@ggui-ai/registry-server 0.6.3 → 0.8.0

package/README.md

@@ -42,7 +42,7 @@ ggui gadget publish --auth=bearer --token=$GGUI_REGISTRY_TOKEN \
 | GET    | `/bundles/:scope/:name/:version/bundle.js.sig` | none   | Serve the signature envelope (immutable cache)             |
 | GET    | `/bundles/:scope/:name/:version/manifest.json` | none   | Serve the manifest verbatim (immutable cache)              |
 
-\* Reads of `visibility: 'private'` rows require bearer; unauthenticated callers see only public rows.
+\* Reads of `visibility: 'private'` rows are ownership-gated: a private version is served only to the verified caller who published it or who owns the artifact's scope. Every other caller — unauthenticated included — receives the same `not_found` response as a genuinely missing artifact, and the version list filters unreadable versions (answering `not_found` when none are visible), so responses never reveal that a private artifact exists.
 
 ## Storage modes
 
@@ -60,7 +60,7 @@ This server is **MVP-scoped** for self-hosters who want the marketplace surface
 - Rate limiting (use a reverse proxy)
 - TLS termination (use a reverse proxy)
 - Backup automation (the filesystem mode is single-machine)
-- Per-org private artifact scoping (treat `visibility: 'private'` as a label, not enforcement)
+- Per-org private artifact scoping (enforcement is per-subject — publisher or scope owner; org-membership admission is not implemented)
 - Sigstore transparency log integration
 
 If you need any of the above, build your own transport on top of [`@ggui-ai/registry-core`](https://github.com/ggui-ai/ggui/tree/main/packages/registry-core).

package/dist/authn/bearer.js

@@ -37,7 +37,7 @@
  *   emits 401 with `{ error: 'unauthorized', message: ... }`.
  *
  * **Observable violation:**
- * - The integration test in `server.test.ts` exercises three negative
+ * - The integration test in `server.integration.test.ts` exercises three negative
  *   paths (no header, wrong scheme, bad token) and asserts identical
  *   401 responses. Any divergence — a different status, a leaked
  *   token hint in the body — is a contract violation.

package/dist/filesystem-bundle-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-bundle-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-bundle-storage.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,WAAW,8BAA8B;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,aAAa,CA+Ef"}
+{"version":3,"file":"filesystem-bundle-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-bundle-storage.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAExE,MAAM,WAAW,8BAA8B;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,aAAa,CA0Ff"}

package/dist/filesystem-bundle-storage.js

@@ -1,17 +1,20 @@
 /**
  * Filesystem-backed {@link BundleStorage} for the OSS registry server.
  *
- * Blob layout:
+ * Blob layout (H1 visibility split — placement is the access-control
+ * boundary):
  *
- *   <root>/bundles/<scope>/<name>/<version>/bundle.js
- *   <root>/bundles/<scope>/<name>/<version>/bundle.js.sig
- *   <root>/bundles/<scope>/<name>/<version>/manifest.json
+ *   <root>/bundles/public/<scope>/<name>/<version>/bundle.js
+ *   <root>/bundles/public/<scope>/<name>/<version>/bundle.js.sig
+ *   <root>/bundles/public/<scope>/<name>/<version>/manifest.json
+ *   <root>/bundles/private/<scope>/<name>/<version>/{...}
  *
  * Scope is written verbatim (`@my-org/...`) because the leading `@`
  * is filename-safe on every supported OS. The URL composition mirrors
- * the same path so the public URL the install CLI follows resolves
- * directly against the file (the hono server's `/bundles/*` route
- * streams the file).
+ * the same path so the URL the install CLI follows resolves directly
+ * against the file: the hono server serves `/bundles/public/*`
+ * anonymously and `/bundles/private/*` through its authenticated
+ * bundle route.
  *
  * ## Path-traversal defense
  *
@@ -40,31 +43,39 @@ import { isGadgetSignature } from '@ggui-ai/gadget-signing';
 export function createFilesystemBundleStorage(options) {
     const bundlesRoot = join(options.root, 'bundles');
     const bundleHost = stripTrailingSlash(options.bundleHost);
-    const dirFor = (scope, name, version) => {
+    const dirFor = (scope, name, version, visibility) => {
+        // `visibility` is a closed union ('public' | 'private') — no
+        // traversal surface; the free-form triple still gets the check.
         rejectTraversal(scope, 'scope');
         rejectTraversal(name, 'name');
         rejectTraversal(version, 'version');
-        return join(bundlesRoot, scope, name, version);
+        return join(bundlesRoot, visibility, scope, name, version);
+    };
+    const urlFor = (scope, name, version, visibility, file) => {
+        rejectTraversal(scope, 'scope');
+        rejectTraversal(name, 'name');
+        rejectTraversal(version, 'version');
+        return `${bundleHost}/bundles/${visibility}/${scope}/${name}/${version}/${file}`;
     };
     return {
-        async putBundle(scope, name, version, bytes) {
-            const dir = dirFor(scope, name, version);
+        async putBundle(scope, name, version, visibility, bytes) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'bundle.js'), bytes);
-            return this.bundleUrl(scope, name, version);
+            return this.bundleUrl(scope, name, version, visibility);
         },
-        async getBundle(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'bundle.js');
+        async getBundle(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'bundle.js');
             return readFileOrNull(path);
         },
-        async putSignature(scope, name, version, signature) {
-            const dir = dirFor(scope, name, version);
+        async putSignature(scope, name, version, visibility, signature) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'bundle.js.sig'), JSON.stringify(signature, null, 2), 'utf8');
-            return this.signatureUrl(scope, name, version);
+            return this.signatureUrl(scope, name, version, visibility);
         },
-        async getSignature(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'bundle.js.sig');
+        async getSignature(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'bundle.js.sig');
             const text = await readTextOrNull(path);
             if (text === null)
                 return null;
@@ -78,34 +89,25 @@ export function createFilesystemBundleStorage(options) {
                 return null;
             return parsed;
         },
-        async putManifest(scope, name, version, manifest) {
-            const dir = dirFor(scope, name, version);
+        async putManifest(scope, name, version, visibility, manifest) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'manifest.json'), JSON.stringify(manifest, null, 2), 'utf8');
-            return this.manifestUrl(scope, name, version);
+            return this.manifestUrl(scope, name, version, visibility);
         },
-        async getManifest(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'manifest.json');
+        async getManifest(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'manifest.json');
             const text = await readTextOrNull(path);
             return text === null ? null : JSON.parse(text);
         },
-        bundleUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/bundle.js`;
+        bundleUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'bundle.js');
         },
-        signatureUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/bundle.js.sig`;
+        signatureUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'bundle.js.sig');
         },
-        manifestUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/manifest.json`;
+        manifestUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'manifest.json');
         },
     };
 }

