@kb-labs/marketplace-registry-api 2.96.0

package/README.md

@@ -0,0 +1,5 @@
+# @kb-labs/marketplace-registry-api
+
+> Part of [KB Labs](https://github.com/KirillBaranov/kb-labs) ecosystem.
+
+REST API handlers for the marketplace registry plugin.

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+import { FastifyInstance } from 'fastify';
+import { ILogger } from '@kb-labs/core-platform';
+import { JwtConfig } from '@kb-labs/gateway-auth';
+import { RegistryService } from '@kb-labs/marketplace-registry-core';
+
+interface RegistryServerOptions {
+    port?: number;
+    host?: string;
+    logger: ILogger;
+    registry: RegistryService;
+    jwtConfig?: JwtConfig;
+}
+declare function createRegistryServer(opts: RegistryServerOptions): Promise<FastifyInstance>;
+
+export { type RegistryServerOptions, createRegistryServer };

package/dist/index.js

@@ -0,0 +1,321 @@
+import multipart from '@fastify/multipart';
+import { HttpObservabilityCollector, createDaemonServer, createServiceReadyResponse } from '@kb-labs/shared-http';
+import { verifyAccessToken } from '@kb-labs/gateway-auth';
+
+// src/server.ts
+
+// src/multipart.ts
+async function parseMultipart(req) {
+  const parts = req.parts?.();
+  if (!parts) {
+    return { tarball: null, fields: {} };
+  }
+  let tarball = null;
+  const fields = {};
+  for await (const part of parts) {
+    if (part.file) {
+      if (part.fieldname === "tarball") {
+        const chunks = [];
+        for await (const chunk of part.file) {
+          chunks.push(chunk);
+        }
+        tarball = Buffer.concat(chunks);
+      } else {
+        for await (const _ of part.file) {
+        }
+      }
+    } else {
+      fields[part.fieldname] = part.value;
+    }
+  }
+  return { tarball, fields };
+}
+
+// src/routes/packages.ts
+function registerPackageRoutes(app, registry) {
+  app.get("/api/v1/packages", async (req, reply) => {
+    const q = req.query?.q;
+    const packages = q?.trim() ? await registry.searchPackages(q) : await registry.listPublicPackages();
+    return reply.send(packages);
+  });
+  app.get(
+    "/api/v1/packages/:handle/:name",
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      const entry = await registry.getEntry(handle, name);
+      if (!entry) {
+        return reply.code(404).send({ error: "Package not found" });
+      }
+      const token = extractShareToken(req);
+      const resolvedToken = token ? await registry.resolveShareToken(token) : null;
+      const callerNs = req.authContext?.namespaceId ?? null;
+      if (!registry.canAccess(entry, callerNs, resolvedToken)) {
+        return reply.code(403).send({ error: "Access denied" });
+      }
+      return reply.send(entry);
+    }
+  );
+  app.get(
+    "/api/v1/packages/:handle/:name/stats",
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      return reply.send(await registry.getStats(handle, name));
+    }
+  );
+  app.get("/api/v1/my/packages", { preHandler: requireAuth }, async (req, reply) => {
+    const { namespaceId } = req.authContext;
+    const packages = await registry.listByAuthor(namespaceId);
+    return reply.send(packages);
+  });
+  app.post("/api/v1/packages/publish", { preHandler: requireAuth }, async (req, reply) => {
+    const { namespaceId } = req.authContext;
+    const handle = req.headers["x-author-handle"];
+    if (!handle) {
+      return reply.code(400).send({ error: "Missing X-Author-Handle header" });
+    }
+    const { tarball, fields } = await parseMultipart(req);
+    if (!tarball) {
+      return reply.code(400).send({ error: "Missing tarball file" });
+    }
+    if (!fields.meta) {
+      return reply.code(400).send({ error: "Missing meta field" });
+    }
+    let publishReq;
+    try {
+      publishReq = JSON.parse(fields.meta);
+    } catch {
+      return reply.code(400).send({ error: "Invalid meta JSON" });
+    }
+    const result = await registry.publish(tarball, publishReq, handle, namespaceId);
+    return reply.code(201).send(result);
+  });
+  app.patch(
+    "/api/v1/packages/:handle/:name/meta",
+    { preHandler: requireAuth },
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      await assertOwner(req, registry, handle, name);
+      await registry.updateMeta(handle, name, req.body ?? {});
+      return reply.code(204).send();
+    }
+  );
+  app.post(
+    "/api/v1/packages/:handle/:name/:version/yank",
+    { preHandler: requireAuth },
+    async (req, reply) => {
+      const { handle, name, version } = req.params;
+      await assertOwner(req, registry, handle, name);
+      const { reason } = req.body ?? {};
+      await registry.yank(handle, name, version, reason);
+      return reply.code(204).send();
+    }
+  );
+  app.post(
+    "/api/v1/packages/:handle/:name/deprecate",
+    { preHandler: requireAuth },
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      await assertOwner(req, registry, handle, name);
+      const { message } = req.body ?? {};
+      await registry.deprecate(handle, name, message);
+      return reply.code(204).send();
+    }
+  );
+  app.post(
+    "/api/v1/packages/:handle/:name/share/allowlist",
+    { preHandler: requireAuth },
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      await assertOwner(req, registry, handle, name);
+      const { namespaceId } = req.body ?? {};
