@ggui-ai/registry-core 0.6.2 → 0.7.0

package/dist/impls/memory-registry-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-registry-storage.d.ts","sourceRoot":"","sources":["../../src/impls/memory-registry-storage.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAK3C,wBAAgB,uBAAuB,IAAI,eAAe,CAmHzD"}
+{"version":3,"file":"memory-registry-storage.d.ts","sourceRoot":"","sources":["../../src/impls/memory-registry-storage.ts"],"names":[],"mappings":"AAmBA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAK3C,wBAAgB,uBAAuB,IAAI,eAAe,CA2JzD"}

package/dist/impls/memory-registry-storage.js

@@ -6,8 +6,12 @@ export function inMemoryRegistryStorage() {
     const versions = new Map();
     const authorKeys = new Map();
     const compiledBlobs = new Map();
+    const scopeOwners = new Map();
     const versionKey = (artifactId, version) => `${artifactId}@${version}`;
-    const authorKey = (subject, keyId) => `${subject}/${keyId}`;
+    // JSON tuple — unambiguous for ANY subject/keyId contents. Subjects
+    // are operator-defined free text, so a `${subject}/${keyId}` composite
+    // would make ('team', …) and ('team/alice', …) collide or leak.
+    const authorKey = (subject, keyId) => JSON.stringify([subject, keyId]);
     return {
         async getArtifactMetadata(artifactId) {
             return metadata.get(artifactId) ?? null;
@@ -92,6 +96,36 @@ export function inMemoryRegistryStorage() {
             });
             return { ok: true, mode: 'dedup' };
         },
+        async getScopeOwner(scope) {
+            return scopeOwners.get(scope) ?? null;
+        },
+        async claimScope(row) {
+            // First-writer-wins. The check-and-set pair runs with no `await`
+            // between them, so the single-threaded event loop makes it
+            // atomic — two racing claims resolve strictly one-after-another.
+            if (scopeOwners.has(row.scope)) {
+                return { conflict: true };
+            }
+            scopeOwners.set(row.scope, row);
+            return { ok: true };
+        },
+        async updateScopeOwner(row, expect) {
+            // Compare-and-set against the caller's read snapshot. The
+            // check-and-set pair runs with no interleaving `await`, so the
+            // event loop makes it atomic (same discipline as claimScope).
+            const current = scopeOwners.get(row.scope);
+            if ('absent' in expect) {
+                if (current !== undefined)
+                    return { conflict: true };
+            }
+            else if (current === undefined ||
+                current.ownerSubject !== expect.ownerSubject ||
+                current.verification !== expect.verification) {
+                return { conflict: true };
+            }
+            scopeOwners.set(row.scope, row);
+            return { ok: true };
+        },
         async getAuthorKey(subject, keyId) {
             return authorKeys.get(authorKey(subject, keyId)) ?? null;
         },
@@ -103,14 +137,20 @@ export function inMemoryRegistryStorage() {
             authorKeys.set(key, row);
         },
         async listAuthorKeys(subject) {
-            const prefix = `${subject}/`;
+            // Row-field filter, not key-prefix matching — the row's own
+            // `subject` is the only unambiguous ownership signal.
             const matches = [];
-            for (const [key, row] of authorKeys) {
-                if (key.startsWith(prefix))
+            for (const row of authorKeys.values()) {
+                if (row.subject === subject)
                     matches.push(row);
             }
             return matches;
         },
+        async deleteAuthorKey(subject, keyId) {
+            // Map#delete returns whether an entry existed — exactly the
+            // contract's `deleted` signal.
+            return authorKeys.delete(authorKey(subject, keyId));
+        },
     };
 }
 function clampLimit(limit) {