package/dist/filesystem-registry-storage.d.ts

@@ -1,4 +1,4 @@
-import type { RegistryStorage } from '@ggui-ai/registry-core';
+import { type RegistryStorage } from '@ggui-ai/registry-core';
 export interface FilesystemRegistryStorageOptions {
     /** Absolute path to the state root. Must already exist or be `mkdir -p`-able. */
     readonly root: string;

package/dist/filesystem-registry-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-registry-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-registry-storage.ts"],"names":[],"mappings":"AAiEA,OAAO,KAAK,EAMV,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,WAAW,gCAAgC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CAkMjB"}
+{"version":3,"file":"filesystem-registry-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-registry-storage.ts"],"names":[],"mappings":"AAoEA,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,WAAW,gCAAgC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CA2SjB"}

package/dist/filesystem-registry-storage.js

@@ -5,6 +5,7 @@
  *   <root>/state/plugins/<encoded artifactId>.json     → ArtifactsMetadataRow
  *   <root>/state/versions/<encoded artifactId>__<v>.json → ArtifactVersionRow
  *   <root>/state/author-keys/<subject>__<keyId>.json   → AuthorKeyRow
+ *   <root>/state/scope-owners/<encoded scope>.json     → ScopeOwnerRow
  *
  * The `__` separator is chosen because npm pkg names + semvers never
  * contain it (semver disallows underscores entirely; npm names disallow
@@ -19,6 +20,8 @@
  * Mirrors DDB's `ConditionExpression: attribute_not_exists(...)`. The
  * happy-path write is atomic at the inode level — partial writes on
  * crash leave the file absent rather than half-populated.
+ * {@link claimScope} uses the same `wx` primitive for its first-writer-
+ * wins scope claim (`EEXIST` → `{ conflict: true }`).
  *
  * ## Path-traversal defense
  *
@@ -61,8 +64,9 @@
  *   {@link registryStorageContract} suite against a fresh tmpdir per
  *   test. Plus path-traversal rejection tests local to this file.
  */
-import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, unlink, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { AuthorKeyAlreadyExistsError, matchesMcpToolFilters, } from '@ggui-ai/registry-core';
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 200;
 export function createFilesystemRegistryStorage(options) {
@@ -74,6 +78,13 @@ export function createFilesystemRegistryStorage(options) {
     // hex digest + `.json`. The digest itself is filename-safe (hex
     // chars only), so no URL-encoding is needed.
     const compiledBlobsDir = join(stateRoot, 'compiled-blobs');
+    // Scope-ownership rows — one file per claimed scope. The scope is
+    // URL-encoded like every other row key (`@` → `%40`).
+    const scopeOwnersDir = join(stateRoot, 'scope-owners');
+    const scopeOwnerPath = (scope) => {
+        rejectTraversal(scope, 'scope');
+        return join(scopeOwnersDir, `${encodeRowKey(scope)}.json`);
+    };
     const compiledBlobPath = (compiledDigest) => {
         rejectTraversal(compiledDigest, 'compiledDigest');
         return join(compiledBlobsDir, `${compiledDigest}.json`);
@@ -84,7 +95,13 @@ export function createFilesystemRegistryStorage(options) {
         return join(versionsDir, `${encodeRowKey(artifactId)}__${encodeRowKey(version)}.json`);
     };
     const authorKeyPath = (subject, keyId) => {
-        rejectTraversal(subject, 'subject');
+        // NO rejectTraversal on `subject`: subjects are operator-defined
+        // free text (a '/' is legal), and `encodeRowKey` neutralizes every
+        // traversal-capable character ('/' → %2F) before the value ever
+        // becomes a filename component — the appended `__<keyId>.json`
+        // suffix additionally guarantees the segment can never be a bare
+        // '..'. keyIds keep the guard as defense-in-depth (base64url by
+        // derivation — '.', '/', '\\' are unrepresentable).
         rejectTraversal(keyId, 'keyId');
         return join(authorKeysDir, `${encodeRowKey(subject)}__${encodeRowKey(keyId)}.json`);
     };
@@ -223,14 +240,94 @@ export function createFilesystemRegistryStorage(options) {
                 throw err;
             }
         },
+        async getScopeOwner(scope) {
+            return readJsonOrNull(scopeOwnerPath(scope));
+        },
+        async claimScope(row) {
+            // Atomic first-writer-wins via `wx` (open(2) O_EXCL) — mirrors
+            // the conditional-create semantics of a hosted database adapter.
+            // EEXIST maps to `{ conflict: true }` with the winner's file
+            // untouched.
+            await ensureDir(scopeOwnersDir);
+            try {
+                await writeFile(scopeOwnerPath(row.scope), JSON.stringify(row, null, 2), {
+                    flag: 'wx',
+                    encoding: 'utf8',
+                });
+                return { ok: true };
+            }
+            catch (err) {
+                if (isErrnoException(err) && err.code === 'EEXIST') {
+                    return { conflict: true };
+                }
+                throw err;
+            }
+        },
+        async updateScopeOwner(row, expect) {
+            // Compare-and-set against the caller's read snapshot. Atomicity
+            // note: the read-compare-write sequence relies on the OSS
+            // server's single-process, single-writer posture (the same
+            // documented caveat as commitVersionAndBlob's blob leg) — the
+            // `wx` seed path below is additionally inode-atomic.
+            await ensureDir(scopeOwnersDir);
+            const path = scopeOwnerPath(row.scope);
+            if ('absent' in expect) {
+                // Seed path — O_EXCL create, EEXIST means a claim (or another
+                // seed) landed first.
+                try {
+                    await writeFile(path, JSON.stringify(row, null, 2), {
+                        flag: 'wx',
+                        encoding: 'utf8',
+                    });
