@sentropic/artifacts 0.1.4 → 0.2.0

package/dist/http.js

@@ -1,533 +1,194 @@
-/**
- * L-5c — transport-free HTTP app (spec-v8 §9 5c).
- *
- * Part 1: request/response types, ordered error mapping, dispatch and the
- * ensure route. The app delegates to the same services as direct calls
- * (parity); only the DTO validation and status mapping live here. Created
- * views are owned by the caller — no client-supplied owner. Part 2 adds
- * publish/read; part 3 adds lifecycle/fork/access/source routes.
- *
- * Status mapping (first match wins): access denied → 403; state conflicts
- * (already/conflict/lost races, premature purge) → 409; unknown
- * artifact/release/intent/upload/blob or missing source → 404; terminal or
- * removed states (purged/deleted) → 410; failed byte verification → 422;
- * invalid input → 400; anything else → 500 (never expected).
- *
- * m5 hardening: error bodies are stable codes only (never raw internal
- * messages, which can carry driver text or stored identifiers). An actor
- * who cannot read an artifact gets the identical 404 answer as for an
- * unknown artifact on every route — no 404/403 existence oracle. Precise
- * 403 answers remain for actors who can already read the artifact.
- */
-import { buildEnsureRequest } from './client.js';
-import { DEFAULT_PUBLICATION_LIMITS } from './server/publication.js';
-import { validatePublicationFiles } from './server/publication-limits.js';
-import { createContentRuntime } from './server/runtime.js';
-import { evaluateAccess, grantAccess, revokeAccess } from './server/access.js';
-import { parseSourceRef } from './server/sources.js';
-import { assertArtifactAccess } from './server/authorization.js';
-function errorStatus(message) {
-    if (/access denied/.test(message))
-        return 403;
-    if (/can only purge|already |conflict|lost/.test(message))
-        return 409;
-    if (/unknown artifact|unknown release|unknown intent|unknown upload|unknown blob|not found|no source|no release/.test(message)) {
-        return 404;
-    }
-    if (/terminal|purged|deleted/.test(message))
-        return 410;
-    if (/digest|size mismatch|read-back/.test(message))
-        return 422;
-    if (/invalid|missing|empty|duplicate|unknown action|unknown kind|budget|offset|committed|scope mismatch|malformed|forged|byte/.test(message)) {
-        return 400;
-    }
-    return 500;
-}
-const ERROR_CODES = {
-    400: 'invalid_request',
-    401: 'anonymous',
-    403: 'access_denied',
-    404: 'not_found',
-    409: 'conflict',
-    410: 'gone',
-    422: 'verification_failed',
-    500: 'internal_error',
-};
-/** Stable error body for one status; internal messages never leave the app. */
+import { parseManifest } from './codecs.js';
+import { assertCompiledArtifactsProfile, ArtifactProfileInputError } from './profile/index.js';
+import { createArtifactCommand } from './server/command-identity.js';
+import { createGuardedEnsureService } from './server/service.js';
+import { assertArtifactReplayMigration } from './server/idempotency.js';
+import { createGuardedPublicationService } from './server/publication.js';
+import { CommitQuarantineError } from './server/commit/types.js';
+import { ArtifactOperationError, classifyArtifactFailure } from './server/failures.js';
+import { projectArtifactHttpOutcome } from './server/outcome-projection.js';
+export { projectArtifactHttpOutcome } from './server/outcome-projection.js';
+/** Stable content-route error codes; private driver messages never leave the host. */
 export function errorBody(status) {
-    return { error: ERROR_CODES[status] ?? 'internal_error' };
+    return { error: { 400: 'invalid_request', 401: 'anonymous', 403: 'access_denied',
+            404: 'not_found', 409: 'conflict', 410: 'gone', 422: 'verification_failed',
