@ggui-ai/registry-core 0.6.3 → 0.8.0

package/dist/mcp-tool-filters.js

@@ -0,0 +1,14 @@
+export function matchesMcpToolFilters(bindings, filters) {
+    const { tool, server } = filters;
+    if (tool === undefined && server === undefined)
+        return true;
+    if (bindings === undefined || bindings.length === 0)
+        return false;
+    return bindings.some((binding) => {
+        if (tool !== undefined && binding.tool !== tool)
+            return false;
+        if (server !== undefined && binding.server !== server)
+            return false;
+        return true;
+    });
+}

package/dist/ops/delete-author-key.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `deleteAuthorKey` — pure op for `DELETE /author-keys/{keyId}`.
+ *
+ * Hard-deletes the `(subject, keyId)` row under the VERIFIED caller
+ * identity. Like {@link listAuthorKeys} there is no anonymous branch —
+ * transports MUST 401 before calling this op when the bearer
+ * credential is missing or invalid.
+ *
+ * Semantics (see {@link DeleteAuthorKeyResponseBody}):
+ *
+ *   - Idempotent: an absent keyId is a 200 with `deleted: false`, not
+ *     an error — retries and double-clicks converge.
+ *   - Subject-scoped: the delete only ever addresses the caller's own
+ *     partition. A keyId registered by ANOTHER subject is untouched
+ *     and the response is byte-identical to the plain-absent case, so
+ *     key existence never leaks across accounts.
+ *   - Forward-only: removal blocks FUTURE publishes signed with this
+ *     key. Versions already published stay valid — their signing key
+ *     is pinned per version at publish time, which this delete never
+ *     touches.
+ */
+import type { DeleteAuthorKeyErrorBody, DeleteAuthorKeyResponseBody } from '../types.js';
+import type { AuthnContext } from '../interfaces/authn.js';
+import type { RegistryStorage } from '../interfaces/registry-storage.js';
+export interface DeleteAuthorKeyInput {
+    /** The keyId path segment — `derivePublicKeyId` output, non-empty. */
+    readonly keyId: string;
+}
+export interface DeleteAuthorKeyDeps {
+    readonly storage: RegistryStorage;
+    /** REQUIRED — the verified caller identity. No anonymous branch. */
+    readonly authn: AuthnContext;
+}
+export type DeleteAuthorKeyResult = {
+    readonly ok: true;
+    readonly status: 200;
+    readonly body: DeleteAuthorKeyResponseBody;
+} | {
+    readonly ok: false;
+    readonly status: 400 | 500;
+    readonly body: DeleteAuthorKeyErrorBody;
+};
+export declare function deleteAuthorKey(input: DeleteAuthorKeyInput, deps: DeleteAuthorKeyDeps): Promise<DeleteAuthorKeyResult>;
+export type { DeleteAuthorKeyErrorBody, DeleteAuthorKeyResponseBody };
+//# sourceMappingURL=delete-author-key.d.ts.map

package/dist/ops/delete-author-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-author-key.d.ts","sourceRoot":"","sources":["../../src/ops/delete-author-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;CAC5C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;CACzC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CA+BhC;AAID,YAAY,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/ops/delete-author-key.js

@@ -0,0 +1,31 @@
+export async function deleteAuthorKey(input, deps) {
+    if (typeof input.keyId !== 'string' || input.keyId.length === 0) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'invalid_request',
+                message: '`keyId` path segment is required',
+            },
+        };
+    }
+    let deleted;
+    try {
+        deleted = await deps.storage.deleteAuthorKey(deps.authn.subject, input.keyId);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 500,
+            body: {
+                error: 'server_error',
+                message: `failed to delete author key: ${err instanceof Error ? err.message : String(err)}`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        status: 200,
+        body: { keyId: input.keyId, deleted },
+    };
+}

