@ggui-ai/registry-server 0.7.0 → 0.9.0

package/README.md

@@ -42,7 +42,7 @@ ggui gadget publish --auth=bearer --token=$GGUI_REGISTRY_TOKEN \
 | GET    | `/bundles/:scope/:name/:version/bundle.js.sig` | none   | Serve the signature envelope (immutable cache)             |
 | GET    | `/bundles/:scope/:name/:version/manifest.json` | none   | Serve the manifest verbatim (immutable cache)              |
 
-\* Reads of `visibility: 'private'` rows require bearer; unauthenticated callers see only public rows.
+\* Reads of `visibility: 'private'` rows are ownership-gated: a private version is served only to the verified caller who published it or who owns the artifact's scope. Every other caller — unauthenticated included — receives the same `not_found` response as a genuinely missing artifact, and the version list filters unreadable versions (answering `not_found` when none are visible), so responses never reveal that a private artifact exists.
 
 ## Storage modes
 
@@ -60,7 +60,7 @@ This server is **MVP-scoped** for self-hosters who want the marketplace surface
 - Rate limiting (use a reverse proxy)
 - TLS termination (use a reverse proxy)
 - Backup automation (the filesystem mode is single-machine)
-- Per-org private artifact scoping (treat `visibility: 'private'` as a label, not enforcement)
+- Per-org private artifact scoping (enforcement is per-subject — publisher or scope owner; org-membership admission is not implemented)
 - Sigstore transparency log integration
 
 If you need any of the above, build your own transport on top of [`@ggui-ai/registry-core`](https://github.com/ggui-ai/ggui/tree/main/packages/registry-core).

package/dist/filesystem-bundle-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-bundle-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-bundle-storage.ts"],"names":[],"mappings":"AAwCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,WAAW,8BAA8B;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,aAAa,CA+Ef"}
+{"version":3,"file":"filesystem-bundle-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-bundle-storage.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,aAAa,EAAc,MAAM,wBAAwB,CAAC;AAExE,MAAM,WAAW,8BAA8B;IAC7C,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,aAAa,CA0Ff"}