+                    return { ok: true };
+                }
+                catch (err) {
+                    if (isErrnoException(err) && err.code === 'EEXIST') {
+                        return { conflict: true };
+                    }
+                    throw err;
+                }
+            }
+            const current = await readJsonOrNull(path);
+            if (current === null ||
+                current.ownerSubject !== expect.ownerSubject ||
+                current.verification !== expect.verification) {
+                return { conflict: true };
+            }
+            await writeJson(path, row);
+            return { ok: true };
+        },
         async getAuthorKey(subject, keyId) {
             return readJsonOrNull(authorKeyPath(subject, keyId));
         },
-        async putAuthorKey(row) {
+        async putAuthorKey(row, options) {
             await ensureDir(authorKeysDir);
-            await writeJson(authorKeyPath(row.subject, row.keyId), row);
+            const path = authorKeyPath(row.subject, row.keyId);
+            if (options?.ifNotExists === true) {
+                // O_EXCL conditional create — same `wx` primitive as
+                // putArtifactVersionIfAbsent/claimScope. EEXIST maps to the
+                // typed conflict the register op's TOCTOU close dispatches on.
+                try {
+                    await writeFile(path, JSON.stringify(row, null, 2), {
+                        flag: 'wx',
+                        encoding: 'utf8',
+                    });
+                    return;
+                }
+                catch (err) {
+                    if (isErrnoException(err) && err.code === 'EEXIST') {
+                        throw new AuthorKeyAlreadyExistsError(row.subject, row.keyId);
+                    }
+                    throw err;
+                }
+            }
+            await writeJson(path, row);
         },
         async listAuthorKeys(subject) {
+            // Filename-prefix candidate scan, then a row-field filter — the
+            // row's own `subject` is the unambiguous ownership signal
+            // (encodeRowKey leaves '_' unescaped, so a prefix alone could
+            // cross-match subjects containing '__').
             const prefix = `${encodeRowKey(subject)}__`;
             let entries;
             try {
@@ -246,11 +343,25 @@ export function createFilesystemRegistryStorage(options) {
                 if (!entry.startsWith(prefix) || !entry.endsWith('.json'))
                     continue;
                 const row = await readJsonOrNull(join(authorKeysDir, entry));
-                if (row !== null)
+                if (row !== null && row.subject === subject)
                     matches.push(row);
             }
             return matches;
         },
+        async deleteAuthorKey(subject, keyId) {
+            // ENOENT is the "row absent" signal (mirrors reads), mapped to
+            // the contract's `false`; anything else is a transport failure
+            // and throws.
+            try {
+                await unlink(authorKeyPath(subject, keyId));
+                return true;
+            }
+            catch (err) {
+                if (isErrnoException(err) && err.code === 'ENOENT')
+                    return false;
+                throw err;
+            }
+        },
     };
 }
 /**
@@ -337,13 +448,17 @@ function parseCursor(cursor) {
  * Mirrors {@link inMemoryRegistryStorage}'s filter — same
  * AND-composition, same case-insensitive substring match on q, same
  * publisher-sub OR author-name match. Kept inline so the filesystem
- * impl doesn't depend on a private helper from registry-core.
+ * impl doesn't depend on a private helper from registry-core; the
+ * tool/server dimensions delegate to the PUBLIC shared predicate
+ * `matchesMcpToolFilters` so the reference semantics cannot drift.
  */
 function rowMatchesFilter(row, q) {
     if (q.kind !== undefined && row.kind !== q.kind)
         return false;
     if (q.hook !== undefined && row.hook !== q.hook)
         return false;
+    if (!matchesMcpToolFilters(row.mcpTools, q))
+        return false;
     if (q.tag !== undefined) {
         if (row.tags === undefined || !row.tags.includes(q.tag))
             return false;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { BlueprintProbeRunner, BundleStorage, RegistryStorage } from '@ggui-ai/registry-core';
+import type { BlueprintProbeRunner, BundleStorage, PublishArtifactDeps, RegistryStorage } from '@ggui-ai/registry-core';
 import type { BearerAuthn } from './authn/bearer.js';
 export { createBearerAuthn, type BearerAuthn, type CreateBearerAuthnOptions } from './authn/bearer.js';
 export { createFilesystemBundleStorage, type FilesystemBundleStorageOptions, } from './filesystem-bundle-storage.js';
@@ -40,6 +40,19 @@ export interface CreateRegistryServerOptions {
      * e2e fixtures, not unauthenticated public publish endpoints.
      */
     readonly blueprintProbe?: BlueprintProbeRunner;
+    /**
+     * Optional TUF trust-root tuning for sigstore-cosign publish
+     * verification. Forwarded to `createRegistryApp` (see
+     * {@link RegistryAppOptions.sigstoreTuf}).
+     */
+    readonly sigstoreTuf?: PublishArtifactDeps['sigstoreTuf'];
+    /**
+     * Optional verified-email lookup for the publish gate's identity
+     * binding. Forwarded to `createRegistryApp` (see
+     * {@link RegistryAppOptions.verifiedEmailResolver} for the default
+     * allowlist-only posture when unset).
+     */
+    readonly verifiedEmailResolver?: PublishArtifactDeps['verifiedEmailResolver'];
 }
 export interface RegistryServerHandle {
     /** The port the server is actually bound to. Resolves after {@link start}. */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,KAAK,8BAA8B,GACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAiDtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,KAAK,8BAA8B,GACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAuDtB"}

