@absol-labs/agent 0.8.0 → 0.9.0

package/src/discovery/registry.ts

@@ -1,40 +1,56 @@
 import {
-  deriveServiceRef,
-  recoverServiceBindingSigner,
-  recoverServiceDescriptorSigner,
-  serviceBindingSchema,
-  serviceDescriptorSchema,
-  type SignedServiceBinding,
-  type SignedServiceDescriptor,
+  RegistryUnavailableError,
+  discoverServices as sdkDiscoverServices,
+  type DiscoverResult,
+  type DiscoveredService,
+  type FetchLike,
+  type RegistryConfig,
+} from "@absol-labs/sdk";
+import type {
+  SignedServiceBinding,
+  SignedServiceDescriptor,
 } from "@absol-labs/shared";
-import { isHex } from "viem";
-import { z } from "zod";
 
 /**
  * Service discovery for the Metrik verified-service marketplace.
  *
- * Before this module every agent surface (SDK, MCP, framework tools) assumed the
- * caller already knew a seller's `operator` + `serviceRef`. There was no way to
- * DISCOVER a service. {@link discoverServices} closes that gap: it reads the same
- * Supabase `listings` registry the oracle reads and returns typed, VERIFIED
- * listings an agent can hire directly.
+ * ## One implementation, two shapes
+ * The verification and transport logic lives in ONE place: `@absol-labs/sdk`'s
+ * {@link sdkDiscoverServices}. This module is a thin, documented adapter over it
+ * that projects the SDK's richer {@link DiscoveredService} onto the agent layer's
+ * {@link ServiceListing}. Previously both packages shipped their own
+ * `discoverServices` with different defaults and OPPOSITE failure semantics —
+ * the SDK threw on an unreachable registry while this one silently returned a
+ * hardcoded listing. There is now a single trust decision, a single default
+ * endpoint, and a single error type ({@link RegistryUnavailableError}) across
+ * both packages. Need the SDK's full result (tier, verification summary,
+ * `registryAvailable`, `source`, filter notes)? Call
+ * {@link discoverServicesDetailed}, which returns it verbatim.
  *
- * ## Fail-closed trust model
- * The security-critical envelope lives entirely inside each row's `signed_binding`
- * (`{ binding, signature, serviceRef, targetMetadata }`). The flat `service_ref` /
- * `operator` / `public_url` columns are UNSIGNED denormalised copies for querying
- * only — never trusted. A row is DROPPED (and logged) unless BOTH hold:
- *   1. its EIP-712 signature recovers to `binding.operator`; and
- *   2. `deriveServiceRef(binding)` equals the envelope's own `serviceRef`.
- * `discoverServices` therefore NEVER returns an unverifiable listing.
+ * ## Zero configuration
+ * The default read source is {@link DEFAULT_METRIK_PUBLIC_REGISTRY_URL} — the
+ * oracle's public, credential-free, CORS-enabled listings endpoint. A
+ * third-party developer needs no Supabase key and no configuration. (The old
+ * default was a raw Supabase PostgREST URL that `401`s for anyone without
+ * Metrik's anon key.)
  *
- * The unsigned `category` column is carried through as informational metadata only
- * (used for the optional client-side category filter); it is never part of the
- * trust decision.
+ * ## Untrusted transport
+ * The oracle is a TRANSPORT, not an authority. Every row it serves is treated as
+ * an untrusted envelope: schema-validated, its `serviceRef` re-derived from the
+ * signed content, and its operator EIP-712 signature recovered and matched.
+ * Anything that fails is DROPPED, so a compromised registry or oracle can
+ * neither inject a listing nor redirect an invocation URL. Rows dropped this way
+ * are reported through {@link DiscoverServicesOptions.logger}.
+ *
+ * ## Loud failure
+ * An unreachable registry throws {@link RegistryUnavailableError}. It never
+ * degrades to embedded seed data: a hardcoded listing outlives the service it
+ * points at and cannot be revoked without a release, and a caller that reads
+ * "one service" and invokes it has been actively misled.
  */
 
