@ggui-ai/registry-core 0.7.0 → 0.8.0

package/dist/ops/search.js

@@ -1,4 +1,6 @@
 import { SEARCH_SORT_OPTIONS } from '../types.js';
+import { artifactScope } from './private-read-authz.js';
+import { MCP_TOOL_BINDING_NAME_RE } from '@ggui-ai/artifact-manifest';
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 200;
 export async function searchArtifacts(input, deps) {
@@ -45,12 +47,36 @@ export async function searchArtifacts(input, deps) {
         }
         sort = input.sort;
     }
+    const tool = nonEmpty(input.tool);
+    if (tool !== undefined && !MCP_TOOL_BINDING_NAME_RE.test(tool)) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'invalid_request',
+                message: '`tool` must match ^[A-Za-z0-9_.-]{1,128}$',
+            },
+        };
+    }
+    const server = nonEmpty(input.server);
+    if (server !== undefined && !MCP_TOOL_BINDING_NAME_RE.test(server)) {
+        return {
+            ok: false,
+            status: 400,
+            body: {
+                error: 'invalid_request',
+                message: '`server` must match ^[A-Za-z0-9_.-]{1,128}$',
+            },
+        };
+    }
     const filter = {
         q: nonEmpty(input.q),
         kind,
         hook: nonEmpty(input.hook),
         tag: nonEmpty(input.tag),
         author: nonEmpty(input.author),
+        tool,
+        server,
         limit,
         cursor: nonEmpty(input.cursor),
         order: sort,
@@ -72,11 +98,16 @@ export async function searchArtifacts(input, deps) {
             continue;
         visibleRows.push(row);
     }
+    // Scope-verification surfacing — ONE owner read per unique scope on
+    // the page, batched. A failed or empty read leaves the fields ABSENT
+    // (state unknown is not 'unverified'): the wire only carries a label
+    // the ownership row actually asserted.
+    const ownersByScope = await readScopeOwners(deps.storage, visibleRows);
     // `sort=recent` ordering is served by the storage layer (the filter
     // carries `order: 'recent'`); rows arrive newest-first and are
     // emitted verbatim — no re-sort here, so page order and cursor order
     // cannot diverge.
-    const results = visibleRows.map(rowToEntry);
+    const results = visibleRows.map((row) => rowToEntry(row, ownersByScope.get(artifactScope(row.artifactId)) ?? null));
     return {
         ok: true,
         status: 200,
@@ -86,7 +117,24 @@ export async function searchArtifacts(input, deps) {
 function isSearchSort(value) {
     return SEARCH_SORT_OPTIONS.includes(value);
 }
-function rowToEntry(row) {
+async function readScopeOwners(storage, rows) {
+    const scopes = [...new Set(rows.map((row) => artifactScope(row.artifactId)))];
+    const entries = await Promise.all(scopes.map(async (scope) => {
+        try {
+            return [scope, await storage.getScopeOwner(scope)];
+        }
+        catch (err) {
+            // eslint-disable-next-line no-console -- server-side operator signal; the wire simply omits the fields
+            console.error('registry search: scope-owner lookup failed; omitting verification fields', {
+                scope,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return [scope, null];
+        }
+    }));
+    return new Map(entries);
+}
+function rowToEntry(row, scopeOwner) {
     return {
         artifactId: row.artifactId,
         latestVersion: row.latestVersion,
@@ -94,6 +142,10 @@ function rowToEntry(row) {
         description: row.description,
         tags: row.tags,
         publishedAt: row.publishedAt,
+        mcpTools: row.mcpTools,
+        mcpToolsSource: row.mcpToolsSource,
+        scopeVerification: scopeOwner?.verification,
+        verifiedDomain: scopeOwner?.verification === 'verified' ? scopeOwner.verifiedDomain : undefined,
     };
 }
 function nonEmpty(s) {

package/dist/testing/bundle-storage-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/bundle-storage-contract.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AA0DrE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,aAAa,GAAG,IAAI,CA6H5E"}
+{"version":3,"file":"bundle-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/bundle-storage-contract.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AA0DrE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,aAAa,GAAG,IAAI,CA8K5E"}

package/dist/testing/bundle-storage-contract.js

@@ -69,35 +69,69 @@ export function bundleStorageContract(makeStorage) {
         describe('bundle', () => {
