@dot-skill/registry 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bharat Dudeja
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @dot-skill/registry — free append-only transparency log for `.skill` packages.
+ *
+ * Default log path: ~/.dot-skill/registry/log.jsonl
+ * Each line is a JSON object with a publish record.
+ * Lookup and verify confirm a package_digest is anchored in the log.
+ */
+import type { PermanenceAnchor } from "@dot-skill/protocol";
+export interface RegistryEntry {
+    kind: "registry_entry";
+    digest: string;
+    published_at: string;
+    metadata: Record<string, unknown>;
+}
+export interface RegistryPublishResult {
+    ok: boolean;
+    entry: RegistryEntry;
+    log_path: string;
+}
+export interface RegistryLookupResult {
+    found: boolean;
+    entries: RegistryEntry[];
+}
+export interface RegistryVerifyResult {
+    ok: boolean;
+    anchored: boolean;
+    entries: RegistryEntry[];
+    anchor?: PermanenceAnchor;
+    issues: string[];
+}
+/**
+ * Publish a package digest to the local transparency log.
+ * Creates the log file and parent directories if they do not exist.
+ */
+export declare function publish(digest: string, metadata?: Record<string, unknown>, logPath?: string): Promise<RegistryPublishResult>;
+/**
+ * Look up all log entries for a given digest.
+ */
+export declare function lookup(digest: string, logPath?: string): Promise<RegistryLookupResult>;
+/**
+ * List all entries in the log (most recent last).
+ */
+export declare function list(logPath?: string, limit?: number): Promise<RegistryEntry[]>;
+/**
+ * Verify that a `.skill` package archive has a matching entry in the transparency log
+ * and/or a PermanenceAnchor of kind "transparency_log" or "registry".
+ */
+export declare function verify(archive: Uint8Array, logPath?: string): Promise<RegistryVerifyResult>;
+/**
+ * Build a PermanenceAnchor pointing to the local transparency log.
+ * Use with addPermanenceAnchor from @dot-skill/core to embed the anchor in the package.
+ */
+export declare function buildTransparencyLogAnchor(digest: string, logPath?: string): Omit<PermanenceAnchor, "package_digest">;

package/dist/index.js

@@ -0,0 +1,115 @@
+/**
+ * @dot-skill/registry — free append-only transparency log for `.skill` packages.
+ *
+ * Default log path: ~/.dot-skill/registry/log.jsonl
+ * Each line is a JSON object with a publish record.
+ * Lookup and verify confirm a package_digest is anchored in the log.
+ */
+import { appendFile, readFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { unpackSkill } from "@dot-skill/core";
+function defaultLogPath() {
+    return join(homedir(), ".dot-skill", "registry", "log.jsonl");
+}
+async function ensureDir(filePath) {
+    const dir = filePath.slice(0, filePath.lastIndexOf("/"));
+    if (!existsSync(dir)) {
+        await mkdir(dir, { recursive: true });
+    }
+}
+/**
+ * Publish a package digest to the local transparency log.
+ * Creates the log file and parent directories if they do not exist.
+ */
+export async function publish(digest, metadata = {}, logPath) {
+    const path = logPath ?? defaultLogPath();
+    await ensureDir(path);
+    const entry = {
+        kind: "registry_entry",
+        digest,
+        published_at: new Date().toISOString(),
+        metadata,
+    };
+    await appendFile(path, JSON.stringify(entry) + "\n", "utf8");
+    return { ok: true, entry, log_path: path };
+}
+/**
+ * Look up all log entries for a given digest.
+ */
+export async function lookup(digest, logPath) {
+    const path = logPath ?? defaultLogPath();
+    if (!existsSync(path)) {
+        return { found: false, entries: [] };
+    }
+    const raw = await readFile(path, "utf8");
+    const entries = raw
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line))
+        .filter((e) => e.digest === digest);
+    return { found: entries.length > 0, entries };
+}
+/**
+ * List all entries in the log (most recent last).
+ */
+export async function list(logPath, limit = 50) {
+    const path = logPath ?? defaultLogPath();
+    if (!existsSync(path))
+        return [];
+    const raw = await readFile(path, "utf8");
+    const all = raw
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+    return all.slice(-limit);
+}
+/**
+ * Verify that a `.skill` package archive has a matching entry in the transparency log
+ * and/or a PermanenceAnchor of kind "transparency_log" or "registry".
+ */
+export async function verify(archive, logPath) {
+    const issues = [];
+    let unpacked;
+    try {
+        unpacked = unpackSkill(archive);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            anchored: false,
+            entries: [],
+            issues: [e instanceof Error ? e.message : String(e)],
+        };
+    }
+    const digest = unpacked.manifest.package_digest;
+    const { found, entries } = await lookup(digest, logPath);
+    const anchors = unpacked.manifest.anchors ?? [];
+    const registryAnchor = anchors.find((a) => a.kind === "transparency_log" || a.kind === "registry");
+    if (!found) {
+        issues.push(`Digest ${digest} not found in transparency log`);
+    }
+    if (!registryAnchor) {
+        issues.push("No transparency_log or registry PermanenceAnchor in manifest");
+    }
+    return {
+        ok: found && Boolean(registryAnchor),
+        anchored: found || Boolean(registryAnchor),
+        entries,
+        anchor: registryAnchor,
+        issues,
+    };
+}
+/**
+ * Build a PermanenceAnchor pointing to the local transparency log.
+ * Use with addPermanenceAnchor from @dot-skill/core to embed the anchor in the package.
+ */
+export function buildTransparencyLogAnchor(digest, logPath) {
+    return {
+        kind: "transparency_log",
+        located_at: `file://${logPath ?? defaultLogPath()}`,
+        anchored_at: new Date().toISOString(),
+        issuer: "@dot-skill/registry",
+    };
+}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@dot-skill/registry",
+  "version": "0.4.1",
+  "description": "Optional local transparency log (not a marketplace)",
+  "license": "MIT",
+  "author": {
+    "name": "Bharat Dudeja",
+    "url": "https://github.com/bharatdudeja13-cmd"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dot-skill/dot-skill.git",
+    "directory": "packages/registry"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "prepack": "npm run build",
+    "clean": "rm -rf dist"
+  },
+  "dependencies": {
+    "@dot-skill/core": "^0.4.1",
+    "@dot-skill/protocol": "^0.4.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "typescript": "^5.4.5"
+  }
+}