 /** A verified, hireable service listing. `serviceRef`/`operator`/`publicUrl` are
- * derived from the SIGNED binding, not the unsigned flat columns. */
+ * derived from the SIGNED record, never from unsigned envelope columns. */
 export interface ServiceListing {
   readonly serviceRef: `0x${string}`;
   readonly operator: `0x${string}`;
@@ -44,26 +60,48 @@ export interface ServiceListing {
   readonly accessUrl: string;
   /** The schema-validated and cryptographically verified signed record. */
   readonly signed: SignedServiceBinding | SignedServiceDescriptor;
-  /** Unsigned informational category from the listings row (may be absent). */
+  /** Unsigned informational category from the registry row (may be absent). */
   readonly category: string | null;
-  /** Optional unsigned operator-supplied resolver hints; never used for invocation. */
+  /**
+   * @deprecated No longer populated. The signed-record schema is strict, and the
+   * public discovery endpoint carries no unsigned resolver hints. Retained so
+   * existing code compiles.
+   */
   readonly targetMetadata?: Record<string, string>;
 }
 
 export interface DiscoverServicesOptions {
-  /** Registry endpoint. Defaults to {@link DEFAULT_METRIK_REGISTRY_URL} (env override:
-   * `METRIK_AGENT_REGISTRY_URL`). Pass the full PostgREST `?select=...&order=...` URL. */
+  /**
+   * Registry endpoint. Defaults to {@link DEFAULT_METRIK_PUBLIC_REGISTRY_URL}
+   * (env override: `METRIK_AGENT_REGISTRY_URL`).
+   *
+   * With no {@link DiscoverServicesOptions.apiKey} this is read as a plain
+   * credential-free `GET` against exactly this URL.
+   *
+   * With an `apiKey` it is read as Supabase/PostgREST, and this must be either a
+   * project base URL (`https://<ref>.supabase.co`, to which `/rest/v1/listings`
+   * is appended) or a URL already ending in `/rest/v1` or `/rest/v1/listings`.
+   * Any query string is stripped — the SDK appends its own `select`/`order`.
+   * Supplying an `apiKey` without setting this explicitly is a configuration
+   * error and throws: the public default is not a PostgREST base, and silently
+   * appending to it would produce a 404 on every read.
+   */
   readonly registryUrl?: string;
-  /** Append the built-in {@link DEMO_SEED_LISTING} when the registry does not already
-   * surface it (empty / unreachable / 401 / just missing), so a zero-config newcomer
-   * still discovers one hireable, verified service. The seed is NOT trusted blindly —
-   * it flows through the SAME fail-closed {@link verifyRow} path as any registry row.
-   * Defaults to `true`. Pass `false` to get only what the registry itself returns. */
+  /**
+   * @deprecated No-op. Discovery no longer ships an embedded seed listing: an
+   * unreachable registry throws {@link RegistryUnavailableError} instead of
+   * quietly serving stale local data.
+   */
   readonly includeDemoSeed?: boolean;
-  /** PostgREST apikey (Supabase anon key). Env override: `METRIK_AGENT_REGISTRY_APIKEY`.
-   * Sent as both the `apikey` header and `Authorization: Bearer`. */
+  /** PostgREST apikey (Supabase anon key) for an authenticated read. Env override:
+   * `METRIK_AGENT_REGISTRY_APIKEY`. Not required — the default endpoint is public. */
   readonly apiKey?: string;
-  /** Optional client-side filter on the unsigned `category` column. */
+  /**
+   * Optional filter on the unsigned `category` column (case-insensitive).
+   * The public discovery endpoint serves signed records only and carries no
+   * category column, so this filter matches nothing there; use it against an
+   * authenticated PostgREST read.
+   */
   readonly category?: string;
   /** Optional cap on the number of verified listings returned. */
   readonly limit?: number;
@@ -71,439 +109,229 @@ export interface DiscoverServicesOptions {
   readonly fetch?: typeof fetch;
   /** Request timeout in milliseconds. Defaults to 5000. */
   readonly timeoutMs?: number;
-  /** Warning sink for dropped rows / registry failures. Defaults to `console`. */
+  /** Warning sink for dropped rows / filter notes. Defaults to `console`. */
   readonly logger?: { warn: (...args: unknown[]) => void };
 }
 