package/dist/index.js

@@ -34,6 +34,12 @@ export function createRegistryServer(options) {
         ...(options.blueprintProbe !== undefined
             ? { blueprintProbe: options.blueprintProbe }
             : {}),
+        ...(options.sigstoreTuf !== undefined
+            ? { sigstoreTuf: options.sigstoreTuf }
+            : {}),
+        ...(options.verifiedEmailResolver !== undefined
+            ? { verifiedEmailResolver: options.verifiedEmailResolver }
+            : {}),
     });
     const host = options.host ?? '0.0.0.0';
     const requestedPort = options.port ?? 9001;

package/dist/server.d.ts

@@ -6,25 +6,47 @@
  *   GET  /search                           → searchArtifacts
  *   GET  /pkg/:scope/:name/:version        → readArtifact
  *   POST /publish                          → publishArtifact (bearer-gated)
+ *   POST /author-keys                      → registerAuthorKey (bearer-gated)
+ *   GET  /author-keys                      → listAuthorKeys (bearer-gated)
+ *   DELETE /author-keys/:keyId             → deleteAuthorKey (bearer-gated)
  *   POST /conformance/check                → checkConformance (pre-flight gate)
- *   GET  /bundles/:scope/:name/:version/bundle.js
- *   GET  /bundles/:scope/:name/:version/bundle.js.sig
- *   GET  /bundles/:scope/:name/:version/manifest.json
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js        (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js.sig    (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/manifest.json    (anonymous)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js       (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js.sig   (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/manifest.json   (bearer-gated)
  *
  * Bundle / signature / manifest serves go through {@link BundleStorage}
  * directly so the operator can plug a different storage backend
  * (memory for tests; filesystem for self-hosting) without rewriting
- * the route table. The server always emits
- * `Cache-Control: public, max-age=31536000, immutable` on these
- * routes — bundles are SRI-pinned + immutable post-publish.
+ * the route table.
+ *
+ * H1 visibility split: blob placement mirrors the manifest's
+ * `visibility` (`bundles/public/…` vs `bundles/private/…`), and the
+ * ROUTE decides the auth posture — the public prefix serves
+ * anonymously; the private prefix requires a bearer AND authorizes the
+ * caller against the artifact's publisher or the scope owner (403
+ * otherwise; unknown triples answer 404). A blob is only findable
+ * through the prefix it was published under, so a private artifact can
+ * never be fetched via the anonymous route.
+ *
+ * Cache headers: public-prefix responses emit
+ * `Cache-Control: public, max-age=31536000, immutable` (bundles are
+ * SRI-pinned + immutable post-publish); private-prefix responses stay
+ * immutable but non-shared-cacheable
+ * (`Cache-Control: private, max-age=31536000, immutable`).
  *
  * CORS: permissive on public-read routes (`/search`, `/pkg/*`,
- * `/bundles/*`, `/conformance/check`); strict on `/publish` (same-origin
- * or no Origin header — the install CLI runs server-to-server, not
- * browser-side).
+ * `/bundles/public/*`, `/conformance/check`); strict on `/publish`
+ * (same-origin or no Origin header — the install CLI runs
+ * server-to-server, not browser-side) AND on `/bundles/private/*`
+ * (per-caller authorized content — no ACAO, no permissive preflight;
+ * browser consumers of private bundles go through presigned URLs
+ * rather than cross-origin credentialed fetches).
  */
 import { Hono } from 'hono';
-import { type BlueprintProbeRunner, type BundleStorage, type RegistryStorage } from '@ggui-ai/registry-core';
+import { type BlueprintProbeRunner, type PublishArtifactDeps, type BundleStorage, type RegistryStorage } from '@ggui-ai/registry-core';
 import type { BearerAuthn } from './authn/bearer.js';
 export interface RegistryAppOptions {
     readonly storage: RegistryStorage;
@@ -41,6 +63,25 @@ export interface RegistryAppOptions {
      * only the static gates from `checkConformance`.
      */
     readonly blueprintProbe?: BlueprintProbeRunner;
+    /**
+     * Optional TUF trust-root tuning for sigstore-cosign publish
+     * verification, forwarded verbatim to the publish op. Point
+     * `tufMirrorURL` + `tufRootPath` at an alternative TUF repository
+     * (private sigstore deployments; hermetic tests); `tufCachePath` /
+     * `tufForceCache` control cache placement + warm reuse. Unset =
+     * the sigstore public-good trust root.
+     */
+    readonly sigstoreTuf?: PublishArtifactDeps['sigstoreTuf'];
+    /**
+     * Optional verified-email lookup for the publish gate's F4 identity
+     * binding — see {@link PublishArtifactDeps.verifiedEmailResolver}
+     * for the contract. Unset (the default here): publisher identity is
+     * enforced only on scopes whose ownership row carries a
+     * `sanAllowlist`; scopes without one accept any identity a valid
+     * sigstore bundle proves. Wire a resolver backed by your identity
+     * layer to bind default publishes to account emails.
+     */
+    readonly verifiedEmailResolver?: PublishArtifactDeps['verifiedEmailResolver'];
 }
 /**
  * Build the hono app. Does NOT bind a port — callers (the CLI, the

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAKL,KAAK,oBAAoB,EAGzB,KAAK,aAAa,EAIlB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAwQnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAUL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,KAAK,aAAa,EAIlB,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAyXnE"}