+            500: 'internal_error', 503: 'capability_unavailable' }[status] ?? 'internal_error' };
 }
-function fail(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = errorStatus(message);
-    return { status, body: errorBody(status) };
-}
-function needObject(body) {
-    if (typeof body !== 'object' || body === null || Array.isArray(body)) {
-        throw new Error('invalid request: body must be an object');
-    }
-    return body;
-}
-function needString(value, name) {
-    if (typeof value !== 'string' || value.length === 0)
-        throw new Error(`invalid request: missing ${name}`);
+/** Retained for consumers describing canonical textual publication inputs. */
+export const TEXT_MIME_PATTERN = '^(?:text/[a-z0-9!#$&^_.+-]+|application/(?:javascript|ecmascript|json|xml|[a-z0-9!#$&^_.+-]+\\+(?:json|xml))|image/svg\\+xml)(?![\\s\\S])';
+function object(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new ArtifactProfileInputError();
     return value;
 }
-function needBytes(value, maxBytes) {
-    if (!Array.isArray(value))
-        throw new Error('invalid file bytes: must be an array');
-    if (value.length > maxBytes)
-        throw new Error('invalid publication byte budget');
-    const bytes = new Uint8Array(value.length);
-    for (let i = 0; i < value.length; i += 1) {
-        const byte = value[i];
-        if (typeof byte !== 'number' || !Number.isInteger(byte) || byte < 0 || byte > 255) {
-            throw new Error(`invalid file bytes: byte ${i} out of range`);
-        }
-        bytes[i] = byte;
+/** Other mutation surfaces need their own qualification before host activation. */
+export function assertArtifactsTransportProfile(value) {
+    assertCompiledArtifactsProfile(value);
+    const supported = ['artifacts_ensure', 'artifacts_publish', 'artifacts_list', 'artifacts_get'];
+    if (value.selectedCapabilities.some((name) => !supported.includes(name))) {
+        throw new Error('unsupported artifacts transport capability');
     }
-    return bytes;
 }
-/** Canonical text MIME types; parameters are omitted (encoding is always UTF-8). */
-export const TEXT_MIME_PATTERN = '^(?:text/[a-z0-9!#$&^_.+-]+|application/(?:javascript|ecmascript|json|xml|[a-z0-9!#$&^_.+-]+\\+(?:json|xml))|image/svg\\+xml)(?![\\s\\S])';
-function needFileBytes(entry, mimeType, maxBytes) {
-    const hasBytes = 'bytes' in entry;
-    const hasText = 'text' in entry;
-    if (hasBytes === hasText)
-        throw new Error('invalid file: supply exactly one of bytes or text');
-    if (hasBytes)
-        return needBytes(entry['bytes'], maxBytes);
-    if (typeof entry['text'] !== 'string' || !new RegExp(TEXT_MIME_PATTERN).test(mimeType)) {
-        throw new Error('invalid file text: expected a string and a canonical text MIME type');
-    }
-    if (Buffer.byteLength(entry['text'], 'utf8') > maxBytes)
-        throw new Error('invalid publication byte budget');
-    return new TextEncoder().encode(entry['text']);
-}
-/** Create the HTTP app over injected services (no server, no fetch). */
 export function createHttpArtifactApp(deps) {
-    const isApproved = deps.isApprovedAccount ?? (() => false);
-    const runtime = createContentRuntime({
-        acls: deps.acls,
-        lifecycle: deps.lifecycle,
-        publication: deps.publication,
-        blobs: deps.blobs,
-    });
-    /**
-     * Load the ACL only when the actor may learn the artifact exists: the
-     * owner always, everyone else only with a live read right. Unknown and
-     * unreadable artifacts throw the identical error (no existence oracle).
-     */
-    // Upload sessions are bound to their creating owner + artifact in-app
-    // (the upload service itself is actor-agnostic staging).
