@dxos/protocols 0.8.4-staging.ac66bdf99f → 0.9.1-main.c7dcc2e112

package/src/edge/edge.ts

@@ -13,10 +13,16 @@ import { SpaceId } from '@dxos/keys';
  */
 export const EDGE_CLIENT_TAG_HEADER = 'X-DXOS-Client-Tag';
 
+/**
+ * HTTP header sent on every Edge request to provide a BYOK (Bring Your Own Key) for AI services.
+ */
+export const BYOK_HEADER = 'X-BYOK';
+
 // TODO(burdon): Rename EdgerRouterEndpoint.
 // If we would rename it, we need to be careful to not break composer production.
 export enum EdgeService {
   AUTOMERGE_REPLICATOR = 'automerge-replicator',
+  SUBDUCTION_REPLICATOR = 'subduction-replicator',
   /**
    * Control feed replicator (hypercore append only logs) for the space.
    */
@@ -216,6 +222,12 @@ export type RecoverIdentityRequest = {
   lookupKey?: string;
   signature?: RecoverIdentitySignature;
   token?: string;
+  /**
+   * One-time proof minted by kms-service after a successful OAuth recovery flow.
+   * When provided, db-service redeems the proof to obtain the bound identityKey directly
+   * and `lookupKey`/`signature` are not required.
+   */
+  recoveryProof?: string;
 };
 
 export type RecoverIdentityResponseBody = {
@@ -314,10 +326,22 @@ export type EdgeAuthChallenge = {
 };
 
 export enum OAuthProvider {
-  GOOGLE = 'google',
+  ATLASSIAN = 'atlassian',
+  ATPROTO = 'atproto',
+  /** @deprecated Use ATPROTO instead. */
   BLUESKY = 'bluesky',
+  DISCORD = 'discord',
+  GITHUB = 'github',
+  GOOGLE = 'google',
+  LINEAR = 'linear',
+  NOTION = 'notion',
+  SLACK = 'slack',
+  TRELLO = 'trello',
 }
 
+/** atproto OAuth scopes for the Atmosphere integration and account-recovery flows. */
+export const ATPROTO_OAUTH_SCOPES = ['atproto', 'transition:generic', 'transition:email'] as const;
+
 export const InitiateOAuthFlowRequestSchema = Schema.Struct({
   provider: Schema.Enums(OAuthProvider),
   spaceId: Schema.String.pipe(Schema.filter(SpaceId.isValid)), // TODO(burdon): Use SpaceId.
@@ -325,8 +349,17 @@ export const InitiateOAuthFlowRequestSchema = Schema.Struct({
   scopes: Schema.mutable(Schema.Array(Schema.String)),
   // Set to true if we don't want periodic token refreshes in background, for cases like account connect
   noRefresh: Schema.optional(Schema.Boolean),
-  // Provider-specific (user handle or did for bluesky) hint for auth server resolution
+  // Provider-specific (user handle or did for atproto) hint for auth server resolution
   loginHint: Schema.optional(Schema.String),
+  // Return a 302 redirect to composer://oauth/callback instead of HTML.
+  // Required for ASWebAuthenticationSession (iOS) which blocks JavaScript redirects.
+  nativeAppRedirect: Schema.optional(Schema.Boolean),
+  // OAuth-based account recovery: when purpose === 'register', kms-service writes a
+  // recovery binding for `identityKey` after the OAuth flow completes; when 'recovery',
+  // kms-service mints a one-time `recoveryProof` the client forwards to db-service.
+  registerRecovery: Schema.optional(Schema.Boolean),
+  identityKey: Schema.optional(Schema.String),
+  purpose: Schema.optional(Schema.Literal('register', 'recovery')),
 });
 export type InitiateOAuthFlowRequest = Schema.Schema.Type<typeof InitiateOAuthFlowRequestSchema>;
 
@@ -335,9 +368,29 @@ export type InitiateOAuthFlowResponse = {
 };
 
 export type OAuthFlowResult =
-  | { success: true; accessToken: string; accessTokenId: string }
+  | { success: true; accessToken: string; accessTokenId: string; recoveryProof?: string }
   | { success: false; reason: string };
 
