@hiyve/cli 1.0.17 → 1.0.19

package/src/commands/init.test.js

@@ -0,0 +1,151 @@
+/**
+ * The scaffolder must produce a project that installs and runs against the
+ * PUBLISHED packages and matches the getting-started guide. It drifted
+ * badly once (2026-09-01): MUI ^5 against a ^9 peer (ERESOLVE on install), a
+ * hand-rolled token route posting to a host with no DNS record, no region
+ * pin, and env var names the SDK does not read. These tests check the
+ * generated output against the real peer ranges in this workspace so the
+ * next drift fails here, not on a developer's first `npm install`.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import {
+  PINS,
+  DEFAULT_REGION,
+  generatePackageJson,
+  generateEnvExample,
+  generateMain,
+  generateApp,
+  generateVideoRoom,
+  generateServer,
+  generateViteConfig,
+  generateTsConfig,
+} from './init.js';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const workspacePkg = (name) =>
+  JSON.parse(readFileSync(join(here, '../../../..', name, 'package.json'), 'utf8'));
+
+const TEMPLATES = {
+  basic: { packages: ['@hiyve/react', '@hiyve/react-ui', '@hiyve/admin'], features: { intelligence: false, collaboration: false } },
+  ai: { packages: ['@hiyve/react', '@hiyve/react-ui', '@hiyve/react-intelligence', '@hiyve/admin'], features: { intelligence: true, collaboration: false } },
+  full: { packages: ['@hiyve/react-room', '@hiyve/react-intelligence', '@hiyve/react-semantic-relay', '@hiyve/admin'], features: { intelligence: true, collaboration: true } },
+};
+
+/** Major of a ^x.y.z / ~x.y.z pin. */
+const majorOf = (range) => Number.parseInt(range.replace(/^[\^~]/, ''), 10);
+/** Majors a caret-only peer range admits, e.g. "^18.0.0 || ^19.0.0" -> [18, 19]. */
+const peerMajors = (peer) => peer.split('||').map((r) => majorOf(r.trim()));
+/** Does a caret pin fall inside a caret-only peer range? */
+const rangeFitsPeer = (pin, peer) => peerMajors(peer).includes(majorOf(pin));
+
+describe('generated package.json', () => {
+  const pkg = JSON.parse(generatePackageJson('demo', TEMPLATES.basic));
+
+  it('pins MUI inside the range @hiyve/react-ui and @hiyve/react-room actually require', () => {
+    for (const p of ['react-ui', 'react-room']) {
+      const peer = workspacePkg(`packages/${p}`).peerDependencies['@mui/material'];
+      expect(rangeFitsPeer(pkg.dependencies['@mui/material'], peer), `${p} wants ${peer}`).toBe(true);
+    }
+    expect(pkg.dependencies['@mui/icons-material']).toBe(pkg.dependencies['@mui/material']);
+  });
+
+  it('pins React inside the range @hiyve/react requires', () => {
+    const peer = workspacePkg('packages/react').peerDependencies.react;
+    expect(rangeFitsPeer(pkg.dependencies.react, peer)).toBe(true);
+    expect(pkg.dependencies['react-dom']).toBe(pkg.dependencies.react);
+  });
+
+  it('never pins MUI 5 or React 18 — the drift that broke install', () => {
+    expect(majorOf(pkg.dependencies['@mui/material'])).toBeGreaterThanOrEqual(9);
+    expect(majorOf(pkg.dependencies.react)).toBeGreaterThanOrEqual(19);
+  });
+
+  it('includes @hiyve/admin — the token server is the SDK, not hand-rolled', () => {
+    expect(pkg.dependencies['@hiyve/admin']).toBeDefined();
+    expect(pkg.dependencies.express).toBeDefined();
+    expect(pkg.dependencies.cors).toBeDefined();
+  });
+
+  it('every dev dependency the tsconfig relies on is present', () => {