-    const uploadOwners = new Map();
-    function requireUploads() {
-        if (deps.uploads === undefined || deps.staging === undefined) {
-            throw new Error('invalid request: uploads are not configured on this host');
-        }
-        return { uploads: deps.uploads, staging: deps.staging };
-    }
-    function requireTemplates() {
-        if (deps.templates === undefined) {
-            throw new Error('invalid request: templates are not configured on this host');
-        }
-        return deps.templates;
+    assertArtifactsTransportProfile(deps.profile);
+    if (typeof deps.coordinator?.finalizePrepared !== 'function' || typeof deps.coordinator.replayPrepared !== 'function') {
+        throw new Error('artifacts requires an atomic commit coordinator');
     }
-    function requireUploadOwner(uploadId, actorId) {
-        const binding = uploadOwners.get(uploadId);
-        if (binding === undefined || binding.ownerId !== actorId) {
-            throw new Error(`unknown upload: ${uploadId}`);
-        }
-        return binding;
+    if (deps.derivation?.algorithm !== deps.profile.rules.keyDerivationAlgorithm) {
+        throw new Error('artifacts profile/derivation mismatch');
     }
-    async function requireVisible(artifactId, actorId) {
+    if (typeof deps.legacyRecords?.get !== 'function')
+        throw new Error('artifacts requires a legacy record inventory');
+    const profile = deps.profile;
+    const ensure = createGuardedEnsureService({ profile, coordinator: deps.coordinator,
+        derivation: deps.derivation, host: deps.ensureHost });
+    async function visible(artifactId, invocation) {
         const acl = await deps.acls.getArtifactAcl(artifactId);
-        if (acl === undefined)
-            throw new Error(`unknown artifact: ${artifactId}`);
-        if (acl.ownerId === actorId)
-            return acl;
+        if (!acl || acl.storageScopeId !== invocation.storageScopeId)
+            throw new ArtifactOperationError('not_found');
         const state = await deps.lifecycle.stateOf(artifactId);
-        if (!deps.lifecycle.canRead({ artifactId, state }, acl, actorId, 'read', isApproved)) {
-            throw new Error(`unknown artifact: ${artifactId}`);
+        if (!deps.lifecycle.canRead({ artifactId, state }, acl, invocation.actorId, 'read', deps.isApprovedAccount)) {
+            throw new ArtifactOperationError('not_found');
         }
         return acl;
     }
-    return {
-        async handle(request) {
+    const app = {
+        selectedCapabilities: profile.selectedCapabilities,
+        profileDigest: profile.profileDigest,
+        async execute(request, supplied) {
+            let operation = 'unsupported';
+            let phase = 'selection';
+            let commitState = 'not_committed';
+            let invocation = supplied;
             try {
-                if (request.actorId.length === 0)
-                    return { status: 401, body: errorBody(401) };
-                const body = request.body === undefined ? {} : needObject(request.body);
-                if (request.method === 'POST' && request.path === '/ensure') {
-                    const ensured = buildEnsureRequest(deps.parameterSchema, {
-                        bindingName: needString(body['bindingName'], 'bindingName'),
-                        storageScopeId: needString(request.storageScopeId, 'host storageScopeId'),
-                        idempotencyKey: needString(body['idempotencyKey'], 'idempotencyKey'),
-                        paramsHash: '',
-                        parameters: (body['parameters'] ?? {}),
-                    });
-                    const result = await deps.artifacts.ensurePrivateView({
-                        actorUserId: request.actorId,
-                        ownerId: request.actorId,
-                        storageScopeId: ensured.storageScopeId,
-                        bindingName: ensured.bindingName,
-                        idempotencyKey: ensured.idempotencyKey,
-                        parameters: ensured.parameters,
-                    });
-                    if ((await deps.acls.getArtifactAcl(result.artifactId)) === undefined) {
-                        await deps.acls.putArtifactAcl(result.artifactId, {
-                            ownerId: request.actorId,
-                            storageScopeId: ensured.storageScopeId,
-                            isPublic: false,
-                            withdrawn: false,
-                            grants: [],
-                        });
-                    }
-                    await deps.lifecycle.register(result.artifactId, request.actorId);
-                    return { status: 201, body: result };
-                }
-                if (request.method === 'POST' && request.path === '/publish') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    assertArtifactAccess({ actorUserId: request.actorId, artifactOwnerId: acl.ownerId, action: 'mutate' });
-                    if (acl.storageScopeId === undefined)
-                        throw new Error('invalid request: missing storage scope');
-                    const rawFiles = body['files'];
-                    const limits = deps.publication.limits ?? DEFAULT_PUBLICATION_LIMITS;
-                    if (!Array.isArray(rawFiles) || rawFiles.length === 0 || rawFiles.length > limits.maxFiles) {
-                        throw new Error('invalid publication file count budget');
-                    }
-                    let remaining = limits.maxTotalBytes;
-                    const files = rawFiles.map((file) => {
-                        const entry = needObject(file);
-                        const mimeType = needString(entry['mimeType'], 'file.mimeType');
-                        const bytes = needFileBytes(entry, mimeType, Math.min(limits.maxFileBytes, remaining));
-                        remaining -= bytes.byteLength;
-                        return {
-                            path: needString(entry['path'], 'file.path'),