+      if (!namespaceId) {
+        return reply.code(400).send({ error: "Missing namespaceId" });
+      }
+      await registry.addToAllowlist(handle, name, namespaceId);
+      return reply.code(204).send();
+    }
+  );
+  app.post(
+    "/api/v1/packages/:handle/:name/share/token",
+    { preHandler: requireAuth },
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      await assertOwner(req, registry, handle, name);
+      const { ttlDays } = req.body ?? {};
+      const ttlMs = ttlDays ? ttlDays * 24 * 60 * 60 * 1e3 : void 0;
+      const shareToken = await registry.createShareToken(handle, name, ttlMs);
+      return reply.code(201).send(shareToken);
+    }
+  );
+  app.get(
+    "/api/v1/packages/:handle/:name/:version/tarball",
+    async (req, reply) => {
+      const { handle, name, version } = req.params;
+      const entry = await registry.getEntry(handle, name);
+      if (!entry) {
+        return reply.code(404).send({ error: "Package not found" });
+      }
+      const token = extractShareToken(req);
+      const resolvedToken = token ? await registry.resolveShareToken(token) : null;
+      const callerNs = req.authContext?.namespaceId ?? null;
+      if (!registry.canAccess(entry, callerNs, resolvedToken)) {
+        return reply.code(403).send({ error: "Access denied" });
+      }
+      const { tarball, signature } = await registry.getTarball(handle, name, version);
+      await registry.incrementInstalls(handle, name);
+      return reply.header("Content-Type", "application/octet-stream").header("Content-Disposition", `attachment; filename="${name}-${version}.tgz"`).header("X-Registry-Signature", signature ? JSON.stringify(signature) : "").send(tarball);
+    }
+  );
+  app.post(
+    "/api/v1/admin/packages/:handle/:name/feature",
+    { preHandler: requireAdmin },
+    async (req, reply) => {
+      const { handle, name } = req.params;
+      const { featured = true } = req.body ?? {};
+      await registry.setFeatured(handle, name, featured);
+      return reply.code(204).send();
+    }
+  );
+}
+function requireAuth(req, reply, done) {
+  if (!req.authContext) {
+    reply.code(401).send({ error: "Unauthorized" });
+    return;
+  }
+  done();
+}
+function requireAdmin(req, reply, done) {
+  if (!req.authContext || !req.authContext.permissions?.includes("admin")) {
+    reply.code(403).send({ error: "Forbidden" });
+    return;
+  }
+  done();
+}
+async function assertOwner(req, registry, handle, name) {
+  const entry = await registry.getEntry(handle, name);
+  if (!entry) {
+    throw Object.assign(new Error("Package not found"), { statusCode: 404 });
+  }
+  if (entry.authorNamespaceId !== req.authContext.namespaceId) {
+    throw Object.assign(new Error("Forbidden"), { statusCode: 403 });
+  }
+}
+function extractShareToken(req) {
+  return req.query?.token ?? req.headers["x-share-token"];
+}
+var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
+  "/health",
+  "/ready",
+  "/metrics",
+  "/observability/describe",
+  "/observability/health",
+  "/docs",
+  "/docs/json"
+]);
+function createRegistryAuthMiddleware(jwtConfig) {
+  return async function registryAuthMiddleware(request, reply) {
+    const pathname = new URL(request.url, "http://localhost").pathname;
+    if (PUBLIC_ROUTES.has(pathname) || pathname.startsWith("/docs")) {
+      return;
+    }
+    if (request.method === "GET" && (pathname.startsWith("/api/v1/packages") || pathname.startsWith("/api/v1/my"))) ;
+    const authHeader = request.headers.authorization;
+    const token = authHeader?.match(/^Bearer\s+(.+)$/i)?.[1] ?? null;
+    if (!token) {
+      return;
+    }
+    const payload = await verifyAccessToken(token, jwtConfig);
+    if (!payload) {
+      return reply.code(401).send({ error: "Unauthorized", message: "Invalid token" });
+    }
+    request.authContext = {
+      type: payload.type,
+      userId: payload.sub ?? "",
+      namespaceId: payload.namespaceId,
+      tier: payload.tier,
+      permissions: ["host:connect"]
+    };
+  };
+}
+
+// src/server.ts
+function wrapObservability(collector) {
+  return {
+    register: (server) => collector.register(server),
+    buildDescribe: () => collector.buildDescribe(),
+    renderPrometheusMetrics: (status, extra) => collector.renderPrometheusMetrics(status, extra),
+    buildHealth: (_params) => collector.buildHealth({
+      status: "healthy",
+      checks: [{ id: "registry-service", status: "ok", message: "Registry service registered" }],
+      meta: { serviceHealthEndpoint: "/health" }
+    })
+  };
+}
+async function createRegistryServer(opts) {
+  const { logger, registry, jwtConfig } = opts;
+  const collector = new HttpObservabilityCollector({
+    serviceId: "marketplace-registry",
+    serviceType: "http-api",
+    version: "0.1.0",
+    logsSource: "marketplace-registry"
+  });
+  const observability = wrapObservability(collector);
+  const server = await createDaemonServer({
+    serviceId: "marketplace-registry",
+    logger,
+    observability,
+    // Preserve the legacy /health contract { status:'ok', service, ts } — e2e RG-H01.
+    healthResponse: () => ({ status: "ok", service: "marketplace-registry", ts: Date.now() }),
+    // /ready must return { ready, components } — e2e RG-H02 asserts body.ready === true.