             it('returns null on miss', async () => {
                 const s = makeStorage();
-                expect(await s.getBundle('@test', 'foo', '0.1.0')).toBe(null);
+                expect(await s.getBundle('@test', 'foo', '0.1.0', 'public')).toBe(null);
             });
             it('round-trips bundle bytes', async () => {
                 const s = makeStorage();
                 const bytes = new Uint8Array([0xff, 0x00, 0x10, 0x20]);
-                await s.putBundle('@test', 'foo', '0.1.0', bytes);
-                const fetched = await s.getBundle('@test', 'foo', '0.1.0');
+                await s.putBundle('@test', 'foo', '0.1.0', 'public', bytes);
+                const fetched = await s.getBundle('@test', 'foo', '0.1.0', 'public');
                 expect(fetched).toEqual(bytes);
             });
             it('isolates bundles by (scope, name, version)', async () => {
                 const s = makeStorage();
-                await s.putBundle('@a', 'pkg', '0.1.0', new Uint8Array([1]));
-                await s.putBundle('@a', 'pkg', '0.2.0', new Uint8Array([2]));
-                await s.putBundle('@b', 'pkg', '0.1.0', new Uint8Array([3]));
-                expect((await s.getBundle('@a', 'pkg', '0.1.0'))?.[0]).toBe(1);
-                expect((await s.getBundle('@a', 'pkg', '0.2.0'))?.[0]).toBe(2);
-                expect((await s.getBundle('@b', 'pkg', '0.1.0'))?.[0]).toBe(3);
+                await s.putBundle('@a', 'pkg', '0.1.0', 'public', new Uint8Array([1]));
+                await s.putBundle('@a', 'pkg', '0.2.0', 'public', new Uint8Array([2]));
+                await s.putBundle('@b', 'pkg', '0.1.0', 'public', new Uint8Array([3]));
+                expect((await s.getBundle('@a', 'pkg', '0.1.0', 'public'))?.[0]).toBe(1);
+                expect((await s.getBundle('@a', 'pkg', '0.2.0', 'public'))?.[0]).toBe(2);
+                expect((await s.getBundle('@b', 'pkg', '0.1.0', 'public'))?.[0]).toBe(3);
+            });
+        });
+        describe('visibility key split (H1)', () => {
+            it('a private-written bundle is invisible to a public read of the same triple', async () => {
+                const s = makeStorage();
+                await s.putBundle('@acme', 'secret', '1.0.0', 'private', new Uint8Array([7]));
+                expect(await s.getBundle('@acme', 'secret', '1.0.0', 'public')).toBe(null);
+                expect((await s.getBundle('@acme', 'secret', '1.0.0', 'private'))?.[0]).toBe(7);
+            });
+            it('a public-written bundle is invisible to a private read of the same triple', async () => {
+                const s = makeStorage();
+                await s.putBundle('@acme', 'open', '1.0.0', 'public', new Uint8Array([9]));
+                expect(await s.getBundle('@acme', 'open', '1.0.0', 'private')).toBe(null);
+                expect((await s.getBundle('@acme', 'open', '1.0.0', 'public'))?.[0]).toBe(9);
+            });
+            it('splits signatures and manifests by visibility too', async () => {
+                const s = makeStorage();
+                await s.putSignature('@acme', 'secret', '1.0.0', 'private', stubSignature());
+                await s.putManifest('@acme', 'secret', '1.0.0', 'private', stubManifest());
+                expect(await s.getSignature('@acme', 'secret', '1.0.0', 'public')).toBe(null);
+                expect(await s.getManifest('@acme', 'secret', '1.0.0', 'public')).toBe(null);
+                expect(await s.getSignature('@acme', 'secret', '1.0.0', 'private')).not.toBe(null);
+                expect(await s.getManifest('@acme', 'secret', '1.0.0', 'private')).not.toBe(null);
+            });
+            it('embeds the visibility segment in every composed URL', () => {
+                const s = makeStorage();
+                for (const compose of [
+                    s.bundleUrl.bind(s),
+                    s.signatureUrl.bind(s),
+                    s.manifestUrl.bind(s),
+                ]) {
+                    expect(compose('@test', 'foo', '0.1.0', 'public')).toContain('/bundles/public/');
+                    expect(compose('@test', 'foo', '0.1.0', 'private')).toContain('/bundles/private/');
+                }
             });
         });
         describe('signature', () => {
             it('returns null on miss', async () => {
                 const s = makeStorage();
-                expect(await s.getSignature('@test', 'foo', '0.1.0')).toBe(null);