 /**
- * Default Metrik listings registry (Supabase PostgREST). Selects the columns the
- * oracle and the agent both need and orders newest-first.
+ * The oracle's public, credential-free, CORS-enabled discovery endpoint. Serves
+ * operator-signed envelopes verbatim so they can be verified client-side, and
+ * answers an unreachable upstream with `503` and NO `listings` key — precisely so
+ * it cannot be misread as "zero services".
  */
-export const DEFAULT_METRIK_REGISTRY_URL =
-  "https://pzvnacjolaipeobmptsb.supabase.co/rest/v1/listings?select=service_ref,operator,public_url,category,signed_binding&order=created_at.desc";
-
-const DEFAULT_TIMEOUT_MS = 5_000;
+export const DEFAULT_METRIK_PUBLIC_REGISTRY_URL =
+  "https://oracle.metrik.live/listings";
 
 /**
- * `serviceRef` of the built-in verified live-data listing. Kept as a named constant so
- * callers can recognise (and dedupe against) the seeded row.
+ * @deprecated Renamed to {@link DEFAULT_METRIK_PUBLIC_REGISTRY_URL}. The value
+ * changed in 0.9.0: it used to be a raw Supabase PostgREST URL that `401`s
+ * without Metrik's anon key.
  */
-export const LIVE_DATA_SEED_SERVICE_REF =
-  "0x79e57358e98a35273c1cd9d5f1bf9ae1e0af8705db432eb706459dc4f88b6fe0" as const;
-/** @deprecated Use {@link LIVE_DATA_SEED_SERVICE_REF}. */
-export const DEMO_SEED_SERVICE_REF = LIVE_DATA_SEED_SERVICE_REF;
+export const DEFAULT_METRIK_REGISTRY_URL = DEFAULT_METRIK_PUBLIC_REGISTRY_URL;
 