+    readyCheck: () => createServiceReadyResponse({
+      ready: true,
+      components: { registryService: { ready: true } }
+    }),
+    openapi: {
+      title: "KB Labs Marketplace Registry",
+      description: "Public registry for KB Labs plugins and adapters"
+    },
+    setErrorHandler: (app) => {
+      app.setErrorHandler((err, request, reply) => {
+        const code = err.code ?? "UNKNOWN";
+        if (code === "PACKAGE_NOT_FOUND" || code === "VERSION_NOT_FOUND") {
+          return reply.code(404).send({ error: "NotFound", code, message: err.message });
+        }
+        if (code === "VERSION_ALREADY_EXISTS") {
+          return reply.code(409).send({ error: "Conflict", code, message: err.message });
+        }
+        if (code === "TARBALL_TOO_LARGE" || code === "INVALID_MANIFEST") {
+          return reply.code(422).send({ error: "UnprocessableEntity", code, message: err.message });
+        }
+        if (code === "FORBIDDEN" || code === "VERSION_YANKED") {
+          return reply.code(403).send({ error: "Forbidden", code, message: err.message });
+        }
+        if (err.statusCode === 401) {
+          return reply.code(401).send({ error: "Unauthorized", code: "UNAUTHORIZED", message: err.message });
+        }
+        logger.error("Unhandled registry error", err, {
+          route: `${request.method} ${request.url}`,
+          code
+        });
+        return reply.code(500).send({ error: "InternalServerError", code, message: err.message });
+      });
+    },
+    registerRoutes: async (app) => {
+      await app.register(multipart, { limits: { fileSize: 55 * 1024 * 1024 } });
+      app.decorate("registry", registry);
+      app.decorate("observability", collector);
+      if (jwtConfig) {
+        app.addHook("onRequest", createRegistryAuthMiddleware(jwtConfig));
+      }
+      await collector.observeOperation(
+        "marketplace-registry.bootstrap",
+        () => registerPackageRoutes(app, registry)
+      );
+    }
+  });
+  return server;
+}
+
+export { createRegistryServer };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/multipart.ts","../src/routes/packages.ts","../src/auth-middleware.ts","../src/server.ts"],"names":[],"mappings":";;;;;;;AAWA,eAAsB,eAAe,GAAA,EAA+C;AAClF,EAAA,MAAM,KAAA,GAAS,IAAY,KAAA,IAAQ;AACnC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,MAAA,EAAQ,EAAC,EAAE;AAAA,EACrC;AAEA,EAAA,IAAI,OAAA,GAAyB,IAAA;AAC7B,EAAA,MAAM,SAAiC,EAAC;AAExC,EAAA,WAAA,MAAiB,QAAQ,KAAA,EAAO;AAC9B,IAAA,IAAI,KAAK,IAAA,EAAM;AACb,MAAA,IAAI,IAAA,CAAK,cAAc,SAAA,EAAW;AAChC,QAAA,MAAM,SAAmB,EAAC;AAC1B,QAAA,WAAA,MAAiB,KAAA,IAAS,KAAK,IAAA,EAAM;AAAE,UAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,QAAG;AAC3D,QAAA,OAAA,GAAU,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,MAChC,CAAA,MAAO;AAEL,QAAA,WAAA,MAAiB,CAAA,IAAK,KAAK,IAAA,EAAM;AAAA,QAAa;AAAA,MAChD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,GAAI,IAAA,CAAK,KAAA;AAAA,IAChC;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAC3B;;;AC/BO,SAAS,qBAAA,CAAsB,KAAsB,QAAA,EAAiC;AAE3F,EAAA,GAAA,CAAI,GAAA,CAAqC,kBAAA,EAAoB,OAAO,GAAA,EAAK,KAAA,KAAU;AACjF,IAAA,MAAM,CAAA,GAAK,IAAI,KAAA,EAAe,CAAA;AAC9B,IAAA,MAAM,QAAA,GAAW,CAAA,EAAG,IAAA,EAAK,GACrB,MAAM,QAAA,CAAS,cAAA,CAAe,CAAC,CAAA,GAC/B,MAAM,QAAA,CAAS,kBAAA,EAAmB;AACtC,IAAA,OAAO,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,EAC5B,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,gCAAA;AAAA,IACA,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,QAAA,CAAS,QAAQ,IAAI,CAAA;AAClD,MAAA,IAAI,CAAC,KAAA,EAAO;AAAE,QAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,MAAG;AAE3E,MAAA,MAAM,KAAA,GAAQ,kBAAkB,GAAG,CAAA;AACnC,MAAA,MAAM,gBAAgB,KAAA,GAAQ,MAAM,QAAA,CAAS,iBAAA,CAAkB,KAAK,CAAA,GAAI,IAAA;AACxE,MAAA,MAAM,QAAA,GAAY,GAAA,CAAY,WAAA,EAAa,WAAA,IAAe,IAAA;AAE1D,MAAA,IAAI,CAAC,QAAA,CAAS,SAAA,CAAU,KAAA,EAAO,QAAA,EAAU,aAAa,CAAA,EAAG;AACvD,QAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iBAAiB,CAAA;AAAA,MACxD;AAEA,MAAA,OAAO,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACzB;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,sCAAA;AAAA,IACA,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,OAAO,MAAM,IAAA,CAAK,MAAM,SAAS,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAC,CAAA;AAAA,IACzD;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,GAAA,CAAI,uBAAuB,EAAE,UAAA,EAAY,aAAY,EAAG,OAAO,KAAK,KAAA,KAAU;AAChF,IAAA,MAAM,EAAE,WAAA,EAAY,GAAK,GAAA,CAAY,WAAA;AACrC,IAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,YAAA,CAAa,WAAW,CAAA;AACxD,IAAA,OAAO,KAAA,CAAM,KAAK,QAAQ,CAAA;AAAA,EAC5B,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,IAAA,CAAK,4BAA4B,EAAE,UAAA,EAAY,aAAY,EAAG,OAAO,KAAK,KAAA,KAAU;AACtF,IAAA,MAAM,EAAE,WAAA,EAAY,GAAK,GAAA,CAAY,WAAA;AACrC,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,iBAAiB,CAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,kCAAkC,CAAA;AAAA,IACzE;AAEA,IAAA,MAAM,EAAE,OAAA,EAAS,MAAA,EAAO,GAAI,MAAM,eAAe,GAAG,CAAA;AACpD,IAAA,IAAI,CAAC,OAAA,EAAS;AAAE,MAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,wBAAwB,CAAA;AAAA,IAAG;AAChF,IAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAAE,MAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,sBAAsB,CAAA;AAAA,IAAG;AAElF,IAAA,IAAI,UAAA;AACJ,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA;AAAA,IACrC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,SAAS,MAAM,QAAA,CAAS,QAAQ,OAAA,EAAS,UAAA,EAAY,QAAQ,WAAW,CAAA;AAC9E,IAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,KAAK,MAAM,CAAA;AAAA,EACpC,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,KAAA;AAAA,IACF,qCAAA;AAAA,IACA,EAAE,YAAY,WAAA,EAAY;AAAA,IAC1B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,WAAA,CAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,IAAI,CAAA;AAC7C,MAAA,MAAM,SAAS,UAAA,CAAW,MAAA,EAAQ,MAAO,GAAA,CAAI,IAAA,IAAgB,EAAE,CAAA;AAC/D,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,EAAK;AAAA,IAC9B;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,8CAAA;AAAA,IACA,EAAE,YAAY,WAAA,EAAY;AAAA,IAC1B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,KAAY,GAAA,CAAI,MAAA;AACtC,MAAA,MAAM,WAAA,CAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,IAAI,CAAA;AAC7C,MAAA,MAAM,EAAE,MAAA,EAAO,GAAK,GAAA,CAAI,QAAgB,EAAC;AACzC,MAAA,MAAM,QAAA,CAAS,IAAA,CAAK,MAAA,EAAQ,IAAA,EAAM,SAAS,MAAM,CAAA;AACjD,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,EAAK;AAAA,IAC9B;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,0CAAA;AAAA,IACA,EAAE,YAAY,WAAA,EAAY;AAAA,IAC1B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,WAAA,CAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,IAAI,CAAA;AAC7C,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAK,GAAA,CAAI,QAAgB,EAAC;AAC1C,MAAA,MAAM,QAAA,CAAS,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAA;AAC9C,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,EAAK;AAAA,IAC9B;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,gDAAA;AAAA,IACA,EAAE,YAAY,WAAA,EAAY;AAAA,IAC1B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,WAAA,CAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,IAAI,CAAA;AAC7C,MAAA,MAAM,EAAE,WAAA,EAAY,GAAK,GAAA,CAAI,QAAgB,EAAC;AAC9C,MAAA,IAAI,CAAC,WAAA,EAAa;AAAE,QAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,uBAAuB,CAAA;AAAA,MAAG;AACnF,MAAA,MAAM,QAAA,CAAS,cAAA,CAAe,MAAA,EAAQ,IAAA,EAAM,WAAW,CAAA;AACvD,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,EAAK;AAAA,IAC9B;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,4CAAA;AAAA,IACA,EAAE,YAAY,WAAA,EAAY;AAAA,IAC1B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,WAAA,CAAY,GAAA,EAAK,QAAA,EAAU,MAAA,EAAQ,IAAI,CAAA;AAC7C,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAK,GAAA,CAAI,QAAgB,EAAC;AAC1C,MAAA,MAAM,QAAQ,OAAA,GAAU,OAAA,GAAU,EAAA,GAAK,EAAA,GAAK,KAAK,GAAA,GAAO,MAAA;AACxD,MAAA,MAAM,aAAa,MAAM,QAAA,CAAS,gBAAA,CAAiB,MAAA,EAAQ,MAAM,KAAK,CAAA;AACtE,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,KAAK,UAAU,CAAA;AAAA,IACxC;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,GAAA;AAAA,IACF,iDAAA;AAAA,IACA,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,OAAA,KAAY,GAAA,CAAI,MAAA;AACtC,MAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,QAAA,CAAS,QAAQ,IAAI,CAAA;AAClD,MAAA,IAAI,CAAC,KAAA,EAAO;AAAE,QAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,MAAG;AAE3E,MAAA,MAAM,KAAA,GAAQ,kBAAkB,GAAG,CAAA;AACnC,MAAA,MAAM,gBAAgB,KAAA,GAAQ,MAAM,QAAA,CAAS,iBAAA,CAAkB,KAAK,CAAA,GAAI,IAAA;AACxE,MAAA,MAAM,QAAA,GAAY,GAAA,CAAY,WAAA,EAAa,WAAA,IAAe,IAAA;AAE1D,MAAA,IAAI,CAAC,QAAA,CAAS,SAAA,CAAU,KAAA,EAAO,QAAA,EAAU,aAAa,CAAA,EAAG;AACvD,QAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,iBAAiB,CAAA;AAAA,MACxD;AAEA,MAAA,MAAM,EAAE,SAAS,SAAA,EAAU,GAAI,MAAM,QAAA,CAAS,UAAA,CAAW,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAA;AAC9E,MAAA,MAAM,QAAA,CAAS,iBAAA,CAAkB,MAAA,EAAQ,IAAI,CAAA;AAE7C,MAAA,OAAO,KAAA,CACJ,OAAO,cAAA,EAAgB,0BAA0B,EACjD,MAAA,CAAO,qBAAA,EAAuB,CAAA,sBAAA,EAAyB,IAAI,CAAA,CAAA,EAAI,OAAO,OAAO,CAAA,CAC7E,MAAA,CAAO,sBAAA,EAAwB,SAAA,GAAY,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,GAAI,EAAE,CAAA,CACzE,IAAA,CAAK,OAAO,CAAA;AAAA,IACjB;AAAA,GACF;AAGA,EAAA,GAAA,CAAI,IAAA;AAAA,IACF,8CAAA;AAAA,IACA,EAAE,YAAY,YAAA,EAAa;AAAA,IAC3B,OAAO,KAAK,KAAA,KAAU;AACpB,MAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAK,GAAI,GAAA,CAAI,MAAA;AAC7B,MAAA,MAAM,EAAE,QAAA,GAAW,IAAA,EAAK,GAAK,GAAA,CAAI,QAAgB,EAAC;AAClD,MAAA,MAAM,QAAA,CAAS,WAAA,CAAY,MAAA,EAAQ,IAAA,EAAM,QAAQ,CAAA;AACjD,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,EAAK;AAAA,IAC9B;AAAA,GACF;AACF;AAIA,SAAS,WAAA,CAAY,GAAA,EAAU,KAAA,EAAY,IAAA,EAAwB;AACjE,EAAA,IAAI,CAAC,IAAI,WAAA,EAAa;AACpB,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,gBAAgB,CAAA;AAC9C,IAAA;AAAA,EACF;AACA,EAAA,IAAA,EAAK;AACP;AAEA,SAAS,YAAA,CAAa,GAAA,EAAU,KAAA,EAAY,IAAA,EAAwB;AAClE,EAAA,IAAI,CAAC,IAAI,WAAA,IAAe,CAAC,IAAI,WAAA,CAAY,WAAA,EAAa,QAAA,CAAS,OAAO,CAAA,EAAG;AACvE,IAAA,KAAA,CAAM,KAAK,GAAG,CAAA,CAAE,KAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAC3C,IAAA;AAAA,EACF;AACA,EAAA,IAAA,EAAK;AACP;AAEA,eAAe,WAAA,CAAY,GAAA,EAAU,QAAA,EAA2B,MAAA,EAAgB,IAAA,EAA6B;AAC3G,EAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,QAAA,CAAS,QAAQ,IAAI,CAAA;AAClD,EAAA,IAAI,CAAC,KAAA,EAAO;AAAE,IAAA,MAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