+                expect(await s.getSignature('@test', 'foo', '0.1.0', 'public')).toBe(null);
             });
             it('round-trips an Ed25519 signature envelope', async () => {
                 const s = makeStorage();
                 const sig = stubSignature();
-                await s.putSignature('@test', 'foo', '0.1.0', sig);
-                const fetched = await s.getSignature('@test', 'foo', '0.1.0');
+                await s.putSignature('@test', 'foo', '0.1.0', 'private', sig);
+                const fetched = await s.getSignature('@test', 'foo', '0.1.0', 'private');
                 expect(fetched).toEqual(sig);
             });
             // Pin the sigstore round-trip through the storage layer. Guards
@@ -110,8 +144,8 @@ export function bundleStorageContract(makeStorage) {
             it('round-trips a sigstore signature envelope including the embedded cosign bundle', async () => {
                 const s = makeStorage();
                 const sig = stubSigstoreSignature();
-                await s.putSignature('@test', 'foo', '0.1.0', sig);
-                const fetched = await s.getSignature('@test', 'foo', '0.1.0');
+                await s.putSignature('@test', 'foo', '0.1.0', 'public', sig);
+                const fetched = await s.getSignature('@test', 'foo', '0.1.0', 'public');
                 expect(fetched).toEqual(sig);
                 // Specifically pin the `algorithm` discriminator + the
                 // `bundle` field — these are sigstore-only fields the prior
@@ -135,41 +169,41 @@ export function bundleStorageContract(makeStorage) {
                 // case is covered by the round-trip tests; this test pins the
                 // null-on-miss contract specifically — without it, a regression
                 // that silently returns a stub object would slip through.
-                const fetched = await s.getSignature('@no-such-scope', 'no-such-name', '0.0.0');
+                const fetched = await s.getSignature('@no-such-scope', 'no-such-name', '0.0.0', 'public');
                 expect(fetched).toBe(null);
             });
         });
         describe('manifest', () => {
             it('returns null on miss', async () => {
                 const s = makeStorage();
-                expect(await s.getManifest('@test', 'foo', '0.1.0')).toBe(null);
+                expect(await s.getManifest('@test', 'foo', '0.1.0', 'public')).toBe(null);
             });
             it('round-trips the manifest', async () => {
                 const s = makeStorage();
                 const m = stubManifest();
-                await s.putManifest('@test', 'foo', '0.1.0', m);
-                const fetched = await s.getManifest('@test', 'foo', '0.1.0');
+                await s.putManifest('@test', 'foo', '0.1.0', 'public', m);
+                const fetched = await s.getManifest('@test', 'foo', '0.1.0', 'public');
                 expect(fetched).toEqual(m);
             });
         });
         describe('URL composition', () => {
             it('produces distinct URLs for bundle / sig / manifest', async () => {
                 const s = makeStorage();
-                const b = s.bundleUrl('@test', 'foo', '0.1.0');
-                const sig = s.signatureUrl('@test', 'foo', '0.1.0');
-                const man = s.manifestUrl('@test', 'foo', '0.1.0');
+                const b = s.bundleUrl('@test', 'foo', '0.1.0', 'public');
+                const sig = s.signatureUrl('@test', 'foo', '0.1.0', 'public');
+                const man = s.manifestUrl('@test', 'foo', '0.1.0', 'public');
                 expect(b).not.toBe(sig);
                 expect(b).not.toBe(man);
                 expect(sig).not.toBe(man);
             });
             it('matches the URL returned from put*', async () => {
                 const s = makeStorage();
-                const putBundleUrl = await s.putBundle('@test', 'foo', '0.1.0', new Uint8Array([1]));
-                expect(putBundleUrl).toBe(s.bundleUrl('@test', 'foo', '0.1.0'));
-                const putSigUrl = await s.putSignature('@test', 'foo', '0.1.0', stubSignature());
-                expect(putSigUrl).toBe(s.signatureUrl('@test', 'foo', '0.1.0'));
-                const putManUrl = await s.putManifest('@test', 'foo', '0.1.0', stubManifest());
-                expect(putManUrl).toBe(s.manifestUrl('@test', 'foo', '0.1.0'));
+                const putBundleUrl = await s.putBundle('@test', 'foo', '0.1.0', 'private', new Uint8Array([1]));