package/dist/index.d.ts

@@ -9,17 +9,20 @@
  */
 export type { AuthnContext } from './interfaces/authn.js';
 export type { BundleStorage } from './interfaces/bundle-storage.js';
-export { AuthorKeyAlreadyExistsError, type PutAuthorKeyOptions, type RegistryStorage, } from './interfaces/registry-storage.js';
-export { ARTIFACTS_METADATA_SK, type ArtifactKind, type ArtifactScanFilter, type ArtifactVersionRow, type ArtifactsMetadataRow, type AuthorKeyRow, type CompiledBlobRow, type ErrorBody, LIST_VERSIONS_ERROR_CODES, type ListVersionsErrorBody, type ListVersionsErrorCode, type ListVersionsResponse, PUBLISH_ERROR_CODES, type PublishErrorBody, type PublishErrorCode, type PublishRequestBody, type PublishResponseBody, READ_ERROR_CODES, type ReadErrorBody, type ReadErrorCode, type ReadPkgResponse, REGISTER_AUTHOR_KEY_ERROR_CODES, type RegisterAuthorKeyErrorBody, type RegisterAuthorKeyErrorCode, type RegisterAuthorKeyRequestBody, type RegisterAuthorKeyResponseBody, SEARCH_ERROR_CODES, SEARCH_SORT_OPTIONS, type SearchErrorBody, type SearchErrorCode, type SearchResponse, type SearchResultEntry, type SearchSort, type VersionListEntry, type Visibility, } from './types.js';
+export { AuthorKeyAlreadyExistsError, type PutAuthorKeyOptions, type RegistryStorage, type ScopeOwnerExpectation, } from './interfaces/registry-storage.js';
+export { ARTIFACTS_METADATA_SK, type ArtifactKind, type ArtifactScanFilter, type ArtifactVersionRow, type ArtifactsMetadataRow, type AuthorKeyListEntry, type AuthorKeyRow, type CompiledBlobRow, DELETE_AUTHOR_KEY_ERROR_CODES, type DeleteAuthorKeyErrorBody, type DeleteAuthorKeyErrorCode, type DeleteAuthorKeyResponseBody, type ErrorBody, LIST_AUTHOR_KEYS_ERROR_CODES, type ListAuthorKeysErrorBody, type ListAuthorKeysErrorCode, type ListAuthorKeysResponseBody, LIST_VERSIONS_ERROR_CODES, type ListVersionsErrorBody, type ListVersionsErrorCode, type ListVersionsResponse, PUBLISH_ERROR_CODES, type PublishErrorBody, type PublishErrorCode, type PublishRequestBody, type PublishResponseBody, READ_ERROR_CODES, type ReadErrorBody, type ReadErrorCode, type ReadPkgResponse, REGISTER_AUTHOR_KEY_ERROR_CODES, type RegisterAuthorKeyErrorBody, type RegisterAuthorKeyErrorCode, type RegisterAuthorKeyRequestBody, type RegisterAuthorKeyResponseBody, SCOPE_VERIFICATIONS, type ScopeOwnerRow, type ScopeVerification, SEARCH_ERROR_CODES, SEARCH_SORT_OPTIONS, unauthorizedErrorBody, type SearchErrorBody, type SearchErrorCode, type SearchResponse, type SearchResultEntry, type SearchSort, type VersionListEntry, type Visibility, } from './types.js';
 export { compileBlueprint, type CompileBlueprintErr, type CompileBlueprintOk, type CompileBlueprintResult, } from './ops/compile.js';
 export { checkConformance, MAX_BLUEPRINT_SOURCE_BYTES, type BlueprintProbeRunner, type ConformanceError, type ConformanceErrorCode, type ConformanceFailureCode, type ConformanceRequestPayload, type ConformanceResponseBody, } from './ops/conformance.js';
-export { publishArtifact, MAX_BUNDLE_BYTES, type PublishArtifactDeps, type PublishArtifactInput, type PublishArtifactResult, } from './ops/publish.js';
+export { publishArtifact, MAX_BUNDLE_BYTES, RESERVED_SCOPES, type PublishArtifactDeps, type PublishArtifactInput, type PublishArtifactResult, } from './ops/publish.js';