 /**
- * A real, operator-signed live-data listing row embedded so `discoverServices()` returns
- * something hireable with ZERO configuration (no Supabase anon key, no registry URL).
- *
- * This is PUBLIC data — a signed {@link https://github.com/Absol-Labs | Metrik}
- * ServiceBinding — safe to ship in source. It is **NOT** a trust bypass: when seeded
- * it is fed through the exact same fail-closed {@link verifyRow} path as any registry
- * row, so it only ever surfaces if BOTH its EIP-712 signature recovers to
- * `binding.operator` AND `deriveServiceRef(binding)` equals its `serviceRef`. Tamper
- * with any field here and the seed silently drops itself, identically to a bad
- * registry row. The `category` column is unsigned informational metadata only.
+ * @deprecated Removed in 0.9.0. The embedded seed listing is gone: it was
+ * unrevocable without a release, and masking an unreachable registry with stale
+ * local data is exactly the bug this package now refuses to ship. Kept as an
+ * empty object so existing imports still compile.
  */
-export const LIVE_DATA_SEED_LISTING = {
-  service_ref: LIVE_DATA_SEED_SERVICE_REF,
-  operator: "0xB3e162711920dFD8933609019Dc35C73cC1a09F0",
-  public_url: "https://livedata.137.23.50.249.sslip.io",
-  category: "live-data",
-  signed_binding: {
-    serviceRef: LIVE_DATA_SEED_SERVICE_REF,
-    descriptor: {
-      version: 3,
-      operator: "0xB3e162711920dFD8933609019Dc35C73cC1a09F0",
-      publicUrl: "https://livedata.137.23.50.249.sslip.io",
-      issuedAt: 1_787_772_057,
-      interface: {
-        baseUrl: "https://livedata.137.23.50.249.sslip.io",
-        healthPath: "/health",
-        endpoints: [
-          {
-            name: "health",
-            path: "/health",
-            method: "GET",
-            description: "Liveness probe.",
-          },
-          {
-            name: "readiness",
-            path: "/readiness",
-            method: "GET",
-            description:
-              "Non-value dependency readiness backed by the same real BTC cache policy.",
-          },
-          {
-            name: "price",
-            path: "/price",
-            method: "GET",
-            description:
-              "Real live crypto spot price (?symbol=BTC|ETH|SOL) from CoinGecko's public API.",
-          },
-        ],
-        authModel: "caller-auth",
-        example: {
-          endpoint: "price",
-          request: { symbol: "BTC" },
-          response: { symbol: "BTC", source: "coingecko-public-api" },
-          description:
-            "Real, nondeterministic live price — no re-execution guarantee.",
-        },
-        expectedStatuses: [200],
-      },
-      verification: {
-        canaries: [
-          {
-            path: "/readiness",
-            method: "GET",
-            matcher: {
-              type: "json-field-equals",
-              field: "source",
-              expected: "coingecko-public-api",
-            },
-            nonce: {
-              inject: { in: "query", name: "nonce" },
-              echo: { from: "json-path", path: "nonce" },
-            },
-          },
-          {
-            path: "/canary",
-            method: "GET",
-            matcher: {
-              type: "includes",
-              expected: "metrik-canary:live-data:",
-            },
-            nonce: {
-              inject: { in: "query", name: "nonce" },
-              echo: { from: "json-path", path: "nonce" },
-            },
-          },
-        ],
-        schema: {
-          path: "/readiness?nonce=metrik-schema",
-          required: [
-            { pointer: "ready", type: "boolean" },
-            { pointer: "source", type: "string", nonEmpty: true },
-            { pointer: "fetchedAt", type: "string", nonEmpty: true },
-            { pointer: "priceAgeMs", type: "number" },
-            { pointer: "freshness", type: "string", nonEmpty: true },
-          ],
-        },
-        sla: { maxLatencyMs: 5000, freshnessSeconds: 60 },
-      },
-      commercial: {
-        minRatePerSecond: "100",
-        maxRatePerSecond: "10000",
-        currency: "USDC",
-        slaDescription:
-          "Failed or unproven intervals do not advance verified cumulative entitlement; the stream remains active until buyer close or expiry.",
-        refundPolicy:
-          "The buyer reclaims unspent escrow using the latest checkpoint after close/expiry, or the unverified escape path after its grace window.",
-      },
-      access: "gated",
-      callerAuth: {
-        mechanism: "on-chain",
-        role: "buyer",
-        accessUrl: "https://gateway.137.23.50.249.sslip.io",
-      },
-    },
-    signature:
-      "0x2f4d2784eb40b1542517bc19f12534fb2e97da4ade5a3ff56193fcfb97fbef921309f77af3445e336cb07a4379011b080bba700033a098f672b0b2f096197f161b",
-  },
-} as const;
-/** @deprecated Use {@link LIVE_DATA_SEED_LISTING}. */
-export const DEMO_SEED_LISTING = LIVE_DATA_SEED_LISTING;
-
-const signature65HexSchema = z
-  .string()
-  .refine(
-    (value) => isHex(value, { strict: true }) && value.length === 132,
-    "must be a 65-byte hex signature",
-  );
+export const LIVE_DATA_SEED_LISTING: Record<string, never> = Object.freeze({});
+/** @deprecated Removed in 0.9.0. See {@link LIVE_DATA_SEED_LISTING}. */
+export const DEMO_SEED_LISTING: Record<string, never> = LIVE_DATA_SEED_LISTING;
+/** @deprecated Removed in 0.9.0. There is no seeded listing to identify. */
+export const LIVE_DATA_SEED_SERVICE_REF: null = null;
+/** @deprecated Removed in 0.9.0. See {@link LIVE_DATA_SEED_SERVICE_REF}. */
+export const DEMO_SEED_SERVICE_REF: null = null;
 
-const bytes32HexSchema = z
-  .string()
-  .refine(
-    (value) => isHex(value, { strict: true }) && value.length === 66,
-    "must be bytes32 hex",
-  );
+const DEFAULT_TIMEOUT_MS = 5_000;
 
