@ggui-ai/cli 0.2.0-alpha.4 → 0.3.0-rc.0

package/dist/internal/artifact-publish.js

@@ -20,11 +20,11 @@
  *      platform=neutral) with manifest.peerDeps + react family
  *      hoisted to externals.
  *   4. Authenticate — either `--auth=bearer` (explicit token for self-
- *      hosted / local registries) OR the default hosted-auth flow via
- *      the configured registry. The hosted-auth implementation here
- *      talks to the cloud registry's hosted identity provider, but
- *      the public-surface naming stays vendor-neutral (see
- *      `./auth-strategy.ts`).
+ *      hosted / local registries) OR the default: reuse the session
+ *      `ggui login` already stored at `~/.ggui/auth.json`, refreshing
+ *      the access token via `POST /v1/auth/refresh` when it has
+ *      expired (see `./auth-strategy.ts` for the routing and
+ *      `../auth-store.ts` for the on-disk document).
  *   5. Conformance preflight — POST `/conformance/check` with the
  *      manifest + bundle text. Fail-fast so a malformed bundle
  *      doesn't hit S3.
@@ -42,7 +42,7 @@
  * **HTTP contract (locked).**
  *
  *   POST <registry>/publish
- *     Headers: `Authorization: Bearer <jwt>`, `Content-Type: application/json`
+ *     Headers: `Authorization: Bearer <token>`, `Content-Type: application/json`
  *     Body   : { manifest, bundle?, bundleSha384?, signature }
  *     201    : { artifactId, version, manifestUrl, bundleUrl?, signatureUrl?, installCommand }
  *     400    : { code: 'version_exists' | 'unknown_key' | 'conformance_failed' | … , message }
@@ -50,26 +50,23 @@
  *     501    : endpoint stubbed
  *
  *   POST <registry>/conformance/check
- *     Headers: `Authorization: Bearer <jwt>`, `Content-Type: application/json`
+ *     Headers: `Authorization: Bearer <token>`, `Content-Type: application/json`
  *     Body   : { manifest, bundle? }
  *     200    : { ok: true }
  *     200    : { ok: false, issues: [{code, message, path?}] }
  *     5xx    : transient — caller retries or surfaces
  */
 import { build as esbuild } from 'esbuild';
-// Cloud-internal hosted-auth implementation. The vendor SDK is named
-// here because this is the leaf implementation file the OSS-facing
-// `acquireHostedAuthJwt` wraps; the public surface (CLI flags, help
-// text, README, the auth-strategy module) is vendor-neutral.
-import { CognitoIdentityProviderClient, InitiateAuthCommand, } from '@aws-sdk/client-cognito-identity-provider';
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { URL } from 'node:url';
 import { GGUI_BLUEPRINT_JSON_FILENAME, GGUI_GADGET_JSON_FILENAME, parseBlueprintManifest, parseGadgetManifest, } from '@ggui-ai/artifact-manifest';
 import { canonicalJson, derivePublicKeyId, generateEd25519Keypair, publicKeyFromPrivate, signBundleEd25519, signBundleSigstore, } from '@ggui-ai/gadget-signing';
+import { PROTOCOL_VERSION } from '@ggui-ai/protocol';
 import { resolveOidcToken, OidcResolutionError, } from './oidc-token.js';
 import { sha384 } from '@noble/hashes/sha512.js';
-import { isTokenFresh, loadRegistryToken, saveRegistryToken, } from './auth-cache.js';
+import { saveAuthSession, tryLoadAuthSession, } from '../auth-store.js';
+import { ApiError, postAuthRefresh } from '../api-client.js';
 import { getPrivateKeyPath, hasKeypair, readPrivateKey, scopeOf, writePrivateKey, } from './key-store.js';
 import { acquireAuthToken, parseAuthFlags, AUTH_HELP_FRAGMENT, } from './auth-strategy.js';
 /**
@@ -224,8 +221,21 @@ export async function runArtifactPublish(opts) {
         }
         return { ok: false, exitCode: 1, error: manifestRes.error };
     }
-    const { manifest, manifestPath } = manifestRes;
-    // ---- step 2a: enforce verb / manifest kind alignment ----
+    const { manifestPath } = manifestRes;
+    // ---- step 2a: stamp the persistence-contract era (blueprints) ----
+    // `generatorProtocolVersion` is the import-gate era stamp (mirrors
+    // `PortableBlueprint`): deployments that feed installed blueprints
+    // into a matcher pool REQUIRE it and drop unstamped rows loudly.