-                            mimeType,
-                            bytes,
-                        };
-                    });
-                    const source = body['source'];
-                    const attached = source === undefined ? undefined : parseSourceRef(source);
-                    const result = await deps.publication.publish({
-                        ownerId: acl.ownerId,
-                        storageScopeId: acl.storageScopeId,
-                        artifactId,
-                        profile: (body['profile'] ?? {}),
-                        files,
-                        source: attached,
-                        idempotencyKey: typeof body['idempotencyKey'] === 'string' ? body['idempotencyKey'] : undefined,
-                        paramsHash: typeof body['paramsHash'] === 'string' ? body['paramsHash'] : undefined,
-                    }, deps.sources);
-                    await deps.lifecycle.trackRelease(artifactId, result.releaseId);
-                    return { status: 201, body: result };
-                }
-                if (request.method === 'GET' && request.path.startsWith('/current/')) {
-                    const artifactId = request.path.slice('/current/'.length);
-                    if (artifactId.length === 0)
-                        return { status: 404, body: errorBody(404) };
-                    await requireVisible(artifactId, request.actorId);
-                    const state = await deps.lifecycle.stateOf(artifactId);
-                    if (state === 'deleted' || state === 'purged') {
-                        return { status: 404, body: errorBody(404) };
-                    }
-                    const current = await deps.publication.getCurrent(artifactId);
-                    if (current === undefined)
-                        return { status: 404, body: errorBody(404) };
-                    return { status: 200, body: current };
-                }
-                if (request.method === 'POST' && ['/withdraw', '/restore', '/delete'].includes(request.path)) {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    await requireVisible(artifactId, request.actorId);
-                    if (request.path === '/withdraw')
-                        await deps.lifecycle.withdraw(artifactId, request.actorId);
-                    if (request.path === '/restore')
-                        await deps.lifecycle.restore(artifactId, request.actorId);
-                    if (request.path === '/delete')
-                        await deps.lifecycle.deleteArtifact(artifactId, request.actorId);
-                    return { status: 200, body: { artifactId, state: await deps.lifecycle.stateOf(artifactId) } };
-                }
-                if (request.method === 'POST' && request.path === '/purge') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    await requireVisible(artifactId, request.actorId);
-                    const digests = [];
-                    for (const releaseId of await deps.lifecycle.listReleases(artifactId)) {
-                        const release = await deps.publication.getRelease(releaseId);
-                        if (release === undefined)
-                            throw new Error(`unknown release: ${releaseId}`);
-                        const manifest = JSON.parse(release.manifest);
-                        for (const file of manifest.files ?? []) {
-                            if (typeof file.digest === 'string')
-                                digests.push(file.digest);
-                        }
-                    }
-                    const report = await deps.lifecycle.purge(artifactId, request.actorId, digests);
-                    return { status: 200, body: report };
-                }
-                if (request.method === 'POST' && request.path === '/promote') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    await requireVisible(artifactId, request.actorId);
-                    const result = await deps.lifecycle.promote(artifactId, request.actorId, needString(body['releaseId'], 'releaseId'), needString(body['expectedCurrent'], 'expectedCurrent'));
-                    return { status: 200, body: result };
-                }
-                if (request.method === 'POST' && request.path === '/renew') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    await requireVisible(artifactId, request.actorId);
-                    const result = await deps.lifecycle.renew(artifactId, request.actorId);
-                    return { status: 200, body: result };
-                }
-                if (request.method === 'POST' && request.path === '/fork') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    // Visibility first (404 without a read right, no oracle); a
-                    // visible object then reports its terminal state (410).
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    const state = await deps.lifecycle.stateOf(artifactId);
-                    if (state === 'deleted' || state === 'purged') {
-                        throw new Error(`cannot fork ${state} artifact: ${artifactId}`);
-                    }
-                    const current = await deps.publication.getCurrent(artifactId);
-                    if (current === undefined)
-                        throw new Error(`no release to fork for ${artifactId}`);
-                    const manifest = JSON.parse(current.manifest);
-                    const parent = {
-                        artifactId,
-                        ownerId: acl.ownerId,
-                        releaseId: current.releaseId,
-                        manifest: current.manifest,
-                        state,
-                        readerIds: acl.grants.map((grant) => grant.principalId),
-                        blobDigests: (manifest.files ?? []).flatMap((file) => typeof file.digest === 'string' ? [file.digest] : []),
+                const capability = profile.capabilityForRoute(request.method, request.path) ??
