@arnilo/prism-supervisor 0.0.96 → 0.1.0

package/CHANGELOG.md

@@ -1,12 +1,126 @@
 # Changelog
-## [0.0.96] - 2026-07-21
+
+## [0.1.0] - 2026-08-09
 
 ### Changed
+- Released with exact 0.1.0 graph.
 
-- Released with exact 0.0.96 graph.
+## [0.0.28] - 2026-08-08
+
+### Changed
+- Released with exact 0.0.28 graph.
+
+## [0.0.27] - 2026-08-07
+
+### Changed
+- Released with exact 0.0.27 graph.
+
+## [0.0.26] - 2026-08-06
+
+### Changed
+- Released with exact 0.0.26 graph.
+
+## [0.0.25] - 2026-08-06
+
+### Added
+- Durable child approvals: `checkpoints` + `definitionRevision` on supervisor; `resumeNestedRun` routes hashed attributed decisions without widening child permission.
+
+### Changed
+- Released with exact 0.0.25 graph.
+
+See [migration guide](../../docs/migration.md) for the 0.0.24 → 0.0.25 notes.
+
+## [0.0.24] - 2026-08-04
+
+### Added
+- Durable `AgentEventSource` (memory + PostgreSQL LISTEN/NOTIFY), recoverable `ToolEffectStore`, and AG-UI MCP/MCP Apps/A2A fronting for Phase 7.
+
+### Changed
+- Publishable graph remains **47** manifests at **0.0.24**; peers and lockfile move together.
+
+See [migration guide](../../docs/migration.md) for the 0.0.23 → 0.0.24 notes.
+
+## [0.0.23] - 2026-08-03
+
+### Changed
+- Released with exact 0.0.23 graph.
+
+## [0.0.22] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.22 graph.
+
+## [0.0.21] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.21 graph.
+
+## [0.0.20] - 2026-07-31
+
+### Changed
+- Released with exact 0.0.20 graph.
+
+## [0.0.19] - 2026-07-30
+
+### Changed
+- Released with exact 0.0.19 graph.
+
+## [0.0.18] - 2026-07-30
 
+### Changed
+- Released with exact 0.0.18 graph.
+
+## [0.0.17] - 2026-07-29
+
+### Changed
+- Released with exact 0.0.17 graph.
+
+## [0.0.16] - 2026-07-26
+
+### Changed
+- Released with exact 0.0.16 graph.
+
+## [0.0.15] - 2026-07-26
+
+### Changed
+
+- Released with exact 0.0.15 graph.
+
+## [0.0.14] - 2026-07-26
+
+### Changed
+
+- Released with exact 0.0.14 graph.
+
+## [0.0.13] - 2026-07-24
+
+### Changed
+
+- Released with exact 0.0.13 graph.
 
-## Unreleased
+## [0.0.12] - 2026-07-22
+
+### Changed
+
+- Released with exact 0.0.12 graph.
+
+## [0.0.11] - 2026-07-22
+
+### Changed
+
+- Released with exact 0.0.11 graph.
+
+## [0.0.10] - 2026-07-21
+
+### Changed
+
+- Released with exact 0.0.10 graph.
+
+## [0.0.96] - 2026-07-21
+
+### Changed
+
+- Released with exact 0.0.96 graph.
 
 ## [0.0.9] - 2026-07-21
 
@@ -30,7 +144,6 @@
 
 - Added optional bounded child delegation and A2A 1.0 card/server/client interoperability.
 
-
 ## [0.0.4] - 2026-07-14
 
 - Bounded explicit local child delegation with narrowing-only policy composition, derived memory scope IDs, hooks, nested delegation, cancellation, and event subscription.