package/dist/filesystem-bundle-storage.js

@@ -1,17 +1,20 @@
 /**
  * Filesystem-backed {@link BundleStorage} for the OSS registry server.
  *
- * Blob layout:
+ * Blob layout (H1 visibility split — placement is the access-control
+ * boundary):
  *
- *   <root>/bundles/<scope>/<name>/<version>/bundle.js
- *   <root>/bundles/<scope>/<name>/<version>/bundle.js.sig
- *   <root>/bundles/<scope>/<name>/<version>/manifest.json
+ *   <root>/bundles/public/<scope>/<name>/<version>/bundle.js
+ *   <root>/bundles/public/<scope>/<name>/<version>/bundle.js.sig
+ *   <root>/bundles/public/<scope>/<name>/<version>/manifest.json
+ *   <root>/bundles/private/<scope>/<name>/<version>/{...}
  *
  * Scope is written verbatim (`@my-org/...`) because the leading `@`
  * is filename-safe on every supported OS. The URL composition mirrors
- * the same path so the public URL the install CLI follows resolves
- * directly against the file (the hono server's `/bundles/*` route
- * streams the file).
+ * the same path so the URL the install CLI follows resolves directly
+ * against the file: the hono server serves `/bundles/public/*`
+ * anonymously and `/bundles/private/*` through its authenticated
+ * bundle route.
  *
  * ## Path-traversal defense
  *
@@ -40,31 +43,39 @@ import { isGadgetSignature } from '@ggui-ai/gadget-signing';
 export function createFilesystemBundleStorage(options) {
     const bundlesRoot = join(options.root, 'bundles');
     const bundleHost = stripTrailingSlash(options.bundleHost);
-    const dirFor = (scope, name, version) => {
+    const dirFor = (scope, name, version, visibility) => {
+        // `visibility` is a closed union ('public' | 'private') — no
+        // traversal surface; the free-form triple still gets the check.
         rejectTraversal(scope, 'scope');
         rejectTraversal(name, 'name');
         rejectTraversal(version, 'version');
-        return join(bundlesRoot, scope, name, version);
+        return join(bundlesRoot, visibility, scope, name, version);
+    };
+    const urlFor = (scope, name, version, visibility, file) => {
+        rejectTraversal(scope, 'scope');
+        rejectTraversal(name, 'name');
+        rejectTraversal(version, 'version');
+        return `${bundleHost}/bundles/${visibility}/${scope}/${name}/${version}/${file}`;
     };
     return {
-        async putBundle(scope, name, version, bytes) {
-            const dir = dirFor(scope, name, version);
+        async putBundle(scope, name, version, visibility, bytes) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'bundle.js'), bytes);
-            return this.bundleUrl(scope, name, version);
+            return this.bundleUrl(scope, name, version, visibility);
         },
-        async getBundle(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'bundle.js');
+        async getBundle(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'bundle.js');
             return readFileOrNull(path);
         },
-        async putSignature(scope, name, version, signature) {
-            const dir = dirFor(scope, name, version);
+        async putSignature(scope, name, version, visibility, signature) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'bundle.js.sig'), JSON.stringify(signature, null, 2), 'utf8');
-            return this.signatureUrl(scope, name, version);
+            return this.signatureUrl(scope, name, version, visibility);
         },
-        async getSignature(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'bundle.js.sig');
+        async getSignature(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'bundle.js.sig');
             const text = await readTextOrNull(path);
             if (text === null)
                 return null;
@@ -78,34 +89,25 @@ export function createFilesystemBundleStorage(options) {
                 return null;
             return parsed;
         },
-        async putManifest(scope, name, version, manifest) {
-            const dir = dirFor(scope, name, version);
+        async putManifest(scope, name, version, visibility, manifest) {
+            const dir = dirFor(scope, name, version, visibility);
             await mkdir(dir, { recursive: true });
             await writeFile(join(dir, 'manifest.json'), JSON.stringify(manifest, null, 2), 'utf8');
-            return this.manifestUrl(scope, name, version);
+            return this.manifestUrl(scope, name, version, visibility);
         },
-        async getManifest(scope, name, version) {
-            const path = join(dirFor(scope, name, version), 'manifest.json');
+        async getManifest(scope, name, version, visibility) {
+            const path = join(dirFor(scope, name, version, visibility), 'manifest.json');
             const text = await readTextOrNull(path);
             return text === null ? null : JSON.parse(text);
         },
-        bundleUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/bundle.js`;
+        bundleUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'bundle.js');
         },
-        signatureUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/bundle.js.sig`;
+        signatureUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'bundle.js.sig');
         },
-        manifestUrl(scope, name, version) {
-            rejectTraversal(scope, 'scope');
-            rejectTraversal(name, 'name');
-            rejectTraversal(version, 'version');
-            return `${bundleHost}/bundles/${scope}/${name}/${version}/manifest.json`;
+        manifestUrl(scope, name, version, visibility) {
+            return urlFor(scope, name, version, visibility, 'manifest.json');
         },
     };
 }

package/dist/filesystem-registry-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-registry-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-registry-storage.ts"],"names":[],"mappings":"AAoEA,OAAO,EAOL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,WAAW,gCAAgC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CA2SjB"}
+{"version":3,"file":"filesystem-registry-storage.d.ts","sourceRoot":"","sources":["../src/filesystem-registry-storage.ts"],"names":[],"mappings":"AAoEA,OAAO,EAQL,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,WAAW,gCAAgC;IAC/C,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gCAAgC,GACxC,eAAe,CA2SjB"}