+                    (request.method === 'GET' && /^\/meta\/[^/]*$/.test(request.path) &&
+                        profile.selectedCapabilities.includes('artifacts_get') ? 'artifacts_get' : undefined);
+                if (!capability)
+                    throw new ArtifactProfileInputError(true);
+                operation = capability.slice('artifacts_'.length);
+                phase = 'entry';
+                if (!supplied || !supplied.invocationId || typeof supplied.authorizeCommit !== 'function') {
+                    throw new ArtifactProfileInputError();
+                }
+                invocation = Object.freeze({ ...supplied });
+                if (!invocation.actorId)
+                    throw new ArtifactOperationError('anonymous');
+                if (request.actorId !== invocation.actorId || !invocation.storageScopeId ||
+                    (request.storageScopeId !== undefined && request.storageScopeId !== invocation.storageScopeId)) {
+                    throw new ArtifactProfileInputError();
+                }
+                let args;
+                if (capability === 'artifacts_get') {
+                    if (request.body !== undefined && Object.keys(object(request.body)).length)
+                        throw new ArtifactProfileInputError();
+                    args = { artifactId: request.path.slice('/meta/'.length) };
+                }
+                else {
+                    args = { ...object(request.body ?? {}) };
+                    if (Object.hasOwn(args, 'storageScopeId')) {
+                        if (args.storageScopeId !== invocation.storageScopeId)
+                            throw new ArtifactProfileInputError();
+                        delete args.storageScopeId;
+                    }
+                }
+                const normalized = profile.validate(capability, args, request.idempotencyKey);
+                const command = capability === 'artifacts_ensure' || capability === 'artifacts_publish'
+                    ? createArtifactCommand(profile, capability, args, invocation, deps.derivation, request.idempotencyKey) : undefined;
+                if (command) {
+                    phase = 'migration';
+                    await assertArtifactReplayMigration(deps.legacyRecords, command, invocation, normalized.idempotencyKey);
+                }
+                phase = 'dispatch';
+                if (capability === 'artifacts_ensure') {
+                    const outcome = await ensure.ensure(invocation, { ...normalized,
+                        envelopeKey: request.idempotencyKey });
+                    return outcome.ok ? { ...outcome, result: { status: 201, body: outcome.result } } : outcome;
+                }
+                if (capability === 'artifacts_publish') {
+                    const artifactId = normalized.artifactId;
+                    const acl = await visible(artifactId, invocation);
+                    if (acl.ownerId !== invocation.actorId)
+                        throw new ArtifactOperationError('access_denied');
+                    // Both finalization and fresh replay combine provider checks with this request's host guard.
+                    const bindGuard = (request) => ({ ...request,
+                        guard: async (context, transaction) => {
+                            const decision = await request.guard(context, transaction);
+                            return decision.allowed ? invocation.authorizeCommit(context, transaction) : decision;
+                        } });
+                    const coordinator = {
+                        ...deps.coordinator,
+                        finalizePrepared: (request) => deps.coordinator.finalizePrepared(bindGuard(request)),
+                        replayPrepared: (request) => deps.coordinator.replayPrepared(bindGuard(request)),
                     };
-                    await deps.forks.track(parent);
-                    const forked = await deps.forks.fork({ actorId: request.actorId, artifactId });
-                    return { status: 201, body: forked };
-                }
-                if (request.method === 'POST' && request.path === '/access/grant') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    const grant = body['grant'];
-                    if (grant !== 'read' && grant !== 'source')
-                        throw new Error('invalid grant: must be read or source');
-                    const updated = grantAccess(acl, request.actorId, {
-                        principalId: needString(body['principalId'], 'principalId'),
-                        grant,
+                    const limits = profile.operations.find((entry) => entry.operation === 'publish').limits;
+                    const publication = createGuardedPublicationService({ ...deps.publication, coordinator,
+                        limits: { maxFiles: limits.publishFilesMax, maxFileBytes: limits.maxDecodedFileBytes,
+                            maxTotalBytes: limits.maxDecodedTotalBytes } });
+                    const outcome = await publication.publishFinalized({
+                        ownerId: acl.ownerId, storageScopeId: invocation.storageScopeId, artifactId,
+                        identity: command.identity, actorId: invocation.actorId, invocationId: invocation.invocationId,
+                        attemptId: invocation.invocationId, policyRevision: await deps.ensureHost.readPolicyRevision(),
+                        source: { kind: 'inline-original' }, profile: normalized.profile,
+                        files: normalized.files.map((file) => ({
+                            path: file.path, mimeType: file.mimeType, bytes: Uint8Array.from(file.bytes),
+                        })),
                     });
-                    await deps.acls.putArtifactAcl(artifactId, updated);
-                    return { status: 200, body: { grants: updated.grants } };
-                }
-                if (request.method === 'POST' && request.path === '/access/revoke') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    const updated = revokeAccess(acl, request.actorId, needString(body['principalId'], 'principalId'));
-                    await deps.acls.putArtifactAcl(artifactId, updated);
-                    return { status: 200, body: { grants: updated.grants } };
-                }