+/**
+ * Completes OAuth recovery registration for an existing identity: routes the OAuth refresh token
+ * into the personal space and writes the recovery binding.
+ */
+export type CompleteOAuthRegistrationRequest = {
+  registrationToken: string;
+  identityKey: string;
+  spaceKey: string;
+};
+
+export type CompleteOAuthRegistrationResponse = {
+  email?: string;
+  provider: OAuthProvider;
+  accessTokenId: string;
+  accessToken: string;
+  expiresInSeconds: number;
+  scopes: string[];
+  identifier: string;
+};
+
 export enum EdgeWebsocketProtocol {
   V0 = 'edge-ws-v0',
   /**
@@ -543,7 +596,7 @@ export type InspectSpaceResponse = {
     objectCount: number;
     deletedObjectCount: number;
     indexedDocumentCount: number;
-    objectsByType: { typeDxn: string; count: number }[];
+    objectsByType: { typeURI: string; count: number }[];
     indexerStatus: {
       indexingInProgress: boolean;
       cursors: { indexName: string; sourceName: string; resourceId: string | null; cursor: string | number }[];
@@ -571,7 +624,7 @@ export type InspectIdentityResponse = {
   spaces: InspectSpaceResponse[];
 };
 
-/** Matches the SerializedSpace format from @dxos/echo-db, extended with spaceId. */
+/** Matches the SerializedSpace format from @dxos/echo-client, extended with spaceId. */
 export type SpaceExportPayload = {
   version: number;
   timestamp: string;
@@ -602,3 +655,226 @@ export type DeleteSpaceResponse = { status: string; spaceId: string };
 