-/** The signed envelope inside a listings row. Mirrors the oracle's ingest schema
- * (includes the optional operator-supplied `targetMetadata`). */
-const signedBindingRecordSchema = z.object({
-  serviceRef: bytes32HexSchema,
-  binding: serviceBindingSchema,
-  signature: signature65HexSchema,
-  targetMetadata: z.record(z.string()).optional(),
-});
+export { RegistryUnavailableError };
+export type { DiscoverResult, DiscoveredService };
 
-const signedDescriptorRecordSchema = z.object({
-  serviceRef: bytes32HexSchema,
-  descriptor: serviceDescriptorSchema,
-  signature: signature65HexSchema,
-  targetMetadata: z.record(z.string()).optional(),
-});
+/**
+ * Discover verified services and return the SDK's full {@link DiscoverResult}
+ * (typed listings plus `registryAvailable`, `source`, `matched`, `filteredOut`
+ * and an explanatory `note` when a non-empty source was filtered to nothing).
+ *
+ * Throws {@link RegistryUnavailableError} when the configured read source cannot
+ * be read at all.
+ */
+export async function discoverServicesDetailed(
+  opts: DiscoverServicesOptions = {},
+): Promise<DiscoverResult> {
+  const logger = opts.logger ?? console;
+  const { config, rowCounter } = buildRegistryConfig(opts, logger);
+  const result = await sdkDiscoverServices(config, {
+    ...(opts.category === undefined ? {} : { category: opts.category }),
+  });
 
-/** A Supabase `listings` row. Only `signed_binding` is trusted; `category` is
- * carried through as unsigned informational metadata. Unknown columns are ignored. */
-const listingRowSchema = z
-  .object({
-    service_ref: bytes32HexSchema.optional(),
-    operator: z.string().optional(),
-    public_url: z.string().optional(),
-    category: z.string().nullish(),
-    signed_binding: z.union([
-      signedBindingRecordSchema,
-      signedDescriptorRecordSchema,
-    ]),
-  })
-  .passthrough();
+  // The SDK drops any row that fails schema / serviceRef / signature
+  // verification. Surface that as a warning: a silently shrinking result set is
+  // how a tampering registry stays invisible.
+  const dropped = rowCounter.rows - result.services.length - result.filteredOut;
+  if (dropped > 0) {
+    logger.warn(
+      `metrik discovery: ${dropped} of ${rowCounter.rows} registry row(s) dropped by fail-closed verification (bad schema, serviceRef mismatch, or signature that does not recover to the operator)`,
+    );
+  }
+  if (result.note !== undefined) {
+    logger.warn(`metrik discovery: ${result.note}`);
+  }
+  return result;
+}
 
 /**
  * Discover verified services from the Metrik listings registry.
  *
- * Fail-closed: any row whose signed binding is malformed, whose signature does not
- * recover to its operator, or whose `serviceRef` does not match `deriveServiceRef`
- * is dropped and logged. Degrades gracefully: any network/registry failure returns
- * `[]` (with a logged warning) rather than throwing to the caller.
+ * Zero configuration: reads {@link DEFAULT_METRIK_PUBLIC_REGISTRY_URL}, the
+ * oracle's credential-free public endpoint.
+ *
+ * Fail-closed: every row is schema-validated, its `serviceRef` re-derived and
+ * its operator signature recovered; anything that fails is dropped and logged,
+ * so an unverifiable listing is never returned.
+ *
+ * LOUD, not silent: an unreachable / erroring / non-200 registry throws
+ * {@link RegistryUnavailableError} rather than returning `[]` or embedded seed
+ * data. Catch it if your caller can genuinely handle "the marketplace was never
+ * reached" — but do not confuse it with an empty marketplace.
  */
 export async function discoverServices(
   opts: DiscoverServicesOptions = {},
 ): Promise<ServiceListing[]> {
   const logger = opts.logger ?? console;
-  const registryUrl =
-    opts.registryUrl ??
-    process.env.METRIK_AGENT_REGISTRY_URL ??
-    DEFAULT_METRIK_REGISTRY_URL;
-  const apiKey = opts.apiKey ?? process.env.METRIK_AGENT_REGISTRY_APIKEY;
-  const fetchImpl = opts.fetch ?? globalThis.fetch;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const includeDemoSeed = opts.includeDemoSeed ?? true;
-
-  // `registryUnavailable` = the registry could not be queried at all (no fetch /
-  // network error / non-200). It never throws into the hire flow; instead it
-  // degrades to the built-in verified live-data seed (when enabled) so a cold user
-  // still discovers a hireable service.
-  let rows: unknown[] = [];
-  let registryUnavailable = false;
-  if (typeof fetchImpl !== "function") {
+  if (opts.includeDemoSeed !== undefined) {
     logger.warn(
-      "metrik discovery: no fetch implementation available; falling back to live-data seed only",
+      "metrik discovery: `includeDemoSeed` is a deprecated no-op — the embedded seed listing was removed in 0.9.0; an unreachable registry now throws RegistryUnavailableError",
     );
-    registryUnavailable = true;
-  } else {
-    try {
-      rows = await fetchListingRows(fetchImpl, registryUrl, apiKey, timeoutMs);
-    } catch (error) {
-      // Fail-safe / buyer-favouring: a down, unreachable, or 401 registry (the
-      // Supabase default rejects credential-free reads) must never throw into the
-      // agent's hire flow — it degrades to the live-data seed.
-      logger.warn(
-        `metrik discovery: listings registry unavailable (${errorMessage(error)}); falling back to live-data seed only`,
-      );
-      registryUnavailable = true;
-    }
   }
 