package/dist/ops/list-author-keys.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `listAuthorKeys` — pure op for `GET /author-keys`.
+ *
+ * Lists every signing key registered under the VERIFIED caller
+ * identity. Unlike the read/list-versions ops there is no anonymous
+ * branch: "my keys" has no public projection, so `deps.authn` is
+ * required — transports MUST 401 before calling this op when the
+ * bearer credential is missing or invalid.
+ *
+ * Ordering: newest first by `createdAt` (ISO strings compare
+ * lexicographically === chronologically), rows without `createdAt`
+ * (registered before the display enrichment) last, `keyId` tie-break —
+ * deterministic across storage impls whose list order is arbitrary.
+ */
+import type { ListAuthorKeysErrorBody, ListAuthorKeysResponseBody } from '../types.js';
+import type { AuthnContext } from '../interfaces/authn.js';
+import type { RegistryStorage } from '../interfaces/registry-storage.js';
+export interface ListAuthorKeysDeps {
+    readonly storage: RegistryStorage;
+    /** REQUIRED — the verified caller identity. No anonymous branch. */
+    readonly authn: AuthnContext;
+}
+export type ListAuthorKeysResult = {
+    readonly ok: true;
+    readonly status: 200;
+    readonly body: ListAuthorKeysResponseBody;
+} | {
+    readonly ok: false;
+    readonly status: 500;
+    readonly body: ListAuthorKeysErrorBody;
+};
+export declare function listAuthorKeys(deps: ListAuthorKeysDeps): Promise<ListAuthorKeysResult>;
+export type { ListAuthorKeysErrorBody, ListAuthorKeysResponseBody };
+//# sourceMappingURL=list-author-keys.d.ts.map

package/dist/ops/list-author-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-author-keys.d.ts","sourceRoot":"","sources":["../../src/ops/list-author-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAGV,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;CAC3C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;CACxC,CAAC;AAEN,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,oBAAoB,CAAC,CAuB/B;AAyBD,YAAY,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,CAAC"}

package/dist/ops/list-author-keys.js

@@ -0,0 +1,45 @@
+export async function listAuthorKeys(deps) {
+    const subject = deps.authn.subject;
+    let rows;
+    try {
+        rows = await deps.storage.listAuthorKeys(subject);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 500,
+            body: {
+                error: 'server_error',
+                message: `failed to list author keys: ${err instanceof Error ? err.message : String(err)}`,
+            },
+        };
+    }
+    const sorted = [...rows].sort(compareNewestFirst);
+    return {
+        ok: true,
+        status: 200,
+        body: { subject, keys: sorted.map(rowToEntry) },
+    };
+}
+function compareNewestFirst(a, b) {
+    if (a.createdAt !== undefined && b.createdAt !== undefined) {
+        const byCreated = b.createdAt.localeCompare(a.createdAt);
+        if (byCreated !== 0)
+            return byCreated;
+    }
+    else if (a.createdAt !== undefined) {
+        return -1;
+    }
+    else if (b.createdAt !== undefined) {
+        return 1;
+    }
+    return a.keyId.localeCompare(b.keyId);
+}
+function rowToEntry(row) {
+    return {
+        keyId: row.keyId,
+        publicKeyBase64: row.publicKeyBase64,
+        ...(row.createdAt !== undefined ? { createdAt: row.createdAt } : {}),
+        ...(row.label !== undefined ? { label: row.label } : {}),
+    };
+}