+    for (const k of ['@types/node', 'typescript', 'vite', '@vitejs/plugin-react', 'tsx', 'concurrently']) {
+      expect(pkg.devDependencies[k], k).toBe(PINS[k]);
+    }
+  });
+});
+
+describe('generated server', () => {
+  const server = generateServer();
+
+  it('mounts the SDK routes instead of posting to a signaling host by hand', () => {
+    expect(server).toContain("from '@hiyve/admin'");
+    expect(server).toContain('mountHiyveRoutes(apiRouter, loadHiyveConfig())');
+    expect(server).toContain("app.use('/api', apiRouter)");
+    expect(server).not.toContain('signal.hiyve.dev');
+    expect(server).not.toContain('/api/rooms/token');
+    expect(server).not.toContain('HIYVE_API_KEY');
+  });
+
+  it('listens where vite proxies /api to', () => {
+    const port = server.match(/\|\| (\d+);/)[1];
+    expect(generateViteConfig()).toContain(`http://localhost:${port}`);
+  });
+});
+
+describe('generated .env.example', () => {
+  it('uses the variable names loadHiyveConfig reads, and the region the client pins', () => {
+    const env = generateEnvExample(TEMPLATES.basic);
+    expect(env).toMatch(/^APIKEY=pk_/m);
+    expect(env).toMatch(/^CLIENT_SECRET=sk_/m);
+    expect(env).toContain(`SERVER_REGION=${DEFAULT_REGION}`);
+    expect(env).not.toContain('HIYVE_API_KEY');
+    expect(env).not.toContain('signal.hiyve.dev');
+    expect(env).toContain('console.hiyve.dev');
+  });
+});
+
+describe('region pin', () => {
+  it('basic/ai: HiyveProvider in main.tsx carries the region', () => {
+    expect(generateMain(TEMPLATES.basic)).toContain(`<HiyveProvider region="${DEFAULT_REGION}">`);
+    expect(generateMain(TEMPLATES.ai)).toContain(`<HiyveProvider region="${DEFAULT_REGION}">`);
+  });
+
+  it('full: HiyveRoom carries the region and main.tsx does not double-wrap', () => {
+    expect(generateApp(TEMPLATES.full)).toContain(`region={REGION}`);
+    expect(generateApp(TEMPLATES.full)).toContain(`const REGION = '${DEFAULT_REGION}'`);
+    expect(generateMain(TEMPLATES.full)).not.toContain('HiyveProvider');
+  });
+
+  it('client and server agree on the region', () => {
+    const env = generateEnvExample(TEMPLATES.full);
+    const serverRegion = env.match(/^SERVER_REGION=(\S+)/m)[1];
+    expect(serverRegion).toBe(DEFAULT_REGION);
+  });
+});
+
+describe('generated client', () => {
+  it('basic/ai is the guide verbatim: useRoomFlow + JoinForm, SDK fetches the token', () => {
+    const app = generateApp(TEMPLATES.basic);
+    expect(app).toContain("import { useRoomFlow } from '@hiyve/react'");
+    expect(app).toContain('<JoinForm autoConnect devicePreviewMode="inline" />');
+    expect(app).not.toContain('fetch(');
+    expect(generateVideoRoom()).toContain('<VideoGrid localVideoElementId="local-video"');
+  });
+
+  it('full fetches tokens from the SDK routes and reads the fields they return', () => {
+    const app = generateApp(TEMPLATES.full);
+    expect(app).toContain("fetch('/api/generate-room-token'");
+    expect(app).toContain('return data.roomToken');
+    expect(app).toContain("fetch('/api/generate-cloud-token'");
+    expect(app).toContain('return data.cloudToken');
+    expect(app).not.toContain('/api/token');
+  });
+
+  it('tsconfig covers both the browser and the server sources', () => {
+    const ts = JSON.parse(generateTsConfig());
+    expect(ts.include).toEqual(expect.arrayContaining(['src', 'server']));
+    expect(ts.compilerOptions.types).toEqual(expect.arrayContaining(['vite/client', 'node']));
+  });
+});