 export type DeleteIdentityRequest = { identityKey: string };
 export type DeleteIdentityResponse = { status: string; identityKey: string };
+
+//
+// Account / Invitation
+//
+
+export const INVITATION_CODE_LENGTH = 8;
+export const DEFAULT_INVITATIONS_PER_ACCOUNT = 5;
+
+/** Crockford base32 alphabet (no I, L, O, U). Case-insensitive on the wire. */
+export const INVITATION_CODE_ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+
+export const InvitationCodeSchema = Schema.String.pipe(
+  Schema.pattern(new RegExp(`^[${INVITATION_CODE_ALPHABET}]{${INVITATION_CODE_LENGTH}}$`)),
+);
+
+export const CheckEmailExistsRequestSchema = Schema.Struct({
+  email: Schema.String,
+});
+export type CheckEmailExistsRequest = Schema.Schema.Type<typeof CheckEmailExistsRequestSchema>;
+export type CheckEmailExistsResponse = { exists: boolean };
+
+export const ValidateInvitationCodeRequestSchema = Schema.Struct({
+  code: InvitationCodeSchema,
+});
+export type ValidateInvitationCodeRequest = Schema.Schema.Type<typeof ValidateInvitationCodeRequestSchema>;
+export type ValidateInvitationCodeResponse = { valid: boolean };
+
+/**
+ * Body of `POST /account/login`. Existing-account email recovery only --
+ * unlike `/account/signup`, this never creates new identities or waitlist rows.
+ */
+export const LoginRequestSchema = Schema.Struct({
+  email: Schema.String,
+  identityDid: Schema.optional(Schema.String),
+  identityKey: Schema.optional(Schema.String),
+});
+export type LoginRequest = Schema.Schema.Type<typeof LoginRequestSchema>;
+
+/**
+ * Response from `POST /account/login`. The shape is identical regardless of
+ * whether the email is registered, so the endpoint is safe against enumeration.
+ * Regular emails are delivered out-of-band and the response is `{}`.
+ */
+export const LoginResponseSchema = Schema.Struct({
+  token: Schema.optional(Schema.String),
+  needsIdentity: Schema.optional(Schema.Boolean),
+  admitted: Schema.optional(Schema.Boolean),
+});
+export type LoginResponse = Schema.Schema.Type<typeof LoginResponseSchema>;
+
+// Two-step signup: invitation code + identity DID + email.
+export const RedeemInvitationCodeRequestSchema = Schema.Struct({
+  code: Schema.optional(InvitationCodeSchema),
+  identityDid: Schema.optional(Schema.String),
+  /** Raw hex public key, stored alongside the DID for the magic-link recovery flow. */
+  identityKey: Schema.optional(Schema.String),
+  email: Schema.String,
+});
+export type RedeemInvitationCodeRequest = Schema.Schema.Type<typeof RedeemInvitationCodeRequestSchema>;
+export type RedeemInvitationCodeResponse =
+  | { accountId: string; emailVerificationSent: boolean }
+  | { needsIdentity: true };
+
+export const GetAccountResponseSchema = Schema.Struct({
+  identityDid: Schema.String,
+  email: Schema.String,
+  emailVerified: Schema.Boolean,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  invitationsRemaining: Schema.Number,
+});
+export type GetAccountResponse = Schema.Schema.Type<typeof GetAccountResponseSchema>;
+
+export const AccountInvitationSchema = Schema.Struct({
+  code: Schema.String,
+  /** ISO timestamp. */
+  createdAt: Schema.String,
+  redeemedByIdentityDid: Schema.optional(Schema.String),
+  /** ISO timestamp. */
+  redeemedAt: Schema.optional(Schema.String),
+});
+export type AccountInvitation = Schema.Schema.Type<typeof AccountInvitationSchema>;
+
+export const ListAccountInvitationsResponseSchema = Schema.Struct({
+  invitations: Schema.Array(AccountInvitationSchema),
+});
+export type ListAccountInvitationsResponse = Schema.Schema.Type<typeof ListAccountInvitationsResponseSchema>;
+
+export type IssueInvitationResponse = { code: string };
+
+export type ResendVerificationEmailResponse = {
+  sent: boolean;
+  cooldownSecondsRemaining?: number;
+};
+
+/**
+ * Submitted by users without an Account who want to request access. Captured
+ * by Hub for admin follow-up (e.g. mailing list, Discord notification).
+ */
+export const RequestAccessRequestSchema = Schema.Struct({
+  email: Schema.String,
+  /** Optional: identity DID the user is currently signed in as. */
+  identityDid: Schema.optional(Schema.String),
+  /** Optional free-form message from the requester. */
+  message: Schema.optional(Schema.String),
+});
+export type RequestAccessRequest = Schema.Schema.Type<typeof RequestAccessRequestSchema>;
+export type RequestAccessResponse = { received: boolean };
+
+//
+// Metering (VP auth)
+//
+
+/** Structured usage key aligned with {@link MeteringLimitSchema} (without cap/window fields). */
+export const MeteringUsageKeySchema = Schema.Struct({
+  /** Event type (e.g. `ai`). */
+  eventType: Schema.String,
+  /** Value key being metered (e.g. `outputTokens`). */
+  valueKey: Schema.String,
+  /**
+   * Positional match against the event's subtype segments (e.g. model); `*` matches any
+   * segment, and positions beyond the pattern are unconstrained.
+   */
+  subtypePattern: Schema.Array(Schema.String),
+});
+export type MeteringUsageKey = Schema.Schema.Type<typeof MeteringUsageKeySchema>;
+
+/** Rolling-window usage total for a structured key. */
+export const MeteringUsageItemSchema = Schema.Struct({
+  ...MeteringUsageKeySchema.fields,
+  amount: Schema.Number,
+});
+export type MeteringUsageItem = Schema.Schema.Type<typeof MeteringUsageItemSchema>;
+
+/** A single raw usage bucket (1h resolution) for a structured key. */
+export const MeteringUsageBucketSchema = Schema.Struct({
+  ...MeteringUsageKeySchema.fields,
+  /** Bucket start timestamp (epoch ms, floored to the hour). */
+  bucketStart: Schema.Number,
+  amount: Schema.Number,
+});
+export type MeteringUsageBucket = Schema.Schema.Type<typeof MeteringUsageBucketSchema>;
+
+export const MeteringLimitSchema = Schema.Struct({
+  /** Event type the limit applies to (e.g. `ai`). */
+  eventType: Schema.String,
+  /** Value key being limited (e.g. `outputTokens`). */
+  valueKey: Schema.String,
+  /**
+   * Positional match against the event's subtype segments (e.g. model); `*` matches any
+   * segment, and positions beyond the pattern are unconstrained.
+   */
+  subtypePattern: Schema.Array(Schema.String),
+  /** Rolling-window cap; `null` means unlimited. */
+  limit: Schema.NullOr(Schema.Number),
+  /** Window duration in seconds. */
+  windowDuration: Schema.Number,
+});
+export type MeteringLimit = Schema.Schema.Type<typeof MeteringLimitSchema>;
+
+export const GetProfileUsageResponseSchema = Schema.Struct({
+  profileId: Schema.String,
+  usage: Schema.Array(MeteringUsageItemSchema),
+  limits: Schema.Array(MeteringLimitSchema),
+  buckets: Schema.Array(MeteringUsageBucketSchema),
+});
+export type GetProfileUsageResponse = Schema.Schema.Type<typeof GetProfileUsageResponseSchema>;
+
+//
+// Admin (X-API-KEY)
+//
+
+export type AdminListAccountsResponse = {
+  accounts: GetAccountResponse[];
+};
+
+export const AdminGrantInvitationsRequestSchema = Schema.Struct({
+  identityDid: Schema.String,
+  count: Schema.Number,
+});
+export type AdminGrantInvitationsRequest = Schema.Schema.Type<typeof AdminGrantInvitationsRequestSchema>;
+
+export const AdminCreateInvitationCodesRequestSchema = Schema.Struct({
+  count: Schema.Number,
+  note: Schema.optional(Schema.String),
+});
+export type AdminCreateInvitationCodesRequest = Schema.Schema.Type<typeof AdminCreateInvitationCodesRequestSchema>;
+export type AdminCreateInvitationCodesResponse = { codes: string[] };
+
+export type AdminListInvitationCodesResponse = {
+  codes: Array<{
+    code: string;
+    /** ISO timestamp. */
+    createdAt: string;
+    note?: string;
+    issuedByIdentityDid?: string;
+    redeemedByIdentityDid?: string;
+    /** ISO timestamp. */
+    redeemedAt?: string;
+    /** ISO timestamp. Set when revoked. */
+    revokedAt?: string;
+  }>;
+};
+
+export const AdminRevokeInvitationCodeRequestSchema = Schema.Struct({
+  code: InvitationCodeSchema,
+});
+export type AdminRevokeInvitationCodeRequest = Schema.Schema.Type<typeof AdminRevokeInvitationCodeRequestSchema>;
+
+/**
+ * Account/invitation-related variants placed in `EdgeFailure.data.type`.
+ * EdgeErrorData is open-ended; these are documentation for known values.
+ */
+export type AccountErrorType =
+  | 'invitation_code_invalid'
+  | 'invitation_code_already_redeemed'
+  | 'invitation_code_revoked'
+  | 'email_already_registered'
+  | 'identity_already_associated'
+  | 'no_invitations_remaining'
+  | 'identity_not_associated_with_account'
+  | 'no_account'
+  | 'rate_limited';