+    // The SIGNING toolchain owns the claim — it validates the manifest
+    // against its own protocol era and signs the stamped bytes — so the
+    // stamp is set here, BEFORE the signature payload is computed, and
+    // overwrites any hand-authored value (an author cannot truthfully
+    // claim a different toolchain's era). Gadgets never enter a matcher
+    // pool; they stay unstamped.
+    const manifest = manifestRes.manifest.kind === 'blueprint'
+        ? { ...manifestRes.manifest, generatorProtocolVersion: PROTOCOL_VERSION }
+        : manifestRes.manifest;
+    // ---- step 2b: enforce verb / manifest kind alignment ----
     if (manifest.kind !== opts.kind) {
         const foundFile = manifest.kind === 'blueprint'
             ? GGUI_BLUEPRINT_JSON_FILENAME
@@ -259,34 +269,26 @@ export async function runArtifactPublish(opts) {
     // ---- step 4: authenticate ----
     // Two paths:
     //   --auth=bearer → token from flag or GGUI_REGISTRY_TOKEN
-    //   default       → hosted auth via the configured registry (cloud)
-    let jwt;
+    //   default       → the `ggui login` session stored at ~/.ggui/auth.json
+    let token;
     const authFlags = opts.auth ?? {};
+    const authKind = authFlags.auth === 'bearer' ? 'bearer' : 'session';
     try {
-        jwt = await acquireAuthToken({
+        token = await acquireAuthToken({
             flags: authFlags,
             env: process.env,
-            cwd,
-            registryUrl,
-            acquireHostedAuthJwt: async (deps) => {
-                const hosted = await acquireHostedAuthJwt({
-                    registryUrl: deps.registryUrl,
-                    env: deps.env,
-                    cwd: deps.cwd,
-                    hostedAuthClient: opts.hostedAuthClient,
-                    prompt: opts.prompt,
-                    now,
-                });
-                if (!hosted.ok) {
-                    throw new HostedAuthError(hosted.error);
+            acquireSessionToken: async () => {
+                const session = await acquireLoginSessionToken({ now, fetchImpl });
+                if (!session.ok) {
+                    throw new SessionAuthError(session.error);
                 }
-                stdout(`auth: ${hosted.fromCache ? 'cached' : 'fresh'} JWT for ${hosted.token.username}\n`);
-                return hosted.token.idToken;
+                stdout(`auth: ggui login session${session.refreshed ? ' (refreshed)' : ''}\n`);
+                return session.accessToken;
             },
         });
     }
     catch (err) {
-        if (err instanceof HostedAuthError) {
+        if (err instanceof SessionAuthError) {
             stderr(`${verb}: ${err.payload.message}\n`);
             return { ok: false, exitCode: 1, error: err.payload };
         }
@@ -294,18 +296,24 @@ export async function runArtifactPublish(opts) {
         stderr(`${verb}: ${msg}\n`);
         return { ok: false, exitCode: 1, error: { code: 'auth_failed', message: msg } };
     }
-    if (authFlags.auth === 'bearer') {
-        stdout(`auth: bearer token (length=${jwt.length})\n`);
+    if (authKind === 'bearer') {
+        stdout(`auth: bearer token (length=${token.length})\n`);
     }
     // ---- step 5: conformance preflight ----
     const preflightRes = await runConformancePreflight({
         registryUrl,
-        jwt,
+        token,
+        authKind,
         manifest,
         bundleBytes,
         fetchImpl,
     });
     if (!preflightRes.ok) {
+        if (preflightRes.error.code === 'auth_failed') {
+            // 401 from the registry — an auth problem, not a conformance one.