package/dist/filesystem-registry-storage.js

@@ -66,7 +66,7 @@
  */
 import { mkdir, readFile, readdir, unlink, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { AuthorKeyAlreadyExistsError, } from '@ggui-ai/registry-core';
+import { AuthorKeyAlreadyExistsError, matchesMcpToolFilters, } from '@ggui-ai/registry-core';
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 200;
 export function createFilesystemRegistryStorage(options) {
@@ -448,13 +448,24 @@ function parseCursor(cursor) {
  * Mirrors {@link inMemoryRegistryStorage}'s filter — same
  * AND-composition, same case-insensitive substring match on q, same
  * publisher-sub OR author-name match. Kept inline so the filesystem
- * impl doesn't depend on a private helper from registry-core.
+ * impl doesn't depend on a private helper from registry-core; the
+ * tool/server dimensions delegate to the PUBLIC shared predicate
+ * `matchesMcpToolFilters` so the reference semantics cannot drift.
  */
 function rowMatchesFilter(row, q) {
+    // #474 — visibility gating lives INSIDE every scanArtifacts impl
+    // (the ruled canonical location); the search op's post-filter stays
+    // as defense-in-depth. Without this, private rows would consume
+    // page slots on self-host impls even though the op filters them out
+    // before they ever reach the wire.
+    if (row.visibility !== 'public')
+        return false;
     if (q.kind !== undefined && row.kind !== q.kind)
         return false;
     if (q.hook !== undefined && row.hook !== q.hook)
         return false;
+    if (!matchesMcpToolFilters(row.mcpTools, q))
+        return false;
     if (q.tag !== undefined) {
         if (row.tags === undefined || !row.tags.includes(q.tag))
             return false;

package/dist/index.d.ts

@@ -46,6 +46,13 @@ export interface CreateRegistryServerOptions {
      * {@link RegistryAppOptions.sigstoreTuf}).
      */
     readonly sigstoreTuf?: PublishArtifactDeps['sigstoreTuf'];
+    /**
+     * Optional verified-email lookup for the publish gate's identity
+     * binding. Forwarded to `createRegistryApp` (see
+     * {@link RegistryAppOptions.verifiedEmailResolver} for the default
+     * allowlist-only posture when unset).
+     */
+    readonly verifiedEmailResolver?: PublishArtifactDeps['verifiedEmailResolver'];
 }
 export interface RegistryServerHandle {
     /** The port the server is actually bound to. Resolves after {@link start}. */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,KAAK,8BAA8B,GACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAoDtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EACL,6BAA6B,EAC7B,KAAK,8BAA8B,GACpC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,+BAA+B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;CAC/E;AAED,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAuDtB"}

package/dist/index.js

@@ -37,6 +37,9 @@ export function createRegistryServer(options) {
         ...(options.sigstoreTuf !== undefined
             ? { sigstoreTuf: options.sigstoreTuf }
             : {}),
+        ...(options.verifiedEmailResolver !== undefined
+            ? { verifiedEmailResolver: options.verifiedEmailResolver }
+            : {}),
     });
     const host = options.host ?? '0.0.0.0';
     const requestedPort = options.port ?? 9001;

package/dist/server.d.ts

@@ -10,21 +10,40 @@
  *   GET  /author-keys                      → listAuthorKeys (bearer-gated)
  *   DELETE /author-keys/:keyId             → deleteAuthorKey (bearer-gated)