package/src/edge/registry.ts

@@ -4,93 +4,202 @@
 
 import * as Schema from 'effect/Schema';
 
+import * as Config2 from '../Config2.ts';
+
 /**
- * Hydrated plugin metadata, mirroring the @dxos/app-framework `Plugin.Meta` shape.
- *
- * Defined locally rather than imported from @dxos/app-framework to keep the protocols
- * package free of UI/runtime dependencies. Consumers can treat decoded values as
- * `Plugin.Meta` directly.
+ * A snapshot of a plugin's declared dependencies resolved to concrete installed versions at build
+ * time (`{ "@dxos/app-framework": "0.8.3", "react": "19.2.0", … }`). The host derives SDK
+ * compatibility from the subset it shares with the plugin (the externalized `@dxos/*` packages).
  */
-export const PluginMetaSchema = Schema.Struct({
-  id: Schema.String.pipe(Schema.nonEmptyString()),
-  name: Schema.String.pipe(Schema.nonEmptyString()),
-  description: Schema.optional(Schema.String),
-  homePage: Schema.optional(Schema.String),
-  source: Schema.optional(Schema.String),
-  screenshots: Schema.optional(Schema.Array(Schema.String)),
-  tags: Schema.optional(Schema.Array(Schema.String)),
-  icon: Schema.optional(Schema.String),
-  iconHue: Schema.optional(Schema.String),
-});
-export type PluginMeta = Schema.Schema.Type<typeof PluginMetaSchema>;
+export const DependencyMapSchema = Schema.Record({ key: Schema.String, value: Schema.String });
+export type DependencyMap = Schema.Schema.Type<typeof DependencyMapSchema>;
 