+            stderr(`${verb}: ${preflightRes.error.message}\n`);
+            return { ok: false, exitCode: 1, error: preflightRes.error };
+        }
         stderr(`${verb}: conformance preflight failed\n`);
         if (preflightRes.error.code === 'conformance_failed' && preflightRes.error.issues) {
             for (const issue of preflightRes.error.issues) {
@@ -402,7 +410,8 @@ export async function runArtifactPublish(opts) {
     }
     const publishRes = await postPublish({
         registryUrl,
-        jwt,
+        token,
+        authKind,
         manifest,
         bundleBytes,
         bundleSha384,
@@ -625,240 +634,105 @@ async function bundleGadget(manifest, manifestDir) {
     }
 }
 /**
- * Sentinel error that lets the bearer/hosted strategy router surface
+ * Sentinel error that lets the bearer/session strategy router surface
  * a structured `PublishError` without leaking through `throw any`.
  */
-class HostedAuthError extends Error {
+class SessionAuthError extends Error {
     payload;
     constructor(payload) {
         super(payload.message);
         this.payload = payload;
     }
 }
-export async function acquireHostedAuthJwt(opts) {
-    // 1. Cached?
-    const cached = loadRegistryToken(opts.registryUrl);
-    if (cached && cached.registry === opts.registryUrl && isTokenFresh(cached, opts.now())) {
-        return { ok: true, token: cached, fromCache: true };
-    }
-    // 2. Need auth config (Cognito pool id + client id). Personal
-    // credentials never go in source-controlled ggui.json: auth config
-    // lives in env vars or a user-level secret store. No fallback to
-    // project config.
-    const authConfig = resolveCognitoConfig(opts.env);
-    if (!authConfig) {
+/** Safety margin (seconds) before access-token expiry at which the CLI
+ * proactively refreshes instead of racing a boundary rejection. */
+const ACCESS_TOKEN_FRESHNESS_MARGIN_SECONDS = 60;
+/**
+ * Resolve the `ggui login` session token for registry calls.
+ *
+ * 1. Load `~/.ggui/auth.json` (written by `ggui login`). Missing /
+ *    malformed → `auth_config_missing` telling the operator to either
+ *    `ggui login` or use `--auth=bearer`.
+ * 2. Fresh access token → return it as-is.
+ * 3. Expired access token + live refresh token → `POST
+ *    <session.endpoint>/v1/auth/refresh`, persist the rotated session,
+ *    return the new access token.
+ * 4. Expired refresh token (or refresh rejected) → `auth_failed`
+ *    telling the operator to `ggui login` again.
+ */
+export async function acquireLoginSessionToken(opts) {
+    const session = tryLoadAuthSession();
+    if (!session) {
         return {
             ok: false,
             error: {
                 code: 'auth_config_missing',
-                message: 'registry hosted-auth config missing. Either:\n' +
-                    '  - pass --auth=bearer --token <token> (for self-hosted / local registries), or\n' +
-                    '  - set GGUI_REGISTRY_COGNITO_POOL_ID + GGUI_REGISTRY_COGNITO_APP_CLIENT_ID in your environment.',
+                message: 'no registry credentials found. Either:\n' +
+                    '  - run `ggui login` to sign in, or\n' +
+                    '  - pass --auth=bearer --token <token> (or set GGUI_REGISTRY_TOKEN) for self-hosted / local registries.',
             },
         };
     }
-    // 3. Refresh-token path (cache exists but expired)
-    if (cached && cached.refreshToken) {
-        const refreshed = await tryRefresh({
-            ...(opts.hostedAuthClient ? { hostedAuthClient: opts.hostedAuthClient } : {}),
-            authConfig,
-            refreshToken: cached.refreshToken,
-            registryUrl: opts.registryUrl,
-            username: cached.username,
-            now: opts.now,
-        });
-        if (refreshed.ok) {
-            saveRegistryToken(refreshed.token);
-            return { ok: true, token: refreshed.token, fromCache: false };
-        }
-        // refresh failed — fall through to password flow
+    const nowSeconds = opts.now();
+    if (session.accessExpiresAt - nowSeconds > ACCESS_TOKEN_FRESHNESS_MARGIN_SECONDS) {
+        return { ok: true, accessToken: session.accessToken, refreshed: false };
     }
-    // 4. Password flow
-    const promptFn = opts.prompt ?? defaultPrompt;
-    let username;
-    let password;
-    try {
-        username = await promptFn('Registry username: ');
-        password = await promptFn('Registry password: ', { hidden: true });
-    }
-    catch (err) {
+    if (session.refreshExpiresAt <= nowSeconds) {
         return {
             ok: false,
             error: {
                 code: 'auth_failed',
-                message: `prompt failed: ${err instanceof Error ? err.message : String(err)}`,
+                message: 'login session expired. Run `ggui login` again.',
             },
         };
     }
-    const idp = opts.hostedAuthClient ?? new CognitoIdentityProviderClient({});
-    const auth = await runUserPasswordAuth({
-        hostedAuthClient: idp,
-        authConfig,
-        username,
-        password,
-    });
-    if (!auth.ok) {
-        return { ok: false, error: { code: 'auth_failed', message: auth.error } };
-    }
-    const token = {
-        version: 1,
-        registry: opts.registryUrl,
-        idToken: auth.idToken,
-        accessToken: auth.accessToken,
-        refreshToken: auth.refreshToken,
-        expiresAt: opts.now() + auth.expiresIn,
-        username,
-        writtenAt: new Date().toISOString(),
-    };
-    saveRegistryToken(token);
-    return { ok: true, token, fromCache: false };
-}
-/**
- * Resolve Cognito auth config from environment variables only.