+  const result = await discoverServicesDetailed(opts);
   const listings: ServiceListing[] = [];
-  let seedAlreadyPresent = false;
-  for (const [index, row] of rows.entries()) {
-    const listing = await verifyRow(row, index, logger);
+  for (const service of result.services) {
+    const listing = toServiceListing(service, logger);
     if (listing === null) {
       continue;
     }
-    if (eqHex(listing.serviceRef, DEMO_SEED_SERVICE_REF)) {
-      seedAlreadyPresent = true;
-    }
-    if (opts.category !== undefined && listing.category !== opts.category) {
-      continue;
-    }
     listings.push(listing);
     if (opts.limit !== undefined && listings.length >= opts.limit) {
-      // Limit satisfied by the registry alone — no need to seed.
-      return listings;
-    }
-  }
-
-  // Append the built-in verified live-data listing when the registry did not already
-  // surface it. Runs through the SAME fail-closed verifyRow path, so it is
-  // verified exactly like a registry row and can never be a trust bypass.
-  if (includeDemoSeed && !seedAlreadyPresent) {
-    const seed = await verifyRow(DEMO_SEED_LISTING, "live-data-seed", logger);
-    if (seed === null) {
-      // Defensive: only reachable if the embedded constant were corrupted.
-      logger.warn(
-        "metrik discovery: built-in live-data seed failed fail-closed verification; not seeding",
-      );
-    } else if (opts.category === undefined || seed.category === opts.category) {
-      logger.warn(
-        registryUnavailable
-          ? "metrik discovery: registry unavailable — serving the built-in verified live-data listing"
-          : "metrik discovery: registry did not include live data — appending the built-in verified listing",
-      );
-      listings.push(seed);
+      break;
     }
   }
-
   return listings;
 }
 