 /**
- * Health signal the registry service attaches to a hydrated entry when a refresh fails.
- * Clients surface the appropriate badge or filter entries based on this field.
+ * Filename of the entry module every plugin must publish at the root of its bundle.
+ * The host dynamic-imports `<manifest URL base>/index.mjs` directly — no per-plugin
+ * configuration. `composerPlugin` outputs the bundle under this name so plugin authors
+ * never have to think about it.
  */
-export const PluginHealthSchema = Schema.Literal('ok', 'release-missing', 'manifest-invalid', 'repo-unavailable');
-export type PluginHealth = Schema.Schema.Type<typeof PluginHealthSchema>;
+export const PLUGIN_ENTRY_FILENAME = 'index.mjs';
 
 /**
  * Shape of the manifest-asset JSON the registry service fetches from each plugin's latest release.
- * Extends {@link PluginMetaSchema} with an optional override for the module bundle filename
- * (defaults to `plugin.mjs`).
+ *
+ * Emitted by `@dxos/app-framework/vite-plugin`'s `composerPlugin` (see
+ * `MANIFEST_ASSET_NAME`). Lists every file the plugin needs at runtime — the entry
+ * module ({@link PLUGIN_ENTRY_FILENAME}) plus any sibling CSS, code-split chunks,
+ * fonts, etc. — so the host can eagerly precache the whole bundle for offline use.
+ * Paths in `assets` are relative to the manifest's URL.
  */
 export const PluginManifestSchema = Schema.Struct({
-  ...PluginMetaSchema.fields,
-  moduleFile: Schema.optional(Schema.String),
+  ...Config2.Plugin.fields,
+  /** Plugin version (semver). Sourced from the publishing project's `package.json`. */
+  version: Schema.String.pipe(Schema.nonEmptyString()),
+  /**
+   * Relative paths of every file the plugin needs at runtime, including the entry.
+   * Must include {@link PLUGIN_ENTRY_FILENAME}; consumers verify on parse.
+   */
+  assets: Schema.Array(Schema.String).pipe(Schema.minItems(1)),
+  /** Declared dependencies resolved to installed versions at build time (SDK-compat source). */
+  dependencies: Schema.optional(DependencyMapSchema),
 });
 export type PluginManifest = Schema.Schema.Type<typeof PluginManifestSchema>;
 
