anantham-v2 2.0.0-alpha.1

package/dist/api/api-server.js

@@ -0,0 +1,131 @@
+import http from "node:http";
+import { SqliteEngine } from "../persistence/sqlite-engine.js";
+import { MigrationEngine } from "../persistence/migration-engine.js";
+import { ProjectRepository } from "../persistence/repositories/project-repository.js";
+import { SessionRepository } from "../persistence/repositories/session-repository.js";
+import { TaskRepository } from "../persistence/repositories/task-repository.js";
+import { JobRepository } from "../persistence/repositories/job-repository.js";
+import { NodeRepository } from "../persistence/repositories/node-repository.js";
+import { RemoteDispatchRepository } from "../persistence/repositories/remote-dispatch-repository.js";
+import { ArtifactRepository } from "../persistence/repositories/artifact-repository.js";
+import { LeaseRepository } from "../persistence/repositories/lease-repository.js";
+import { CheckpointRepository } from "../persistence/repositories/checkpoint-repository.js";
+import { EventRepository } from "../persistence/repositories/event-repository.js";
+import { EventStore } from "../event-state/event-store.js";
+import { TaskClaimManager } from "../tasks/task-claim-manager.js";
+import { CrashRecoveryEngine } from "../recovery/crash-recovery-engine.js";
+import { ApiRouter } from "./api-router.js";
+/**
+ * Native Node.js HTTP Server Container for Anantham V2 REST API.
+ * PRD Part 2 Section 200–215.
+ */
+export class ApiServer {
+    engine;
+    projectRepo;
+    sessionRepo;
+    taskRepo;
+    jobRepo;
+    nodeRepo;
+    dispatchRepo;
+    artifactRepo;
+    leaseRepo;
+    checkpointRepo;
+    eventRepo;
+    eventStore;
+    claimManager;
+    recoveryEngine;
+    router;
+    server;
+    isInitialized = false;
+    constructor(options = {}) {
+        const dbPath = options.dbPath ?? ":memory:";
+        this.engine = new SqliteEngine({ path: dbPath });
+        this.projectRepo = new ProjectRepository(this.engine);
+        this.sessionRepo = new SessionRepository(this.engine);
+        this.taskRepo = new TaskRepository(this.engine);
+        this.jobRepo = new JobRepository(this.engine);
+        this.nodeRepo = new NodeRepository(this.engine);
+        this.dispatchRepo = new RemoteDispatchRepository(this.engine);
+        this.artifactRepo = new ArtifactRepository(this.engine);
+        this.leaseRepo = new LeaseRepository(this.engine);
+        this.checkpointRepo = new CheckpointRepository(this.engine);
+        this.eventRepo = new EventRepository(this.engine);
+        this.eventStore = new EventStore(this.engine);
+        this.claimManager = new TaskClaimManager({
+            engine: this.engine,
+            taskRepo: this.taskRepo,
+            leaseRepo: this.leaseRepo,
+            eventStore: this.eventStore,
+        });
+        this.recoveryEngine = new CrashRecoveryEngine({
+            engine: this.engine,
+            eventStore: this.eventStore,
+            checkpointRepo: this.checkpointRepo,
+            artifactRepo: this.artifactRepo,
+        });
+        this.router = new ApiRouter({
+            engine: this.engine,
+            projectRepo: this.projectRepo,
+            sessionRepo: this.sessionRepo,
+            taskRepo: this.taskRepo,
+            jobRepo: this.jobRepo,
+            nodeRepo: this.nodeRepo,
+            artifactRepo: this.artifactRepo,
+            eventStore: this.eventStore,
+            claimManager: this.claimManager,
+            recoveryEngine: this.recoveryEngine,
+            authenticator: options.authenticator,
+            idempotencyManager: options.idempotencyManager,
+        });
+        this.server = http.createServer((req, res) => {
+            this.router.handleRequest(req, res).catch((err) => {
+                if (!res.headersSent) {
+                    res.writeHead(500, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ success: false, error: { message: err.message, code: "server_error" } }));
+                }
+            });
+        });
+    }
+    async initialize() {
+        if (this.isInitialized)
+            return;
+        this.engine.open();
+        const migrator = new MigrationEngine(this.engine);
+        migrator.migrate();
+        try {
+            await this.recoveryEngine.executeRecovery();
+        }
+        catch {
+            // Non-blocking on clean setup
+        }
+        this.isInitialized = true;
+    }
+    async listen(port = 0, host = "127.0.0.1") {
+        if (!this.isInitialized) {
+            await this.initialize();
+        }
+        return new Promise((resolve) => {
+            this.server.listen(port, host, () => {
+                const addr = this.server.address();
+                const actualPort = addr.port;
+                const actualHost = addr.address;
+                resolve({
+                    port: actualPort,
+                    host: actualHost,
+                    url: `http://${actualHost}:${actualPort}`,
+                });
+            });
+        });
+    }
+    async close() {
+        return new Promise((resolve) => {
+            this.server.close(() => {
+                if (this.engine.isOpen()) {
+                    this.engine.close();
+                }
+                resolve();
+            });
+        });
+    }
+}
+//# sourceMappingURL=api-server.js.map

