]();
     const encoder = new TextEncoder();
     let events = 0;
@@ -667,8 +722,7 @@ function sse(source, owned, limits, options, release) {
                     controller.close();
                     return;
                 }
-                const safe = options.redactor?.redact(next.value) ?? next.value;
-                const chunk = encoder.encode(`data: ${JSON.stringify(safe)}\n\n`);
+                const chunk = encoder.encode(serialize(next.value));
                 events += 1;
                 bytes += chunk.byteLength;
                 if (chunk.byteLength > limits.maxEventBytes || events > limits.maxStreamEvents || bytes > limits.maxStreamBytes) {

package/dist/index.d.ts

@@ -13,8 +13,8 @@ export type { PrismDeploymentLimits, PrismServerLimits, ResolvedPrismDeploymentL
 export { DEFAULT_DRAIN_DEADLINE_MS, DEFAULT_MAX_CONCURRENT_RUNS, DEFAULT_MAX_EVENT_BYTES, DEFAULT_MAX_HEALTH_BYTES, DEFAULT_MAX_QUEUED_EVENTS, DEFAULT_MAX_REPLAY_CURSOR_BYTES, DEFAULT_MAX_REPLAY_EVENTS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_MAX_STREAM_BYTES, DEFAULT_MAX_STREAM_EVENTS, DEFAULT_REQUEST_TIMEOUT_MS, HARD_DRAIN_DEADLINE_MS, HARD_MAX_CONCURRENT_RUNS, HARD_MAX_EVENT_BYTES, HARD_MAX_HEALTH_BYTES, HARD_MAX_QUEUED_EVENTS, HARD_MAX_REPLAY_CURSOR_BYTES, HARD_MAX_REPLAY_EVENTS, HARD_MAX_REQUEST_BYTES, HARD_MAX_RESPONSE_BYTES, HARD_MAX_STREAM_BYTES, HARD_MAX_STREAM_EVENTS, HARD_REQUEST_TIMEOUT_MS, resolvePrismDeploymentLimits, resolvePrismServerLimits, } from "./limits.js";
 export type { MemoryRateLimiterOptions, PrismServerRateLimitDenial, PrismServerRateLimiter, PrismServerRateLimitInput, } from "./rate-limit.js";
 export { createMemoryRateLimiter } from "./rate-limit.js";
-export type { CreatePrismEventReplayOptions, CreatePrismReplayHandlerOptions, PrismEventReplay, PrismEventReplayRequest, } from "./replay.js";
-export { createPrismEventReplay, createPrismReplayHandler } from "./replay.js";
-export type { CreatePrismHandlerOptions, PrismAgentExposure, PrismAgentRunExposure, PrismRequestHandler, PrismScheduleExposure, PrismServerAuthorization, PrismServerAuthorizationInput, PrismServerAuthorizer, PrismServerOperation, PrismWorkflowExposure, } from "./types.js";
+export type { CreatePrismEventReplayOptions, CreatePrismReplayHandlerOptions, PrismAgentEventReplay, PrismEventReplay, PrismEventReplayRequest, } from "./replay.js";
+export { createPrismAgentEventReplay, createPrismEventReplay, createPrismReplayHandler } from "./replay.js";
+export type { CreatePrismHandlerOptions, PrismAgentEventResolutionInput, PrismAgentExposure, PrismAgentRunExposure, PrismRequestHandler, PrismScheduleExposure, PrismServerAuthorization, PrismServerAuthorizationInput, PrismServerAuthorizer, PrismServerOperation, PrismWorkflowExposure, } from "./types.js";
 export { PrismServerError } from "./types.js";
 export declare const packageName = "@arnilo/prism-server";

package/dist/index.js

@@ -6,7 +6,7 @@ export { createPrismHandler } from "./handler.js";
 export { createPrismHealthHandler } from "./health.js";
 export { DEFAULT_DRAIN_DEADLINE_MS, DEFAULT_MAX_CONCURRENT_RUNS, DEFAULT_MAX_EVENT_BYTES, DEFAULT_MAX_HEALTH_BYTES, DEFAULT_MAX_QUEUED_EVENTS, DEFAULT_MAX_REPLAY_CURSOR_BYTES, DEFAULT_MAX_REPLAY_EVENTS, DEFAULT_MAX_REQUEST_BYTES, DEFAULT_MAX_RESPONSE_BYTES, DEFAULT_MAX_STREAM_BYTES, DEFAULT_MAX_STREAM_EVENTS, DEFAULT_REQUEST_TIMEOUT_MS, HARD_DRAIN_DEADLINE_MS, HARD_MAX_CONCURRENT_RUNS, HARD_MAX_EVENT_BYTES, HARD_MAX_HEALTH_BYTES, HARD_MAX_QUEUED_EVENTS, HARD_MAX_REPLAY_CURSOR_BYTES, HARD_MAX_REPLAY_EVENTS, HARD_MAX_REQUEST_BYTES, HARD_MAX_RESPONSE_BYTES, HARD_MAX_STREAM_BYTES, HARD_MAX_STREAM_EVENTS, HARD_REQUEST_TIMEOUT_MS, resolvePrismDeploymentLimits, resolvePrismServerLimits, } from "./limits.js";
 export { createMemoryRateLimiter } from "./rate-limit.js";
-export { createPrismEventReplay, createPrismReplayHandler } from "./replay.js";
+export { createPrismAgentEventReplay, createPrismEventReplay, createPrismReplayHandler } from "./replay.js";
 export { PrismServerError } from "./types.js";
 export const packageName = "@arnilo/prism-server";
 //# sourceMappingURL=index.js.map