+                expect(putBundleUrl).toBe(s.bundleUrl('@test', 'foo', '0.1.0', 'private'));
+                const putSigUrl = await s.putSignature('@test', 'foo', '0.1.0', 'private', stubSignature());
+                expect(putSigUrl).toBe(s.signatureUrl('@test', 'foo', '0.1.0', 'private'));
+                const putManUrl = await s.putManifest('@test', 'foo', '0.1.0', 'private', stubManifest());
+                expect(putManUrl).toBe(s.manifestUrl('@test', 'foo', '0.1.0', 'private'));
             });
         });
     });

package/dist/testing/registry-storage-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/registry-storage-contract.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAqI3C,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAkqBhF"}
+{"version":3,"file":"registry-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/registry-storage-contract.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAqI3C,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAgzBhF"}

package/dist/testing/registry-storage-contract.js

@@ -17,7 +17,7 @@
  */
 import { describe, expect, it } from 'vitest';
 import { AuthorKeyAlreadyExistsError, } from '../interfaces/registry-storage.js';
-import { ARTIFACTS_METADATA_SK } from '../types.js';
+import { ARTIFACTS_METADATA_SK, SAN_ALLOWLIST_INVALID } from '../types.js';
 function makeMetadata(overrides = {}) {
     return {
         artifactId: '@test/foo',
@@ -265,6 +265,68 @@ export function registryStorageContract(makeStorage) {
                 const byTag = await storage.scanArtifacts({ q: 'geo' });
                 expect(byTag.rows.map((r) => r.artifactId)).toEqual(['@a/leaflet']);
             });
+            // #259 delta-2 — MCP tool-binding filters share `matchesMcpToolFilters`
+            // semantics with the search op; every impl must honor them identically
+            // (the byMcpTool GSI path in the DDB adapter is the load-bearing case).
+            it('filters by tool (matches any entry with that tool name, with or without a server)', async () => {
+                const storage = makeStorage();
+                await storage.putArtifactMetadata(makeMetadata({
+                    artifactId: '@a/stripe-ui',
+                    mcpTools: [{ server: 'stripe-mcp', tool: 'create_payment' }],
+                    mcpToolsSource: 'declared',
+                }));
+                await storage.putArtifactMetadata(makeMetadata({
+                    artifactId: '@a/bare-ui',
+                    mcpTools: [{ tool: 'refund_payment' }],
+                    mcpToolsSource: 'derived',
+                }));
+                await storage.putArtifactMetadata(makeMetadata({ artifactId: '@a/unbound', mcpTools: undefined }));
+                const byServerBound = await storage.scanArtifacts({ tool: 'create_payment' });
+                expect(byServerBound.rows.map((r) => r.artifactId)).toEqual(['@a/stripe-ui']);
+                const byBare = await storage.scanArtifacts({ tool: 'refund_payment' });
+                expect(byBare.rows.map((r) => r.artifactId)).toEqual(['@a/bare-ui']);
+                const byMiss = await storage.scanArtifacts({ tool: 'unknown_tool' });
+                expect(byMiss.rows).toEqual([]);
+            });
+            it('filters by server; bare-tool entries never match', async () => {
+                const storage = makeStorage();
+                await storage.putArtifactMetadata(makeMetadata({
+                    artifactId: '@a/bound',
+                    mcpTools: [{ server: 'stripe-mcp', tool: 'create_payment' }],
+                    mcpToolsSource: 'declared',
+                }));
+                await storage.putArtifactMetadata(makeMetadata({
+                    artifactId: '@a/bare',
+                    mcpTools: [{ tool: 'create_payment' }],
+                    mcpToolsSource: 'derived',
+                }));
+                const page = await storage.scanArtifacts({ server: 'stripe-mcp' });
+                expect(page.rows.map((r) => r.artifactId)).toEqual(['@a/bound']);
+            });
+            it('tool + server composes into the exact-pair filter — cross-product is not enough', async () => {
+                const storage = makeStorage();
+                // A single artifact declaring TWO bindings — `stripe-mcp` and
+                // `refund_payment` each independently exist on this row, but
+                // never paired on the same binding entry.