 export { readArtifact, type ReadArtifactDeps, type ReadArtifactInput, type ReadArtifactResult, } from './ops/read.js';
 export { listArtifactVersions, type ListArtifactVersionsDeps, type ListArtifactVersionsInput, type ListArtifactVersionsResult, } from './ops/list-versions.js';
 export { searchArtifacts, type SearchArtifactsDeps, type SearchArtifactsInput, type SearchArtifactsResult, } from './ops/search.js';
 export { registerAuthorKey, type RegisterAuthorKeyDeps, type RegisterAuthorKeyInput, type RegisterAuthorKeyResult, } from './ops/register-author-key.js';
+export { listAuthorKeys, type ListAuthorKeysDeps, type ListAuthorKeysResult, } from './ops/list-author-keys.js';
+export { deleteAuthorKey, type DeleteAuthorKeyDeps, type DeleteAuthorKeyInput, type DeleteAuthorKeyResult, } from './ops/delete-author-key.js';
 export { inMemoryRegistryStorage } from './impls/memory-registry-storage.js';
 export { inMemoryBundleStorage, type InMemoryBundleStorageOptions, } from './impls/memory-bundle-storage.js';
+export { installCommand, type InstallCommandOptions, } from './install-command.js';
 export { compareSemver } from './utils/semver.js';
 export { base64Encode, safeBase64Decode, sha384Base64 } from './utils/base64.js';
 export type { Ed25519Signature, GadgetSignature } from '@ggui-ai/gadget-signing';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKjF,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC3B,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACd,4BAA4B,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKjF,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -9,18 +9,21 @@
  */
 export { AuthorKeyAlreadyExistsError, } from './interfaces/registry-storage.js';
 // Types — rows + wire shapes
-export { ARTIFACTS_METADATA_SK, LIST_VERSIONS_ERROR_CODES, PUBLISH_ERROR_CODES, READ_ERROR_CODES, REGISTER_AUTHOR_KEY_ERROR_CODES, SEARCH_ERROR_CODES, SEARCH_SORT_OPTIONS, } from './types.js';
+export { ARTIFACTS_METADATA_SK, DELETE_AUTHOR_KEY_ERROR_CODES, LIST_AUTHOR_KEYS_ERROR_CODES, LIST_VERSIONS_ERROR_CODES, PUBLISH_ERROR_CODES, READ_ERROR_CODES, REGISTER_AUTHOR_KEY_ERROR_CODES, SCOPE_VERIFICATIONS, SEARCH_ERROR_CODES, SEARCH_SORT_OPTIONS, unauthorizedErrorBody, } from './types.js';
 // Operations
 export { compileBlueprint, } from './ops/compile.js';
 export { checkConformance, MAX_BLUEPRINT_SOURCE_BYTES, } from './ops/conformance.js';
-export { publishArtifact, MAX_BUNDLE_BYTES, } from './ops/publish.js';
+export { publishArtifact, MAX_BUNDLE_BYTES, RESERVED_SCOPES, } from './ops/publish.js';
 export { readArtifact, } from './ops/read.js';
 export { listArtifactVersions, } from './ops/list-versions.js';
 export { searchArtifacts, } from './ops/search.js';
 export { registerAuthorKey, } from './ops/register-author-key.js';
+export { listAuthorKeys, } from './ops/list-author-keys.js';
+export { deleteAuthorKey, } from './ops/delete-author-key.js';
 // In-memory impls
 export { inMemoryRegistryStorage } from './impls/memory-registry-storage.js';
 export { inMemoryBundleStorage, } from './impls/memory-bundle-storage.js';
 // Utils
+export { installCommand, } from './install-command.js';
 export { compareSemver } from './utils/semver.js';
 export { base64Encode, safeBase64Decode, sha384Base64 } from './utils/base64.js';