package/dist/ops/list-versions.d.ts

@@ -7,12 +7,20 @@
  *   1. Point-read the metadata row via {@link RegistryStorage.getArtifactMetadata}.
  *      Missing metadata → 404 (`not_found`).
  *   2. Fetch all version rows via {@link RegistryStorage.listArtifactVersions}.
- *   3. Filter out private rows for unauthenticated callers — same gate
- *      as the read op's `visibility === 'private' && authn === undefined`
- *      branch. We do NOT 403 on a fully-private artifact for an unauthed
- *      caller; we 200 with `versions: []` so the wire response doesn't
- *      leak the existence of a private artifact (cf. GitHub's 404-on-
- *      private-repo behaviour).
+ *   3. Filter out private rows the caller cannot read — the same
+ *      ownership rule as the read op ({@link canReadPrivateArtifact}:
+ *      publisher or scope owner). Unreadable rows are FILTERED, never
+ *      errored: an unauthorized caller (anonymous or authenticated)
+ *      gets the readable subset. When NOTHING is readable, the
+ *      response is the SAME 404 `not_found` as a true miss — a 200
+ *      `versions: []` would differ from the miss shape and that
+ *      difference is an existence oracle (cf. GitHub's
+ *      404-on-private-repo behaviour). The scope-owner lookup is lazy,
+ *      memoized, and fail-closed ({@link createScopeOwnerResolver}):
+ *      at most one {@link RegistryStorage.getScopeOwner} call per
+ *      request; none when every row is public, the caller published
+ *      every private row, or the caller is anonymous; a lookup fault
+ *      denies instead of erroring.
  *   4. Sort by semver DESC so the latest version is first. Yanked rows
  *      are NOT filtered — they stay in the list with `yanked: true`
  *      so the UI can show "this version was yanked".
@@ -38,10 +46,11 @@ export interface ListArtifactVersionsInput {
 export interface ListArtifactVersionsDeps {
     readonly storage: RegistryStorage;
     /**
-     * Optional — when undefined, the op filters `private` versions OUT
-     * of the response. Authenticated callers see every version they own
-     * (the storage layer's row-level visibility filter is the source of
-     * truth; this op just honours it).
+     * Optional — the verified caller context, produced by the
+     * transport's own credential verification. Private versions appear
+     * in the response only for the caller who published them or the
+     * owner of the artifact's scope ({@link canReadPrivateArtifact});
+     * every other caller — anonymous included — gets the public subset.
      */
     readonly authn?: AuthnContext;
 }

package/dist/ops/list-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-versions.d.ts","sourceRoot":"","sources":["../../src/ops/list-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAEV,qBAAqB,EAErB,oBAAoB,EAErB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGzE,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;CACtC,CAAC;AAEN,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CA6DrC"}
+{"version":3,"file":"list-versions.d.ts","sourceRoot":"","sources":["../../src/ops/list-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAEV,qBAAqB,EAErB,oBAAoB,EAErB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAOzE,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;CAC/B;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;CACrC,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;CACtC,CAAC;AAEN,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,0BAA0B,CAAC,CAsErC"}