+// ─── ATProto-native registry view ────────────────────────────────────────────
+
 /**
- * Single hydrated plugin entry returned by the registry service.
+ * A single installable release of a plugin, projected from a `package.release`
+ * ATProto record.
  */
-export const PluginEntrySchema = Schema.Struct({
-  /** GitHub repository in `owner/name` form. */
-  repo: Schema.String.pipe(Schema.nonEmptyString()),
-  /** Plugin metadata from the repo's latest-release `manifest.json`. */
-  meta: PluginMetaSchema,
+export const PluginReleaseSchema = Schema.Struct({
+  /** Semver version string, e.g. `0.8.3`. */
+  version: Schema.String.pipe(Schema.nonEmptyString()),
+  /** URL the host dynamic-imports to install this specific version. */
+  moduleUrl: Schema.String.pipe(Schema.nonEmptyString()),
   /**
-   * URL from which Composer can dynamic-import the plugin module. The registry service is
-   * responsible for returning a URL that is CORS-safe for browser `import()` (e.g. served or
-   * proxied by the service itself); clients pass this value directly to the URL loader.
+   * Dependencies this release was built against, resolved to installed versions. The host derives
+   * SDK compatibility from the `@dxos/*` subset to decide whether to offer this release.
    */
-  moduleUrl: Schema.String,
-  /** Release tag the entry was resolved from (e.g. `v0.1.0`). */
-  releaseTag: Schema.String,
-  /** Health signal set by the service when an entry fails to refresh. */
-  health: PluginHealthSchema,
-  /** Unix ms when this entry was last successfully hydrated. */
-  hydratedAt: Schema.Number,
+  dependencies: Schema.optional(DependencyMapSchema),
 });
-export type PluginEntry = Schema.Schema.Type<typeof PluginEntrySchema>;
+export type PluginRelease = Schema.Schema.Type<typeof PluginReleaseSchema>;
+
+/**
+ * Verbatim content of a `package.profile` ATProto record. `key` is the record's rkey (a reverse-domain
+ * NSID), denormalized into the body. Version-independent identity + display metadata; provenance
+ * (`author`) is resolved separately from the publisher DID/handle.
+ */
+export const PluginProfileSchema = Schema.Struct({
+  /** Reverse-domain NSID — the plugin's globally-unique key and the `package.profile` rkey (e.g. `org.dxos.plugin.excalidraw`). */
+  key: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Plugin display name. */
+  name: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Short description of plugin functionality. */
+  description: Schema.optional(Schema.String),
+  /** Publisher's homepage or plugin documentation URL. */
+  homePage: Schema.optional(Schema.String),
+  /** Source repository URL. */
+  source: Schema.optional(Schema.String),
+  /** Tags to help categorize the plugin. */
+  tags: Schema.optional(Schema.Array(Schema.String)),
+  /** Preview images — theme-keyed screenshot URLs shown on the plugin's card. */
+  screenshots: Schema.optional(Schema.Array(Config2.Screenshot)),
+  /** Icon identifier resolvable by `@ch-ui/icons` (e.g. `ph--sparkle--regular`), with an optional palette hue. */
+  icon: Schema.optional(Config2.Icon),
+  /** Composer plugin ids this plugin depends on at runtime (NSIDs). Author-declared, version-independent. */
+  dependsOn: Schema.optional(Schema.Array(Schema.String)),
+  /** Relative path inside the package to a bundled MDL spec (consumed by plugin-code). */
+  spec: Schema.optional(Schema.String),
+});
+export type PluginProfile = Schema.Schema.Type<typeof PluginProfileSchema>;
+
+/**
+ * A single hydrated plugin entry returned by `GET /registry/plugins`.
+ *
+ * This is an indexer-assembled *view* — analogous to emdash's `PackageView` — projected
+ * from four ATProto record types: `package.profile`, `package.release`,
+ * `publisher.profile`, and `publisher.verification`. It is NOT a direct serialization
+ * of any single ATProto record.
+ *
+ * Design notes:
+ * - `profile.key` is required to be a valid NSID (e.g. `org.dxos.plugin.excalidraw`), making it
+ *   the single identifier for both PDS addressing and the composer runtime plugin id.
+ *   `DXN.make(profile.key, latestVersion)` reconstructs the canonical plugin DXN.
+ * - `releases` inlines all known versions, eliminating a separate versions round-trip for
+ *   the version picker. Ordered newest-first.
+ * - `latestVersion` is a convenience pointer into `releases` indicating the recommended
+ *   install target.
+ */
+export const PluginViewSchema = Schema.Struct({
+  // ── Addressing / provenance (indexer-derived) ────────────────────────────
+  /**
+   * `at://` URI of the source `package.profile` record.
+   * Globally unique and stable — never changes after the record is published.
+   */
+  uri: Schema.String.pipe(Schema.nonEmptyString()),
+  /** Publisher DID, e.g. `did:plc:abc…`. Cryptographic identity; never changes. */
+  did: Schema.String.pipe(Schema.nonEmptyString()),
+  /**
+   * Publisher AT Protocol handle at index time, e.g. `alice.bsky.social`.
+   * Display-only — handles can be reassigned; never use as a stable key.
+   */
+  handle: Schema.optional(Schema.String),
+  /** Unix ms when the indexer last assembled this entry. */
+  indexedAt: Schema.Number,
+  /**
+   * Trust labels derived from curator `publisher.verification` records.
+   * An empty array means the entry has no verification signal.
+   */
+  labels: Schema.Array(Schema.String),
+
+  // ── Verbatim profile record content ─────────────────────────────────────
+  profile: PluginProfileSchema,
+
+  // ── Releases (projected from package.release records) ───────────────────
+  /**
+   * All known releases for this package, ordered newest-first.
+   * Powers the version picker directly — no separate endpoint needed.
+   */
+  releases: Schema.Array(PluginReleaseSchema),
+  /**
+   * The latest (recommended) release version. Always references an entry in `releases`.
+   * Used by the host to determine whether an update is available.
+   */
+  latestVersion: Schema.String.pipe(Schema.nonEmptyString()),
+});
+export type PluginView = Schema.Schema.Type<typeof PluginViewSchema>;
 
