@arnilo/prism-server 0.0.96 → 0.1.0

package/CHANGELOG.md

@@ -1,11 +1,138 @@
 # Changelog
+
+## [0.1.0] - 2026-08-09
+
+### Changed
+- Released with exact 0.1.0 graph.
+
+## [0.0.28] - 2026-08-08
+
+### Added
+- `createArtifactService` accepts an optional `bodies: ArtifactBodyStore` (core contract from `@arnilo/prism`): when wired, `deliveryLink` resolves through `bodies.presign` and returns an additional bounded-TTL presigned `url` beside the signed link/token; revisions without a recorded `size` fail closed at delivery. `attach`/`revise` accept an optional `size` (validated non-negative safe integer) recorded on the revision.
+- New `@arnilo/prism-server/artifact-bodies` subpath: `createS3ArtifactBodyStore` — reference S3-compatible `ArtifactBodyStore` (AWS S3, MinIO, Cloudflare R2) with hand-rolled SigV4 presigning over native fetch + WebCrypto (validated against the official AWS sig-v4-test-suite get-vanilla vector), path-style addressing, single-chunk PUT with exact Content-Length and verified `x-amz-content-sha256`, ownership verification on every operation, size/SHA-256/MIME verification on put and get (fail closed), legal-hold-aware idempotent delete (host `isHeld` callback), host-resolved credentials (never inline), optional host-owned client-side KMS callback, bounded concurrent transfers, and no bucket/path/key disclosure in errors. `S3ArtifactBodyError` carries frozen `ERR_PRISM_S3_*` codes; limits `maxBodyBytes` 64 MiB/512 MiB, `maxConcurrentTransfers` 4/16, `presignTtlMs` 10 min/24 h, `maxRefBytes` 256 B/1 KiB.
+
+## [0.0.27] - 2026-08-07
+
+### Changed
+- Released with exact 0.0.27 graph.
+
+## [0.0.26] - 2026-08-06
+
+### Changed
+- Released with exact 0.0.26 graph.
+
+## [0.0.25] - 2026-08-06
+
+### Added
+- Agent resume accepts batch `decisions: RunDecision[]` (exclusive with legacy binary `decision`) with boundary validation.
+
+### Changed
+- Released with exact 0.0.25 graph.
+
+See [migration guide](../../docs/migration.md) for the 0.0.24 → 0.0.25 notes.
+
+## [0.0.24] - 2026-08-04
+
+### Added
+- Durable `AgentEventSource` (memory + PostgreSQL LISTEN/NOTIFY), recoverable `ToolEffectStore`, and AG-UI MCP/MCP Apps/A2A fronting for Phase 7.
+
+### Changed
+- Publishable graph remains **47** manifests at **0.0.24**; peers and lockfile move together.
+
+See [migration guide](../../docs/migration.md) for the 0.0.23 → 0.0.24 notes.
+
+## [0.0.23] - 2026-08-03
+
+### Changed
+- Released with exact 0.0.23 graph.
+
+## [0.0.22] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.22 graph.
+
+## [0.0.21] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.21 graph.
+
+## [0.0.20] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.20 graph.
+
+## [0.0.19] - 2026-07-30
+
+### Changed
+- Released with exact 0.0.19 graph.
+
+## [0.0.18] - 2026-07-30
+
+### Changed
+- Released with exact 0.0.18 graph.
+
+## [0.0.17] - 2026-07-29
+
+### Changed
+- Released with exact 0.0.17 graph.
+
+## [0.0.16] - 2026-07-26
+
+### Changed
+- Released with exact 0.0.16 graph.
+
+## [0.0.15] - 2026-07-26
+
+### Changed
+
+- Released with exact 0.0.15 graph.
+
+## [0.0.14] - 2026-07-26
+
+### Added
+
+- Durable user-scoped conversation service (`createConversationService`/`createConversationHandler`) and durable artifact service with review/approval/authorized delivery links (`createArtifactService`/`createArtifactHandler`) (Plan 077 Tasks 1, 3).
+
+## [0.0.13] - 2026-07-24
+
+### Changed
+
+- Released with exact 0.0.13 graph.