- *
- * `ggui.json` is source-controlled, so personal credentials never go
- * in git. The publish CLI's auth config comes exclusively from the
- * canonical env-var pair:
- *
- *   `GGUI_REGISTRY_COGNITO_POOL_ID` + `GGUI_REGISTRY_COGNITO_APP_CLIENT_ID`
- *
- * The `GGUI_REGISTRY_` prefix matches other registry-scoped vars
- * (`GGUI_REGISTRY_TOKEN`, `GGUI_REGISTRY`). There is deliberately no
- * unprefixed `GGUI_COGNITO_*` fallback — a second accepted form would
- * re-introduce env-var ambiguity.
- *
- * No project-config fallback. Operators who want per-project auth
- * pinning use a per-project `.envrc` (direnv) or shell wrapper.
- */
-function resolveCognitoConfig(env) {
-    const poolId = env['GGUI_REGISTRY_COGNITO_POOL_ID'];
-    const appClientId = env['GGUI_REGISTRY_COGNITO_APP_CLIENT_ID'];
-    if (poolId && appClientId) {
-        return { poolId, appClientId };
-    }
-    return null;
-}
-async function runUserPasswordAuth(opts) {
-    const input = {
-        AuthFlow: 'USER_PASSWORD_AUTH',
-        ClientId: opts.authConfig.appClientId,
-        AuthParameters: {
-            USERNAME: opts.username,
-            PASSWORD: opts.password,
-        },
-    };
+    let tokens;
     try {
-        const cmd = new InitiateAuthCommand(input);
-        const res = await opts.hostedAuthClient.send(cmd);
-        return extractAuthResult(res);
+        tokens = await postAuthRefresh(session.endpoint, session.refreshToken, opts.fetchImpl);
     }
     catch (err) {
+        if (err instanceof ApiError && (err.status === 400 || err.status === 401)) {
+            return {
+                ok: false,
+                error: {
+                    code: 'auth_failed',
+                    message: 'login session expired or was revoked. Run `ggui login` again.',
+                },
+            };
+        }
         return {
             ok: false,
-            error: err instanceof Error ? err.message : String(err),
-        };
-    }
-}
-async function tryRefresh(opts) {
-    const idp = opts.hostedAuthClient ?? new CognitoIdentityProviderClient({});
-    const input = {
-        AuthFlow: 'REFRESH_TOKEN_AUTH',
-        ClientId: opts.authConfig.appClientId,
-        AuthParameters: {
-            REFRESH_TOKEN: opts.refreshToken,
-        },
-    };
-    try {
-        const res = await idp.send(new InitiateAuthCommand(input));
-        const extracted = extractAuthResult(res);
-        if (!extracted.ok)
-            return { ok: false, error: extracted.error };
-        // Cognito's REFRESH_TOKEN flow returns a new RefreshToken only
-        // when rotation is enabled on the pool. When absent, reuse the
-        // existing refresh token (still valid until its TTL).