package/dist/api/api-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-server.js","sourceRoot":"","sources":["../../src/api/api-server.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,+CAA+C,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAY5C;;;GAGG;AACH,MAAM,OAAO,SAAS;IACJ,MAAM,CAAe;IACrB,WAAW,CAAoB;IAC/B,WAAW,CAAoB;IAC/B,QAAQ,CAAiB;IACzB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,YAAY,CAA2B;IACvC,YAAY,CAAqB;IACjC,SAAS,CAAkB;IAC3B,cAAc,CAAuB;IACrC,SAAS,CAAkB;IAC3B,UAAU,CAAa;IACvB,YAAY,CAAmB;IAC/B,cAAc,CAAsB;IAEpC,MAAM,CAAY;IAClB,MAAM,CAAc;IAC5B,aAAa,GAAG,KAAK,CAAC;IAE9B,YAAY,UAA4B,EAAE;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAEjD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,CAAC,YAAY,GAAG,IAAI,gBAAgB,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,GAAG,IAAI,mBAAmB,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,UAAU;QACrB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,QAAQ,CAAC,OAAO,EAAE,CAAC;QAEnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,WAAW;QAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAiB,CAAC;gBAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;gBAChC,OAAO,CAAC;oBACN,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,UAAU;oBAChB,GAAG,EAAE,UAAU,UAAU,IAAI,UAAU,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACrB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/api/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Anantham V2 — API Subsystem
+ * PRD Part 2 Section 200–215.
+ */
+export * from "./api-authenticator.js";
+export * from "./api-authorizer.js";
+export * from "./api-error-mapper.js";
+export * from "./api-idempotency-manager.js";
+export * from "./openapi-generator.js";
+export * from "./api-router.js";
+export * from "./api-server.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,12 @@
+/**
+ * Anantham V2 — API Subsystem
+ * PRD Part 2 Section 200–215.
+ */
+export * from "./api-authenticator.js";
+export * from "./api-authorizer.js";
+export * from "./api-error-mapper.js";
+export * from "./api-idempotency-manager.js";
+export * from "./openapi-generator.js";
+export * from "./api-router.js";
+export * from "./api-server.js";
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC"}

package/dist/api/openapi-generator.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OpenAPI 3.1.0 Specification Generator for Anantham V2.
+ * PRD Part 2 Section 210.
+ */
+export declare class OpenApiGenerator {
+    static generateSpec(): Record<string, unknown>;
+}
+//# sourceMappingURL=openapi-generator.d.ts.map

package/dist/api/openapi-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../src/api/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,gBAAgB;WACb,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAsKtD"}