+
+## [0.0.12] - 2026-07-23
+
+### Added
+
+- Optional deployment seams: `createPrismHealthHandler`, `createPrismDrainController`, host `rateLimit` adapter (+ `createMemoryRateLimiter`), ownership-scoped `createPrismEventReplay` / `createPrismReplayHandler`, and `createPrismDeploymentLease` for worker/coordinator election over existing leases. No queue adapter (deferred pending measured Postgres polling need).
+
+## [0.0.12] - 2026-07-22
+
+### Changed
+
+- Released with exact 0.0.12 graph.
+
+## [0.0.11] - 2026-07-22
+
+### Changed
+
+- Released with exact 0.0.11 graph.
+
+## [0.0.10] - 2026-07-21
+
+### Changed
+
+- Released with exact 0.0.10 graph.
+
+### Changed
+
+- Released with exact 0.0.10 graph.
+
 ## [0.0.96] - 2026-07-21
 
 ### Changed
 
 - Released with exact 0.0.96 graph.
 
-
 ## [0.0.9] - 2026-07-21
 
 - Released with the exact 0.0.9 first-party package graph.

package/README.md

@@ -24,8 +24,31 @@ const response = await handler(new Request("https://api.example.test/prism/agent
 }));
 ```
 
-Routes: direct/SSE agent run, explicitly selected durable agent status/resume through `agentRuns`, direct/SSE workflow run, durable workflow enqueue/status/cancel/resume/replay, and optional ownership-scoped schedule create/list/pause/resume/trigger/delete. `agentRuns` uses core `createAgentRunLifecycle()`; no lifecycle route exists by default. All bodies, responses, events, queues, concurrency, and timeouts are bounded.
+Routes: direct/SSE agent run, cross-replica durable event reconnect through object agent exposures with `events` + `resolveRun`, explicitly selected durable agent status/resume through `agentRuns`, direct/SSE workflow run, durable workflow enqueue/status/cancel/resume/replay, and optional ownership-scoped schedule create/list/pause/resume/trigger/delete. `agentRuns` uses core `createAgentRunLifecycle()`; no lifecycle route exists by default. Agent resume accepts legacy binary `decision` or batch `decisions: RunDecision[]` (exactly one). All bodies, responses, events, queues, concurrency, and timeouts are bounded.
 
-Nothing is exposed by default. Authorization is required; ownership comes only from its result. No listener, framework, auth provider, user database, credential discovery, or hidden package activation ships.
+Optional 0.0.14 co-work handlers (mount beside the API handler): `createConversationHandler` (durable user-scoped conversation threads with reconnectable redacted replay — `createConversationService`) and `createArtifactHandler` (artifact revisions, approve/reject review, expiring authorized delivery links — `createArtifactService` over the existing checkpoint store). Both are ownership-scoped and fail closed without authorization.
+
+Optional deployment helpers (compose beside the API handler — no embedded listener):
+
+```ts
+import {
+  createPrismDrainController,
+  createPrismHealthHandler,
+  createMemoryRateLimiter,
+  createPrismDeploymentLease,
+} from "@arnilo/prism-server";
+
+const drain = createPrismDrainController();
+const handler = createPrismHandler({
+  agents: { support: agent },
+  authorize,
+  drain,
+  rateLimit: createMemoryRateLimiter({ maxRequests: 60, windowMs: 60_000 }),
+});
+const health = createPrismHealthHandler({ drain, ready: () => store.ping() });
+// Workers: createWorkflowCoordinator(...). Coordinators: createPrismDeploymentLease({ key: "coordinator", ... }).
+```
+
+Nothing is exposed by default. Authorization is required; ownership comes only from its result. No listener, framework, auth provider, user database, credential discovery, queue adapter, or hidden package activation ships.
 
 Full API, route, limits, security, and deployment notes: [`docs/server.md`](../../docs/server.md).

package/dist/artifact-bodies-s3.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Hand-rolled AWS Signature V4 over native WebCrypto (crypto.subtle) — no SDK dependency.
+ * Validated against the official AWS sig-v4-test-suite get-vanilla vector in
+ * `src/__tests__/artifact-bodies.test.ts`. S3-specific presigning (query-string auth,
+ * UNSIGNED-PAYLOAD for GET/DELETE, signed x-amz-content-sha256 for single-chunk PUT)
+ * lives in `artifact-bodies.ts`; this module is the generic algorithm.