package/dist/install-command.d.ts

@@ -0,0 +1,25 @@
+import type { ArtifactKind } from './types.js';
+export interface InstallCommandOptions {
+    /**
+     * Registry origin to pin via an explicit `--registry=<url>` flag —
+     * pass the URL the artifact was discovered on (the same origin the
+     * search/read endpoints were queried against). When provided, the
+     * emitted command installs from exactly that registry instead of
+     * whatever the CLI's ambient default resolves to; when omitted, the
+     * flag is left off and the CLI default applies.
+     */
+    readonly registryHost?: string;
+}
+/**
+ * Compose the canonical CLI install command for a published artifact:
+ *
+ *     ggui <kind> install <scope>/<name>@<version> [--registry=<url>]
+ *
+ * Same shape the publish flow reports back after a successful publish,
+ * so every surface that displays an install command agrees on one
+ * wording. Pure string composition — callers are responsible for
+ * validating `artifactId` (`@scope/name`) and `version` (semver)
+ * before display; this function does not re-validate.
+ */
+export declare function installCommand(kind: ArtifactKind, artifactId: string, version: string, opts?: InstallCommandOptions): string;
+//# sourceMappingURL=install-command.d.ts.map

package/dist/install-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-command.d.ts","sourceRoot":"","sources":["../src/install-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,qBAA0B,GAC/B,MAAM,CAIR"}

package/dist/install-command.js

@@ -0,0 +1,15 @@
+/**
+ * Compose the canonical CLI install command for a published artifact:
+ *
+ *     ggui <kind> install <scope>/<name>@<version> [--registry=<url>]
+ *
+ * Same shape the publish flow reports back after a successful publish,
+ * so every surface that displays an install command agrees on one
+ * wording. Pure string composition — callers are responsible for
+ * validating `artifactId` (`@scope/name`) and `version` (semver)
+ * before display; this function does not re-validate.
+ */
+export function installCommand(kind, artifactId, version, opts = {}) {
+    const registry = opts.registryHost !== undefined ? ` --registry=${opts.registryHost}` : '';
+    return `ggui ${kind} install ${artifactId}@${version}${registry}`;
+}