+                await storage.putArtifactMetadata(makeMetadata({
+                    artifactId: '@a/multi-bound',
+                    mcpTools: [
+                        { server: 'stripe-mcp', tool: 'create_payment' },
+                        { server: 'other-mcp', tool: 'refund_payment' },
+                    ],
+                    mcpToolsSource: 'declared',
+                }));
+                const exactPair = await storage.scanArtifacts({
+                    server: 'stripe-mcp',
+                    tool: 'create_payment',
+                });
+                expect(exactPair.rows.map((r) => r.artifactId)).toEqual(['@a/multi-bound']);
+                const crossProduct = await storage.scanArtifacts({
+                    server: 'stripe-mcp',
+                    tool: 'refund_payment',
+                });
+                expect(crossProduct.rows).toEqual([]);
+            });
         });
         describe('plugin versions', () => {
             it('returns null for missing version', async () => {
@@ -582,6 +644,65 @@ export function registryStorageContract(makeStorage) {
                 await storage.claimScope(makeScopeOwner({ ownerSubject: 'winner' }));
                 expect((await storage.getScopeOwner('@test'))?.ownerSubject).toBe('winner');
             });
+            // F4 — `sanAllowlist` is the per-scope publisher-identity
+            // allowlist the publish gate enforces on sigstore-signed
+            // publishes. It's an OPTIONAL array column: a row without it
+            // falls back to the deployment's default identity rule, so a
+            // storage impl that silently drops (or fabricates) the field
+            // would flip a scope's identity policy without any write.
+            it('claimScope round-trips a sanAllowlist (F4 identity binding)', async () => {
+                const storage = makeStorage();
+                const row = makeScopeOwner({
+                    sanAllowlist: [
+                        'ci@test.example',
+                        'https://ci.example.com/workflows/publish.yml@refs/heads/main',
+                    ],
+                });
+                await storage.claimScope(row);
+                expect(await storage.getScopeOwner(row.scope)).toEqual(row);
+            });
+            it('updateScopeOwner sets a sanAllowlist on an existing row (operator path)', async () => {
+                const storage = makeStorage();
+                await storage.claimScope(makeScopeOwner());
+                const withAllowlist = makeScopeOwner({ sanAllowlist: ['ops@test.example'] });
+                const result = await storage.updateScopeOwner(withAllowlist, {
+                    ownerSubject: 'user-1',
+                    verification: 'unverified',
+                });
+                expect(result).toEqual({ ok: true });
+                expect(await storage.getScopeOwner('@test')).toEqual(withAllowlist);
+            });
+            it('the SAN_ALLOWLIST_INVALID marker round-trips as invalid — corruption never launders into a valid policy', async () => {
+                // Fail-closed obligation: an adapter that reads malformed
+                // allowlist data projects SAN_ALLOWLIST_INVALID (see
+                // ScopeOwnerRow.sanAllowlist). Writing the marker itself back
+                // (e.g. a verification flip preserving a corrupt column) MUST
+                // read back as invalid in every impl — the marker is a bare
+                // string, itself a malformed column value, so the round-trip
+                // cannot turn corruption into "no allowlist" or a real list.