+ */
+/** RFC 3986 percent-encoding as required by SigV4 (encodeURIComponent leaves !'()* unencoded). */
+export declare function awsUriEncode(value: string): string;
+/** SHA-256 hex digest over WebCrypto. */
+export declare function sha256Hex(data: Uint8Array): Promise<string>;
+/** Canonical query string: sorted keys, RFC 3986 encoded, `key=value` joined with `&`. */
+export declare function canonicalQueryString(query: Readonly<Record<string, string>>): string;
+/** Canonical headers block: lowercase name, trimmed/collapsed value, trailing newline. */
+export declare function canonicalHeaders(headers: Readonly<Record<string, string>>, signedHeaders: readonly string[]): string;
+export interface SigV4SignInput {
+    readonly method: string;
+    /** Pre-encoded path (e.g. `/bucket/key`); used verbatim. */
+    readonly path: string;
+    readonly query?: Readonly<Record<string, string>>;
+    /** Lowercase header names. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** Subset of header names, sorted; the caller decides what to sign. */
+    readonly signedHeaders: readonly string[];
+    /** Hex SHA-256 of the payload, or "UNSIGNED-PAYLOAD". */
+    readonly payloadHash: string;
+    readonly region: string;
+    readonly service: string;
+    /** `YYYYMMDDTHHMMSSZ`. */
+    readonly amzDate: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+}
+export interface SigV4Signature {
+    readonly signature: string;
+    readonly canonicalRequest: string;
+}
+/** Full SigV4 pipeline: canonical request -> string-to-sign -> derived-key HMAC. */
+export declare function signV4(input: SigV4SignInput): Promise<SigV4Signature>;
+export interface SigV4PresignInput {
+    readonly method: string;
+    readonly path: string;
+    readonly query?: Readonly<Record<string, string>>;
+    /** Lowercase header names; only `host` is signed for presigned URLs. */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly payloadHash: string;
+    readonly region: string;
+    readonly service: string;
+    readonly amzDate: string;
+    readonly expiresSeconds: number;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+}
+/** Presign: returns the full query string (X-Amz-* params + X-Amz-Signature) for a URL. */
+export declare function presignV4(input: SigV4PresignInput): Promise<string>;
+export interface SigV4RequestSignInput {
+    readonly method: string;
+    readonly path: string;
+    readonly headers: Readonly<Record<string, string>>;
+    /** Headers to sign (subset of `headers`, sorted); the caller sends exactly these. */
+    readonly signedHeaders: readonly string[];
+    readonly payloadHash: string;
+    readonly region: string;
+    readonly service: string;
+    readonly amzDate: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken?: string;
+}
+/** Sign a direct request: returns headers including x-amz-date, x-amz-content-sha256, and Authorization. */
+export declare function signRequestV4(input: SigV4RequestSignInput): Promise<{
+    readonly headers: Record<string, string>;
+}>;

package/dist/artifact-bodies-s3.js

@@ -0,0 +1,104 @@
+/**
+ * Hand-rolled AWS Signature V4 over native WebCrypto (crypto.subtle) — no SDK dependency.
+ * Validated against the official AWS sig-v4-test-suite get-vanilla vector in
+ * `src/__tests__/artifact-bodies.test.ts`. S3-specific presigning (query-string auth,
+ * UNSIGNED-PAYLOAD for GET/DELETE, signed x-amz-content-sha256 for single-chunk PUT)
+ * lives in `artifact-bodies.ts`; this module is the generic algorithm.