  *   POST /conformance/check                → checkConformance (pre-flight gate)
- *   GET  /bundles/:scope/:name/:version/bundle.js
- *   GET  /bundles/:scope/:name/:version/bundle.js.sig
- *   GET  /bundles/:scope/:name/:version/manifest.json
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js        (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js.sig    (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/manifest.json    (anonymous)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js       (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js.sig   (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/manifest.json   (bearer-gated)
  *
  * Bundle / signature / manifest serves go through {@link BundleStorage}
  * directly so the operator can plug a different storage backend
  * (memory for tests; filesystem for self-hosting) without rewriting
- * the route table. The server always emits
- * `Cache-Control: public, max-age=31536000, immutable` on these
- * routes — bundles are SRI-pinned + immutable post-publish.
+ * the route table.
+ *
+ * H1 visibility split: blob placement mirrors the manifest's
+ * `visibility` (`bundles/public/…` vs `bundles/private/…`), and the
+ * ROUTE decides the auth posture — the public prefix serves
+ * anonymously; the private prefix requires a bearer AND authorizes the
+ * caller against the artifact's publisher or the scope owner (403
+ * otherwise; unknown triples answer 404). A blob is only findable
+ * through the prefix it was published under, so a private artifact can
+ * never be fetched via the anonymous route.
+ *
+ * Cache headers: public-prefix responses emit
+ * `Cache-Control: public, max-age=31536000, immutable` (bundles are
+ * SRI-pinned + immutable post-publish); private-prefix responses stay
+ * immutable but non-shared-cacheable
+ * (`Cache-Control: private, max-age=31536000, immutable`).
  *
  * CORS: permissive on public-read routes (`/search`, `/pkg/*`,
- * `/bundles/*`, `/conformance/check`); strict on `/publish` (same-origin
- * or no Origin header — the install CLI runs server-to-server, not
- * browser-side).
+ * `/bundles/public/*`, `/conformance/check`); strict on `/publish`
+ * (same-origin or no Origin header — the install CLI runs
+ * server-to-server, not browser-side) AND on `/bundles/private/*`
+ * (per-caller authorized content — no ACAO, no permissive preflight;
+ * browser consumers of private bundles go through presigned URLs
+ * rather than cross-origin credentialed fetches).
  */
 import { Hono } from 'hono';
 import { type BlueprintProbeRunner, type PublishArtifactDeps, type BundleStorage, type RegistryStorage } from '@ggui-ai/registry-core';
@@ -53,6 +72,16 @@ export interface RegistryAppOptions {
      * the sigstore public-good trust root.
      */
     readonly sigstoreTuf?: PublishArtifactDeps['sigstoreTuf'];
+    /**
+     * Optional verified-email lookup for the publish gate's F4 identity
+     * binding — see {@link PublishArtifactDeps.verifiedEmailResolver}
+     * for the contract. Unset (the default here): publisher identity is
+     * enforced only on scopes whose ownership row carries a
+     * `sanAllowlist`; scopes without one accept any identity a valid
+     * sigstore bundle proves. Wire a resolver backed by your identity
+     * layer to bind default publishes to account emails.
+     */
+    readonly verifiedEmailResolver?: PublishArtifactDeps['verifiedEmailResolver'];
 }
 /**
  * Build the hono app. Does NOT bind a port — callers (the CLI, the