package/dist/ops/list-versions.js

@@ -1,4 +1,5 @@
 import { compareSemver } from '../utils/semver.js';
+import { canReadPrivateArtifact, createScopeOwnerResolver, } from './private-read-authz.js';
 export async function listArtifactVersions(input, deps) {
     if (typeof input.artifactId !== 'string' || input.artifactId.length === 0) {
         return errorResult(400, 'invalid_request', 'missing artifactId');
@@ -12,10 +13,11 @@ export async function listArtifactVersions(input, deps) {
         metadataExists = metadata !== null;
     }
     catch (err) {
-        return errorResult(500, 'server_error', `failed to read metadata: ${err instanceof Error ? err.message : String(err)}`);
+        logStorageFailure('read metadata', input.artifactId, err);
+        return errorResult(500, 'server_error', 'failed to list versions');
     }
     if (!metadataExists) {
-        return errorResult(404, 'not_found', `no such artifact: ${input.artifactId}`);
+        return notFoundResult(input);
     }
     // Step 2 — fetch all version rows.
     let rows;
@@ -23,18 +25,31 @@ export async function listArtifactVersions(input, deps) {
         rows = await deps.storage.listArtifactVersions(input.artifactId);
     }
     catch (err) {
-        return errorResult(500, 'server_error', `failed to list versions: ${err instanceof Error ? err.message : String(err)}`);
+        logStorageFailure('list version rows', input.artifactId, err);
+        return errorResult(500, 'server_error', 'failed to list versions');
     }
-    // Step 3 — visibility filter. Unauthed callers see only public rows;
-    // authed callers see everything (finer org-membership gating is a
-    // future concern — for now, "authed" === "can see your own private
-    // rows" is captured by the verified caller subject being non-null).
+    // Step 3 — ownership filter. A private row stays in the list only
+    // when the caller may read it under the shared rule (publisher or
+    // scope owner). All rows share one artifactId, hence one scope —
+    // the shared resolver memoizes the lazy owner lookup (one
+    // getScopeOwner call at most; none for public rows / anonymous
+    // callers / publisher-only matches) and fails CLOSED on a storage
+    // fault (deny + server-side log, never a distinctive error status).
+    const getScopeOwner = createScopeOwnerResolver(deps.storage, input.artifactId);
     const visibleRows = [];
     for (const row of rows) {
-        if (row.visibility === 'private' && deps.authn === undefined)
+        if (row.visibility === 'private' &&
+            !(await canReadPrivateArtifact(deps.authn, row, getScopeOwner))) {
             continue;
+        }
         visibleRows.push(row);
     }
+    // No visible versions ⇒ answer exactly as a true miss. Emitting a
+    // 200 `versions: []` here would differ from the miss shape, and
+    // that difference is an existence oracle for private artifacts.
+    if (visibleRows.length === 0) {
+        return notFoundResult(input);
+    }
     // Step 4 — semver DESC sort. `compareSemver(a, b)` returns -1/0/1
     // matching ascending order; flip the sign for DESC.
     const sorted = [...visibleRows].sort((a, b) => -compareSemver(a.version, b.version));
@@ -55,6 +70,26 @@ function rowToEntry(row) {
         visibility: row.visibility,
     };
 }
+/**
+ * The one not-found projection — used for a true miss AND an artifact
+ * with no versions visible to the caller, so the two responses cannot
+ * drift apart (drift would reintroduce the existence signal).
+ */
+function notFoundResult(input) {
+    return errorResult(404, 'not_found', `no such artifact: ${input.artifactId}`);
+}
+/**
+ * Structured server-side failure log. Raw storage error text stays
+ * OUT of wire bodies (it can carry backend identifiers a caller has
+ * no business seeing); this log line is the operator's copy.
+ */
+function logStorageFailure(operation, artifactId, err) {
+    // eslint-disable-next-line no-console -- server-side operator signal; the wire stays generic
+    console.error(`registry list-versions: failed to ${operation}`, {
+        artifactId,
+        error: err instanceof Error ? err.message : String(err),
+    });
+}
 function errorResult(status, error, message) {
     return { ok: false, status, body: { error, message } };
 }