+ */
+/** RFC 3986 percent-encoding as required by SigV4 (encodeURIComponent leaves !'()* unencoded). */
+export function awsUriEncode(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** SHA-256 hex digest over WebCrypto. */
+export async function sha256Hex(data) {
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return Buffer.from(digest).toString("hex");
+}
+async function hmacSha256(key, data) {
+    const imported = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", imported, data);
+    return new Uint8Array(signature);
+}
+/** Canonical query string: sorted keys, RFC 3986 encoded, `key=value` joined with `&`. */
+export function canonicalQueryString(query) {
+    return Object.keys(query)
+        .sort()
+        .map((key) => `${awsUriEncode(key)}=${awsUriEncode(query[key])}`)
+        .join("&");
+}
+/** Canonical headers block: lowercase name, trimmed/collapsed value, trailing newline. */
+export function canonicalHeaders(headers, signedHeaders) {
+    return signedHeaders.map((name) => `${name}:${(headers[name] ?? "").trim().replace(/\s+/g, " ")}\n`).join("");
+}
+/** Full SigV4 pipeline: canonical request -> string-to-sign -> derived-key HMAC. */
+export async function signV4(input) {
+    const date = input.amzDate.slice(0, 8);
+    const query = canonicalQueryString(input.query ?? {});
+    const headers = canonicalHeaders(input.headers, input.signedHeaders);
+    const signedNames = input.signedHeaders.join(";");
+    const canonicalRequest = `${input.method}\n${input.path}\n${query}\n${headers}\n${signedNames}\n${input.payloadHash}`;
+    const scope = `${date}/${input.region}/${input.service}/aws4_request`;
+    const stringToSign = `AWS4-HMAC-SHA256\n${input.amzDate}\n${scope}\n${await sha256Hex(new TextEncoder().encode(canonicalRequest))}`;
+    const kDate = await hmacSha256(new TextEncoder().encode(`AWS4${input.secretAccessKey}`), new TextEncoder().encode(date));
+    const kRegion = await hmacSha256(kDate, new TextEncoder().encode(input.region));
+    const kService = await hmacSha256(kRegion, new TextEncoder().encode(input.service));
+    const kSigning = await hmacSha256(kService, new TextEncoder().encode("aws4_request"));
+    const signature = Buffer.from(await hmacSha256(kSigning, new TextEncoder().encode(stringToSign))).toString("hex");
+    return { signature, canonicalRequest };
+}
+/** Presign: returns the full query string (X-Amz-* params + X-Amz-Signature) for a URL. */
+export async function presignV4(input) {
+    const date = input.amzDate.slice(0, 8);
+    const scope = `${date}/${input.region}/${input.service}/aws4_request`;
+    const signedHeaders = ["host"];
+    const query = {
+        "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
+        "X-Amz-Credential": `${input.accessKeyId}/${scope}`,
+        "X-Amz-Date": input.amzDate,
+        "X-Amz-Expires": String(input.expiresSeconds),
+        "X-Amz-SignedHeaders": signedHeaders.join(";"),
+        ...(input.sessionToken === undefined ? {} : { "X-Amz-Security-Token": input.sessionToken }),
+        ...input.query,
+    };
+    const { signature } = await signV4({
+        method: input.method,
+        path: input.path,
+        query,
+        headers: input.headers,
+        signedHeaders,
+        payloadHash: input.payloadHash,
+        region: input.region,
+        service: input.service,
+        amzDate: input.amzDate,
+        accessKeyId: input.accessKeyId,
+        secretAccessKey: input.secretAccessKey,
+        sessionToken: input.sessionToken,
+    });
+    return canonicalQueryString({ ...query, "X-Amz-Signature": signature });
+}
+/** Sign a direct request: returns headers including x-amz-date, x-amz-content-sha256, and Authorization. */
+export async function signRequestV4(input) {
+    const date = input.amzDate.slice(0, 8);
+    const scope = `${date}/${input.region}/${input.service}/aws4_request`;
+    const headers = {
+        ...input.headers,
+        "x-amz-date": input.amzDate,
+        "x-amz-content-sha256": input.payloadHash,
+    };
+    const { signature } = await signV4({
+        method: input.method,
+        path: input.path,
+        headers,
+        signedHeaders: input.signedHeaders,
+        payloadHash: input.payloadHash,
+        region: input.region,
+        service: input.service,
+        amzDate: input.amzDate,
+        accessKeyId: input.accessKeyId,
+        secretAccessKey: input.secretAccessKey,
+        sessionToken: input.sessionToken,
+    });
+    headers.authorization = `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${input.signedHeaders.join(";")}, Signature=${signature}`;
+    return { headers };
+}
+//# sourceMappingURL=artifact-bodies-s3.js.map

package/dist/artifact-bodies.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Reference S3-compatible artifact body store (Phase 11 / 0.0.28): hand-rolled SigV4
+ * presigning over native fetch + WebCrypto, path-style addressing, single-chunk PUT with
+ * exact Content-Length and x-amz-content-sha256 = verified SHA-256 hex (no chunked transfer).