-                if (request.method === 'POST' && request.path === '/sources') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    assertArtifactAccess({ actorUserId: request.actorId, artifactOwnerId: acl.ownerId, action: 'mutate' });
-                    const attached = parseSourceRef(body['source'] ?? {});
-                    await deps.sources.putSource(artifactId, attached);
-                    return { status: 200, body: attached };
-                }
-                if (request.method === 'GET' && request.path.startsWith('/content/')) {
-                    const rest = request.path.slice('/content/'.length).split('/');
-                    if (rest.length !== 2 || (rest[0]?.length ?? 0) === 0 || (rest[1]?.length ?? 0) === 0) {
-                        return { status: 404, body: errorBody(404) };
-                    }
-                    await requireVisible(rest[0], request.actorId);
-                    const served = await runtime.serveFile({
-                        artifactId: rest[0],
-                        digest: rest[1],
-                        actorId: request.actorId,
-                        isApproved,
-                    });
-                    return {
-                        status: 200,
-                        body: {
-                            digest: served.digest,
-                            mimeType: served.mimeType,
-                            size: served.size,
-                            bytes: Array.from(served.bytes),
-                        },
-                    };
-                }
-                if (request.method === 'GET' && request.path.startsWith('/source/')) {
-                    const artifactId = request.path.slice('/source/'.length);
-                    if (artifactId.length === 0)
-                        return { status: 404, body: errorBody(404) };
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    if (!evaluateAccess(acl, request.actorId, 'source', isApproved)) {
-                        throw new Error('access denied: source export requires a source grant');
-                    }
-                    const source = await deps.sources.getSource(artifactId);
-                    if (source === undefined)
-                        return { status: 404, body: errorBody(404) };
-                    return { status: 200, body: source };
-                }
-                if (request.method === 'POST' && request.path === '/list') {
-                    const limit = body['limit'] === undefined ? 20 : body['limit'];
-                    const offset = body['offset'] === undefined ? 0 : body['offset'];
-                    if (!Number.isInteger(limit) || limit < 1 || limit > 100) {
-                        throw new Error('invalid request: limit must be an integer in 1..100');
-                    }
-                    if (!Number.isInteger(offset) || offset < 0) {
-                        throw new Error('invalid request: offset must be a non-negative integer');
-                    }
-                    // ACL filtering precedes pagination: invisible artifacts neither
-                    // appear nor shift the page window (spec-v8 5c).
-                    const visible = [];
-                    for (const artifactId of await deps.acls.listArtifactIds()) {
-                        const acl = await deps.acls.getArtifactAcl(artifactId);
-                        if (acl === undefined)
-                            continue;
-                        const state = await deps.lifecycle.stateOf(artifactId);
-                        if (!deps.lifecycle.canRead({ artifactId, state }, acl, request.actorId, 'read', isApproved)) {
-                            continue;
-                        }
-                        visible.push({ artifactId, ownerId: acl.ownerId, state, isPublic: acl.isPublic });
-                    }
-                    return {
-                        status: 200,
-                        body: {
-                            total: visible.length,
-                            artifacts: visible.slice(offset, offset + limit),
-                        },
-                    };
-                }
-                if (request.method === 'GET' && request.path.startsWith('/meta/')) {
-                    const artifactId = request.path.slice('/meta/'.length);
-                    if (artifactId.length === 0)
-                        return { status: 404, body: errorBody(404) };
-                    const acl = await requireVisible(artifactId, request.actorId);
+                    if (!outcome.ok) {
+                        const failure = { ...outcome.failure, kind: 'operational' };
+                        Object.defineProperty(failure, 'cause', { value: outcome.failure.cause, enumerable: false });
+                        return { ok: false, failure: Object.freeze(failure) };
+                    }
+                    commitState = outcome.commitState;
+                    const receipt = object(outcome.result.receipt);
+                    if (typeof receipt.releaseId !== 'string' || typeof receipt.manifest !== 'string') {
+                        throw new Error('invalid publication receipt');
+                    }
+                    return { ...outcome, result: { status: 201, body: {
+                                artifactId, releaseId: receipt.releaseId, manifest: receipt.manifest,
+                                digest: parseManifest(receipt.manifest).digest,
+                                ...deps.publicationUrls?.(artifactId, receipt.releaseId),
+                            } } };
+                }
+                if (capability === 'artifacts_get') {
+                    const artifactId = normalized.artifactId;
+                    const acl = await visible(artifactId, invocation);
                     const state = await deps.lifecycle.stateOf(artifactId);
                     const current = await deps.publication.getCurrent(artifactId);
-                    return {
-                        status: 200,
-                        body: {
-                            artifactId,
-                            ownerId: acl.ownerId,
-                            storageScopeId: acl.storageScopeId,
-                            state,
-                            isPublic: acl.isPublic,
-                            withdrawn: state === 'withdrawn',
-                            currentReleaseId: current?.releaseId,
-                            // Grant rosters stay owner-visible; readers learn no principals.