package/dist/ops/private-read-authz.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The single ownership rule for private-row reads.
+ *
+ * A `visibility: 'private'` row is readable when the verified caller
+ * is the row's publisher (`authn.subject === row.publishedBy`) OR the
+ * owner of the artifact's scope (`authn.subject === ScopeOwnerRow.
+ * ownerSubject`). Everyone else — including anonymous callers — MUST
+ * receive a response indistinguishable from "no such artifact" so a
+ * probe can never confirm a private artifact exists.
+ *
+ * Every read-path consumer (the read op, the list-versions op, any
+ * transport route that serves private artifact content — bundle and
+ * signature byte routes included) MUST authorize through this one
+ * predicate. A second hand-rolled comparison is how the rule forks;
+ * import this instead. Note the byte-route obligation explicitly:
+ * metadata gating alone is insufficient while bundle URLs serve
+ * private bytes anonymously — a deployment MUST place its private
+ * bundle storage behind a route that applies this same predicate
+ * (the hosted deployment's public/private storage-prefix split does
+ * exactly that).
+ *
+ * ## Protocol & Contract Bar
+ *
+ * **Parties:** read-path ops and transport routes are the callers;
+ * the deployment's {@link RegistryStorage.getScopeOwner} backs the
+ * lazy scope-owner lookup.
+ *
+ * **Obligations:** callers MUST pass the verified caller context (or
+ * `undefined` for anonymous) — never a caller-supplied subject. The
+ * `getScopeOwner` thunk MUST resolve the ownership row for the
+ * artifact's scope (see {@link artifactScope}); it is invoked at most
+ * once, and ONLY when the caller is authenticated and not the
+ * publisher — the hot public path and the publisher fast path incur
+ * zero extra storage reads. Callers SHOULD build the thunk via
+ * {@link createScopeOwnerResolver}, which adds memoization and the
+ * fail-closed error posture.
+ *
+ * **Failure mode:** {@link createScopeOwnerResolver} resolves a
+ * storage failure to `null` (unclaimed) — the owner arm DENIES, the
+ * caller answers with its ordinary miss shape, and the fault is
+ * logged server-side. Failing open would serve the private row;
+ * failing loud (a 5xx only private rows can trigger) would leak
+ * existence. A hand-built thunk that rejects propagates to the
+ * caller instead — prefer the resolver.
+ *
+ * **Observable violation:** a private row served to a subject that is
+ * neither its `publishedBy` nor its scope's `ownerSubject` — pinned
+ * by the op suites (`read.test.ts`, `list-versions.test.ts`) and the
+ * server parity suite.
+ */
+import type { AuthnContext } from '../interfaces/authn.js';
+import type { RegistryStorage } from '../interfaces/registry-storage.js';
+import type { ArtifactVersionRow, ScopeOwnerRow } from '../types.js';
+/**
+ * Decide whether `authn` may read a private row.
+ *
+ * @param authn verified caller context; `undefined` for anonymous.
+ * @param row the private row under decision (only `publishedBy` is
+ *   consulted — pass the full row or a narrowed projection).
+ * @param getScopeOwner lazy scope-owner lookup for the artifact's
+ *   scope. Called at most once, only when the publisher fast path
+ *   misses. Build it with {@link createScopeOwnerResolver} for
+ *   memoization + fail-closed semantics.
+ */
+export declare function canReadPrivateArtifact(authn: AuthnContext | undefined, row: Pick<ArtifactVersionRow, 'publishedBy'>, getScopeOwner: () => Promise<ScopeOwnerRow | null>): Promise<boolean>;
+/**
+ * Build the memoized, fail-closed `getScopeOwner` thunk for
+ * {@link canReadPrivateArtifact}.
+ *
+ *   - **Lazy** — no storage read happens until the owner arm is
+ *     actually needed (public rows, anonymous callers, and publisher
+ *     matches never trigger one).
+ *   - **Memoized** — a caller checking many rows of one artifact
+ *     (the list op) pays for at most one lookup.
+ *   - **Fail-closed** — a storage failure resolves to `null`
+ *     (unclaimed ⇒ deny) and is logged server-side with structure;
+ *     the raw error never reaches a wire body. See the failure-mode
+ *     section above for why neither fail-open nor fail-loud is
+ *     acceptable here.
+ */
+export declare function createScopeOwnerResolver(storage: Pick<RegistryStorage, 'getScopeOwner'>, artifactId: string): () => Promise<ScopeOwnerRow | null>;
+/**
+ * Extract the scope segment (leading `@` included) from a canonical
+ * `<@scope>/<name>` artifactId — the key for
+ * {@link RegistryStorage.getScopeOwner}.
+ */
+export declare function artifactScope(artifactId: string): string;
+//# sourceMappingURL=private-read-authz.d.ts.map

package/dist/ops/private-read-authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-read-authz.d.ts","sourceRoot":"","sources":["../../src/ops/private-read-authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,EAC5C,aAAa,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,GACjD,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAC/C,UAAU,EAAE,MAAM,GACjB,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAiBrC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/ops/private-read-authz.js