package/dist/interfaces/registry-storage.d.ts

@@ -27,6 +27,23 @@
  *   at the storage layer. Implementations
  *   MUST NOT overwrite on conflict — per-version immutability is a
  *   load-bearing registry invariant.
+ * - {@link claimScope} MUST be an atomic first-writer-wins conditional
+ *   create: when two claims race on the same scope, EXACTLY one wins
+ *   and the loser observes `{ conflict: true }` with the winner's row
+ *   left untouched. Scope ownership is the publish-authorization
+ *   invariant — a lost race that overwrote the winner would silently
+ *   reassign every future publish under that scope.
+ * - {@link getScopeOwner} MUST observe a completed {@link claimScope}
+ *   immediately (read-your-writes strong). The publish gate's
+ *   claim-conflict path re-reads to learn the winner; a read that can
+ *   lag a durable claim would fail the losing racer's publish with a
+ *   spurious storage-inconsistency error.
+ * - {@link updateScopeOwner} MUST be conditional on the caller's read
+ *   snapshot (`expect`): the write lands only when the stored row still
+ *   matches (or is still absent, for `{ absent: true }`). On mismatch
+ *   it returns `{ conflict: true }` with the stored row untouched —
+ *   an operator rewrite MUST NOT clobber a concurrent transfer or a
+ *   racing first-publish claim.
  * - {@link getArtifactMetadata} / {@link getArtifactVersion} MUST return
  *   exactly what was last written. `null` on miss; throw on transport
  *   failure (caller decides retry).
@@ -48,10 +65,11 @@
  *   round-trip preservation, idempotent {@link putArtifactMetadata},
  *   `putArtifactVersionIfAbsent` rejects on collision, missing returns
  *   null, `listAuthorKeys` returns only keys for the queried subject,
+ *   `deleteAuthorKey` true/false idempotency + per-subject isolation,
  *   and `order: 'recent'` newest-first ordering (single page + across
  *   the cursor chain).
  */
-import type { ArtifactScanFilter, ArtifactVersionRow, ArtifactsMetadataRow, AuthorKeyRow, CompiledBlobRow } from '../types.js';
+import type { ArtifactScanFilter, ArtifactVersionRow, ArtifactsMetadataRow, AuthorKeyRow, CompiledBlobRow, ScopeOwnerRow } from '../types.js';
 /**
  * Optional flags for {@link RegistryStorage.putAuthorKey}.
  *
@@ -79,6 +97,18 @@ export declare class AuthorKeyAlreadyExistsError extends Error {
     readonly keyId: string;
     constructor(subject: string, keyId: string);
 }
+/**
+ * The caller's read snapshot for {@link RegistryStorage.updateScopeOwner}
+ * — either the `(ownerSubject, verification)` pair the caller read, or
+ * an assertion that no row exists yet (`{ absent: true }`, the operator
+ * seed path).
+ */
+export type ScopeOwnerExpectation = {
+    readonly ownerSubject: string;
+    readonly verification: ScopeOwnerRow['verification'];
+} | {
+    readonly absent: true;
+};
 export interface RegistryStorage {
     getArtifactMetadata(artifactId: string): Promise<ArtifactsMetadataRow | null>;
     putArtifactMetadata(row: ArtifactsMetadataRow): Promise<void>;
@@ -201,6 +231,56 @@ export interface RegistryStorage {
         ok: false;
         reason: 'version_exists';
     }>;
+    /**
+     * Fetch the ownership row for `scope` (leading `@` included, e.g.
+     * `@acme`). Returns `null` when the scope is unclaimed.
+     *
+     * MUST be read-your-writes strong with respect to {@link claimScope}
+     * and {@link updateScopeOwner} — see the Obligations section above.
+     */
+    getScopeOwner(scope: string): Promise<ScopeOwnerRow | null>;
+    /**
+     * Atomic first-writer-wins claim — creates the ownership row only
+     * when no row exists for `row.scope`. On conflict (a row already
+     * exists, including one that landed in a concurrent race) returns
+     * `{ conflict: true }` WITHOUT touching the existing row.
+     *
+     * The publish op claims on the caller's first publish into an
+     * unclaimed scope. Consumers MUST NOT pre-check with
+     * {@link getScopeOwner} + claim as a substitute for handling
+     * `conflict` — the conditional create is the only race-safe
+     * primitive (re-read on conflict instead).
+     */
+    claimScope(row: ScopeOwnerRow): Promise<{
+        ok: true;
+    } | {
+        conflict: true;
+    }>;
+    /**
+     * Conditional full-row put of the ownership row — a compare-and-set
+     * against the caller's read snapshot.
+     *
+     * `expect` states what the caller believes is stored:
+     *   - `{ ownerSubject, verification }` — the row MUST still carry
+     *     exactly this pair (the snapshot identity of an ownership row).
+     *   - `{ absent: true }` — no row may exist yet (operator seeding).
+     *
+     * On mismatch the write is refused with `{ conflict: true }` and the
+     * stored row is untouched — the caller re-reads and retries. This is
+     * the structural defense against read-modify-write races between two
+     * operators, or between an operator write and a concurrent
+     * first-publish claim.
+     *
+     * Operator-only caller: verification flips and ownership transfers
+     * (including seeding rows for reserved scopes, which are never
+     * first-publish-claimable). The publish path MUST NOT call this —
+     * {@link claimScope} is its only write.
+     */
+    updateScopeOwner(row: ScopeOwnerRow, expect: ScopeOwnerExpectation): Promise<{
+        ok: true;
+    } | {
+        conflict: true;
+    }>;
     getAuthorKey(subject: string, keyId: string): Promise<AuthorKeyRow | null>;
     /**
      * Write an AuthorKey row. With `options.ifNotExists === true`, the
@@ -211,5 +291,19 @@ export interface RegistryStorage {
      */
     putAuthorKey(row: AuthorKeyRow, options?: PutAuthorKeyOptions): Promise<void>;
     listAuthorKeys(subject: string): Promise<readonly AuthorKeyRow[]>;
+    /**
+     * Hard-delete the row for `(subject, keyId)`. Returns `true` when a
+     * row existed and was removed, `false` when no row existed — the
+     * caller-visible idempotency signal for the delete op's
+     * `deleted: false` response. Implementations MUST NOT throw on the
+     * absent case; transport failures still throw.
+     *
+     * Hard delete is the registry's established author-key removal
+     * semantic: the durable audit trail is the public key pinned per
+     * published version (`ArtifactVersionRow.authorPublicKey` +
+     * `publishedBy`), which this delete never touches — removal only
+     * blocks FUTURE publishes signed with the key.
+     */
+    deleteAuthorKey(subject: string, keyId: string): Promise<boolean>;
 }
 //# sourceMappingURL=registry-storage.d.ts.map