-                            ...(request.actorId === acl.ownerId ? { grants: acl.grants } : {}),
-                        },
-                    };
-                }
-                if (request.method === 'POST' && request.path === '/uploads') {
-                    const { uploads } = requireUploads();
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    assertArtifactAccess({ actorUserId: request.actorId, artifactOwnerId: acl.ownerId, action: 'mutate' });
-                    const maxSize = body['maxSize'];
-                    if (maxSize !== undefined && (!Number.isSafeInteger(maxSize) || maxSize < 1)) {
-                        throw new Error('invalid request: maxSize must be a positive integer');
-                    }
-                    const limits = deps.publication.limits ?? DEFAULT_PUBLICATION_LIMITS;
-                    const begun = await uploads.begin({
-                        mimeType: needString(body['mimeType'], 'mimeType'),
-                        maxSize: Math.min(maxSize ?? Infinity, limits.maxFileBytes, limits.maxTotalBytes),
-                    });
-                    uploadOwners.set(begun.uploadId, { artifactId, ownerId: request.actorId });
-                    return { status: 201, body: begun };
-                }
-                if (request.method === 'POST' && request.path === '/uploads/append') {
-                    const { uploads } = requireUploads();
-                    const uploadId = needString(body['uploadId'], 'uploadId');
-                    requireUploadOwner(uploadId, request.actorId);
-                    const offset = body['offset'];
-                    if (!Number.isSafeInteger(offset) || offset < 0) {
-                        throw new Error('invalid request: offset must be a non-negative integer');
-                    }
-                    const limits = deps.publication.limits ?? DEFAULT_PUBLICATION_LIMITS;
-                    const remaining = Math.min(uploads.remainingBytes(uploadId, offset), limits.maxFileBytes - offset, limits.maxTotalBytes - offset);
-                    const appended = await uploads.append(uploadId, offset, needBytes(body['bytes'], remaining));
-                    return { status: 200, body: appended };
-                }
-                if (request.method === 'POST' && request.path === '/uploads/commit') {
-                    const { uploads, staging } = requireUploads();
-                    const uploadId = needString(body['uploadId'], 'uploadId');
-                    const binding = requireUploadOwner(uploadId, request.actorId);
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    if (artifactId !== binding.artifactId) {
-                        throw new Error('invalid request: upload belongs to another artifact');
-                    }
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    assertArtifactAccess({ actorUserId: request.actorId, artifactOwnerId: acl.ownerId, action: 'mutate' });
-                    if (acl.storageScopeId === undefined)
-                        throw new Error('invalid request: missing storage scope');
-                    const size = body['size'];
-                    if (!Number.isInteger(size) || size < 0) {
-                        throw new Error('invalid request: size must be a non-negative integer');
-                    }
-                    const files = [{
-                            path: needString(body['path'], 'path'),
-                            mimeType: needString(body['mimeType'], 'mimeType'),
-                            bytes: new Uint8Array(0),
-                        }];
-                    await uploads.commit(uploadId, {
-                        digest: needString(body['digest'], 'digest'),
-                        size: size,
-                    }, (bytes) => {
-                        files[0].bytes = bytes;
-                        validatePublicationFiles(files, deps.publication.limits ?? DEFAULT_PUBLICATION_LIMITS);
-                    });
-                    const result = await deps.publication.publish({
-                        ownerId: acl.ownerId,
-                        storageScopeId: acl.storageScopeId,
-                        artifactId,
-                        profile: (body['profile'] ?? {}),
-                        files,
-                        idempotencyKey: typeof body['idempotencyKey'] === 'string' ? body['idempotencyKey'] : undefined,
-                        paramsHash: typeof body['paramsHash'] === 'string' ? body['paramsHash'] : undefined,
-                    });
-                    await deps.lifecycle.trackRelease(artifactId, result.releaseId);
-                    await staging.discard(uploadId);
-                    return { status: 201, body: result };
-                }
-                if (request.method === 'GET' && request.path.startsWith('/templates/')) {