@@ -0,0 +1,58 @@
+/**
+ * Decide whether `authn` may read a private row.
+ *
+ * @param authn verified caller context; `undefined` for anonymous.
+ * @param row the private row under decision (only `publishedBy` is
+ *   consulted — pass the full row or a narrowed projection).
+ * @param getScopeOwner lazy scope-owner lookup for the artifact's
+ *   scope. Called at most once, only when the publisher fast path
+ *   misses. Build it with {@link createScopeOwnerResolver} for
+ *   memoization + fail-closed semantics.
+ */
+export async function canReadPrivateArtifact(authn, row, getScopeOwner) {
+    if (authn === undefined)
+        return false;
+    if (authn.subject === row.publishedBy)
+        return true;
+    const owner = await getScopeOwner();
+    return owner !== null && owner.ownerSubject === authn.subject;
+}
+/**
+ * Build the memoized, fail-closed `getScopeOwner` thunk for
+ * {@link canReadPrivateArtifact}.
+ *
+ *   - **Lazy** — no storage read happens until the owner arm is
+ *     actually needed (public rows, anonymous callers, and publisher
+ *     matches never trigger one).
+ *   - **Memoized** — a caller checking many rows of one artifact
+ *     (the list op) pays for at most one lookup.
+ *   - **Fail-closed** — a storage failure resolves to `null`
+ *     (unclaimed ⇒ deny) and is logged server-side with structure;
+ *     the raw error never reaches a wire body. See the failure-mode
+ *     section above for why neither fail-open nor fail-loud is
+ *     acceptable here.
+ */
+export function createScopeOwnerResolver(storage, artifactId) {
+    let lookup;
+    return () => {
+        lookup ??= storage.getScopeOwner(artifactScope(artifactId)).catch((err) => {
+            // eslint-disable-next-line no-console -- server-side operator signal; the wire stays opaque
+            console.error('registry: scope-owner lookup failed; treating scope as unclaimed (fail closed)', {
+                artifactId,
+                scope: artifactScope(artifactId),
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return null;
+        });
+        return lookup;
+    };
+}
+/**
+ * Extract the scope segment (leading `@` included) from a canonical
+ * `<@scope>/<name>` artifactId — the key for
+ * {@link RegistryStorage.getScopeOwner}.
+ */
+export function artifactScope(artifactId) {
+    const slash = artifactId.indexOf('/');
+    return slash === -1 ? artifactId : artifactId.slice(0, slash);
+}