package/dist/server.js

@@ -6,26 +6,53 @@
  *   GET  /search                           → searchArtifacts
  *   GET  /pkg/:scope/:name/:version        → readArtifact
  *   POST /publish                          → publishArtifact (bearer-gated)
+ *   POST /author-keys                      → registerAuthorKey (bearer-gated)
+ *   GET  /author-keys                      → listAuthorKeys (bearer-gated)
+ *   DELETE /author-keys/:keyId             → deleteAuthorKey (bearer-gated)
  *   POST /conformance/check                → checkConformance (pre-flight gate)
- *   GET  /bundles/:scope/:name/:version/bundle.js
- *   GET  /bundles/:scope/:name/:version/bundle.js.sig
- *   GET  /bundles/:scope/:name/:version/manifest.json
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js        (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js.sig    (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/manifest.json    (anonymous)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js       (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js.sig   (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/manifest.json   (bearer-gated)
  *
  * Bundle / signature / manifest serves go through {@link BundleStorage}
  * directly so the operator can plug a different storage backend
  * (memory for tests; filesystem for self-hosting) without rewriting
- * the route table. The server always emits
- * `Cache-Control: public, max-age=31536000, immutable` on these
- * routes — bundles are SRI-pinned + immutable post-publish.
+ * the route table.
+ *
+ * H1 visibility split: blob placement mirrors the manifest's
+ * `visibility` (`bundles/public/…` vs `bundles/private/…`), and the
+ * ROUTE decides the auth posture — the public prefix serves
+ * anonymously; the private prefix requires a bearer AND authorizes the
+ * caller against the artifact's publisher or the scope owner (403
+ * otherwise; unknown triples answer 404). A blob is only findable
+ * through the prefix it was published under, so a private artifact can
+ * never be fetched via the anonymous route.
+ *
+ * Cache headers: public-prefix responses emit
+ * `Cache-Control: public, max-age=31536000, immutable` (bundles are
+ * SRI-pinned + immutable post-publish); private-prefix responses stay
+ * immutable but non-shared-cacheable
+ * (`Cache-Control: private, max-age=31536000, immutable`).
  *
  * CORS: permissive on public-read routes (`/search`, `/pkg/*`,
- * `/bundles/*`, `/conformance/check`); strict on `/publish` (same-origin
- * or no Origin header — the install CLI runs server-to-server, not
- * browser-side).
+ * `/bundles/public/*`, `/conformance/check`); strict on `/publish`
+ * (same-origin or no Origin header — the install CLI runs
+ * server-to-server, not browser-side) AND on `/bundles/private/*`
+ * (per-caller authorized content — no ACAO, no permissive preflight;
+ * browser consumers of private bundles go through presigned URLs
+ * rather than cross-origin credentialed fetches).
  */
 import { Hono } from 'hono';
-import { checkConformance, listArtifactVersions, publishArtifact, registerAuthorKey, readArtifact, searchArtifacts, } from '@ggui-ai/registry-core';
+import { canReadPrivateArtifact, checkConformance, createScopeOwnerResolver, deleteAuthorKey, unauthorizedErrorBody, listArtifactVersions, listAuthorKeys, publishArtifact, registerAuthorKey, readArtifact, searchArtifacts, } from '@ggui-ai/registry-core';
 const IMMUTABLE_CACHE_HEADER = 'public, max-age=31536000, immutable';
+/**
+ * Private-prefix responses are immutable too, but MUST NOT land in
+ * shared caches — the authorization decision is per-caller.
+ */
+const PRIVATE_IMMUTABLE_CACHE_HEADER = 'private, max-age=31536000, immutable';
 /**
  * Build the hono app. Does NOT bind a port — callers (the CLI, the
  * `createRegistryServer` factory, programmatic embeds) decide how to
@@ -36,27 +63,41 @@ export function createRegistryApp(options) {
     const { storage, bundleStorage, authn, registryHostname } = options;
     const clock = options.clock ?? (() => new Date());
     const blueprintProbe = options.blueprintProbe;
+    const sigstoreTuf = options.sigstoreTuf;
+    const verifiedEmailResolver = options.verifiedEmailResolver;
     const app = new Hono();
-    // CORS — permissive read; strict for /publish. Adds ACAO headers
-    // AFTER the route runs so they overlay on the route's response.
+    // Shared bearer gate for every authed route — ONE verification call
+    // shape, ONE 401 body (`unauthorizedErrorBody`, exported beside the
+    // registry-core error enums so every transport of this wire contract
+    // agrees).
+    const verifyBearer = (c) => authn.verify(c.req.header('authorization'));
+    // CORS — permissive read; strict for /publish AND the private
+    // bundle prefix (review finding 5). Private bundles are per-caller