,mBAAmB,CAAA,EAAG,EAAE,UAAA,EAAY,GAAA,EAAK,CAAA;AAAA,EAAG;AACxF,EAAA,IAAI,KAAA,CAAM,iBAAA,KAAsB,GAAA,CAAI,WAAA,CAAY,WAAA,EAAa;AAC3D,IAAA,MAAM,MAAA,CAAO,OAAO,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG,EAAE,UAAA,EAAY,GAAA,EAAK,CAAA;AAAA,EACjE;AACF;AAEA,SAAS,kBAAkB,GAAA,EAA8B;AACvD,EAAA,OAAQ,GAAA,CAAI,KAAA,EAAe,KAAA,IAAS,GAAA,CAAI,QAAQ,eAAe,CAAA;AACjE;AC5MA,IAAM,aAAA,uBAAoB,GAAA,CAAI;AAAA,EAC5B,SAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,yBAAA;AAAA,EACA,uBAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAQM,SAAS,6BAA6B,SAAA,EAAsB;AACjE,EAAA,OAAO,eAAe,sBAAA,CACpB,OAAA,EACA,KAAA,EACe;AACf,IAAA,MAAM,WAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,QAAA;AAC1D,IAAA,IAAI,cAAc,GAAA,CAAI,QAAQ,KAAK,QAAA,CAAS,UAAA,CAAW,OAAO,CAAA,EAAG;AAAE,MAAA;AAAA,IAAQ;AAG3E,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,KAAA,KACrB,QAAA,CAAS,UAAA,CAAW,kBAAkB,CAAA,IACtC,QAAA,CAAS,UAAA,CAAW,YAAY,CAAA,CAAA,EAC/B;AAIH,IAAA,MAAM,UAAA,GAAa,QAAQ,OAAA,CAAQ,aAAA;AACnC,IAAA,MAAM,QAAQ,UAAA,EAAY,KAAA,CAAM,kBAAkB,CAAA,GAAI,CAAC,CAAA,IAAK,IAAA;AAC5D,IAAA,IAAI,CAAC,KAAA,EAAO;AAAE,MAAA;AAAA,IAAQ;AAEtB,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,KAAA,EAAO,SAAS,CAAA;AACxD,IAAA,IAAI,CAAC,OAAA,EAAS;AAEZ,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,OAAA,EAAS,eAAA,EAAiB,CAAA;AAAA,IACjF;AAEA,IAAA,OAAA,CAAQ,WAAA,GAAc;AAAA,MACpB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAA,EAAQ,QAAQ,GAAA,IAAO,EAAA;AAAA,MACvB,aAAa,OAAA,CAAQ,WAAA;AAAA,MACrB,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,WAAA,EAAa,CAAC,cAAc;AAAA,KAC9B;AAAA,EACF,CAAA;AACF;;;AC1BA,SAAS,kBAAkB,SAAA,EAAmE;AAC5F,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,CAAC,MAAA,KAA4B,SAAA,CAAU,SAAS,MAAM,CAAA;AAAA,IAChE,aAAA,EAAe,MAAM,SAAA,CAAU,aAAA,EAAc;AAAA,IAC7C,yBAAyB,CAAC,MAAA,EAAgB,UAAqB,SAAA,CAAU,uBAAA,CAAwB,QAA+B,KAAK,CAAA;AAAA,IACrI,WAAA,EAAa,CAAC,OAAA,KACZ,SAAA,CAAU,WAAA,CAAY;AAAA,MACpB,MAAA,EAAQ,SAAA;AAAA,MACR,MAAA,EAAQ,CAAC,EAAE,EAAA,EAAI,oBAAoB,MAAA,EAAQ,IAAA,EAAkC,OAAA,EAAS,6BAAA,EAA+B,CAAA;AAAA,MACrH,IAAA,EAAM,EAAE,qBAAA,EAAuB,SAAA;AAAU,KAC1C;AAAA,GACL;AACF;AAEA,eAAsB,qBAAqB,IAAA,EAAuD;AAChG,EAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAU,SAAA,EAAU,GAAI,IAAA;AAExC,EAAA,MAAM,SAAA,GAAY,IAAI,0BAAA,CAA2B;AAAA,IAC/C,SAAA,EAAW,sBAAA;AAAA,IACX,WAAA,EAAa,UAAA;AAAA,IACb,OAAA,EAAS,OAAA;AAAA,IACT,UAAA,EAAY;AAAA,GACb,CAAA;AACD,EAAA,MAAM,aAAA,GAAgB,kBAAkB,SAAS,CAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB;AAAA,IACtC,SAAA,EAAW,sBAAA;AAAA,IACX,MAAA;AAAA,IACA,aAAA;AAAA;AAAA,IAEA,cAAA,EAAgB,OAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,SAAS,sBAAA,EAAwB,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAE,CAAA;AAAA;AAAA,IAEvF,UAAA,EAAY,MACV,0BAAA,CAA2B;AAAA,MACzB,KAAA,EAAO,IAAA;AAAA,MACP,YAAY,EAAE,eAAA,EAAiB,EAAE,KAAA,EAAO,MAAK;AAAE,KAChD,CAAA;AAAA,IACH,OAAA,EAAS;AAAA,MACP,KAAA,EAAO,8BAAA;AAAA,MACP,WAAA,EAAa;AAAA,KACf;AAAA,IACA,eAAA,EAAiB,CAAC,GAAA,KAAQ;AACxB,MAAA,GAAA,CAAI,eAAA,CAAgB,CAAC,GAAA,EAAmB,OAAA,EAAS,KAAA,KAAU;AACzD,QAAA,MAAM,IAAA,GAAgB,IAAyC,IAAA,IAAQ,SAAA;AAEvE,QAAA,IAAI,IAAA,KAAS,mBAAA,IAAuB,IAAA,KAAS,mBAAA,EAAqB;AAChE,UAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,UAAA,EAAY,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAC/E;AACA,QAAA,IAAI,SAAS,wBAAA,EAA0B;AACrC,UAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,UAAA,EAAY,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAC/E;AACA,QAAA,IAAI,IAAA,KAAS,mBAAA,IAAuB,IAAA,KAAS,kBAAA,EAAoB;AAC/D,UAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,qBAAA,EAAuB,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAC1F;AACA,QAAA,IAAI,IAAA,KAAS,WAAA,IAAe,IAAA,KAAS,gBAAA,EAAkB;AACrD,UAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,WAAA,EAAa,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,QAChF;AACA,QAAA,IAAI,GAAA,CAAI,eAAe,GAAA,EAAK;AAC1B,UAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,cAAA,EAAgB,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,GAAA,CAAI,SAAS,CAAA;AAAA,QACnG;AAEA,QAAA,MAAA,CAAO,KAAA,CAAM,4BAA4B,GAAA,EAAK;AAAA,UAC5C,OAAO,CAAA,EAAG,OAAA,CAAQ,MAAM,CAAA,CAAA,EAAI,QAAQ,GAAG,CAAA,CAAA;AAAA,UACvC;AAAA,SACD,CAAA;AACD,QAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,qBAAA,EAAuB,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,CAAA;AAAA,MAC1F,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,cAAA,EAAgB,OAAO,GAAA,KAAQ;AAC7B,MAAA,MAAM,GAAA,CAAI,QAAA,CAAS,SAAA,EAAW,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAU,EAAA,GAAK,IAAA,GAAO,IAAA,EAAK,EAAG,CAAA;AAExE,MAAA,GAAA,CAAI,QAAA,CAAS,YAAY,QAAQ,CAAA;AACjC,MAAA,GAAA,CAAI,QAAA,CAAS,iBAAiB,SAAS,CAAA;AAEvC,MAAA,IAAI,SAAA,EAAW;AACb,QAAA,GAAA,CAAI,OAAA,CAAQ,WAAA,EAAa,4BAAA,CAA6B,SAAS,CAAC,CAAA;AAAA,MAClE;AAEA,MAAA,MAAM,SAAA,CAAU,gBAAA;AAAA,QAAiB,gCAAA;AAAA,QAAkC,MACjE,qBAAA,CAAsB,GAAA,EAAK,QAAQ;AAAA,OACrC;AAAA,IACF;AAAA,GACD,CAAA;AAED,EAAA,OAAO,MAAA;AACT","file":"index.js","sourcesContent":["import type { FastifyRequest } from 'fastify';\n\nexport interface MultipartResult {\n  tarball: Buffer | null;\n  fields: Record<string, string>;\n}\n\n/**\n * Parse a multipart/form-data request.