package/src/commands/list.js

@@ -6,9 +6,9 @@
 
 import chalk from 'chalk';
 import ora from 'ora';
-import { getApiUrl } from '../config.js';
+import { fetchPackageCatalogue } from '../utils/registryApi.js';
 import { getCurrentConfig } from '../utils/npmrc.js';
-import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
+import { printDevHint, printDevModeBanner } from '../utils/output.js';
 
 /**
  * List available packages
@@ -32,22 +32,16 @@ export async function list() {
   const spinner = ora('Fetching packages...').start();
 
   try {
-    const response = await fetchWithTimeout(`${getApiUrl()}packages`, {
-      headers: {
-        Authorization: `Bearer ${config.apiKey}`,
-      },
-    });
+    const data = await fetchPackageCatalogue(config.apiKey);
 
-    if (!response.ok) {
+    if (!data.ok) {
       spinner.fail('Failed to fetch packages');
-      const error = await response.json().catch(() => ({ error: 'Unknown error' }));
       console.log('');
-      console.log(chalk.red(`  ${error.error || 'Failed to fetch packages'}`));
+      console.log(chalk.red(`  ${data.error}`));
       printDevHint('list');
       process.exit(1);
     }
 
-    const data = await response.json();
     spinner.succeed(`Found ${data.total} packages`);
     console.log('');
 
@@ -55,7 +49,7 @@ export async function list() {
     if (data.sdk?.length > 0) {
       console.log(chalk.white.bold('SDK Packages:'));
       for (const pkg of data.sdk) {
-        console.log(chalk.cyan(`  ${pkg.name}`));
+        console.log(chalk.cyan(`  ${pkg.name}`) + (pkg.version ? chalk.gray(`  ${pkg.version}`) : ''));
       }
       console.log('');
     }
@@ -64,7 +58,7 @@ export async function list() {
     if (data.components?.length > 0) {
       console.log(chalk.white.bold('Component Packages:'));
       for (const pkg of data.components) {
-        console.log(chalk.cyan(`  ${pkg.name}`));
+        console.log(chalk.cyan(`  ${pkg.name}`) + (pkg.version ? chalk.gray(`  ${pkg.version}`) : ''));
       }
       console.log('');
     }

package/src/commands/login.js

@@ -8,8 +8,9 @@ import prompts from 'prompts';
 import chalk from 'chalk';
 import ora from 'ora';
 import { configureNpmrc } from '../utils/npmrc.js';
-import { getApiUrl, getRegistryUrl } from '../config.js';
-import { printDevHint, printDevModeBanner, fetchWithTimeout } from '../utils/output.js';
+import { getRegistryUrl } from '../config.js';
+import { verifyApiKey, fetchPackageCatalogue } from '../utils/registryApi.js';
+import { printDevHint, printDevModeBanner } from '../utils/output.js';
 
 /**
  * Login to Hiyve and configure npm
@@ -77,31 +78,18 @@ export async function login(options) {
   const spinner = ora('Verifying API key...').start();
 
   try {
-    const response = await fetchWithTimeout(`${getApiUrl()}verify`, {
-      headers: {
-        Authorization: `Bearer ${apiKey}`,
-      },
-    });
+    const result = await verifyApiKey(apiKey);
 
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({ error: 'Unknown error' }));
+    if (!result.ok) {
       spinner.fail('API key verification failed');
       console.log('');
-      console.log(chalk.red(`  ${error.error || 'Invalid API key'}`));
+      console.log(chalk.red(`  ${result.error}`));
       printDevHint('login');
       process.exit(1);
     }
 
-    const data = await response.json();
     spinner.succeed('API key verified');
-
-    // Server returns a masked key — always mask client-side as a safety net
-    if (data.apiKey) {
-      const display = data.apiKey.length > 12
-        ? `${data.apiKey.slice(0, 8)}...${data.apiKey.slice(-4)}`
-        : data.apiKey;
-      console.log(chalk.gray(`  Account: ${display}`));
-    }
+    console.log(chalk.gray(`  Account: ${result.apiKey}`));
   } catch (err) {
     if (err.name === 'AbortError') {
       spinner.fail('Request timed out');
@@ -137,13 +125,9 @@ export async function login(options) {
 
   // Fetch available packages from registry
   try {
-    const packagesResponse = await fetchWithTimeout(`${getApiUrl()}packages`, {
-      headers: { Authorization: `Bearer ${apiKey}` },
-    });
-
-    if (packagesResponse.ok) {
-      const packages = await packagesResponse.json();
+    const packages = await fetchPackageCatalogue(apiKey);
 