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAQL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,KAAK,aAAa,EAIlB,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;CAC3D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAkSnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAUL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAGxB,KAAK,aAAa,EAIlB,KAAK,eAAe,EAErB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,mBAAmB,CAAC,uBAAuB,CAAC,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAyXnE"}

package/dist/server.js

@@ -10,25 +10,49 @@
  *   GET  /author-keys                      → listAuthorKeys (bearer-gated)
  *   DELETE /author-keys/:keyId             → deleteAuthorKey (bearer-gated)
  *   POST /conformance/check                → checkConformance (pre-flight gate)
- *   GET  /bundles/:scope/:name/:version/bundle.js
- *   GET  /bundles/:scope/:name/:version/bundle.js.sig
- *   GET  /bundles/:scope/:name/:version/manifest.json
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js        (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/bundle.js.sig    (anonymous)
+ *   GET  /bundles/public/:scope/:name/:version/manifest.json    (anonymous)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js       (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/bundle.js.sig   (bearer-gated)
+ *   GET  /bundles/private/:scope/:name/:version/manifest.json   (bearer-gated)
  *
  * Bundle / signature / manifest serves go through {@link BundleStorage}
  * directly so the operator can plug a different storage backend
  * (memory for tests; filesystem for self-hosting) without rewriting
- * the route table. The server always emits
- * `Cache-Control: public, max-age=31536000, immutable` on these
- * routes — bundles are SRI-pinned + immutable post-publish.
+ * the route table.
+ *
+ * H1 visibility split: blob placement mirrors the manifest's
+ * `visibility` (`bundles/public/…` vs `bundles/private/…`), and the
+ * ROUTE decides the auth posture — the public prefix serves
+ * anonymously; the private prefix requires a bearer AND authorizes the
+ * caller against the artifact's publisher or the scope owner (403
+ * otherwise; unknown triples answer 404). A blob is only findable
+ * through the prefix it was published under, so a private artifact can
+ * never be fetched via the anonymous route.
+ *
+ * Cache headers: public-prefix responses emit
+ * `Cache-Control: public, max-age=31536000, immutable` (bundles are
+ * SRI-pinned + immutable post-publish); private-prefix responses stay
+ * immutable but non-shared-cacheable
+ * (`Cache-Control: private, max-age=31536000, immutable`).
  *
  * CORS: permissive on public-read routes (`/search`, `/pkg/*`,
- * `/bundles/*`, `/conformance/check`); strict on `/publish` (same-origin
- * or no Origin header — the install CLI runs server-to-server, not
- * browser-side).
+ * `/bundles/public/*`, `/conformance/check`); strict on `/publish`
+ * (same-origin or no Origin header — the install CLI runs
+ * server-to-server, not browser-side) AND on `/bundles/private/*`
+ * (per-caller authorized content — no ACAO, no permissive preflight;
+ * browser consumers of private bundles go through presigned URLs
+ * rather than cross-origin credentialed fetches).
  */
 import { Hono } from 'hono';
-import { checkConformance, deleteAuthorKey, unauthorizedErrorBody, listArtifactVersions, listAuthorKeys, publishArtifact, registerAuthorKey, readArtifact, searchArtifacts, } from '@ggui-ai/registry-core';
+import { canReadPrivateArtifact, checkConformance, createScopeOwnerResolver, deleteAuthorKey, unauthorizedErrorBody, listArtifactVersions, listAuthorKeys, publishArtifact, registerAuthorKey, readArtifact, searchArtifacts, } from '@ggui-ai/registry-core';
 const IMMUTABLE_CACHE_HEADER = 'public, max-age=31536000, immutable';
+/**
+ * Private-prefix responses are immutable too, but MUST NOT land in
+ * shared caches — the authorization decision is per-caller.
+ */
+const PRIVATE_IMMUTABLE_CACHE_HEADER = 'private, max-age=31536000, immutable';
 /**
  * Build the hono app. Does NOT bind a port — callers (the CLI, the
  * `createRegistryServer` factory, programmatic embeds) decide how to
@@ -40,18 +64,24 @@ export function createRegistryApp(options) {
     const clock = options.clock ?? (() => new Date());
     const blueprintProbe = options.blueprintProbe;
     const sigstoreTuf = options.sigstoreTuf;
+    const verifiedEmailResolver = options.verifiedEmailResolver;
     const app = new Hono();
     // Shared bearer gate for every authed route — ONE verification call
     // shape, ONE 401 body (`unauthorizedErrorBody`, exported beside the
     // registry-core error enums so every transport of this wire contract
     // agrees).
     const verifyBearer = (c) => authn.verify(c.req.header('authorization'));
-    // CORS — permissive read; strict for /publish. Adds ACAO headers
-    // AFTER the route runs so they overlay on the route's response.
+    // CORS — permissive read; strict for /publish AND the private
+    // bundle prefix (review finding 5). Private bundles are per-caller
+    // authorized content: no cross-origin page has any business reading
+    // them, and the browser consumers that need private bundle bytes go
+    // through presigned URLs, not cross-origin credentialed fetches.