package/dist/api/openapi-generator.js

@@ -0,0 +1,173 @@
+/**
+ * OpenAPI 3.1.0 Specification Generator for Anantham V2.
+ * PRD Part 2 Section 210.
+ */
+export class OpenApiGenerator {
+    static generateSpec() {
+        return {
+            openapi: "3.1.0",
+            info: {
+                title: "Anantham V2 Runtime API",
+                version: "2.0.0-alpha.1",
+                description: "Programmatic REST API for Anantham V2 AI Agent Operating Environment.",
+            },
+            servers: [
+                {
+                    url: "http://localhost:3000",
+                    description: "Local Runtime Server",
+                },
+            ],
+            paths: {
+                "/v1/health": {
+                    get: {
+                        summary: "Health check",
+                        responses: {
+                            "200": { description: "Runtime healthy" },
+                        },
+                    },
+                },
+                "/v1/doctor": {
+                    get: {
+                        summary: "System Diagnostics",
+                        responses: {
+                            "200": { description: "Diagnostics report" },
+                        },
+                    },
+                },
+                "/v1/projects": {
+                    get: {
+                        summary: "List projects",
+                        responses: {
+                            "200": { description: "Array of projects" },
+                        },
+                    },
+                    post: {
+                        summary: "Create project",
+                        requestBody: {
+                            required: true,
+                            content: { "application/json": { schema: { type: "object" } } },
+                        },
+                        responses: {
+                            "201": { description: "Project created" },
+                        },
+                    },
+                },
+                "/v1/sessions": {
+                    get: {
+                        summary: "List sessions in project",
+                        parameters: [{ name: "projectId", in: "query", required: true, schema: { type: "string" } }],
+                        responses: {
+                            "200": { description: "Array of sessions" },
+                        },
+                    },
+                    post: {
+                        summary: "Create session",
+                        requestBody: {
+                            required: true,
+                            content: { "application/json": { schema: { type: "object" } } },
+                        },
+                        responses: {
+                            "201": { description: "Session created" },
+                        },
+                    },
+                },
+                "/v1/tasks": {
+                    get: {
+                        summary: "List tasks in session",
+                        parameters: [{ name: "sessionId", in: "query", required: true, schema: { type: "string" } }],
+                        responses: {
+                            "200": { description: "Array of tasks" },
+                        },
+                    },
+                    post: {
+                        summary: "Create task",
+                        requestBody: {
+                            required: true,
+                            content: { "application/json": { schema: { type: "object" } } },
+                        },
+                        responses: {
+                            "201": { description: "Task created" },
+                        },
+                    },
+                },
+                "/v1/tasks/{taskId}/claim": {
+                    post: {
+                        summary: "Claim task with lease",
+                        parameters: [{ name: "taskId", in: "path", required: true, schema: { type: "string" } }],
+                        requestBody: {
+                            required: true,
+                            content: { "application/json": { schema: { type: "object" } } },
+                        },
+                        responses: {
+                            "200": { description: "Task claimed and lease acquired" },
+                        },
+                    },
+                },
+                "/v1/jobs": {
+                    get: {
+                        summary: "List background jobs",
+                        parameters: [{ name: "projectId", in: "query", required: true, schema: { type: "string" } }],
+                        responses: {
+                            "200": { description: "Array of background jobs" },
+                        },
+                    },
+                    post: {
+                        summary: "Create background job",
+                        requestBody: {
+                            required: true,
+                            content: { "application/json": { schema: { type: "object" } } },
+                        },
+                        responses: {
+                            "201": { description: "Background job created" },
+                        },
+                    },
+                },
+                "/v1/nodes": {
+                    get: {
+                        summary: "List registered remote worker nodes",
+                        responses: {
+                            "200": { description: "Array of remote nodes" },
+                        },
+                    },
+                },
+                "/v1/artifacts": {
+                    get: {
+                        summary: "List artifacts in session",
+                        parameters: [{ name: "sessionId", in: "query", required: true, schema: { type: "string" } }],
+                        responses: {
+                            "200": { description: "Array of artifacts" },
+                        },
+                    },
+                },
+                "/v1/events": {
+                    get: {
+                        summary: "Query event stream",
+                        parameters: [
+                            { name: "sessionId", in: "query", schema: { type: "string" } },
+                            { name: "limit", in: "query", schema: { type: "integer" } },
+                            { name: "offset", in: "query", schema: { type: "integer" } },
+                        ],
+                        responses: {
+                            "200": { description: "Paginated events" },
+                        },
+                    },
+                },
+            },
+            components: {
+                securitySchemes: {
+                    BearerAuth: {
+                        type: "http",
+                        scheme: "bearer",
+                    },
+                    ApiKeyAuth: {
+                        type: "apiKey",
+                        in: "header",
+                        name: "X-API-Key",
+                    },
+                },
+            },
+            security: [{ BearerAuth: [] }, { ApiKeyAuth: [] }],
+        };
+    }
+}
+//# sourceMappingURL=openapi-generator.js.map