+    // authorized content: no cross-origin page has any business reading
+    // them, and the browser consumers that need private bundle bytes go
+    // through presigned URLs, not cross-origin credentialed fetches.
+    // Adds ACAO headers AFTER the route runs so they overlay on the
+    // route's response.
     app.use('*', async (c, next) => {
         const path = c.req.path;
-        const isPublishRoute = path === '/publish';
-        if (c.req.method === 'OPTIONS' && !isPublishRoute) {
-            // Preflight short-circuit for read routes.
+        const isCorsExcluded = path === '/publish' || path.startsWith('/bundles/private/');
+        if (c.req.method === 'OPTIONS' && !isCorsExcluded) {
+            // Preflight short-circuit for read routes. DELETE is listed for
+            // the author-key management route — a browser console revokes
+            // keys cross-origin ([E]).
             return new Response(null, {
                 status: 204,
                 headers: {
                     'Access-Control-Allow-Origin': '*',
-                    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+                    'Access-Control-Allow-Methods': 'GET, POST, DELETE, OPTIONS',
                     'Access-Control-Allow-Headers': 'content-type, authorization',
                 },
             });
         }
         await next();
-        if (!isPublishRoute) {
+        if (!isCorsExcluded) {
             c.res.headers.set('Access-Control-Allow-Origin', '*');
-            c.res.headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+            c.res.headers.set('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
             c.res.headers.set('Access-Control-Allow-Headers', 'content-type, authorization');
         }
     });
@@ -74,6 +115,8 @@ export function createRegistryApp(options) {
             limit: q.limit,
             cursor: q.cursor,
             sort: q.sort,
+            tool: q.tool,
+            server: q.server,
         }, { storage });
         if (!result.ok) {
             return c.json(result.body, result.status);
@@ -135,13 +178,9 @@ export function createRegistryApp(options) {
             // Defensive: don't echo. Browsers will reject without the
             // ACAO header, which is the protection we want.
         }
-        const authHeader = c.req.header('authorization');
-        const verified = authn.verify(authHeader);
+        const verified = verifyBearer(c);
         if (verified === null) {
-            return c.json({
-                error: 'unauthorized',
-                message: 'publish requires a valid bearer token in the Authorization header',
-            }, 401);
+            return c.json(unauthorizedErrorBody(), 401);
         }
         let body;
         try {
@@ -162,6 +201,8 @@ export function createRegistryApp(options) {
             clock,
             registryHostname,
             ...(blueprintProbe !== undefined ? { blueprintProbe } : {}),
+            ...(sigstoreTuf !== undefined ? { sigstoreTuf } : {}),
+            ...(verifiedEmailResolver !== undefined ? { verifiedEmailResolver } : {}),
         });
         return c.json(result.body, result.status);
     });
@@ -170,13 +211,9 @@ export function createRegistryApp(options) {
     // bearer-authenticated subject's identity. Shares one wire contract
     // with the hosted registry's author-keys endpoint.
     app.post('/author-keys', async (c) => {
-        const authHeader = c.req.header('authorization');
-        const verified = authn.verify(authHeader);
+        const verified = verifyBearer(c);
         if (verified === null) {
-            return c.json({
-                error: 'unauthorized',
-                message: 'author-keys requires a valid bearer token in the Authorization header',
-            }, 401);
+            return c.json(unauthorizedErrorBody(), 401);
         }
         let rawBody;
         try {
@@ -201,7 +238,37 @@ export function createRegistryApp(options) {
                 message: '`publicKeyBase64` must be a string',
             }, 400);
         }
-        const result = await registerAuthorKey({ publicKeyBase64: body.publicKeyBase64 }, { storage, authn: verified });
+        const result = await registerAuthorKey({
+            publicKeyBase64: body.publicKeyBase64,
+            ...(body.label !== undefined ? { label: body.label } : {}),
+        }, { storage, authn: verified, clock });
+        return c.json(result.body, result.status);
+    });
+    // ── GET /author-keys ─────────────────────────────────────────────────
+    // Lists the bearer-authenticated subject's registered signing keys.
+    // Bearer REQUIRED: "my keys" has no anonymous projection, so a
+    // missing/invalid token is a 401 — never an empty anonymous list.