package/dist/limits.d.ts

@@ -31,6 +31,7 @@ export interface PrismServerLimits {
     readonly maxStreamEvents?: number;
     readonly maxConcurrentRuns?: number;
     readonly maxQueuedEvents?: number;
+    readonly maxReplayCursorBytes?: number;
     readonly requestTimeoutMs?: number;
 }
 export interface ResolvedPrismServerLimits {
@@ -41,6 +42,7 @@ export interface ResolvedPrismServerLimits {
     readonly maxStreamEvents: number;
     readonly maxConcurrentRuns: number;
     readonly maxQueuedEvents: number;
+    readonly maxReplayCursorBytes: number;
     readonly requestTimeoutMs: number;
 }
 export interface PrismDeploymentLimits {

package/dist/limits.js

@@ -32,6 +32,7 @@ export function resolvePrismServerLimits(input = {}) {
         maxStreamEvents: bounded(input.maxStreamEvents, DEFAULT_MAX_STREAM_EVENTS, HARD_MAX_STREAM_EVENTS, "maxStreamEvents"),
         maxConcurrentRuns: bounded(input.maxConcurrentRuns, DEFAULT_MAX_CONCURRENT_RUNS, HARD_MAX_CONCURRENT_RUNS, "maxConcurrentRuns"),
         maxQueuedEvents: bounded(input.maxQueuedEvents, DEFAULT_MAX_QUEUED_EVENTS, HARD_MAX_QUEUED_EVENTS, "maxQueuedEvents"),
+        maxReplayCursorBytes: bounded(input.maxReplayCursorBytes, DEFAULT_MAX_REPLAY_CURSOR_BYTES, HARD_MAX_REPLAY_CURSOR_BYTES, "maxReplayCursorBytes"),
         requestTimeoutMs: bounded(input.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS, HARD_REQUEST_TIMEOUT_MS, "requestTimeoutMs"),
     };
 }

package/dist/replay.d.ts

@@ -1,4 +1,4 @@
-import type { AgentEventRecord, OwnershipScope, PersistencePage, ProductionPersistenceStore } from "@arnilo/prism";
+import type { AgentEventEnvelope, AgentEventRecord, AgentEventSource, AgentEventSourcePage, OwnershipScope, PersistencePage, ProductionPersistenceStore } from "@arnilo/prism";
 import { type PrismDeploymentLimits } from "./limits.js";
 export interface PrismEventReplayRequest {
     readonly ownership: OwnershipScope;
@@ -13,7 +13,13 @@ export interface PrismEventReplay {
 export interface CreatePrismEventReplayOptions {
     readonly limits?: PrismDeploymentLimits;
 }
-/** Ownership-scoped, cursor-paginated durable event replay. Does not re-run work. */
+export interface PrismAgentEventReplay {
+    page(input: PrismEventReplayRequest): Promise<AgentEventSourcePage>;
+    subscribe(input: PrismEventReplayRequest): AsyncIterable<AgentEventEnvelope>;
+}
+/** Shared source-backed page/follow adapter. Authorization supplies ownership before each call. */
+export declare function createPrismAgentEventReplay(source: AgentEventSource, options?: CreatePrismEventReplayOptions): PrismAgentEventReplay;
+/** Ownership-scoped, cursor-paginated legacy persistence replay. Does not re-run work. */
 export declare function createPrismEventReplay(store: Pick<ProductionPersistenceStore, "queryEvents">, options?: CreatePrismEventReplayOptions): PrismEventReplay;
 export interface CreatePrismReplayHandlerOptions {
     readonly replay: PrismEventReplay;