package/dist/api/openapi-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-generator.js","sourceRoot":"","sources":["../../src/api/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACpB,MAAM,CAAC,YAAY;QACxB,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE;gBACJ,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,eAAe;gBACxB,WAAW,EAAE,uEAAuE;aACrF;YACD,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,WAAW,EAAE,sBAAsB;iBACpC;aACF;YACD,KAAK,EAAE;gBACL,YAAY,EAAE;oBACZ,GAAG,EAAE;wBACH,OAAO,EAAE,cAAc;wBACvB,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;yBAC1C;qBACF;iBACF;gBACD,YAAY,EAAE;oBACZ,GAAG,EAAE;wBACH,OAAO,EAAE,oBAAoB;wBAC7B,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;yBAC7C;qBACF;iBACF;gBACD,cAAc,EAAE;oBACd,GAAG,EAAE;wBACH,OAAO,EAAE,eAAe;wBACxB,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;yBAC5C;qBACF;oBACD,IAAI,EAAE;wBACJ,OAAO,EAAE,gBAAgB;wBACzB,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;yBAC1C;qBACF;iBACF;gBACD,cAAc,EAAE;oBACd,GAAG,EAAE;wBACH,OAAO,EAAE,0BAA0B;wBACnC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC5F,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE;yBAC5C;qBACF;oBACD,IAAI,EAAE;wBACJ,OAAO,EAAE,gBAAgB;wBACzB,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE;yBAC1C;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,GAAG,EAAE;wBACH,OAAO,EAAE,uBAAuB;wBAChC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC5F,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE;yBACzC;qBACF;oBACD,IAAI,EAAE;wBACJ,OAAO,EAAE,aAAa;wBACtB,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE;yBACvC;qBACF;iBACF;gBACD,0BAA0B,EAAE;oBAC1B,IAAI,EAAE;wBACJ,OAAO,EAAE,uBAAuB;wBAChC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;wBACxF,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE;yBAC1D;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,GAAG,EAAE;wBACH,OAAO,EAAE,sBAAsB;wBAC/B,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC5F,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE;yBACnD;qBACF;oBACD,IAAI,EAAE;wBACJ,OAAO,EAAE,uBAAuB;wBAChC,WAAW,EAAE;4BACX,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;yBAChE;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE;yBACjD;qBACF;iBACF;gBACD,WAAW,EAAE;oBACX,GAAG,EAAE;wBACH,OAAO,EAAE,qCAAqC;wBAC9C,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE;yBAChD;qBACF;iBACF;gBACD,eAAe,EAAE;oBACf,GAAG,EAAE;wBACH,OAAO,EAAE,2BAA2B;wBACpC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;wBAC5F,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;yBAC7C;qBACF;iBACF;gBACD,YAAY,EAAE;oBACZ,GAAG,EAAE;wBACH,OAAO,EAAE,oBAAoB;wBAC7B,UAAU,EAAE;4BACV,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;4BAC9D,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;4BAC3D,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;yBAC7D;wBACD,SAAS,EAAE;4BACT,KAAK,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;yBAC3C;qBACF;iBACF;aACF;YACD,UAAU,EAAE;gBACV,eAAe,EAAE;oBACf,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;qBACjB;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,EAAE,EAAE,QAAQ;wBACZ,IAAI,EAAE,WAAW;qBAClB;iBACF;aACF;YACD,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;SACnD,CAAC;IACJ,CAAC;CACF"}