+    if (packages.ok) {
       console.log(`You can now install ${packages.total} Hiyve packages:`);
       console.log('');
 

package/src/commands/whoami.js

@@ -7,7 +7,7 @@
 import chalk from 'chalk';
 import ora from 'ora';
 import { getCurrentConfig } from '../utils/npmrc.js';
-import { getApiUrl } from '../config.js';
+import { verifyApiKey } from '../utils/registryApi.js';
 
 /**
  * Show current authentication status
@@ -39,19 +39,10 @@ export async function whoami() {
     const spinner = ora('Verifying with server...').start();
 
     try {
-      const response = await fetch(`${getApiUrl()}verify`, {
-        headers: {
-          Authorization: `Bearer ${config.apiKey}`,
-        },
-      });
+      const result = await verifyApiKey(config.apiKey);
 
-      if (response.ok) {
-        const data = await response.json();
+      if (result.ok) {
         spinner.succeed('API key is valid');
-
-        if (data.email) {
-          console.log(`  Email:     ${chalk.cyan(data.email)}`);
-        }
       } else {
         spinner.warn('API key may be invalid or expired');
         console.log('');

package/src/config.js

@@ -1,35 +1,20 @@
 /**
  * Hiyve CLI Configuration
  *
- * Two URLs matter:
- *   - API URL: where the CLI talks to (verify, list, packages). Switches with --dev.
- *   - Registry URL: what goes into ~/.npmrc for npm to fetch tarballs. Always prod.
- */
-
-// The CLI's own API — key verification and the package catalogue, served by
-// hiyve-cloud at /registry/{verify,packages}.
-const PROD_API_URL = 'https://cloud.hiyve.io/registry/';
-// No separate development cloud exists — kept so --dev stays a valid flag,
-// but it reaches the SAME live host (2026-08-24).
-const DEV_API_URL = 'https://cloud.hiyve.io/registry/';
-
-/**
- * Where npm actually fetches tarballs. DELIBERATELY NOT the API URL.
+ * One host: registry.muziemedia.com, the Verdaccio registry `changeset
+ * publish` writes to. It is both where npm fetches tarballs (what `login`
+ * puts in ~/.npmrc) and where the CLI verifies keys and lists packages,
+ * through standard npm endpoints — see utils/registryApi.js.
  *
- * This used to return getApiUrl(), on the assumption that "tarballs are
- * served through the same API". They are not: the cloud's /registry proxy
- * serves a stale catalogue whose `dist.tarball` URLs still name
- * api.muziemedia.com — a host with no DNS record — so a packument fetch
- * succeeded and the download that followed failed with ENOTFOUND. npm does
- * not rewrite tarball hosts for a non-npmjs registry, so the URL in the
- * metadata is the URL it uses.
- *
- * registry.muziemedia.com is the Verdaccio registry `changeset publish`
- * actually publishes to. Verified 2026-08-24 with a customer pk_ key: it
- * authenticates API keys natively (the proxy is not needed for auth),
- * serves current versions, its tarball URLs point at itself, and the
- * download returns a valid package.
+ * The CLI used to talk to a separate API at cloud.hiyve.io/registry/
+ * ({verify,packages}). That is the retired S3-backed registry: a frozen
+ * catalogue (it still lists packages that no longer exist and reports
+ * versions five majors behind) whose tarball URLs once named
+ * api.muziemedia.com — a host with no DNS record. Nothing here should point
+ * at it again. `--dev` remains a valid flag but there is only one registry,
+ * so it changes nothing (there has been no separate dev host since 2026-08-24).
  */
+
 const REGISTRY_URL_VALUE = 'https://registry.muziemedia.com/';
 
 let _devMode = false;
@@ -42,16 +27,17 @@ export function setDevMode(enabled) {
 }
 
 /**
- * Get the API URL for CLI operations (verify, list, packages).
- * Switches between dev and prod based on --dev flag.
+ * Base URL for the CLI's own calls (verify, list). This IS the registry —
+ * kept as a separate function because index.js exports it and because the
+ * two roles were once different hosts. Ignores --dev: one registry.
  */
 export function getApiUrl() {
-  return _devMode ? DEV_API_URL : PROD_API_URL;
+  return REGISTRY_URL_VALUE;
 }
 