-        const refreshToken = extracted.refreshToken.length > 0 ? extracted.refreshToken : opts.refreshToken;
-        return {
-            ok: true,
-            token: {
-                version: 1,
-                registry: opts.registryUrl,
-                idToken: extracted.idToken,
-                accessToken: extracted.accessToken,
-                refreshToken,
-                expiresAt: opts.now() + extracted.expiresIn,
-                username: opts.username,
-                writtenAt: new Date().toISOString(),
+            error: {
+                code: 'auth_failed',
+                message: `token refresh failed: ${err instanceof Error ? err.message : String(err)}`,
             },
         };
     }
-    catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
-    }
-}
-function extractAuthResult(res) {
-    const result = res.AuthenticationResult;
-    if (!result) {
-        return {
-            ok: false,
-            error: `Cognito did not return AuthenticationResult (challenge=${res.ChallengeName ?? 'none'})`,
-        };
-    }
-    if (typeof result.IdToken !== 'string' ||
-        typeof result.AccessToken !== 'string' ||
-        typeof result.ExpiresIn !== 'number') {
-        return {
-            ok: false,
-            error: 'Cognito AuthenticationResult missing IdToken/AccessToken/ExpiresIn',
-        };
-    }
-    return {
-        ok: true,
-        idToken: result.IdToken,
-        accessToken: result.AccessToken,
-        refreshToken: typeof result.RefreshToken === 'string' ? result.RefreshToken : '',
-        expiresIn: result.ExpiresIn,
+    const refreshedSession = {
+        ...session,
+        accessToken: tokens.access_token,
+        accessExpiresAt: nowSeconds + tokens.expires_in,
+        refreshToken: tokens.refresh_token,
+        writtenAt: new Date().toISOString(),
     };
+    saveAuthSession(refreshedSession);
+    return { ok: true, accessToken: refreshedSession.accessToken, refreshed: true };
 }
-async function defaultPrompt(label, opts = {}) {
-    // Minimal stdin reader. For hidden mode we toggle the TTY's `echo`
-    // off. The dependency-injected `prompt` in `runGadgetPublish` is
-    // the test seam — this is the fallback for real CLI use.
-    process.stdout.write(label);
-    const stdin = process.stdin;
-    if (!stdin.isTTY) {
-        throw new Error('stdin is not a TTY — pass --registry / set GGUI_REGISTRY and use a non-interactive auth path');
-    }
-    stdin.setEncoding('utf8');
-    if (opts.hidden) {
-        stdin.setRawMode(true);
-    }
-    let buf = '';
-    for await (const chunk of stdin) {
-        for (const ch of chunk) {
-            if (ch === '\r' || ch === '\n') {
-                if (opts.hidden)
-                    stdin.setRawMode(false);
-                process.stdout.write('\n');
-                return buf;
-            }
-            if (ch === '') {
-                // Ctrl-C — propagate via throw so the caller exits cleanly.
-                if (opts.hidden)
-                    stdin.setRawMode(false);
-                throw new Error('prompt cancelled');
-            }
-            if (ch === '' || ch === '\b') {
-                buf = buf.slice(0, -1);
-                continue;
-            }
-            buf += ch;
-            if (!opts.hidden)
-                process.stdout.write(ch);
-        }
-    }
-    if (opts.hidden)
-        stdin.setRawMode(false);
-    return buf;
+/**
+ * Operator-facing diagnosis for an HTTP 401 from the registry,
+ * specialized on which credential was sent. Used by both the
+ * conformance preflight and the publish POST.