-                    const templateId = request.path.slice('/templates/'.length);
-                    if (templateId.length === 0 || templateId.includes('/')) {
-                        return { status: 404, body: errorBody(404) };
-                    }
-                    const template = await requireTemplates().getTemplate(templateId);
-                    if (template === undefined)
-                        return { status: 404, body: errorBody(404) };
-                    return { status: 200, body: template };
-                }
-                if (request.method === 'GET' &&
-                    (request.path === '/api-guide' || request.path.startsWith('/api-guide/'))) {
-                    const version = request.path === '/api-guide'
-                        ? undefined
-                        : request.path.slice('/api-guide/'.length);
-                    if (version !== undefined && (version.length === 0 || version.includes('/'))) {
-                        return { status: 404, body: errorBody(404) };
-                    }
-                    const guide = await requireTemplates().getApiGuide(version);
-                    if (guide === undefined)
-                        return { status: 404, body: errorBody(404) };
-                    return { status: 200, body: guide };
-                }
-                if (request.method === 'POST' && request.path === '/access/public') {
-                    const artifactId = needString(body['artifactId'], 'artifactId');
-                    const acl = await requireVisible(artifactId, request.actorId);
-                    assertArtifactAccess({ actorUserId: request.actorId, artifactOwnerId: acl.ownerId, action: 'mutate' });
-                    if (typeof body['isPublic'] !== 'boolean') {
-                        throw new Error('invalid request: isPublic must be a boolean');
+                    return { ok: true, invocationId: invocation.invocationId, commitState: 'not_committed', replayed: false,
+                        result: { status: 200, body: { artifactId, ownerId: acl.ownerId, storageScopeId: acl.storageScopeId,
+                                state, isPublic: acl.isPublic, withdrawn: state === 'withdrawn', currentReleaseId: current?.releaseId,
+                                ...(acl.ownerId === invocation.actorId ? { grants: acl.grants } : {}) } } };
+                }
+                const visibleArtifacts = [];
+                for (const artifactId of await deps.acls.listArtifactIds()) {
+                    const acl = await deps.acls.getArtifactAcl(artifactId);
+                    if (!acl || acl.storageScopeId !== invocation.storageScopeId)
+                        continue;
+                    const state = await deps.lifecycle.stateOf(artifactId);
+                    if (deps.lifecycle.canRead({ artifactId, state }, acl, invocation.actorId, 'read', deps.isApprovedAccount)) {
+                        visibleArtifacts.push({ artifactId, ownerId: acl.ownerId, state, isPublic: acl.isPublic });
                     }
-                    await deps.acls.putArtifactAcl(artifactId, { ...acl, isPublic: body['isPublic'] });
-                    return { status: 200, body: { artifactId, isPublic: body['isPublic'] } };
                 }
-                return { status: 404, body: errorBody(404) };
+                const offset = normalized.offset;
+                return { ok: true, invocationId: invocation.invocationId, commitState: 'not_committed', replayed: false,
+                    result: { status: 200, body: { total: visibleArtifacts.length,
+                            artifacts: visibleArtifacts.slice(offset, offset + normalized.limit) } } };
             }
-            catch (error) {
-                return fail(error);
+            catch (cause) {
+                const failure = classifyArtifactFailure(cause, { invocationId: invocation?.invocationId ?? '',
+                    operation, phase, commitState }, (error) => error instanceof ArtifactProfileInputError
+                    ? new ArtifactOperationError(error.category) : undefined);
+                if (cause instanceof CommitQuarantineError) {
+                    const migration = { ...failure, kind: 'operational', category: 'provider_unavailable',
+                        variant: 'legacy_quarantine', httpStatus: 503, publicCode: 'capability_unavailable', retriable: false };
+                    Object.defineProperty(migration, 'cause', { value: cause, enumerable: false });
+                    return { ok: false, failure: Object.freeze(migration) };
+                }
+                return { ok: false, failure };
             }
         },
+        async handle(request, invocation) { return projectArtifactHttpOutcome(await app.execute(request, invocation)); },
     };
+    return Object.freeze(app);
 }