+    app.get('/author-keys', async (c) => {
+        const verified = verifyBearer(c);
+        if (verified === null) {
+            return c.json(unauthorizedErrorBody(), 401);
+        }
+        const result = await listAuthorKeys({ storage, authn: verified });
+        return c.json(result.body, result.status);
+    });
+    // ── DELETE /author-keys/:keyId ───────────────────────────────────────
+    // Hard-deletes the caller's `(subject, keyId)` row. Idempotent
+    // (absent → 200 `deleted: false`) and subject-scoped — see the op's
+    // docstring. Bearer REQUIRED, same as the list route. keyIds are
+    // base64url (`derivePublicKeyId`) — URL-safe by construction, the
+    // path param is the keyId verbatim.
+    app.delete('/author-keys/:keyId', async (c) => {
+        const verified = verifyBearer(c);
+        if (verified === null) {
+            return c.json(unauthorizedErrorBody(), 401);
+        }
+        const { keyId } = c.req.param();
+        const result = await deleteAuthorKey({ keyId }, { storage, authn: verified });
         return c.json(result.body, result.status);
     });
     // ── /conformance/check ───────────────────────────────────────────────
@@ -219,32 +286,106 @@ export function createRegistryApp(options) {
         // conformance handler's wire shape.
         return c.json(result, 200);
     });
-    // ── /bundles/:scope/:name/:version/bundle.js ─────────────────────────
-    app.get('/bundles/:scope/:name/:version/bundle.js', async (c) => {
+    // ── /bundles/public/… — anonymous, CDN-parity serving ────────────────
+    app.get('/bundles/public/:scope/:name/:version/bundle.js', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveBundle(c, bundleStorage, scope, name, version);
+        return serveBundle(c, bundleStorage, scope, name, version, 'public');
     });
-    // ── /bundles/:scope/:name/:version/bundle.js.sig ─────────────────────
-    app.get('/bundles/:scope/:name/:version/bundle.js.sig', async (c) => {
+    app.get('/bundles/public/:scope/:name/:version/bundle.js.sig', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveSignature(c, bundleStorage, scope, name, version);
+        return serveSignature(c, bundleStorage, scope, name, version, 'public');
     });
-    // ── /bundles/:scope/:name/:version/manifest.json ─────────────────────
-    app.get('/bundles/:scope/:name/:version/manifest.json', async (c) => {
+    app.get('/bundles/public/:scope/:name/:version/manifest.json', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveManifest(c, bundleStorage, scope, name, version);
+        return serveManifest(c, bundleStorage, scope, name, version, 'public');
+    });
+    // ── /bundles/private/… — authenticated + ownership-authorized ────────
+    // Auth rule (H1): a valid bearer is required (401 — uniform, fires
+    // before any storage read, so it can't distinguish triples); then
+    // authorization goes through H2's shared `canReadPrivateArtifact`
+    // predicate (publisher OR scope owner; owner lookup lazy + memoized
+    // + fail-closed via `createScopeOwnerResolver`). Unknown triples,
+    // rows that are not private (their blobs live on the public prefix),
+    // AND authorization denials all answer the SAME opaque 404 — a
+    // distinguishable denial is an existence oracle for private
+    // artifacts. Storage faults answer the documented `server_error`
+    // envelope with NO raw error text (fail closed, log server-side).
+    const privateBundleGate = async (c, rawScope, name, version) => {
+        const verified = authn.verify(c.req.header('authorization'));
+        if (verified === null) {
+            return c.json({
+                error: 'unauthorized',
+                message: 'private bundles require a valid bearer token in the Authorization header',
+            }, 401);
+        }
+        const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
+        const artifactId = `${scope}/${name}`;
+        let row;
+        try {
+            row = await storage.getArtifactVersion(artifactId, version);
+        }
+        catch (err) {
+            // Fail closed with the documented envelope — the raw fault text
+            // stays server-side (a wire-visible internals string is both a
+            // leak and a fingerprint).
+            // eslint-disable-next-line no-console -- server-side operator signal; the wire stays opaque
+            console.error('registry: private bundle gate storage read failed', {
+                artifactId,
+                version,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return c.json(errorBody('server_error', 'internal error'), 500);
+        }
+        if (row === null || row.visibility !== 'private') {
+            return c.json(errorBody('not_found', 'bundle not found'), 404);