 /**
  * Response body of `GET /registry/plugins`.
  */
 export const GetPluginsResponseBodySchema = Schema.Struct({
-  /** Wire-format schema version, pinned to 1. */
-  version: Schema.Literal(1),
-  /** Hydrated entries. Order matches the order in the upstream catalog manifest. */
-  plugins: Schema.Array(PluginEntrySchema),
-  /** Unix ms timestamp of the most recent successful refresh cycle. */
+  /** Wire-format schema version, pinned to 2. */
+  version: Schema.Literal(2),
+  /** Hydrated entries. */
+  plugins: Schema.Array(PluginViewSchema),
+  /** Unix ms timestamp of the most recent successful index cycle. */
   refreshedAt: Schema.Number,
 });
 export type GetPluginsResponseBody = Schema.Schema.Type<typeof GetPluginsResponseBodySchema>;
 
+// ─── Publisher records ────────────────────────────────────────────────────────
+
+/** Content of a `publisher.profile` ATProto record. Display metadata for a publisher DID. */
+export const PublisherProfileSchema = Schema.Struct({
+  displayName: Schema.String.pipe(Schema.nonEmptyString()),
+  bio: Schema.optional(Schema.String),
+  homepageUrl: Schema.optional(Schema.String),
+  contact: Schema.optional(Schema.String),
+});
+export type PublisherProfile = Schema.Schema.Type<typeof PublisherProfileSchema>;
+
 /**
- * Shape of the catalog manifest published in the upstream community-plugins repo.
- * Extra keys (e.g. `$schema`) are permitted.
+ * Content of a `publisher.verification` record written by the curator DID.
+ * Links a publisher DID to a trusted AT Protocol handle.
  */
-export const RegistryManifestSchema = Schema.Struct(
-  {
-    version: Schema.Literal(1),
-    plugins: Schema.Array(
-      Schema.Struct({
-        repo: Schema.String,
-      }),
-    ),
-  },
-  Schema.Record({ key: Schema.String, value: Schema.Unknown }),
-);
-export type RegistryManifest = Schema.Schema.Type<typeof RegistryManifestSchema>;
+export const PublisherVerificationSchema = Schema.Struct({
+  subject: Schema.String.pipe(Schema.nonEmptyString()),
+  handle: Schema.String.pipe(Schema.nonEmptyString()),
+  displayName: Schema.String.pipe(Schema.nonEmptyString()),
+  createdAt: Schema.String.pipe(Schema.nonEmptyString()),
+});
+export type PublisherVerification = Schema.Schema.Type<typeof PublisherVerificationSchema>;
+
+// ─── NSID constants ───────────────────────────────────────────────────────────
+
+/** NSID constants for the four `org.dxos.experimental.*` record collections. */
+export const NSID = {
+  PackageProfile: 'org.dxos.experimental.package.profile',
+  PackageRelease: 'org.dxos.experimental.package.release',
+  PublisherProfile: 'org.dxos.experimental.publisher.profile',
+  PublisherVerification: 'org.dxos.experimental.publisher.verification',
+} as const;
+
+export type RegistryNsid = (typeof NSID)[keyof typeof NSID];
+
+export const ALL_NSIDS: readonly RegistryNsid[] = [
+  NSID.PackageProfile,
+  NSID.PackageRelease,
+  NSID.PublisherProfile,
+  NSID.PublisherVerification,
+];