+ * Implements the core `ArtifactBodyStore` contract; hosts may substitute any store.
+ *
+ * Security posture: ownership verified on every operation; size/hash/MIME verified on put
+ * and get (fail closed); delete refuses under legal hold (host `isHeld` callback) and is
+ * idempotent; credentials only via the host resolver; bucket/path/key never appear in
+ * errors, telemetry, or artifact records (the object key is derived from the ref).
+ */
+import { type ArtifactBodyRef, type ArtifactBodyStore } from "@arnilo/prism";
+/** Host-resolved S3 credentials; never inline, never logged. */
+export interface S3Credentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** Optional session token (STS); included in the signature scope when present. */
+    readonly sessionToken?: string;
+}
+export interface ArtifactBodyLimits {
+    readonly maxBodyBytes?: number;
+    readonly maxConcurrentTransfers?: number;
+    readonly presignTtlMs?: number;
+    readonly maxRefBytes?: number;
+}
+export interface ResolvedArtifactBodyLimits {
+    readonly maxBodyBytes: number;
+    readonly maxConcurrentTransfers: number;
+    readonly presignTtlMs: number;
+    readonly maxRefBytes: number;
+}
+/** Phase 11 freeze: body 64 MiB/512 MiB; concurrent transfers 4/16; presign TTL 10 min/24 h; ref 256 B/1 KiB. */
+export declare const DEFAULT_ARTIFACT_BODY_LIMITS: ResolvedArtifactBodyLimits;
+export declare const HARD_ARTIFACT_BODY_LIMITS: ResolvedArtifactBodyLimits;
+export declare function resolveArtifactBodyLimits(input?: ArtifactBodyLimits): ResolvedArtifactBodyLimits;
+export interface S3ArtifactBodyStoreOptions {
+    /** Absolute base URL of the S3-compatible endpoint (https; http only for loopback hosts). */
+    readonly endpoint: string;
+    /** Bucket name (path-style addressing; no slashes). */
+    readonly bucket: string;
+    /** SigV4 region scope; default "us-east-1". */
+    readonly region?: string;
+    /** Host resolver for credentials; never inline keys. */
+    readonly credentials: () => S3Credentials | Promise<S3Credentials>;
+    /**
+     * Optional host-owned client-side encryption: `encrypt` runs before upload, `decrypt`
+     * after download. The ref hash/size always refer to the plaintext; the stored bytes are
+     * the ciphertext (so size is verified on the decrypted plaintext when kms is set).
+     */
+    readonly kms?: (op: "encrypt" | "decrypt", body: Uint8Array) => Promise<Uint8Array>;
+    /** Optional legal-hold check; delete refuses (ERR_PRISM_ARTIFACT_BODY_HELD) when held. */
+    readonly isHeld?: (ref: ArtifactBodyRef) => boolean | Promise<boolean>;
+    readonly limits?: ArtifactBodyLimits;
+    /** Test seam; defaults to global fetch. */
+    readonly fetch?: typeof fetch;
+    /** Test seam; defaults to Date.now. */
+    readonly now?: () => number;
+}
+/** Frozen S3 adapter failure reasons. */
+export type S3ArtifactBodyErrorCode = "PRESIGN" | "UPLOAD" | "DOWNLOAD" | "DELETE" | "CREDENTIALS";
+/** Typed S3 adapter failure; `code` is one of the frozen ERR_PRISM_S3_* codes. */
+export declare class S3ArtifactBodyError extends Error {
+    readonly reason: S3ArtifactBodyErrorCode;
+    readonly code: `ERR_PRISM_S3_${S3ArtifactBodyErrorCode}`;
+    constructor(message: string, reason: S3ArtifactBodyErrorCode);
+}
+/** Deterministic object key derived from the ref; bucket/path/key never enter artifact records. */
+export declare function s3ObjectKey(ref: ArtifactBodyRef): string;
+/** Reference S3-compatible ArtifactBodyStore (AWS S3, MinIO, Cloudflare R2). */
+export declare function createS3ArtifactBodyStore(options: S3ArtifactBodyStoreOptions): ArtifactBodyStore;