 /**
  * Get the registry URL for ~/.npmrc (where npm fetches tarballs).
- * Independent of the API URL, and of --dev: there is one registry.
+ * Ignores --dev: there is one registry.
  */
 export function getRegistryUrl() {
   return REGISTRY_URL_VALUE;
@@ -65,7 +51,6 @@ export function isDevMode() {
 }
 
 // Backwards-compatible named export
-// The npm registry, NOT the CLI API (they are different hosts — see above).
 export const REGISTRY_URL = REGISTRY_URL_VALUE;
 
 export default {

package/src/config.test.js

@@ -11,23 +11,29 @@ describe('config', () => {
     expect(config.REGISTRY_URL).toBe('https://registry.muziemedia.com/');
   });
 
-  it('getApiUrl returns prod URL by default', () => {
+  it('getApiUrl is the registry — there is no separate CLI API host', () => {
     setDevMode(false);
-    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
+    expect(getApiUrl()).toBe('https://registry.muziemedia.com/');
   });
 
-  it('getApiUrl returns dev URL when dev mode is enabled', () => {
+  it('getApiUrl ignores dev mode', () => {
     setDevMode(true);
-    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
+    expect(getApiUrl()).toBe('https://registry.muziemedia.com/');
     setDevMode(false);
   });
 
-  it('getRegistryUrl is the npm registry, NOT the API host', () => {
-    // These are different services: the API serves /verify and /packages
-    // from hiyve-cloud; npm fetches tarballs from Verdaccio. Conflating them
-    // shipped a registry whose tarball URLs pointed at a dead host.
+  it('never points at the retired S3-backed registry', () => {
+    // cloud.hiyve.io/registry/ still answers but serves a frozen catalogue
+    // (@hiyve/core 2.0.22 there vs 7.0.0 live) and once advertised tarballs
+    // on a host with no DNS record. The CLI must verify keys and list
+    // packages against the registry npm actually installs from.
+    expect(getApiUrl()).not.toContain('cloud.hiyve.io');
+    expect(getRegistryUrl()).not.toContain('cloud.hiyve.io');
+  });
+
+  it('getRegistryUrl and getApiUrl are the same host', () => {
     expect(getRegistryUrl()).toBe('https://registry.muziemedia.com/');
-    expect(getRegistryUrl()).not.toBe(getApiUrl());
+    expect(getRegistryUrl()).toBe(getApiUrl());
   });
 
   it('getRegistryUrl does NOT switch with dev mode — there is one registry', () => {