package/dist/artifacts/artifact-manager.d.ts

@@ -0,0 +1,52 @@
+import type { Artifact, ArtifactType } from "../domain/artifact.js";
+import type { ArtifactRepository } from "../persistence/repositories/artifact-repository.js";
+import { type ArtifactAccessContext } from "./artifact-reference-validator.js";
+export declare class ArtifactIntegrityError extends Error {
+    constructor(message: string);
+}
+export declare class ArtifactAccessDeniedError extends Error {
+    constructor(message: string);
+}
+export declare class ArtifactNotFoundError extends Error {
+    constructor(message: string);
+}
+export interface CreateArtifactParams {
+    id?: string;
+    type: ArtifactType | string;
+    data: Buffer | string;
+    projectId?: string;
+    sessionId?: string;
+    taskId?: string;
+    agentId?: string;
+    sourceEventIds?: string[];
+    metadata?: Record<string, unknown>;
+    filename?: string;
+}
+export declare class ArtifactManager {
+    private readonly repository;
+    private readonly storageDir;
+    constructor(repository: ArtifactRepository, storageDir?: string);
+    /**
+     * Creates an artifact with atomic durable write, cryptographic SHA-256 digest,
+     * and SQLite metadata persistence.
+     * PRD Part 1 Section 97.
+     */
+    createArtifact(params: CreateArtifactParams): Promise<Artifact>;
+    /**
+     * Reads an artifact, validates access context, and re-verifies cryptographic integrity.
+     * Throws ArtifactIntegrityError if the physical file has been tampered with or corrupted.
+     */
+    readArtifact(id: string, context?: ArtifactAccessContext): Promise<{
+        artifact: Artifact;
+        data: Buffer;
+    }>;
+    /**
+     * Performs deterministic verification of an artifact and updates its verification status.
+     */
+    verifyArtifact(id: string, verifierId?: string): Promise<Artifact>;
+    /**
+     * Cleans up dangling temporary files (.tmp) left behind after a crash or interrupted write.
+     */
+    cleanupOrphanTempFiles(): Promise<number>;
+}
+//# sourceMappingURL=artifact-manager.d.ts.map

package/dist/artifacts/artifact-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-manager.d.ts","sourceRoot":"","sources":["../../src/artifacts/artifact-manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAwB,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAA8B,KAAK,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE3G,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,UAAU,EAAE,kBAAkB,EAAE,UAAU,SAAwB;IAS9E;;;;OAIG;IACU,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmD5E;;;OAGG;IACU,YAAY,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA+BhD;;OAEG;IACU,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,SAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IA+C1F;;OAEG;IACU,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;CAmBvD"}