\n * Expects a 'tarball' file field and arbitrary string fields.\n */\nexport async function parseMultipart(req: FastifyRequest): Promise<MultipartResult> {\n  const parts = (req as any).parts?.() as AsyncIterable<any> | undefined;\n  if (!parts) {\n    return { tarball: null, fields: {} };\n  }\n\n  let tarball: Buffer | null = null;\n  const fields: Record<string, string> = {};\n\n  for await (const part of parts) {\n    if (part.file) {\n      if (part.fieldname === 'tarball') {\n        const chunks: Buffer[] = [];\n        for await (const chunk of part.file) { chunks.push(chunk); }\n        tarball = Buffer.concat(chunks);\n      } else {\n        // Drain unknown file fields\n        for await (const _ of part.file) { /* noop */ }\n      }\n    } else {\n      fields[part.fieldname] = part.value as string;\n    }\n  }\n\n  return { tarball, fields };\n}\n","import type { FastifyInstance } from 'fastify';\nimport type { RegistryService } from '@kb-labs/marketplace-registry-core';\nimport type { PublishRequest } from '@kb-labs/marketplace-registry-contracts';\nimport { parseMultipart } from '../multipart.js';\n\nexport function registerPackageRoutes(app: FastifyInstance, registry: RegistryService): void {\n  // ── Public: list or search public packages ───────────────────────────────\n  app.get<{ Querystring: { q?: string } }>('/api/v1/packages', async (req, reply) => {\n    const q = (req.query as any)?.q as string | undefined;\n    const packages = q?.trim()\n      ? await registry.searchPackages(q)\n      : await registry.listPublicPackages();\n    return reply.send(packages);\n  });\n\n  // ── Public: get package metadata ─────────────────────────────────────────\n  app.get<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name',\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      const entry = await registry.getEntry(handle, name);\n      if (!entry) { return reply.code(404).send({ error: 'Package not found' }); }\n\n      const token = extractShareToken(req);\n      const resolvedToken = token ? await registry.resolveShareToken(token) : null;\n      const callerNs = (req as any).authContext?.namespaceId ?? null;\n\n      if (!registry.canAccess(entry, callerNs, resolvedToken)) {\n        return reply.code(403).send({ error: 'Access denied' });\n      }\n\n      return reply.send(entry);\n    },\n  );\n\n  // ── Public: package stats ─────────────────────────────────────────────────\n  app.get<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name/stats',\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      return reply.send(await registry.getStats(handle, name));\n    },\n  );\n\n  // ── Auth: list my packages ────────────────────────────────────────────────\n  app.get('/api/v1/my/packages', { preHandler: requireAuth }, async (req, reply) => {\n    const { namespaceId } = (req as any).authContext;\n    const packages = await registry.listByAuthor(namespaceId);\n    return reply.send(packages);\n  });\n\n  // ── Auth: publish (multipart: tarball + meta JSON) ───────────────────────\n  app.post('/api/v1/packages/publish', { preHandler: requireAuth }, async (req, reply) => {\n    const { namespaceId } = (req as any).authContext;\n    const handle = req.headers['x-author-handle'] as string | undefined;\n    if (!handle) {\n      return reply.code(400).send({ error: 'Missing X-Author-Handle header' });\n    }\n\n    const { tarball, fields } = await parseMultipart(req);\n    if (!tarball) { return reply.code(400).send({ error: 'Missing tarball file' }); }\n    if (!fields.meta) { return reply.code(400).send({ error: 'Missing meta field' }); }\n\n    let publishReq: PublishRequest;\n    try {\n      publishReq = JSON.parse(fields.meta) as PublishRequest;\n    } catch {\n      return reply.code(400).send({ error: 'Invalid meta JSON' });\n    }\n\n    const result = await registry.publish(tarball, publishReq, handle, namespaceId);\n    return reply.code(201).send(result);\n  });\n\n  // ── Auth: publish metadata only ───────────────────────────────────────────\n  app.patch<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name/meta',\n    { preHandler: requireAuth },\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      await assertOwner(req, registry, handle, name);\n      await registry.updateMeta(handle, name, (req.body as any) ?? {});\n      return reply.code(204).send();\n    },\n  );\n\n  // ── Auth: yank version ────────────────────────────────────────────────────\n  app.post<{ Params: { handle: string; name: string; version: string } }>(\n    '/api/v1/packages/:handle/:name/:version/yank',\n    { preHandler: requireAuth },\n    async (req, reply) => {\n      const { handle, name, version } = req.params;\n      await assertOwner(req, registry, handle, name);\n      const { reason } = (req.body as any) ?? {};\n      await registry.yank(handle, name, version, reason);\n      return reply.code(204).send();\n    },\n  );\n\n  // ── Auth: deprecate package ───────────────────────────────────────────────\n  app.post<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name/deprecate',\n    { preHandler: requireAuth },\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      await assertOwner(req, registry, handle, name);\n      const { message } = (req.body as any) ?? {};\n      await registry.deprecate(handle, name, message);\n      return reply.code(204).send();\n    },\n  );\n\n  // ── Auth: share — add to allowlist ────────────────────────────────────────\n  app.post<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name/share/allowlist',\n    { preHandler: requireAuth },\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      await assertOwner(req, registry, handle, name);\n      const { namespaceId } = (req.body as any) ?? {};\n      if (!namespaceId) { return reply.code(400).send({ error: 'Missing namespaceId' }); }\n      await registry.addToAllowlist(handle, name, namespaceId);\n      return reply.code(204).send();\n    },\n  );\n\n  // ── Auth: share — create link token ──────────────────────────────────────\n  app.post<{ Params: { handle: string; name: string } }>(\n    '/api/v1/packages/:handle/:name/share/token',\n    { preHandler: requireAuth },\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      await assertOwner(req, registry, handle, name);\n      const { ttlDays } = (req.body as any) ?? {};\n      const ttlMs = ttlDays ? ttlDays * 24 * 60 * 60 * 1000 : undefined;\n      const shareToken = await registry.createShareToken(handle, name, ttlMs);\n      return reply.code(201).send(shareToken);\n    },\n  );\n\n  // ── Auth: download tarball ────────────────────────────────────────────────\n  app.get<{ Params: { handle: string; name: string; version: string } }>(\n    '/api/v1/packages/:handle/:name/:version/tarball',\n    async (req, reply) => {\n      const { handle, name, version } = req.params;\n      const entry = await registry.getEntry(handle, name);\n      if (!entry) { return reply.code(404).send({ error: 'Package not found' }); }\n\n      const token = extractShareToken(req);\n      const resolvedToken = token ? await registry.resolveShareToken(token) : null;\n      const callerNs = (req as any).authContext?.namespaceId ?? null;\n\n      if (!registry.canAccess(entry, callerNs, resolvedToken)) {\n        return reply.code(403).send({ error: 'Access denied' });\n      }\n\n      const { tarball, signature } = await registry.getTarball(handle, name, version);\n      await registry.incrementInstalls(handle, name);\n\n      return reply\n        .header('Content-Type', 'application/octet-stream')\n        .header('Content-Disposition', `attachment; filename=\"${name}-${version}.tgz\"`)\n        .header('X-Registry-Signature', signature ? JSON.stringify(signature) : '')\n        .send(tarball);\n    },\n  );\n\n  // ── Admin: feature/unfeature ──────────────────────────────────────────────\n  app.post<{ Params: { handle: string; name: string } }>(\n    '/api/v1/admin/packages/:handle/:name/feature',\n    { preHandler: requireAdmin },\n    async (req, reply) => {\n      const { handle, name } = req.params;\n      const { featured = true } = (req.body as any) ?? {};\n      await registry.setFeatured(handle, name, featured);\n      return reply.code(204).send();\n    },\n  );\n}\n\n// ── Auth helpers ──────────────────────────────────────────────────────────────\n\nfunction requireAuth(req: any, reply: any, done: () => void): void {\n  if (!req.authContext) {\n    reply.code(401).send({ error: 'Unauthorized' });\n    return;\n  }\n  done();\n}\n\nfunction requireAdmin(req: any, reply: any, done: () => void): void {\n  if (!req.authContext || !req.authContext.permissions?.includes('admin')) {\n    reply.code(403).send({ error: 'Forbidden' });\n    return;\n  }\n  done();\n}\n\nasync function assertOwner(req: any, registry: RegistryService, handle: string, name: string): Promise<void> {\n  const entry = await registry.getEntry(handle, name);\n  if (!entry) { throw Object.assign(new Error('Package not found'), { statusCode: 404 }); }\n  if (entry.authorNamespaceId !== req.authContext.namespaceId) {\n    throw Object.assign(new Error('Forbidden'), { statusCode: 403 });\n  }\n}\n\nfunction extractShareToken(req: any): string | undefined {\n  return (req.query as any)?.token ?? req.headers['x-share-token'];\n}\n","import type { FastifyRequest, FastifyReply } from 'fastify';\nimport type { AuthContext } from '@kb-labs/gateway-contracts';\nimport { verifyAccessToken, type JwtConfig } from '@kb-labs/gateway-auth';\n\nconst PUBLIC_ROUTES = new Set([\n  '/health',\n  '/ready',\n  '/metrics',\n  '/observability/describe',\n  '/observability/health',\n  '/docs',\n  '/docs/json',\n]);\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    authContext?: AuthContext;\n  }\n}\n\nexport function createRegistryAuthMiddleware(jwtConfig: JwtConfig) {\n  return async function registryAuthMiddleware(\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ): Promise<void> {\n    const pathname = new URL(request.url, 'http://localhost').pathname;\n    if (PUBLIC_ROUTES.has(pathname) || pathname.startsWith('/docs')) { return; }\n\n    // Public read-only routes — no auth needed\n    if (request.method === 'GET' && (\n      pathname.startsWith('/api/v1/packages') ||\n      pathname.startsWith('/api/v1/my')  // will be caught by requireAuth in route\n    )) {\n      // still attempt auth so authContext is set if token is present\n    }\n\n    const authHeader = request.headers.authorization;\n    const token = authHeader?.match(/^Bearer\\s+(.