+                const storage = makeStorage();
+                const row = makeScopeOwner({ sanAllowlist: SAN_ALLOWLIST_INVALID });
+                await storage.claimScope(row);
+                expect((await storage.getScopeOwner('@test'))?.sanAllowlist).toBe(SAN_ALLOWLIST_INVALID);
+            });
+            it('updateScopeOwner clears a sanAllowlist — the field is ABSENT after, not empty', async () => {
+                // Absent vs empty is load-bearing: the publish gate treats a
+                // missing allowlist as "no per-scope rule" (default identity
+                // rule applies). A cleared row that came back `[]` instead of
+                // absent would be indistinguishable in JS truthiness tests but
+                // MUST round-trip as absent so every impl agrees on the shape.
+                const storage = makeStorage();
+                await storage.claimScope(makeScopeOwner({ sanAllowlist: ['ops@test.example'] }));
+                const cleared = makeScopeOwner();
+                const result = await storage.updateScopeOwner(cleared, {
+                    ownerSubject: 'user-1',
+                    verification: 'unverified',
+                });
+                expect(result).toEqual({ ok: true });
+                const fetched = await storage.getScopeOwner('@test');
+                expect(fetched).toEqual(cleared);
+                expect(fetched?.sanAllowlist).toBeUndefined();
+            });
         });
         describe('author keys', () => {
             it('returns null on miss', async () => {

package/dist/types.d.ts

@@ -14,7 +14,7 @@
  * 'blueprint'` as the discriminator. The field name `artifactId`
  * matches what the field actually contains.
  */
-import type { ArtifactManifest } from '@ggui-ai/artifact-manifest';
+import type { ArtifactManifest, McpToolBinding, McpToolBindingSource } from '@ggui-ai/artifact-manifest';
 import type { GadgetSignature } from '@ggui-ai/gadget-signing';
 import type { ConformanceFailureCode } from './ops/conformance.js';
 /**
@@ -54,6 +54,15 @@ export interface ArtifactsMetadataRow {
     readonly tags?: readonly string[];
     readonly visibility: Visibility;
     readonly hook?: string;
+    /**
+     * Denormalized MCP tool bindings of the latest version — stamped at
+     * publish from the manifest's declared `mcpTools`, or derived from a
+     * blueprint contract's tool names, so registry search can filter by
+     * tool without reading version rows.
+     */
+    readonly mcpTools?: ReadonlyArray<McpToolBinding>;
+    /** How the denormalized bindings were produced: declared on the manifest, or derived from the contract. */
+    readonly mcpToolsSource?: McpToolBindingSource;
     readonly authorName?: string;
     readonly publishedAt: string;
     readonly publishedBy: string;
@@ -239,7 +248,55 @@ export interface ScopeOwnerRow {
     readonly verifiedDomain?: string;
     /** ISO timestamp of the verification, present when `verification: 'verified'`. */
     readonly verifiedAt?: string;
+    /**
+     * F4 identity binding — per-scope allowlist of sigstore certificate
+     * identities (the Fulcio cert's SubjectAlternativeName) permitted to
+     * publish under this scope. Entries are EXACT literal identity
+     * strings — an email (`release@acme.com`) or a CI workflow identity
+     * URI (`https://github.com/acme/app/.github/workflows/publish.yml@refs/heads/main`).
+     * Regex/glob patterns are deliberately NOT stored server-side: an
+     * allowlist is a finite set of named signers, and pattern semantics
+     * would make the authorization decision unauditable.
+     *
+     * Case rule: ONE rule for every identity comparison — the publish
+     * gate matches entries against certificate SANs CASE-INSENSITIVELY
+     * (mirroring the verified-email rule), and the operator tooling
+     * lowercase-normalizes entries at write time.
+     *
+     * Enforcement (publish gate, sigstore-signed publishes only): when
+     * present and non-empty, one of the bundle certificate's SANs MUST
+     * match one of these entries. When absent, the deployment's default
+     * identity rule applies — a SAN must equal the publishing account's
+     * verified email where the deployment provides a resolver;
+     * deployments without one enforce identity only through this
+     * allowlist.