package/dist/artifacts/artifact-manager.js

@@ -0,0 +1,178 @@
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { ArtifactSchema } from "../domain/artifact.js";
+import { ArtifactReferenceValidator } from "./artifact-reference-validator.js";
+export class ArtifactIntegrityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ArtifactIntegrityError";
+    }
+}
+export class ArtifactAccessDeniedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ArtifactAccessDeniedError";
+    }
+}
+export class ArtifactNotFoundError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ArtifactNotFoundError";
+    }
+}
+export class ArtifactManager {
+    repository;
+    storageDir;
+    constructor(repository, storageDir = ".anantham/artifacts") {
+        this.repository = repository;
+        this.storageDir = resolve(storageDir);
+        if (!existsSync(this.storageDir)) {
+            mkdirSync(this.storageDir, { recursive: true });
+        }
+    }
+    /**
+     * Creates an artifact with atomic durable write, cryptographic SHA-256 digest,
+     * and SQLite metadata persistence.
+     * PRD Part 1 Section 97.
+     */
+    async createArtifact(params) {
+        const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, "utf8");
+        const sha256 = createHash("sha256").update(buffer).digest("hex");
+        const id = params.id || `art_${sha256.slice(0, 16)}`;
+        const now = new Date().toISOString();
+        const fileName = params.filename || `${id}_${sha256.slice(0, 8)}.dat`;
+        const targetPath = join(this.storageDir, fileName);
+        const tempPath = join(this.storageDir, `${fileName}.${randomUUID()}.tmp`);
+        // 1. Path Safety Check
+        const pathCheck = ArtifactReferenceValidator.validateStoragePath(targetPath, this.storageDir);
+        if (!pathCheck.isValid) {
+            throw new Error(pathCheck.reason);
+        }
+        // 2. Atomic Write: Write to .tmp then rename to target
+        writeFileSync(tempPath, buffer);
+        renameSync(tempPath, targetPath);
+        // 3. Construct and Validate Artifact Entity
+        const artifact = {
+            id,
+            type: params.type,
+            projectId: params.projectId,
+            sessionId: params.sessionId,
+            taskId: params.taskId,
+            agentId: params.agentId,
+            contentUri: `file:///${targetPath.replace(/\\/g, "/")}`,
+            sha256,
+            sourceEventIds: params.sourceEventIds || [],
+            verification: {
+                status: "unverified",
+                checks: ["initial-write"],
+            },
+            createdAt: now,
+            metadata: {
+                sizeBytes: buffer.length,
+                originalFilename: params.filename,
+                ...params.metadata,
+            },
+        };
+        const validated = Object.freeze(ArtifactSchema.parse(artifact));
+        // 4. Save metadata into persistent SQLite repository
+        this.repository.save(validated);
+        return validated;
+    }
+    /**
+     * Reads an artifact, validates access context, and re-verifies cryptographic integrity.
+     * Throws ArtifactIntegrityError if the physical file has been tampered with or corrupted.
+     */
+    async readArtifact(id, context) {
+        const artifact = this.repository.findById(id);
+        if (!artifact) {
+            throw new ArtifactNotFoundError(`Artifact '${id}' not found in repository.`);
+        }
+        // 1. Enforce Access & Project Boundaries
+        const accessCheck = ArtifactReferenceValidator.validateAccess(artifact, context);
+        if (!accessCheck.isValid) {
+            throw new ArtifactAccessDeniedError(accessCheck.reason || "Access denied.");
+        }
+        // 2. Resolve and validate file path
+        const filePath = artifact.contentUri.replace(/^file:\/\/\/?/, "");
+        if (!existsSync(filePath)) {
+            throw new ArtifactNotFoundError(`Physical content for artifact '${id}' is missing at '${filePath}'.`);
+        }
+        // 3. Read and verify SHA-256 integrity
+        const buffer = readFileSync(filePath);
+        const actualHash = createHash("sha256").update(buffer).digest("hex");
+        if (actualHash !== artifact.sha256) {
+            throw new ArtifactIntegrityError(`Cryptographic integrity failure for artifact '${id}': expected SHA-256 '${artifact.sha256}', but read '${actualHash}'.`);
+        }
+        return { artifact, data: buffer };
+    }
+    /**
+     * Performs deterministic verification of an artifact and updates its verification status.
+     */
+    async verifyArtifact(id, verifierId = "system_verifier") {
+        const artifact = this.repository.findById(id);
+        if (!artifact) {
+            throw new ArtifactNotFoundError(`Artifact '${id}' not found for verification.`);
+        }
+        const now = new Date().toISOString();
+        const checks = ["schema-valid"];
+        let status = "verified";
+        try {
+            const filePath = artifact.contentUri.replace(/^file:\/\/\/?/, "");
+            if (!existsSync(filePath)) {
+                checks.push("file-missing");
+                status = "failed";
+            }
+            else {
+                checks.push("file-exists");
+                const buffer = readFileSync(filePath);
+                const actualHash = createHash("sha256").update(buffer).digest("hex");
+                if (actualHash === artifact.sha256) {
+                    checks.push("sha256-verified");
+                }
+                else {
+                    checks.push("sha256-mismatch");
+                    status = "failed";
+                }
+            }
+        }
+        catch {
+            checks.push("read-error");
+            status = "failed";
+        }
+        const updatedArtifact = {
+            ...artifact,
+            verification: {
+                status,
+                checks,
+                verifiedAt: now,
+                verifierId,
+            },
+        };
+        const validated = Object.freeze(ArtifactSchema.parse(updatedArtifact));
+        this.repository.save(validated);
+        return validated;
+    }
+    /**
+     * Cleans up dangling temporary files (.tmp) left behind after a crash or interrupted write.
+     */
+    async cleanupOrphanTempFiles() {
+        if (!existsSync(this.storageDir))
+            return 0;
+        let cleaned = 0;
+        const files = readdirSync(this.storageDir);
+        for (const file of files) {
+            if (file.endsWith(".tmp")) {
+                try {
+                    unlinkSync(join(this.storageDir, file));
+                    cleaned++;
+                }
+                catch {
+                    // ignore concurrent deletion
+                }
+            }
+        }
+        return cleaned;
+    }
+}
+//# sourceMappingURL=artifact-manager.js.map