package/dist/replay.js

@@ -1,6 +1,34 @@
 import { resolvePrismDeploymentLimits } from "./limits.js";
 import { PrismServerError } from "./types.js";
-/** Ownership-scoped, cursor-paginated durable event replay. Does not re-run work. */
+/** Shared source-backed page/follow adapter. Authorization supplies ownership before each call. */
+export function createPrismAgentEventReplay(source, options = {}) {
+    const limits = resolvePrismDeploymentLimits(options.limits);
+    const read = (input) => {
+        input.signal?.throwIfAborted();
+        assertOwnership(input.ownership);
+        if (!input.sessionId || !input.runId)
+            throw new PrismServerError("Run is unavailable", 404, "ERR_PRISM_SERVER_REPLAY");
+        if (input.cursor !== undefined)
+            assertCursor(input.cursor, limits);
+        return {
+            ownership: input.ownership,
+            sessionId: input.sessionId,
+            runId: input.runId,
+            after: input.cursor,
+            limit: limits.maxReplayEvents,
+            signal: input.signal,
+        };
+    };
+    return {
+        page: (input) => source.page(read(input)),
+        subscribe(input) {
+            return {
+                [Symbol.asyncIterator]: () => source.subscribe(read(input))[Symbol.asyncIterator](),
+            };
+        },
+    };
+}
+/** Ownership-scoped, cursor-paginated legacy persistence replay. Does not re-run work. */
 export function createPrismEventReplay(store, options = {}) {
     const limits = resolvePrismDeploymentLimits(options.limits);
     return {

package/dist/types.d.ts

@@ -1,9 +1,9 @@
-import type { Agent, AgentIdentity, AgentRunLifecycle, AgentSession, OwnershipScope, RunOptions, SecretRedactor } from "@arnilo/prism";
+import type { Agent, AgentEventSource, AgentIdentity, AgentRunLifecycle, AgentRunRef, AgentSession, OwnershipScope, RunOptions, SecretRedactor } from "@arnilo/prism";
 import type { RunWorkflowOptions, WorkflowCheckpointAdapter, WorkflowDefinition, WorkflowSchedules } from "@arnilo/prism-workflows";
 import type { PrismDrainController } from "./drain.js";
 import type { PrismServerLimits } from "./limits.js";
 import type { PrismServerRateLimiter } from "./rate-limit.js";
-export type PrismServerOperation = "agent.run" | "agent.stream" | "agent.status" | "agent.resume" | "workflow.run" | "workflow.stream" | "workflow.status" | "workflow.cancel" | "workflow.resume" | "workflow.enqueue" | "workflow.replay" | "schedule.create" | "schedule.list" | "schedule.pause" | "schedule.resume" | "schedule.trigger" | "schedule.delete";
+export type PrismServerOperation = "agent.run" | "agent.stream" | "agent.status" | "agent.resume" | "agent.events" | "workflow.run" | "workflow.stream" | "workflow.status" | "workflow.cancel" | "workflow.resume" | "workflow.enqueue" | "workflow.replay" | "schedule.create" | "schedule.list" | "schedule.pause" | "schedule.resume" | "schedule.trigger" | "schedule.delete";
 export interface PrismServerAuthorization {
     readonly ownership: OwnershipScope;
     /** Host-verified identity; when set must project onto `ownership` without widening. */
@@ -17,9 +17,18 @@ export interface PrismServerAuthorizationInput {
     readonly signal: AbortSignal;
 }
 export type PrismServerAuthorizer = (input: PrismServerAuthorizationInput) => false | PrismServerAuthorization | Promise<false | PrismServerAuthorization>;
+export interface PrismAgentEventResolutionInput {
+    readonly runId: string;
+    readonly authorization: PrismServerAuthorization;
+    readonly signal: AbortSignal;
+}
 export interface PrismAgentExposure {
     readonly sessionFactory: (authorization: PrismServerAuthorization) => AgentSession | Promise<AgentSession>;
     readonly runOptions?: Omit<RunOptions, "ownership" | "signal" | "redactor">;
+    /** Optional durable cross-replica event source. Requires resolveRun. */
+    readonly events?: AgentEventSource;
+    /** Resolves an authorized public run selector to exact internal session/run IDs. */
+    readonly resolveRun?: (input: PrismAgentEventResolutionInput) => AgentRunRef | undefined | Promise<AgentRunRef | undefined>;
 }
 /** Explicit durable status/resume capability. Omit it to expose no agent lifecycle routes. */
 export interface PrismAgentRunExposure {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-server",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Optional framework-free Web Request-to-Response handler for explicitly selected Prism agents and workflows.",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,8 +25,8 @@
     "pack:dry-run": "npm pack --dry-run"
   },
   "peerDependencies": {
-    "@arnilo/prism": "0.0.23",
-    "@arnilo/prism-workflows": "0.0.23"
+    "@arnilo/prism": "0.0.24",
+    "@arnilo/prism-workflows": "0.0.24"
   },
   "devDependencies": {
     "@arnilo/prism": "file:../..",