package/README.md

@@ -26,6 +26,6 @@ const supervisor = createSupervisor({
 console.log((await supervisor.delegate({ childId: "research", input: "Check sources" })).text);
 ```
 
-Also exports bounded A2A 1.0 cards, handler/client, rich one-of parts, host-owned `A2ATaskLifecycle`, reconnect subscriptions, and push-config CRUD. Direct text invocation remains compatible; durable get/list/cancel/subscribe and rich raw/data/URL parts require explicit adapters/policy. URL parts are validated but never fetched. Push persistence/network/credentials and exact-owner checks remain host-owned; explicit `deliverA2APushEvent()` only bounds attempts/time and forwards stable event IDs for host idempotency. Returned configs omit secrets. JSON-RPC/HTTPS is the only binding.
+Also exports bounded A2A 1.0 cards, handler/client, rich one-of parts, `client.streamMessage()` for verified task/message stream records, host-owned `A2ATaskLifecycle`, `createA2AAgentEventSource()` for shared durable run→task subscriptions, reconnect subscriptions, and push-config CRUD. Direct text invocation remains compatible; durable get/list/cancel/subscribe and rich raw/data/URL parts require explicit adapters/policy. URL parts are validated but never fetched. Push persistence/network/credentials and exact-owner checks remain host-owned; explicit `deliverA2APushEvent()` only bounds attempts/time and forwards stable event IDs for host idempotency. Returned configs omit secrets. JSON-RPC/HTTPS is the only binding.
 
-See [Supervisors](../../docs/supervisors.md) and [A2A interoperability](../../docs/a2a.md).
+Pass `checkpoints` + `definitionRevision` for durable child approvals (`resumeNestedRun` routes hashed attributed decisions without widening permission). See [Supervisors](../../docs/supervisors.md) and [A2A interoperability](../../docs/a2a.md).

package/dist/a2a-card.js

@@ -44,9 +44,7 @@ export async function verifyA2AAgentCard(card, options) {
                 break;
             }
         }
-        catch {
-            continue;
-        }
+        catch { }
     }
     if (!matched)
         throw new A2AError("Agent card signature is invalid or expired", 403, "ERR_PRISM_A2A_CARD_SIGNATURE");
@@ -71,13 +69,19 @@ function validateCard(card) {
         throw new A2AError("Agent card exceeds collection/byte limits", 400, "ERR_PRISM_A2A_CARD");
     if (!card.name?.trim() || !card.description?.trim() || !card.version?.trim())
         throw new A2AError("Agent card identity is incomplete", 400, "ERR_PRISM_A2A_CARD");
-    if (!card.supportedInterfaces.length || !card.supportedInterfaces.every((item) => item.protocolBinding === "JSONRPC" && item.protocolVersion === "1.0" && isHttpsUrl(item.url)))
+    if (!card.supportedInterfaces.length ||
+        !card.supportedInterfaces.every((item) => item.protocolBinding === "JSONRPC" && item.protocolVersion === "1.0" && isHttpsUrl(item.url)))
         throw new A2AError("Agent card requires an HTTPS JSONRPC 1.0 interface", 400, "ERR_PRISM_A2A_CARD");
     if (!card.defaultInputModes.includes("text/plain") || !card.defaultOutputModes.includes("text/plain"))
         throw new A2AError("Agent card must support text/plain", 400, "ERR_PRISM_A2A_CARD");
     const ids = new Set();
     for (const skill of card.skills) {
-        if (!skill.id.trim() || !skill.name.trim() || !skill.description.trim() || ids.has(skill.id) || skill.tags.length > 64 || [skill.id, skill.name, skill.description, ...skill.tags].some((value) => Buffer.byteLength(value) > 16 * 1024))
+        if (!skill.id.trim() ||
+            !skill.name.trim() ||
+            !skill.description.trim() ||
+            ids.has(skill.id) ||
+            skill.tags.length > 64 ||
+            [skill.id, skill.name, skill.description, ...skill.tags].some((value) => Buffer.byteLength(value) > 16 * 1024))
             throw new A2AError("Agent card skill is invalid", 400, "ERR_PRISM_A2A_CARD");
         ids.add(skill.id);
     }
@@ -87,7 +91,11 @@ function parseProtected(value) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
         throw new Error("invalid protected header");
     const record = parsed;
-    if (typeof record.alg !== "string" || typeof record.typ !== "string" || typeof record.kid !== "string" || typeof record.iat !== "string" || typeof record.exp !== "string")
+    if (typeof record.alg !== "string" ||
+        typeof record.typ !== "string" ||
+        typeof record.kid !== "string" ||
+        typeof record.iat !== "string" ||
+        typeof record.exp !== "string")
         throw new Error("invalid protected header");
     return { alg: record.alg, typ: record.typ, kid: record.kid, iat: record.iat, exp: record.exp };
 }
@@ -103,7 +111,11 @@ function canonicalJson(value) {
         return `[${value.map(canonicalJson).join(",")}]`;
     if (value && typeof value === "object") {
         const record = value;
-        return `{${Object.keys(record).filter((key) => record[key] !== undefined).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+        return `{${Object.keys(record)
+            .filter((key) => record[key] !== undefined)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`)
+            .join(",")}}`;
     }
     throw new A2AError("Agent card is not canonical JSON", 400, "ERR_PRISM_A2A_CARD");
 }