+     *
+     * Fail-closed corruption handling: a storage adapter that finds a
+     * MALFORMED value in this column (anything but an array of strings)
+     * MUST project it as {@link SAN_ALLOWLIST_INVALID}, never as absent
+     * — projecting corrupt policy data as "no allowlist" would silently
+     * downgrade the scope to the weaker default rule. The publish gate
+     * rejects sigstore publishes into such a scope with a
+     * storage-inconsistency error until an operator rewrites the column
+     * (set or clear). Writers MUST only ever write string arrays.
+     *
+     * Managed by the registry operator (never by publish); a first-
+     * publish claim always lands without one, and an ownership transfer
+     * drops it (the previous owner's signer identities must not survive
+     * into the new owner's scope).
+     */
+    readonly sanAllowlist?: readonly string[] | SanAllowlistInvalid;
 }
+/**
+ * Fail-closed marker a storage adapter projects when the
+ * {@link ScopeOwnerRow.sanAllowlist} column holds malformed data (see
+ * that field's docstring). Chosen as a bare string precisely because a
+ * string is itself a malformed value for the column — the marker
+ * round-trips as invalid through every storage impl, so corruption can
+ * never launder itself back into a valid policy.
+ */
+export declare const SAN_ALLOWLIST_INVALID: "invalid";
+export type SanAllowlistInvalid = typeof SAN_ALLOWLIST_INVALID;
 /**
  * `GET /pkg/{scope}/{name}/{version}` body.
  *
@@ -266,6 +323,14 @@ export interface ReadPkgResponse {
     readonly authorPublicKey?: string;
     readonly publishedAt: string;
     readonly publishedBy: string;
+    /**
+     * Verification state of the package's scope. Present only when the
+     * scope-ownership row was read; ABSENT when the scope state is
+     * unknown — absence is not `'unverified'`.
+     */
+    readonly scopeVerification?: ScopeVerification;
+    /** Domain whose control was proven — present only when `scopeVerification: 'verified'`. */
+    readonly verifiedDomain?: string;
 }
 /**
  * One row of `GET /search?…` results — a lightweight per-artifactId
@@ -279,6 +344,19 @@ export interface SearchResultEntry {
     readonly description?: string;
     readonly tags?: readonly string[];
     readonly publishedAt: string;
+    /** MCP tool bindings of the latest version, when the artifact declares or derives any. */
+    readonly mcpTools?: ReadonlyArray<McpToolBinding>;
+    /** How the bindings were produced: declared on the manifest, or derived from a blueprint contract. */
+    readonly mcpToolsSource?: McpToolBindingSource;
+    /**
+     * Verification state of the artifact's scope. Present only when the
+     * scope-ownership row was read; ABSENT when the scope state is
+     * unknown (unclaimed scope or a failed lookup) — absence is not
+     * `'unverified'`.
+     */
+    readonly scopeVerification?: ScopeVerification;
+    /** Domain whose control was proven — present only when `scopeVerification: 'verified'`. */
+    readonly verifiedDomain?: string;
 }
 /**
  * `GET /search?…` body. `nextCursor` is opaque (impl-defined: a
@@ -290,8 +368,8 @@ export interface SearchResponse {
     readonly nextCursor?: string;
 }
 /**
- * `GET /search` sort options. Supports a registry-web "Recent" view
- * that needs `publishedAt`-DESC ordering.
+ * `GET /search` sort options. Supports registry browse UIs that need
+ * a "Recent" view with `publishedAt`-DESC ordering.
  *
  *   - `recent` — order by {@link ArtifactsMetadataRow.publishedAt} DESC.
  *
@@ -382,7 +460,7 @@ export interface PublishResponseBody {
  * propagates to both the wire and the runtime membership check used
  * by downstream guards.
  */
-export declare const PUBLISH_ERROR_CODES: readonly ["unauthorized", "manifest_invalid", "bundle_required", "bundle_too_large", "conformance_failed", "bundle_hash_mismatch", "visibility_algorithm_mismatch", "scope_forbidden", "unknown_key", "signature_invalid", "version_exists", "internal"];
+export declare const PUBLISH_ERROR_CODES: readonly ["unauthorized", "manifest_invalid", "bundle_required", "bundle_too_large", "conformance_failed", "bundle_hash_mismatch", "visibility_algorithm_mismatch", "scope_forbidden", "identity_mismatch", "unknown_key", "signature_invalid", "version_exists", "internal"];
 export type PublishErrorCode = (typeof PUBLISH_ERROR_CODES)[number];
 /**
  * Closed enum for `GET /pkg/:scope/:name[/version]` read responses.