package/dist/ops/publish.d.ts

@@ -1,4 +1,4 @@
-import { type GadgetSignature } from '@ggui-ai/gadget-signing';
+import { type GadgetSignature, type VerifyBundleSigstoreInput } from '@ggui-ai/gadget-signing';
 import type { PublishErrorBody, PublishResponseBody } from '../types.js';
 import type { BlueprintProbeRunner } from './conformance.js';
 import type { AuthnContext } from '../interfaces/authn.js';
@@ -12,6 +12,22 @@ import type { RegistryStorage } from '../interfaces/registry-storage.js';
  * against an OSS-mirrored registry without re-bundling).
  */
 export declare const MAX_BUNDLE_BYTES: number;
+/**
+ * Scopes no publish may CLAIM — well-known names whose squatting would
+ * mislead installers about who authored an artifact. The default
+ * covers first-party names plus obvious squat-bait; a deployment
+ * REPLACES the whole list via
+ * {@link PublishArtifactDeps.reservedScopes} (spread this constant to
+ * extend it instead).
+ *
+ * Reserved scopes block first-publish CLAIMS only — not owned
+ * publishes. A registry operator who wants artifacts under a reserved
+ * name seeds its ownership row out-of-band via
+ * {@link RegistryStorage.updateScopeOwner}; once the row exists, the
+ * normal owner rule applies (the seeded owner publishes, everyone else
+ * gets `scope_forbidden`) with no change to this list.
+ */
+export declare const RESERVED_SCOPES: readonly string[];
 export interface PublishArtifactInput {
     /** Unvalidated request body — the op parses + validates. */
     readonly manifest: unknown;
@@ -44,6 +60,13 @@ export interface PublishArtifactDeps {
      * `http://` for `localhost`/`127.0.0.1`.
      */
     readonly registryHostname: string;
+    /**
+     * Scopes no publish may claim — REPLACES {@link RESERVED_SCOPES}
+     * when set (spread the constant to extend instead:
+     * `[...RESERVED_SCOPES, '@my-brand']`). Exact-match against
+     * `manifest.scope`, leading `@` included.
+     */
+    readonly reservedScopes?: readonly string[];
     /**
      * Optional runtime probe for blueprint manifests. Static gates
      * always run; the probe additionally compiles + renders the
@@ -56,7 +79,51 @@ export interface PublishArtifactDeps {
      * HTTP endpoint that should not pay for react-dom.
      */
     readonly blueprintProbe?: BlueprintProbeRunner;
+    /**
+     * Optional TUF trust-root tuning forwarded verbatim to
+     * sigstore-cosign signature verification (see
+     * {@link VerifyBundleSigstoreInput}). `tufCachePath` points the
+     * verifier's trust-root cache at a writable directory — serverless
+     * runtimes typically only allow writes under `/tmp`.
+     * `tufForceCache` reuses valid cached TUF metadata without a remote
+     * refresh. `tufMirrorURL` + `tufRootPath` select an alternative TUF
+     * repository (private sigstore deployments; hermetic tests) — the
+     * trust root is THE knob that decides which signing infrastructure
+     * this registry's verifier trusts. Ed25519 verification never
+     * consults any of these.
+     */
+    readonly sigstoreTuf?: Pick<VerifyBundleSigstoreInput, 'tufCachePath' | 'tufForceCache' | 'tufMirrorURL' | 'tufRootPath'>;
+    /**
+     * F4 identity binding — resolve the VERIFIED email address of the
+     * publishing account identified by `subject` (the same value as
+     * {@link AuthnContext.subject}). Return `undefined` when the account
+     * has no verified email; the resolver MUST NOT return an address the
+     * deployment's identity layer has not verified, because the publish
+     * gate authorizes signer identities against it.
+     *
+     * Consumed only on sigstore-signed publishes into a scope whose
+     * ownership row carries NO `sanAllowlist`: the bundle's certificate
+     * SAN must then equal the resolved email (compared
+     * case-insensitively). Scopes WITH an allowlist never consult the
+     * resolver — the allowlist is the stricter, operator-managed rule.
+     *
+     * OPTIONAL, and honestly so: a deployment that does not wire a
+     * resolver enforces publisher identity ONLY through per-scope
+     * allowlists ({@link ScopeOwnerRow.sanAllowlist}); scopes without
+     * one accept any identity a valid sigstore bundle proves. Wire a
+     * resolver backed by your identity provider to bind default
+     * publishes to account emails.
+     */
+    readonly verifiedEmailResolver?: VerifiedEmailResolver;
 }
+/**
+ * Deployment-provided lookup from an authenticated caller subject to
+ * that account's VERIFIED email address. See
+ * {@link PublishArtifactDeps.verifiedEmailResolver} for the contract
+ * (parties, obligations, and the fail-closed posture the publish gate
+ * layers on top).
+ */
+export type VerifiedEmailResolver = (subject: string) => Promise<string | undefined>;
 export type PublishArtifactResult = {
     readonly ok: true;
     readonly status: 201;

package/dist/ops/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/ops/publish.ts"],"names":[],"mappings":"AA2BA,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAIV,gBAAgB,EAEhB,mBAAmB,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAMzE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CAChD;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAuXhC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../src/ops/publish.ts"],"names":[],"mappings":"AAwDA,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAIV,gBAAgB,EAEhB,mBAAmB,EAEpB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAMzE;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAkB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAc5C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CACzB,yBAAyB,EACzB,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,aAAa,CAClE,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAEjC,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEN,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAupBhC"}