+    // Adds ACAO headers AFTER the route runs so they overlay on the
+    // route's response.
     app.use('*', async (c, next) => {
         const path = c.req.path;
-        const isPublishRoute = path === '/publish';
-        if (c.req.method === 'OPTIONS' && !isPublishRoute) {
+        const isCorsExcluded = path === '/publish' || path.startsWith('/bundles/private/');
+        if (c.req.method === 'OPTIONS' && !isCorsExcluded) {
             // Preflight short-circuit for read routes. DELETE is listed for
             // the author-key management route — a browser console revokes
             // keys cross-origin ([E]).
@@ -65,7 +95,7 @@ export function createRegistryApp(options) {
             });
         }
         await next();
-        if (!isPublishRoute) {
+        if (!isCorsExcluded) {
             c.res.headers.set('Access-Control-Allow-Origin', '*');
             c.res.headers.set('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
             c.res.headers.set('Access-Control-Allow-Headers', 'content-type, authorization');
@@ -85,6 +115,8 @@ export function createRegistryApp(options) {
             limit: q.limit,
             cursor: q.cursor,
             sort: q.sort,
+            tool: q.tool,
+            server: q.server,
         }, { storage });
         if (!result.ok) {
             return c.json(result.body, result.status);
@@ -170,6 +202,7 @@ export function createRegistryApp(options) {
             registryHostname,
             ...(blueprintProbe !== undefined ? { blueprintProbe } : {}),
             ...(sigstoreTuf !== undefined ? { sigstoreTuf } : {}),
+            ...(verifiedEmailResolver !== undefined ? { verifiedEmailResolver } : {}),
         });
         return c.json(result.body, result.status);
     });
@@ -247,38 +280,112 @@ export function createRegistryApp(options) {
         catch {
             return c.json({ ok: false, errors: [{ code: 'manifest_invalid', message: 'request body is not valid JSON' }] }, 400);
         }
-        const result = checkConformance(payload);
+        const result = await checkConformance(payload);
         // Domain-vs-transport split: a "non-conformant" submission is a
         // valid request that produced a `ok: false` body. Mirrors the cloud
         // conformance handler's wire shape.
         return c.json(result, 200);
     });
-    // ── /bundles/:scope/:name/:version/bundle.js ─────────────────────────
-    app.get('/bundles/:scope/:name/:version/bundle.js', async (c) => {
+    // ── /bundles/public/… — anonymous, CDN-parity serving ────────────────
+    app.get('/bundles/public/:scope/:name/:version/bundle.js', async (c) => {
+        const { scope, name, version } = c.req.param();
+        return serveBundle(c, bundleStorage, scope, name, version, 'public');
+    });
+    app.get('/bundles/public/:scope/:name/:version/bundle.js.sig', async (c) => {
+        const { scope, name, version } = c.req.param();
+        return serveSignature(c, bundleStorage, scope, name, version, 'public');
+    });
+    app.get('/bundles/public/:scope/:name/:version/manifest.json', async (c) => {
+        const { scope, name, version } = c.req.param();
+        return serveManifest(c, bundleStorage, scope, name, version, 'public');
+    });
+    // ── /bundles/private/… — authenticated + ownership-authorized ────────
+    // Auth rule (H1): a valid bearer is required (401 — uniform, fires
+    // before any storage read, so it can't distinguish triples); then
+    // authorization goes through H2's shared `canReadPrivateArtifact`
+    // predicate (publisher OR scope owner; owner lookup lazy + memoized
+    // + fail-closed via `createScopeOwnerResolver`). Unknown triples,
+    // rows that are not private (their blobs live on the public prefix),
+    // AND authorization denials all answer the SAME opaque 404 — a
+    // distinguishable denial is an existence oracle for private
+    // artifacts. Storage faults answer the documented `server_error`
+    // envelope with NO raw error text (fail closed, log server-side).
+    const privateBundleGate = async (c, rawScope, name, version) => {
+        const verified = authn.verify(c.req.header('authorization'));
+        if (verified === null) {
+            return c.json({
+                error: 'unauthorized',
+                message: 'private bundles require a valid bearer token in the Authorization header',
+            }, 401);
+        }
+        const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
+        const artifactId = `${scope}/${name}`;
+        let row;
+        try {
+            row = await storage.getArtifactVersion(artifactId, version);
+        }
+        catch (err) {
+            // Fail closed with the documented envelope — the raw fault text
+            // stays server-side (a wire-visible internals string is both a
+            // leak and a fingerprint).
+            // eslint-disable-next-line no-console -- server-side operator signal; the wire stays opaque
+            console.error('registry: private bundle gate storage read failed', {
+                artifactId,
+                version,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return c.json(errorBody('server_error', 'internal error'), 500);
+        }
+        if (row === null || row.visibility !== 'private') {
