@sentropic/artifacts 0.2.1 → 0.2.2

package/dist/adapters/s3.js

@@ -10,6 +10,7 @@
  * host and injected — this module never reads env or creates connections.
  */
 import { DeleteObjectCommand, GetObjectCommand, ListObjectsV2Command, PutObjectCommand, } from '@aws-sdk/client-s3';
+import { assertBlobPrefix } from '../server/blob-prefix.js';
 const BLOB_KEY_PATTERN = /^artifacts\/[A-Za-z0-9_-]+\/blobs\/sha256\/[0-9a-f]{64}$/;
 /** Reject anything but digest-addressed blob keys, before any I/O. */
 function assertBlobKey(key) {
@@ -17,12 +18,6 @@ function assertBlobKey(key) {
         throw new Error(`invalid blob key (must be artifacts/<scope>/blobs/sha256/<hex>): ${key}`);
     }
 }
-/** Reject empty or escaping prefixes before any I/O. */
-function assertPrefix(prefix) {
-    if (prefix.length === 0 || prefix.includes('..')) {
-        throw new Error(`invalid blob prefix: ${prefix}`);
-    }
-}
 /** Create an S3-backed blob store over an injected client (no env reads). */
 export function createS3BlobStore(options) {
     return {
@@ -49,7 +44,7 @@ export function createS3BlobStore(options) {
             }
         },
         async listKeys(prefix) {
-            assertPrefix(prefix);
+            assertBlobPrefix(prefix);
             const keys = [];
             let token;
             do {

package/dist/mcp-core.d.ts

@@ -10,7 +10,7 @@ export { createRadarKeyDerivation } from './server/command-identity.js';
 export type { ArtifactKeyDerivationBinding } from './server/command-identity.js';
 export declare const ARTIFACTS_PROVIDER_ID = "sentropic.artifacts";
 export declare const ARTIFACTS_APP_ID = "sentropic-artifacts";
-export declare const ARTIFACTS_PROVIDER_VERSION = "0.2.1";
+export declare const ARTIFACTS_PROVIDER_VERSION = "0.2.2";
 export declare const ARTIFACTS_TOOL_NAMES: readonly ["artifacts_get_template", "artifacts_get_api_guide", "artifacts_ensure", "artifacts_publish", "artifacts_create_upload", "artifacts_commit_upload", "artifacts_list", "artifacts_get", "artifacts_get_source", "artifacts_fork", "artifacts_set_access", "artifacts_promote", "artifacts_renew", "artifacts_delete", "artifacts_restore"];
 export type ArtifactsToolName = (typeof ARTIFACTS_TOOL_NAMES)[number];
 export declare const ARTIFACTS_TOOL_SPECS: {

package/dist/mcp-core.js

@@ -6,7 +6,7 @@ export * from './profile/index.js';
 export { createRadarKeyDerivation } from './server/command-identity.js';
 export const ARTIFACTS_PROVIDER_ID = 'sentropic.artifacts';
 export const ARTIFACTS_APP_ID = 'sentropic-artifacts';
-export const ARTIFACTS_PROVIDER_VERSION = '0.2.1';
+export const ARTIFACTS_PROVIDER_VERSION = '0.2.2';
 export const ARTIFACTS_TOOL_NAMES = ARTIFACT_CAPABILITY_NAMES;
 export const ARTIFACTS_TOOL_SPECS = ARTIFACTS_TOOL_NAMES.map((name) => ({ name,
     description: `Artifacts ${name.slice('artifacts_'.length).replaceAll('_', ' ')}.`,

package/dist/server/blob-prefix.d.ts

@@ -0,0 +1,2 @@
+/** Reject empty or escaping prefixes before enumeration or external I/O. */
+export declare function assertBlobPrefix(prefix: string): void;

package/dist/server/blob-prefix.js

@@ -0,0 +1,14 @@
+import { ArtifactOperationError } from './failures.js';
+class InvalidBlobPrefixError extends ArtifactOperationError {
+    code = 'invalid_blob_prefix';
+    constructor(prefix) {
+        super('invalid_request');
+        this.message = `invalid blob prefix: ${prefix}`;
+    }
+}
+/** Reject empty or escaping prefixes before enumeration or external I/O. */
+export function assertBlobPrefix(prefix) {
+    if (prefix.length === 0 || prefix.includes('..')) {
+        throw new InvalidBlobPrefixError(prefix);
+    }
+}

package/dist/server/publication.js

@@ -12,6 +12,7 @@
  * serve unit tests and the Postgres/S3 adapters serve integration.
  */
 import { createHash } from 'node:crypto';
+import { assertBlobPrefix } from './blob-prefix.js';
 import { canonicalManifest, manifestDigest } from '../codecs.js';
 import { parseSourceRef } from './sources.js';
 import { publicationLimits, validatePublicationFiles } from './publication-limits.js';
@@ -59,8 +60,9 @@ export function createMemoryBlobStore() {
         getBlob(key) {
             return Promise.resolve(blobs.get(key));
         },
-        listKeys(prefix) {
-            return Promise.resolve([...blobs.keys()].filter((key) => key.startsWith(prefix)).sort());
+        async listKeys(prefix) {
+            assertBlobPrefix(prefix);
+            return [...blobs.keys()].filter((key) => key.startsWith(prefix)).sort();
         },
         deleteBlob(key) {
             if (!blobs.has(key))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentropic/artifacts",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Generic configurable artifacts MCP and artifact service: StorageScope/Artifact/Binding/Release model, canonical manifests, object authorization, idempotent intents (spec-v8 §9).",
   "type": "module",
   "license": "MIT",