+ */
+function describeRegistryAuthRejection(authKind, path) {
+    if (authKind === 'bearer') {
+        return (`registry rejected the bearer token (HTTP 401 from ${path}). ` +
+            'Check that --token / GGUI_REGISTRY_TOKEN matches the publish token the registry is configured with.');
+    }
+    return ('registry rejected the `ggui login` session token (HTTP 401 from ' +
+        `${path}). Re-run \`ggui login\` — the session may have expired ` +
+        'or been revoked. For self-hosted registries that authenticate ' +
+        'with a static publish token instead of login sessions, pass ' +
+        '--auth=bearer --token <token> (or set GGUI_REGISTRY_TOKEN).');
 }
 async function runConformancePreflight(opts) {
     const url = `${opts.registryUrl}/conformance/check`;
@@ -874,7 +748,7 @@ async function runConformancePreflight(opts) {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Authorization: `Bearer ${opts.jwt}`,
+                Authorization: `Bearer ${opts.token}`,
             },
             body,
         });
@@ -888,6 +762,15 @@ async function runConformancePreflight(opts) {
             },
         };
     }
+    if (res.status === 401) {
+        return {
+            ok: false,
+            error: {
+                code: 'auth_failed',
+                message: describeRegistryAuthRejection(opts.authKind, '/conformance/check'),
+            },
+        };
+    }
     if (!res.ok) {
         let text = '';
         try {
@@ -1043,7 +926,7 @@ async function postPublish(opts) {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                Authorization: `Bearer ${opts.jwt}`,
+                Authorization: `Bearer ${opts.token}`,
             },
             body,
         });
@@ -1057,6 +940,15 @@ async function postPublish(opts) {
             },
         };
     }
+    if (res.status === 401) {
+        return {
+            ok: false,
+            error: {
+                code: 'auth_failed',
+                message: describeRegistryAuthRejection(opts.authKind, '/publish'),
+            },
+        };
+    }
     if (res.status === 501) {
         return {
             ok: false,

package/dist/internal/artifact-search.d.ts

@@ -1,31 +1,5 @@
-/**
- * Artifact-kind discriminator. Mirrors the `gadgetManifestSchema` /
- * `blueprintManifestSchema` discriminators in
- * `@ggui-ai/artifact-manifest`. Inlined here because the manifest
- * package does not currently export a named `ArtifactKind` type — when
- * it does, swap to a structural `import type` from there.
- */
-export type ArtifactKind = 'gadget' | 'blueprint';
-/**
- * One row of `GET /search?…` results. Mirrors the registry's
- * `SearchResultEntry` response type.
- */
-export interface SearchResultEntry {
-    readonly artifactId: string;
-    readonly latestVersion: string;
-    readonly kind: ArtifactKind;
-    readonly description?: string;
-    readonly tags?: readonly string[];
-    readonly publishedAt: string;
-}
-/**
- * `GET /search?…` response body. `nextCursor` is an opaque base64
- * string the client roundtrips verbatim — never inspected client-side.
- */
-export interface SearchResponse {
-    readonly results: readonly SearchResultEntry[];
-    readonly nextCursor?: string;
-}
+import { type ArtifactKind, type SearchResponse, type SearchResultEntry } from '@ggui-ai/registry-core';
+export type { ArtifactKind, SearchResponse, SearchResultEntry };
 /**
  * Flag bundle accepted by {@link runArtifactSearch}. Mirrors the CLI's
  * positional + flag surface. Built either from `process.argv` (via

package/dist/internal/artifact-search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-search.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-search.ts"],"names":[],"mappings":"AA4BA;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;AAelD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,iBAAiB,CAuInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACtD,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BtC;AAiFD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAWzE;AAMD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,cAAc,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;AAMzD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAuFvB;AAwGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAuC1D"}
+{"version":3,"file":"artifact-search.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-search.ts"],"names":[],"mappings":"AA2BA,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAehE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,iBAAiB,CAuInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACtD,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BtC;AAiFD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAWzE;AAMD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,cAAc,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;AAMzD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAuFvB;AAwGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAuC1D"}

package/dist/internal/artifact-search.js

@@ -18,13 +18,14 @@
  * Returns a `SearchOutput` discriminated union; the CLI driver in
  * `gadget-command.ts` renders copy + picks the exit code.
  *
- * The wire shapes below mirror the registry's HTTP response types.
- * Adding fields is a minor change; removing or renaming a field is
- * breaking.
+ * The wire shapes (`SearchResultEntry` / `SearchResponse` /
+ * `ArtifactKind`) are imported from `@ggui-ai/registry-core` — the
+ * canonical owner of the registry HTTP response types — and
+ * re-exported for this module's consumers.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { SEARCH_ERROR_CODES } from '@ggui-ai/registry-core';
+import { SEARCH_ERROR_CODES, } from '@ggui-ai/registry-core';
 /**
  * Filename constant for the project manifest. Duplicated from
  * `@ggui-ai/project-config` rather than imported to keep this