prometheus/package.json

{
  "name": "prometheus",
  "version": "0.1.0",
  "private": true,
  "type": "module",
  "description": "The service behind prometheus.x",
  "license": "MPL-2.0",
  "engines": {
    "node": ">=20"
  },
  "scripts": {
    "start": "node service/server.js"
  },
  "dependencies": {
    "busboy": "^1.6.0"
  }
}
prometheus: scaffold the standalone service — pages, routing, static assets New top-level Prometheus/ directory holds the Node service that will own prometheus.x once the on-chain record flips from the silentmode.st redirect to ip+tls. Nothing dynamic yet — this milestone delivers the site skeleton and proves the family's visual conventions port cleanly to a dynamic server. Shape: Prometheus/service/server.js node:http listener + map-based router Prometheus/service/layout.js document shell, topnav, footer Prometheus/service/pages.js home / browse / submit / publish / boundaries Prometheus/public/style.css ported silentmode.st tokens + category grid Prometheus/public/favicon.svg flame mark Routes: /, /browse, /submit, /publish, /boundaries, /static/. Dynamic routes (/api/upload, /api/manifest, /api/publish, /api/pay, /admin/) land here in later milestones per the architecture doc. Launch config .claude/launch.json gets a prometheus-service entry on port 3700 so the preview harness can run it. The pre-pivot WordPress-based scaffold at site-prometheus-x/ is left in place for the next session to delete deliberately — the architecture doc marks it as abandoned for prometheus.x but keeps the Sirius Press infra fixes it carried in. 2026-10-05 22:22:47 +02:00			`{`
			`"name": "prometheus",`
			`"version": "0.1.0",`
			`"private": true,`
			`"type": "module",`
			`"description": "The service behind prometheus.x",`
			`"license": "MPL-2.0",`
			`"engines": {`
			`"node": ">=20"`
			`},`
			`"scripts": {`
			`"start": "node service/server.js"`
prometheus: upload + ClamAV scan + signed scan reports POST /api/upload accepts a multipart file, spools it to a temp path while hashing to SHA-256, hands the on-disk copy to clamd via INSTREAM, keeps the file at uploads/<sha256>.bin on a clean verdict and discards it on anything else. The response carries the (hash, size, verdict) tuple signed by the service's ed25519 key — the artifact the manifest step will attach to the APS1 record later. For local dev on a box without ClamAV, MOCK_SCAN=clean\|infected\|error short-circuits the TCP call while still draining the bytes end-to-end. CLAMD_HOST / CLAMD_PORT / PROMETHEUS_MAX_UPLOAD_BYTES override the defaults (127.0.0.1:3310, 2 GiB). Service key lives at .keys/service.key (gitignored, 0600), generated on first start if absent. The matching public key is served at /.well-known/prometheus-service-key.json so clients can cache it per origin. ed25519 chosen over BIP-137 because the scan report is a service attestation, not a Bitcoin thing — the key never signs value, never signs for a user, never touches the chain. Canonicalisation walks the payload recursively (sorted keys at every level, no whitespace). The first draft used JSON.stringify with a keys array, which only serialises top-level keys from the array — nested objects came out as {}, so the signature verified nothing useful. /healthz pings clamd (or the mock) so monitors can tell when the scanner is down. The /submit page gets a working upload form that drives the endpoint and renders the full signed response, so the whole chain is testable in the browser as well as via curl. One dependency added: busboy. Rolling our own multipart parser was the obvious alternative; busboy is one small, maintained library with no runtime deps of its own, and multipart RFC 7578 edge cases are not places this project earns anything by rediscovering. 2026-10-05 22:41:55 +02:00			`},`
			`"dependencies": {`
			`"busboy": "^1.6.0"`
prometheus: scaffold the standalone service — pages, routing, static assets New top-level Prometheus/ directory holds the Node service that will own prometheus.x once the on-chain record flips from the silentmode.st redirect to ip+tls. Nothing dynamic yet — this milestone delivers the site skeleton and proves the family's visual conventions port cleanly to a dynamic server. Shape: Prometheus/service/server.js node:http listener + map-based router Prometheus/service/layout.js document shell, topnav, footer Prometheus/service/pages.js home / browse / submit / publish / boundaries Prometheus/public/style.css ported silentmode.st tokens + category grid Prometheus/public/favicon.svg flame mark Routes: /, /browse, /submit, /publish, /boundaries, /static/. Dynamic routes (/api/upload, /api/manifest, /api/publish, /api/pay, /admin/) land here in later milestones per the architecture doc. Launch config .claude/launch.json gets a prometheus-service entry on port 3700 so the preview harness can run it. The pre-pivot WordPress-based scaffold at site-prometheus-x/ is left in place for the next session to delete deliberately — the architecture doc marks it as abandoned for prometheus.x but keeps the Sirius Press infra fixes it carried in. 2026-10-05 22:22:47 +02:00			`}`
			`}`