-async function fetchListingRows(
-  fetchImpl: typeof fetch,
-  url: string,
-  apiKey: string | undefined,
-  timeoutMs: number,
-): Promise<unknown[]> {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const headers: Record<string, string> = {};
-    if (apiKey !== undefined && apiKey.length > 0) {
-      headers.apikey = apiKey;
-      headers.Authorization = `Bearer ${apiKey}`;
-    }
-    const response = await fetchImpl(url, {
-      signal: controller.signal,
-      ...(Object.keys(headers).length === 0 ? {} : { headers }),
-    });
-    if (!response.ok) {
-      throw new Error(
-        `listings registry responded with status ${response.status}`,
-      );
-    }
-    const body: unknown = await response.json();
-    if (!Array.isArray(body)) {
-      throw new Error("listings registry response was not a JSON array");
-    }
-    return body;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-
 /**
- * Verify one raw registry row into a {@link ServiceListing}, or `null` if it fails
- * the fail-closed checks. Never throws.
+ * Project one verified {@link DiscoveredService} onto a {@link ServiceListing},
+ * or `null` when it carries no signed invocation origin (a legacy record that a
+ * caller could otherwise invoke against an unsigned URL).
  */
-async function verifyRow(
-  row: unknown,
-  index: number | string,
+function toServiceListing(
+  service: DiscoveredService,
   logger: { warn: (...args: unknown[]) => void },
-): Promise<ServiceListing | null> {
-  const parsed = listingRowSchema.safeParse(row);
-  if (!parsed.success) {
+): ServiceListing | null {
+  if (service.accessUrl === null) {
     logger.warn(
-      `metrik discovery: row ${index} dropped — invalid listing envelope (${parsed.error.issues[0]?.message ?? "schema error"})`,
-    );
-    return null;
-  }
-  const { signed_binding: record, category } = parsed.data;
-
-  const signedIdentity =
-    "descriptor" in record
-      ? {
-          operator: record.descriptor.operator,
-          publicUrl: record.descriptor.publicUrl,
-        }
-      : {
-          operator: record.binding.operator,
-          publicUrl: record.binding.publicUrl,
-        };
-  if (
-    (parsed.data.service_ref !== undefined &&
-      !eqHex(parsed.data.service_ref, record.serviceRef)) ||
-    (parsed.data.operator !== undefined &&
-      !eqHex(parsed.data.operator, signedIdentity.operator)) ||
-    (parsed.data.public_url !== undefined &&
-      parsed.data.public_url !== signedIdentity.publicUrl)
-  ) {
-    logger.warn(
-      `metrik discovery: row ${index} dropped — flat identity columns disagree with signed record`,
+      `metrik discovery: listing ${service.serviceRef} dropped — no signed invocation URL`,
     );
     return null;
   }
+  return {
+    serviceRef: service.serviceRef,
+    operator: service.operator,
+    publicUrl: service.publicUrl,
+    access: service.access,
+    accessUrl: service.accessUrl,
+    signed: service.signed,
+    category: service.category,
+  };
+}
 
-  let signer: `0x${string}` | null;
-  try {
-    signer = (
-      "descriptor" in record
-        ? await recoverServiceDescriptorSigner(
-            record.descriptor,
-            record.signature as `0x${string}`,
-          )
-        : await recoverServiceBindingSigner(
-            record.binding,
-            record.signature as `0x${string}`,
-          )
-    ) as `0x${string}` | null;
-  } catch (error) {
-    logger.warn(
-      `metrik discovery: row ${index} dropped — signature recovery threw (${errorMessage(error)})`,
-    );
-    return null;
-  }
-  if (signer === null || !eqHex(signer, signedIdentity.operator)) {
-    logger.warn(
-      `metrik discovery: row ${index} dropped — signature does not recover to operator (recovered ${signer ?? "null"})`,
-    );
-    return null;
-  }
+interface RowCounter {
+  rows: number;
+}
 
-  const derivedRef = deriveServiceRef(
-    "descriptor" in record ? record.descriptor : record.binding,
-  );
-  if (!eqHex(derivedRef, record.serviceRef)) {
-    logger.warn(
-      `metrik discovery: row ${index} dropped — serviceRef ${record.serviceRef} does not match derived ${derivedRef}`,
-    );
-    return null;
-  }
+/**
+ * Translate the agent-layer options into an SDK {@link RegistryConfig}.
+ *
+ * With an api key the read is authenticated PostgREST (the SDK appends its own
+ * `select`/`order`, so a query string on the supplied URL is stripped);
+ * otherwise it is the credential-free public `GET`.
+ */
+function buildRegistryConfig(
+  opts: DiscoverServicesOptions,
+  logger: { warn: (...args: unknown[]) => void },
+): { config: RegistryConfig; rowCounter: RowCounter } {
+  const configuredUrl =
+    opts.registryUrl ?? process.env.METRIK_AGENT_REGISTRY_URL;
+  const registryUrl = configuredUrl ?? DEFAULT_METRIK_PUBLIC_REGISTRY_URL;
+  const apiKey = opts.apiKey ?? process.env.METRIK_AGENT_REGISTRY_APIKEY;
 