package/dist/interfaces/registry-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-storage.d.ts","sourceRoot":"","sources":["../../src/interfaces/registry-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQ3C;AAED,MAAM,WAAW,eAAe;IAE9B,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC9E,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACjD,QAAQ,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,CAAC;QAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IAGH,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,0BAA0B,CACxB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxE;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,oBAAoB,CAClB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,eAAe,GACvB,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAA;KAAE,GACxC;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAC1C,CAAC;IAGF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,YAAY,CACV,GAAG,EAAE,YAAY,EACjB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;CACnE"}
+{"version":3,"file":"registry-storage.d.ts","sourceRoot":"","sources":["../../src/interfaces/registry-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,aAAa,EACd,MAAM,aAAa,CAAC;AAErB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQ3C;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CACtD,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC;AAE9B,MAAM,WAAW,eAAe;IAE9B,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAC9E,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC;QACjD,QAAQ,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,CAAC;QAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IAGH,kBAAkB,CAChB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtC;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAClB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IAC1C;;;;;OAKG;IACH,0BAA0B,CACxB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxE;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,oBAAoB,CAClB,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,eAAe,GACvB,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAA;KAAE,GACxC;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAC1C,CAAC;IAGF;;;;;;OAMG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC5D;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CACd,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAG9C,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC3E;;;;;;OAMG;IACH,YAAY,CACV,GAAG,EAAE,YAAY,EACjB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAAC;IAClE;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE"}

package/dist/ops/delete-author-key.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `deleteAuthorKey` — pure op for `DELETE /author-keys/{keyId}`.
+ *
+ * Hard-deletes the `(subject, keyId)` row under the VERIFIED caller
+ * identity. Like {@link listAuthorKeys} there is no anonymous branch —
+ * transports MUST 401 before calling this op when the bearer
+ * credential is missing or invalid.
+ *
+ * Semantics (see {@link DeleteAuthorKeyResponseBody}):
+ *
+ *   - Idempotent: an absent keyId is a 200 with `deleted: false`, not
+ *     an error — retries and double-clicks converge.
+ *   - Subject-scoped: the delete only ever addresses the caller's own
+ *     partition. A keyId registered by ANOTHER subject is untouched
+ *     and the response is byte-identical to the plain-absent case, so
+ *     key existence never leaks across accounts.
+ *   - Forward-only: removal blocks FUTURE publishes signed with this
+ *     key. Versions already published stay valid — their signing key
+ *     is pinned per version at publish time, which this delete never
+ *     touches.
+ */
+import type { DeleteAuthorKeyErrorBody, DeleteAuthorKeyResponseBody } from '../types.js';
+import type { AuthnContext } from '../interfaces/authn.js';
+import type { RegistryStorage } from '../interfaces/registry-storage.js';
+export interface DeleteAuthorKeyInput {
+    /** The keyId path segment — `derivePublicKeyId` output, non-empty. */
+    readonly keyId: string;
+}
+export interface DeleteAuthorKeyDeps {
+    readonly storage: RegistryStorage;
+    /** REQUIRED — the verified caller identity. No anonymous branch. */
+    readonly authn: AuthnContext;
+}
+export type DeleteAuthorKeyResult = {
+    readonly ok: true;
+    readonly status: 200;
+    readonly body: DeleteAuthorKeyResponseBody;
+} | {
+    readonly ok: false;
+    readonly status: 400 | 500;
+    readonly body: DeleteAuthorKeyErrorBody;
+};
+export declare function deleteAuthorKey(input: DeleteAuthorKeyInput, deps: DeleteAuthorKeyDeps): Promise<DeleteAuthorKeyResult>;
+export type { DeleteAuthorKeyErrorBody, DeleteAuthorKeyResponseBody };
+//# sourceMappingURL=delete-author-key.d.ts.map

package/dist/ops/delete-author-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-author-key.d.ts","sourceRoot":"","sources":["../../src/ops/delete-author-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;CAC5C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;CACzC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CA+BhC;AAID,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/ops/delete-author-key.js