package/src/utils/registryApi.js

@@ -0,0 +1,145 @@
+/**
+ * The CLI's view of the npm registry.
+ *
+ * Every command used to call a bespoke API at cloud.hiyve.io/registry/
+ * ({verify,packages}). That is the retired S3-backed registry: its catalogue
+ * is frozen (it still lists @hiyve/auth, which no longer exists, and reports
+ * @hiyve/core at 2.0.22 against 7.0.0 live) and it is not where npm installs
+ * from. registry.muziemedia.com — the Verdaccio registry `changeset publish`
+ * writes to and the host `login` puts in ~/.npmrc — is the only source of
+ * truth, and it exposes everything the CLI needs through standard npm
+ * endpoints. Verified 2026-09-01:
+ *
+ *   GET /@hiyve/<pkg>              200 with a valid key, 401 without or with
+ *                                  a bad one. Packuments and tarballs are
+ *                                  both gated.
+ *   GET /-/whoami                  200 `{username}` for a valid key — but
+ *                                  ALSO 200 `{}` for a bad key or none, so
+ *                                  it cannot be the validity check.
+ *   GET /-/v1/search?text=@hiyve   200, the live catalogue; unauthenticated.
+ */
+
+import { getApiUrl } from '../config.js';
+import { fetchWithTimeout } from './output.js';
+
+/**
+ * A packument that always exists and is small. Fetching it with the key is
+ * the validity check: the response code is the registry's own verdict on
+ * whether this key can install @hiyve packages.
+ */
+const PROBE_PACKAGE = '@hiyve/cli';
+
+/** Verdaccio's search cap is per request; the catalogue is ~70 packages. */
+const SEARCH_PAGE_SIZE = 250;
+
+/**
+ * The packages the getting-started guide installs first. Listed as "SDK";
+ * everything else on the registry is listed as a component package. This
+ * is presentation only — it does not gate anything.
+ */
+const FOUNDATION_PACKAGES = new Set([
+  '@hiyve/core',
+  '@hiyve/react',
+  '@hiyve/react-ui',
+  '@hiyve/react-room',
+  '@hiyve/rtc-client',
+  '@hiyve/rtc-client-rn',
+  '@hiyve/utilities',
+  '@hiyve/admin',
+  '@hiyve/cloud',
+  '@hiyve/identity-client',
+  '@hiyve/cli',
+]);
+
+/**
+ * Mask an API key for display: `pk_live_...abcd`.
+ * @param {string} apiKey
+ * @returns {string}
+ */
+export function maskApiKey(apiKey) {
+  if (typeof apiKey !== 'string') return '';
+  return apiKey.length > 12 ? `${apiKey.slice(0, 8)}...${apiKey.slice(-4)}` : apiKey;
+}
+
+/**
+ * Verify an API key against the registry.
+ *
+ * @param {string} apiKey
+ * @returns {Promise<{ ok: true, apiKey: string } | { ok: false, status: number, error: string }>}
+ *   `apiKey` in the success shape is already masked.
+ * @throws on network failure / timeout (AbortError) — callers own that message.
+ */
+export async function verifyApiKey(apiKey) {
+  const response = await fetchWithTimeout(`${getApiUrl()}${PROBE_PACKAGE}`, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+  });
+
+  if (response.ok) {
+    return { ok: true, apiKey: maskApiKey(apiKey) };
+  }
+
+  const body = await response.json().catch(() => ({}));
+  const error =
+    body.error ||
+    (response.status === 401 || response.status === 403
+      ? 'Invalid API key'
+      : `Registry returned HTTP ${response.status}`);
+  return { ok: false, status: response.status, error };
+}
+
+/**
+ * Turn Verdaccio's search response into the catalogue the commands print.
+ * Exported for tests; `fetchPackageCatalogue` is the one commands call.
+ *
+ * @param {{ objects?: Array<{ package?: { name?: string, version?: string, 'dist-tags'?: { latest?: string } } }> }} searchResult
+ * @returns {{ total: number, sdk: Array<{name: string, version: string}>, components: Array<{name: string, version: string}> }}
+ */
+export function catalogueFromSearch(searchResult) {
+  const seen = new Set();
+  const packages = [];
+  for (const entry of searchResult?.objects ?? []) {
+    const name = entry?.package?.name;
+    if (typeof name !== 'string' || !name.startsWith('@hiyve/') || seen.has(name)) continue;
+    seen.add(name);
+    // Verdaccio's search objects carry the current version as
+    // `dist-tags.latest`, not `version` (that is the npmjs.com shape).
+    const pkg = entry.package;
+    const version = pkg.version ?? pkg['dist-tags']?.latest ?? '';
+    packages.push({ name, version });
+  }
+  packages.sort((a, b) => a.name.localeCompare(b.name));
+
+  return {
+    total: packages.length,
+    sdk: packages.filter((p) => FOUNDATION_PACKAGES.has(p.name)),
+    components: packages.filter((p) => !FOUNDATION_PACKAGES.has(p.name)),
+  };
+}
+
+/**
+ * List the @hiyve packages the registry currently serves.
+ *
+ * @param {string} apiKey
+ * @returns {Promise<{ ok: true, total: number, sdk: Array<{name: string, version: string}>, components: Array<{name: string, version: string}> } | { ok: false, status: number, error: string }>}
+ * @throws on network failure / timeout (AbortError)
+ */
+export async function fetchPackageCatalogue(apiKey) {
+  const url = `${getApiUrl()}-/v1/search?text=${encodeURIComponent('@hiyve')}&size=${SEARCH_PAGE_SIZE}`;
+  const response = await fetchWithTimeout(url, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+  });
+
+  if (!response.ok) {
+    const body = await response.json().catch(() => ({}));
+    return {
+      ok: false,
+      status: response.status,
+      error: body.error || `Registry returned HTTP ${response.status}`,
+    };
+  }
+
+  const searchResult = await response.json().catch(() => ({}));
+  return { ok: true, ...catalogueFromSearch(searchResult) };
+}
+
+export default { maskApiKey, verifyApiKey, catalogueFromSearch, fetchPackageCatalogue };