@@ -390,16 +468,21 @@ export type PublishErrorCode = (typeof PUBLISH_ERROR_CODES)[number];
  * `yanked` is the 410-Gone path — the version exists in metadata but
  * the publisher revoked it. Clients SHOULD treat this as a hard
  * failure (don't fall back to a different version automatically).
+ *
+ * There is deliberately NO `forbidden` code: an unauthorized read of
+ * a private row answers with the SAME `not_found` shape as a true
+ * miss, so the wire never confirms a private artifact exists.
  */
-export declare const READ_ERROR_CODES: readonly ["not_found", "forbidden", "invalid_request", "yanked", "server_error"];
+export declare const READ_ERROR_CODES: readonly ["not_found", "invalid_request", "yanked", "server_error"];
 export type ReadErrorCode = (typeof READ_ERROR_CODES)[number];
 /**
- * Closed enum for `GET /search` responses. Same posture as
- * {@link ReadErrorCode} minus the `yanked` path (search filters
- * yanked rows out of the result set; it never surfaces as a top-level
- * error).
+ * Closed enum for `GET /search` responses. Search serves only public
+ * metadata rows and takes no caller identity, so the surface has no
+ * authorization failure at all — just request validation and adapter
+ * faults. (`yanked` likewise never surfaces: search filters yanked
+ * rows out of the result set.)
  */
-export declare const SEARCH_ERROR_CODES: readonly ["forbidden", "invalid_request", "server_error"];
+export declare const SEARCH_ERROR_CODES: readonly ["invalid_request", "server_error"];
 export type SearchErrorCode = (typeof SEARCH_ERROR_CODES)[number];
 /**
  * Closed enum for `POST /author-keys` register responses. An operator
@@ -595,6 +678,19 @@ export interface ArtifactScanFilter {
     readonly hook?: string;
     readonly tag?: string;
     readonly author?: string;
+    /**
+     * Exact MCP tool-name filter. Matches rows whose binding list has an
+     * entry with this tool name — with or without a server. Case-sensitive.
+     * Shared semantics: `matchesMcpToolFilters` in this package.
+     */
+    readonly tool?: string;
+    /**
+     * Exact MCP server-name filter. Matches rows whose binding list has an
+     * entry declaring this server; bare (server-less) entries never match.
+     * Combined with `tool`, requires a single entry carrying exactly that
+     * (server, tool) pair. Case-sensitive.
+     */
+    readonly server?: string;
     readonly limit?: number;
     readonly cursor?: string;
     /**
@@ -611,12 +707,15 @@ export interface ArtifactScanFilter {
  * Closed enum for `GET /pkg/{scope}/{name}` list-versions responses.
  *
  *   - `invalid_request` — missing or malformed `artifactId`.
- *   - `not_found`       — no metadata row for `artifactId`. Distinct
- *                         from "metadata present but every version is
- *                         private + caller unauthed" (that path returns
- *                         200 with `versions: []` — exposing 404 vs
- *                         empty would leak private-row existence).
- *   - `server_error`    — unexpected adapter failure.
+ *   - `not_found`       — no metadata row for `artifactId`, OR no
+ *                         version of it is visible to the caller.
+ *                         The two are DELIBERATELY indistinguishable:
+ *                         any difference between "does not exist" and
+ *                         "exists but you may not see it" is an
+ *                         existence oracle for private artifacts.
+ *   - `server_error`    — unexpected adapter failure. The message is
+ *                         generic by contract — raw storage error text
+ *                         never reaches the wire.
  */
 export declare const LIST_VERSIONS_ERROR_CODES: readonly ["invalid_request", "not_found", "server_error"];
 export type ListVersionsErrorCode = (typeof LIST_VERSIONS_ERROR_CODES)[number];