@@ -0,0 +1,31 @@
+export async function deleteAuthorKey(input, deps) {
+    if (typeof input.keyId !== 'string' || input.keyId.length === 0) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'invalid_request',
+                message: '`keyId` path segment is required',
+            },
+        };
+    }
+    let deleted;
+    try {
+        deleted = await deps.storage.deleteAuthorKey(deps.authn.subject, input.keyId);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 500,
+            body: {
+                error: 'server_error',
+                message: `failed to delete author key: ${err instanceof Error ? err.message : String(err)}`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        status: 200,
+        body: { keyId: input.keyId, deleted },
+    };
+}

package/dist/ops/list-author-keys.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `listAuthorKeys` — pure op for `GET /author-keys`.
+ *
+ * Lists every signing key registered under the VERIFIED caller
+ * identity. Unlike the read/list-versions ops there is no anonymous
+ * branch: "my keys" has no public projection, so `deps.authn` is
+ * required — transports MUST 401 before calling this op when the
+ * bearer credential is missing or invalid.
+ *
+ * Ordering: newest first by `createdAt` (ISO strings compare
+ * lexicographically === chronologically), rows without `createdAt`
+ * (registered before the display enrichment) last, `keyId` tie-break —
+ * deterministic across storage impls whose list order is arbitrary.
+ */
+import type { ListAuthorKeysErrorBody, ListAuthorKeysResponseBody } from '../types.js';
+import type { AuthnContext } from '../interfaces/authn.js';
+import type { RegistryStorage } from '../interfaces/registry-storage.js';
+export interface ListAuthorKeysDeps {
+    readonly storage: RegistryStorage;
+    /** REQUIRED — the verified caller identity. No anonymous branch. */
+    readonly authn: AuthnContext;
+}
+export type ListAuthorKeysResult = {
+    readonly ok: true;
+    readonly status: 200;
+    readonly body: ListAuthorKeysResponseBody;
+} | {
+    readonly ok: false;
+    readonly status: 500;
+    readonly body: ListAuthorKeysErrorBody;
+};
+export declare function listAuthorKeys(deps: ListAuthorKeysDeps): Promise<ListAuthorKeysResult>;
+export type { ListAuthorKeysErrorBody, ListAuthorKeysResponseBody };
+//# sourceMappingURL=list-author-keys.d.ts.map

package/dist/ops/list-author-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-author-keys.d.ts","sourceRoot":"","sources":["../../src/ops/list-author-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAGV,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;CAC3C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;CACxC,CAAC;AAEN,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAuB/B;AAyBD,YAAY,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/ops/list-author-keys.js

@@ -0,0 +1,45 @@
+export async function listAuthorKeys(deps) {
+    const subject = deps.authn.subject;
+    let rows;
+    try {
+        rows = await deps.storage.listAuthorKeys(subject);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 500,
+            body: {
+                error: 'server_error',
+                message: `failed to list author keys: ${err instanceof Error ? err.message : String(err)}`,
+            },
+        };
+    }
+    const sorted = [...rows].sort(compareNewestFirst);
+    return {
+        ok: true,
+        status: 200,
+        body: { subject, keys: sorted.map(rowToEntry) },
+    };
+}
+function compareNewestFirst(a, b) {
+    if (a.createdAt !== undefined && b.createdAt !== undefined) {
+        const byCreated = b.createdAt.localeCompare(a.createdAt);
+        if (byCreated !== 0)
+            return byCreated;
+    }
+    else if (a.createdAt !== undefined) {
+        return -1;
+    }
+    else if (b.createdAt !== undefined) {
+        return 1;
+    }
+    return a.keyId.localeCompare(b.keyId);
+}
+function rowToEntry(row) {
+    return {
+        keyId: row.keyId,
+        publicKeyBase64: row.publicKeyBase64,
+        ...(row.createdAt !== undefined ? { createdAt: row.createdAt } : {}),
+        ...(row.label !== undefined ? { label: row.label } : {}),
+    };
+}