+        }
+        // `createScopeOwnerResolver` already resolves owner-lookup faults
+        // to null (deny) with its own server-side log, so no try/catch is
+        // needed around the predicate.
+        const authorized = await canReadPrivateArtifact(verified, row, createScopeOwnerResolver(storage, artifactId));
+        if (!authorized) {
+            return c.json(errorBody('not_found', 'bundle not found'), 404);
+        }
+        return null;
+    };
+    app.get('/bundles/private/:scope/:name/:version/bundle.js', async (c) => {
+        const { scope, name, version } = c.req.param();
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveBundle(c, bundleStorage, scope, name, version, 'private');
+    });
+    app.get('/bundles/private/:scope/:name/:version/bundle.js.sig', async (c) => {
+        const { scope, name, version } = c.req.param();
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveSignature(c, bundleStorage, scope, name, version, 'private');
+    });
+    app.get('/bundles/private/:scope/:name/:version/manifest.json', async (c) => {
+        const { scope, name, version } = c.req.param();
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveManifest(c, bundleStorage, scope, name, version, 'private');
     });
     return app;
 }
+/** Cache header for the given prefix — see the module docstring. */
+function cacheHeaderFor(visibility) {
+    return visibility === 'public'
+        ? IMMUTABLE_CACHE_HEADER
+        : PRIVATE_IMMUTABLE_CACHE_HEADER;
+}
 /**
  * Serve the bundle bytes. `application/javascript` MIME with the
- * immutable cache header. 404 on miss.
+ * visibility-appropriate immutable cache header. 404 on miss.
  */
-async function serveBundle(c, bundleStorage, rawScope, name, version) {
+async function serveBundle(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let bytes;
     try {
-        bytes = await bundleStorage.getBundle(scope, name, version);
+        bytes = await bundleStorage.getBundle(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -263,15 +404,15 @@ async function serveBundle(c, bundleStorage, rawScope, name, version) {
         status: 200,
         headers: {
             'Content-Type': 'application/javascript; charset=utf-8',
-            'Cache-Control': IMMUTABLE_CACHE_HEADER,
+            'Cache-Control': cacheHeaderFor(visibility),
         },
     });
 }
-async function serveSignature(c, bundleStorage, rawScope, name, version) {
+async function serveSignature(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let sig;
     try {
-        sig = await bundleStorage.getSignature(scope, name, version);
+        sig = await bundleStorage.getSignature(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -279,14 +420,14 @@ async function serveSignature(c, bundleStorage, rawScope, name, version) {
     if (sig === null) {
         return c.json(errorBody('not_found', 'signature not found'), 404);
     }
-    c.header('Cache-Control', IMMUTABLE_CACHE_HEADER);
+    c.header('Cache-Control', cacheHeaderFor(visibility));
     return c.json(sig, 200);
 }
-async function serveManifest(c, bundleStorage, rawScope, name, version) {
+async function serveManifest(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let manifest;
     try {
-        manifest = await bundleStorage.getManifest(scope, name, version);
+        manifest = await bundleStorage.getManifest(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -294,7 +435,7 @@ async function serveManifest(c, bundleStorage, rawScope, name, version) {
     if (manifest === null) {
         return c.json(errorBody('not_found', 'manifest not found'), 404);
     }
-    c.header('Cache-Control', IMMUTABLE_CACHE_HEADER);
+    c.header('Cache-Control', cacheHeaderFor(visibility));
     return c.json(manifest, 200);
 }
 function errorBody(error, message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/registry-server",
-  "version": "0.6.3",
+  "version": "0.8.0",
   "description": "Self-hostable HTTP server for the ggui marketplace registry. Wraps @ggui-ai/registry-core with hono, filesystem storage, and bearer-token auth. Run via npx for local dev, CI, and on-prem deployments.",
   "keywords": [
     "ggui",
@@ -31,12 +31,16 @@
   "dependencies": {
     "@hono/node-server": "^2.0.12",
     "hono": "^4.12.8",
-    "@ggui-ai/artifact-manifest": "0.6.3",
-    "@ggui-ai/gadget-signing": "0.6.3",
-    "@ggui-ai/registry-core": "0.6.3"
+    "@ggui-ai/artifact-manifest": "0.8.0",
+    "@ggui-ai/gadget-signing": "0.8.0",
+    "@ggui-ai/registry-core": "0.8.0"
   },
   "devDependencies": {
+    "@sigstore/mock": "~0.12.1",
+    "@sigstore/protobuf-specs": "^0.5.1",
+    "@tufjs/repo-mock": "4.0.1",
     "@types/node": "^24.0.0",
+    "nock": "^13.5.6",
     "tsx": "^4.19.0",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6"