package/src/index.ts

@@ -10,7 +10,8 @@ export * from './messenger.ts';
 export * from './profile-archive.ts';
 export * from './space-archive.ts';
 export * from './storage.ts';
-export * from './tracing.ts';
 export type * from './types.ts';
+export * as Config2 from './Config2.ts';
 export * as FunctionProtocol from './FunctionProtocol.ts';
 export * as FeedProtocol from './FeedProtocol.ts';
+export * as TraceProtocol from './TraceProtocol.ts';

package/src/invitation.ts

@@ -4,11 +4,11 @@
 
 import * as Schema from 'effect/Schema';
 
-import { ParamKeyAnnotation } from '@dxos/effect';
+import { SchemaEx } from '@dxos/effect';
 
 // TODO(burdon): Use uniformly for processing HTTP params.
 export const InvitationUrl = Schema.Struct({
   accessToken: Schema.String, // TODO(burdon): Remove.
-  deviceInvitationCode: Schema.String.pipe(ParamKeyAnnotation({ key: 'deviceInvitationCode' })),
-  spaceInvitationCode: Schema.String.pipe(ParamKeyAnnotation({ key: 'spaceInvitationCode' })),
+  deviceInvitationCode: Schema.String.pipe(SchemaEx.ParamKeyAnnotation({ key: 'deviceInvitationCode' })),
+  spaceInvitationCode: Schema.String.pipe(SchemaEx.ParamKeyAnnotation({ key: 'spaceInvitationCode' })),
 });

package/src/lexicons/org.dxos.experimental/README.md

@@ -0,0 +1,29 @@
+# `org.dxos.experimental.*` lexicons
+
+Experimental AT Protocol lexicons for the DXOS plugin registry. The `experimental` segment is intentional — these schemas are unstable and will be renamed to a final namespace before promotion.
+
+## Records
+
+| NSID                                           | rkey               | Purpose                                               |
+| ---------------------------------------------- | ------------------ | ----------------------------------------------------- |
+| `org.dxos.experimental.package.profile`        | `<key>`            | Mutable package metadata (one per key per DID).       |
+| `org.dxos.experimental.package.release`        | `<key>:<version>`  | Versioned artifact record (conceptually single-write).|
+| `org.dxos.experimental.publisher.profile`      | `self`             | Identity-level publisher metadata.                    |
+| `org.dxos.experimental.publisher.verification` | `<verified DID>`   | Trust attestation about a publisher.                  |
+
+## Trust model
+
+`publisher.verification` records are public and unrestricted — anyone may author one. Trust is an indexing policy, not a write gate. Today the indexer honors verification records **only** from a single configured verifier DID (`REGISTRY_CURATOR_DID`) and indexes a publisher's records only if that verifier has vouched for the author DID. Revocation is achieved by deleting the verification record — the indexer unindexes that publisher on the next backfill sweep. This single-verifier gate is intended to generalize to multiple verifiers / moderation labels (à la Bluesky labelers) once that surface exists.
+
+See `packages/sdk/app-framework/docs/registry-spec.md` for the full design, including the integrity / tamper-detection model.
+
+## Prior art
+
+These lexicons are modeled on the emdash RFC:
+
+- RFC: [emdash-cms/emdash#694](https://github.com/emdash-cms/emdash/pull/694) — design rationale, trust model trade-offs, rkey conventions, and the `experimental` namespace strategy.
+- Implementation: [emdash-cms/emdash#923](https://github.com/emdash-cms/emdash/pull/923) — client, CLI, and lexicon bindings.
+
+Differences from emdash's `com.emdashcms.experimental.*`:
+
+- `releaseExtension` / `declaredAccess` records (sandbox manifest, granular permissions) are **not** included in v0; they will be added in a follow-on once the runtime sandbox surface is defined.