package/dist/artifacts/artifact-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-manager.js","sourceRoot":"","sources":["../../src/artifacts/artifact-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,0BAA0B,EAA8B,MAAM,mCAAmC,CAAC;AAE3G,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAeD,MAAM,OAAO,eAAe;IACT,UAAU,CAAqB;IAC/B,UAAU,CAAS;IAEpC,YAAY,UAA8B,EAAE,UAAU,GAAG,qBAAqB;QAC5E,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAEtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,cAAc,CAAC,MAA4B;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;QAE1E,uBAAuB;QACvB,MAAM,SAAS,GAAG,0BAA0B,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAED,uDAAuD;QACvD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjC,4CAA4C;QAC5C,MAAM,QAAQ,GAAa;YACzB,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,WAAW,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YACvD,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;YAC3C,YAAY,EAAE;gBACZ,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,CAAC,eAAe,CAAC;aAC1B;YACD,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,MAAM,CAAC,MAAM;gBACxB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;gBACjC,GAAG,MAAM,CAAC,QAAQ;aACnB;SACF,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEhE,qDAAqD;QACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CACvB,EAAU,EACV,OAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;QAC/E,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,0BAA0B,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,yBAAyB,CAAC,WAAW,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,EAAE,oBAAoB,QAAQ,IAAI,CAAC,CAAC;QACxG,CAAC;QAED,uCAAuC;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAErE,IAAI,UAAU,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,iDAAiD,EAAE,wBAAwB,QAAQ,CAAC,MAAM,gBAAgB,UAAU,IAAI,CACzH,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,UAAU,GAAG,iBAAiB;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAa,CAAC,cAAc,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAmC,UAAU,CAAC;QAExD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC5B,MAAM,GAAG,QAAQ,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrE,IAAI,UAAU,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACnC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBAC/B,MAAM,GAAG,QAAQ,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1B,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;QAED,MAAM,eAAe,GAAa;YAChC,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,GAAG;gBACf,UAAU;aACX;SACF,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEhC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,CAAC;QAE3C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;oBACxC,OAAO,EAAE,CAAC;gBACZ,CAAC;gBAAC,MAAM,CAAC;oBACP,6BAA6B;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/artifacts/artifact-reference-validator.d.ts

@@ -0,0 +1,23 @@
+import type { Artifact } from "../domain/artifact.js";
+export interface ArtifactAccessContext {
+    requestProjectId?: string;
+    requestSessionId?: string;
+    allowCrossProject?: boolean;
+}
+export interface ValidationResult {
+    isValid: boolean;
+    reason?: string;
+}
+export declare class ArtifactReferenceValidator {
+    /**
+     * Validates that an artifact storage path does not escape the designated base directory.
+     * Defends against path traversal, absolute path injection, and directory climbing.
+     * PRD Part 3 Section 138.
+     */
+    static validateStoragePath(filePath: string, allowedBaseDir: string): ValidationResult;
+    /**
+     * Validates whether a caller in a given project context can access the artifact.
+     */
+    static validateAccess(artifact: Artifact, context?: ArtifactAccessContext): ValidationResult;
+}
+//# sourceMappingURL=artifact-reference-validator.d.ts.map

package/dist/artifacts/artifact-reference-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-reference-validator.d.ts","sourceRoot":"","sources":["../../src/artifacts/artifact-reference-validator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,0BAA0B;IACrC;;;;OAIG;WACW,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,gBAAgB;IAmB7F;;OAEG;WACW,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,gBAAgB;CAiBpG"}