+            return c.json(errorBody('not_found', 'bundle not found'), 404);
+        }
+        // `createScopeOwnerResolver` already resolves owner-lookup faults
+        // to null (deny) with its own server-side log, so no try/catch is
+        // needed around the predicate.
+        const authorized = await canReadPrivateArtifact(verified, row, createScopeOwnerResolver(storage, artifactId));
+        if (!authorized) {
+            return c.json(errorBody('not_found', 'bundle not found'), 404);
+        }
+        return null;
+    };
+    app.get('/bundles/private/:scope/:name/:version/bundle.js', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveBundle(c, bundleStorage, scope, name, version);
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveBundle(c, bundleStorage, scope, name, version, 'private');
     });
-    // ── /bundles/:scope/:name/:version/bundle.js.sig ─────────────────────
-    app.get('/bundles/:scope/:name/:version/bundle.js.sig', async (c) => {
+    app.get('/bundles/private/:scope/:name/:version/bundle.js.sig', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveSignature(c, bundleStorage, scope, name, version);
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveSignature(c, bundleStorage, scope, name, version, 'private');
     });
-    // ── /bundles/:scope/:name/:version/manifest.json ─────────────────────
-    app.get('/bundles/:scope/:name/:version/manifest.json', async (c) => {
+    app.get('/bundles/private/:scope/:name/:version/manifest.json', async (c) => {
         const { scope, name, version } = c.req.param();
-        return serveManifest(c, bundleStorage, scope, name, version);
+        const denied = await privateBundleGate(c, scope, name, version);
+        if (denied !== null)
+            return denied;
+        return serveManifest(c, bundleStorage, scope, name, version, 'private');
     });
     return app;
 }
+/** Cache header for the given prefix — see the module docstring. */
+function cacheHeaderFor(visibility) {
+    return visibility === 'public'
+        ? IMMUTABLE_CACHE_HEADER
+        : PRIVATE_IMMUTABLE_CACHE_HEADER;
+}
 /**
  * Serve the bundle bytes. `application/javascript` MIME with the
- * immutable cache header. 404 on miss.
+ * visibility-appropriate immutable cache header. 404 on miss.
  */
-async function serveBundle(c, bundleStorage, rawScope, name, version) {
+async function serveBundle(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let bytes;
     try {
-        bytes = await bundleStorage.getBundle(scope, name, version);
+        bytes = await bundleStorage.getBundle(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -297,15 +404,15 @@ async function serveBundle(c, bundleStorage, rawScope, name, version) {
         status: 200,
         headers: {
             'Content-Type': 'application/javascript; charset=utf-8',
-            'Cache-Control': IMMUTABLE_CACHE_HEADER,
+            'Cache-Control': cacheHeaderFor(visibility),
         },
     });
 }
-async function serveSignature(c, bundleStorage, rawScope, name, version) {
+async function serveSignature(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let sig;
     try {
-        sig = await bundleStorage.getSignature(scope, name, version);
+        sig = await bundleStorage.getSignature(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -313,14 +420,14 @@ async function serveSignature(c, bundleStorage, rawScope, name, version) {
     if (sig === null) {
         return c.json(errorBody('not_found', 'signature not found'), 404);
     }
-    c.header('Cache-Control', IMMUTABLE_CACHE_HEADER);
+    c.header('Cache-Control', cacheHeaderFor(visibility));
     return c.json(sig, 200);
 }
-async function serveManifest(c, bundleStorage, rawScope, name, version) {
+async function serveManifest(c, bundleStorage, rawScope, name, version, visibility) {
     const scope = rawScope.startsWith('@') ? rawScope : `@${rawScope}`;
     let manifest;
     try {
-        manifest = await bundleStorage.getManifest(scope, name, version);
+        manifest = await bundleStorage.getManifest(scope, name, version, visibility);
     }
     catch (err) {
         return c.json(errorBody('server_error', errorMessage(err)), 500);
@@ -328,7 +435,7 @@ async function serveManifest(c, bundleStorage, rawScope, name, version) {
     if (manifest === null) {
         return c.json(errorBody('not_found', 'manifest not found'), 404);
     }
-    c.header('Cache-Control', IMMUTABLE_CACHE_HEADER);
+    c.header('Cache-Control', cacheHeaderFor(visibility));
     return c.json(manifest, 200);
 }
 function errorBody(error, message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/registry-server",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Self-hostable HTTP server for the ggui marketplace registry. Wraps @ggui-ai/registry-core with hono, filesystem storage, and bearer-token auth. Run via npx for local dev, CI, and on-prem deployments.",
   "keywords": [
     "ggui",
@@ -31,9 +31,9 @@
   "dependencies": {
     "@hono/node-server": "^2.0.12",
     "hono": "^4.12.8",
-    "@ggui-ai/artifact-manifest": "0.7.0",
-    "@ggui-ai/gadget-signing": "0.7.0",
-    "@ggui-ai/registry-core": "0.7.0"
+    "@ggui-ai/artifact-manifest": "0.9.0",
+    "@ggui-ai/gadget-signing": "0.9.0",
+    "@ggui-ai/registry-core": "0.9.0"
   },
   "devDependencies": {
     "@sigstore/mock": "~0.12.1",