-  const access =
-    "descriptor" in record ? (record.descriptor.access ?? "public") : "public";
-  const accessUrl =
-    "descriptor" in record
-      ? access === "gated"
-        ? record.descriptor.callerAuth?.accessUrl
-        : (record.descriptor.interface?.baseUrl ?? record.descriptor.publicUrl)
-      : record.binding.publicUrl;
+  // An apiKey switches the read to PostgREST, where the SDK appends
+  // `/rest/v1/<table>` to the configured base. The public default is NOT a
+  // PostgREST base, so appending to it yields `.../listings/rest/v1/listings`
+  // and 404s on every read. Fail loudly at the call site instead of shipping a
+  // discovery path that can never succeed.
   if (
-    accessUrl === undefined ||
-    (access === "gated" && !isHttpsUrl(accessUrl))
+    apiKey !== undefined &&
+    apiKey.length > 0 &&
+    (configuredUrl === undefined || configuredUrl.length === 0)
   ) {
-    logger.warn(
-      `metrik discovery: row ${index} dropped — gated descriptor has no signed HTTPS callerAuth.accessUrl`,
+    throw new Error(
+      "metrik discovery: an apiKey was supplied without a registryUrl. An authenticated read needs a Supabase project URL (https://<ref>.supabase.co) or a URL ending in /rest/v1[/listings] — set `registryUrl` or METRIK_AGENT_REGISTRY_URL. Omit the apiKey to use the credential-free public endpoint instead.",
     );
-    return null;
   }
+  const rowCounter: RowCounter = { rows: 0 };
+  const fetchImpl = opts.fetch ?? globalThis.fetch;
 
-  return {
-    serviceRef: derivedRef,
-    operator: signedIdentity.operator as `0x${string}`,
-    publicUrl: signedIdentity.publicUrl,
-    access,
-    accessUrl,
-    signed: record as SignedServiceBinding | SignedServiceDescriptor,
-    category: category ?? null,
-    ...(record.targetMetadata === undefined
-      ? {}
-      : { targetMetadata: record.targetMetadata }),
+  const config: RegistryConfig = {
+    ...(apiKey !== undefined && apiKey.length > 0
+      ? { url: stripQuery(registryUrl), key: apiKey }
+      : { publicUrl: registryUrl }),
+    ...(typeof fetchImpl === "function"
+      ? { fetch: countingFetch(fetchImpl, rowCounter, logger) }
+      : {}),
+    timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
   };
+  return { config, rowCounter };
 }
 
-function isHttpsUrl(value: string): boolean {
-  try {
-    return new URL(value).protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-function eqHex(a: string, b: string): boolean {
-  return a.toLowerCase() === b.toLowerCase();
+function stripQuery(url: string): string {
+  const queryStart = url.indexOf("?");
+  return queryStart === -1 ? url : url.slice(0, queryStart);
 }
 
-function errorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
+/**
+ * Wrap `fetch` to count the rows the registry actually served, so the number
+ * dropped by fail-closed verification can be reported. Purely observational: the
+ * response is passed through untouched (the body is read from a clone), and any
+ * failure to inspect it leaves the count at 0 rather than failing discovery.
+ */
+function countingFetch(
+  fetchImpl: typeof fetch,
+  rowCounter: RowCounter,
+  logger: { warn: (...args: unknown[]) => void },
+): FetchLike {
+  return async (input, init) => {
+    const response = await fetchImpl(input, init);
+    if (!response.ok) {
+      return response;
+    }
+    try {
+      const payload: unknown = await response.clone().json();
+      if (Array.isArray(payload)) {
+        rowCounter.rows += payload.length;
+      } else if (
+        typeof payload === "object" &&
+        payload !== null &&
+        Array.isArray((payload as { listings?: unknown }).listings)
+      ) {
+        rowCounter.rows += (payload as { listings: unknown[] }).listings.length;
+      }
+    } catch {
+      logger.warn(
+        "metrik discovery: could not inspect the registry payload for a dropped-row count",
+      );
+    }
+    return response;
+  };
 }