package/dist/ops/publish.d.ts

@@ -1,4 +1,4 @@
-import { type GadgetSignature } from '@ggui-ai/gadget-signing';
+import { type GadgetSignature, type VerifyBundleSigstoreInput } from '@ggui-ai/gadget-signing';
 import type { PublishErrorBody, PublishResponseBody } from '../types.js';
 import type { BlueprintProbeRunner } from './conformance.js';
 import type { AuthnContext } from '../interfaces/authn.js';
@@ -12,6 +12,22 @@ import type { RegistryStorage } from '../interfaces/registry-storage.js';
  * against an OSS-mirrored registry without re-bundling).
  */
 export declare const MAX_BUNDLE_BYTES: number;
+/**
+ * Scopes no publish may CLAIM — well-known names whose squatting would
+ * mislead installers about who authored an artifact. The default
+ * covers first-party names plus obvious squat-bait; a deployment
+ * REPLACES the whole list via
+ * {@link PublishArtifactDeps.reservedScopes} (spread this constant to
+ * extend it instead).
+ *
+ * Reserved scopes block first-publish CLAIMS only — not owned
+ * publishes. A registry operator who wants artifacts under a reserved
+ * name seeds its ownership row out-of-band via
+ * {@link RegistryStorage.updateScopeOwner}; once the row exists, the
+ * normal owner rule applies (the seeded owner publishes, everyone else
+ * gets `scope_forbidden`) with no change to this list.
+ */
+export declare const RESERVED_SCOPES: readonly string[];
 export interface PublishArtifactInput {
     /** Unvalidated request body — the op parses + validates. */
     readonly manifest: unknown;
@@ -44,6 +60,13 @@ export interface PublishArtifactDeps {
      * `http://` for `localhost`/`127.0.0.1`.
      */
     readonly registryHostname: string;
+    /**
+     * Scopes no publish may claim — REPLACES {@link RESERVED_SCOPES}
+     * when set (spread the constant to extend instead:
+     * `[...RESERVED_SCOPES, '@my-brand']`). Exact-match against
+     * `manifest.scope`, leading `@` included.
+     */
+    readonly reservedScopes?: readonly string[];
     /**
      * Optional runtime probe for blueprint manifests. Static gates
      * always run; the probe additionally compiles + renders the
@@ -56,6 +79,20 @@ export interface PublishArtifactDeps {
      * HTTP endpoint that should not pay for react-dom.
      */
     readonly blueprintProbe?: BlueprintProbeRunner;
+    /**
+     * Optional TUF trust-root tuning forwarded verbatim to
+     * sigstore-cosign signature verification (see
+     * {@link VerifyBundleSigstoreInput}). `tufCachePath` points the
+     * verifier's trust-root cache at a writable directory — serverless
+     * runtimes typically only allow writes under `/tmp`.
+     * `tufForceCache` reuses valid cached TUF metadata without a remote
+     * refresh. `tufMirrorURL` + `tufRootPath` select an alternative TUF
+     * repository (private sigstore deployments; hermetic tests) — the
+     * trust root is THE knob that decides which signing infrastructure
+     * this registry's verifier trusts. Ed25519 verification never
+     * consults any of these.
+     */
+    readonly sigstoreTuf?: Pick<VerifyBundleSigstoreInput, 'tufCachePath' | 'tufForceCache' | 'tufMirrorURL' | 'tufRootPath'>;
 }
 export type PublishArtifactResult = {
     readonly ok: true;

package/dist/ops/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/ops/publish.ts"],"names":[],"mappings":"AA2BA,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAIV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAMzE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CAChD;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAuXhC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/ops/publish.ts"],"names":[],"mappings":"AA6CA,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAIV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAMzE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAc5C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CACzB,yBAAyB,EACzB,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,aAAa,CAClE,CAAC;CACH;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAqfhC"}