+)$/i)?.[1] ?? null;\n    if (!token) { return; } // public routes proceed without authContext; protected routes use requireAuth\n\n    const payload = await verifyAccessToken(token, jwtConfig);\n    if (!payload) {\n      // Token present but invalid — reject immediately\n      return reply.code(401).send({ error: 'Unauthorized', message: 'Invalid token' });\n    }\n\n    request.authContext = {\n      type: payload.type,\n      userId: payload.sub ?? '',\n      namespaceId: payload.namespaceId,\n      tier: payload.tier,\n      permissions: ['host:connect'],\n    };\n  };\n}\n","import { type FastifyInstance, type FastifyError } from 'fastify';\nimport multipart from '@fastify/multipart';\nimport {\n  HttpObservabilityCollector,\n  createDaemonServer,\n  createServiceReadyResponse,\n  type ObservabilityCollectorLike,\n} from '@kb-labs/shared-http';\nimport type { ILogger } from '@kb-labs/core-platform';\nimport type { ServiceHealthStatus, ObservabilityCheckStatus } from '@kb-labs/core-contracts';\nimport type { JwtConfig } from '@kb-labs/gateway-auth';\nimport type { RegistryService } from '@kb-labs/marketplace-registry-core';\nimport { registerPackageRoutes } from './routes/packages.js';\nimport { createRegistryAuthMiddleware } from './auth-middleware.js';\n\nexport interface RegistryServerOptions {\n  port?: number;\n  host?: string;\n  logger: ILogger;\n  registry: RegistryService;\n  jwtConfig?: JwtConfig;\n}\n\n/**\n * Wraps HttpObservabilityCollector to satisfy ObservabilityCollectorLike.\n * The buildHealth() no-arg call from createDaemonServer routes uses a fixed\n * \"service registered\" check — the same information the original routes conveyed.\n */\nfunction wrapObservability(collector: HttpObservabilityCollector): ObservabilityCollectorLike {\n  return {\n    register: (server: FastifyInstance) => collector.register(server),\n    buildDescribe: () => collector.buildDescribe(),\n    renderPrometheusMetrics: (status: string, extra?: string[]) => collector.renderPrometheusMetrics(status as ServiceHealthStatus, extra),\n    buildHealth: (_params?: Record<string, unknown>) =>\n      collector.buildHealth({\n        status: 'healthy' as ServiceHealthStatus,\n        checks: [{ id: 'registry-service', status: 'ok' as ObservabilityCheckStatus, message: 'Registry service registered' }],\n        meta: { serviceHealthEndpoint: '/health' },\n      }),\n  };\n}\n\nexport async function createRegistryServer(opts: RegistryServerOptions): Promise<FastifyInstance> {\n  const { logger, registry, jwtConfig } = opts;\n\n  const collector = new HttpObservabilityCollector({\n    serviceId: 'marketplace-registry',\n    serviceType: 'http-api',\n    version: '0.1.0',\n    logsSource: 'marketplace-registry',\n  });\n  const observability = wrapObservability(collector);\n\n  const server = await createDaemonServer({\n    serviceId: 'marketplace-registry',\n    logger,\n    observability,\n    // Preserve the legacy /health contract { status:'ok', service, ts } — e2e RG-H01.\n    healthResponse: () => ({ status: 'ok', service: 'marketplace-registry', ts: Date.now() }),\n    // /ready must return { ready, components } — e2e RG-H02 asserts body.ready === true.\n    readyCheck: () =>\n      createServiceReadyResponse({\n        ready: true,\n        components: { registryService: { ready: true } },\n      }),\n    openapi: {\n      title: 'KB Labs Marketplace Registry',\n      description: 'Public registry for KB Labs plugins and adapters',\n    },\n    setErrorHandler: (app) => {\n      app.setErrorHandler((err: FastifyError, request, reply) => {\n        const code: string = (err as FastifyError & { code?: string }).code ?? 'UNKNOWN';\n\n        if (code === 'PACKAGE_NOT_FOUND' || code === 'VERSION_NOT_FOUND') {\n          return reply.code(404).send({ error: 'NotFound', code, message: err.message });\n        }\n        if (code === 'VERSION_ALREADY_EXISTS') {\n          return reply.code(409).send({ error: 'Conflict', code, message: err.message });\n        }\n        if (code === 'TARBALL_TOO_LARGE' || code === 'INVALID_MANIFEST') {\n          return reply.code(422).send({ error: 'UnprocessableEntity', code, message: err.message });\n        }\n        if (code === 'FORBIDDEN' || code === 'VERSION_YANKED') {\n          return reply.code(403).send({ error: 'Forbidden', code, message: err.message });\n        }\n        if (err.statusCode === 401) {\n          return reply.code(401).send({ error: 'Unauthorized', code: 'UNAUTHORIZED', message: err.message });\n        }\n        // Unhandled error — log full stack so failures surface in service logs.\n        logger.error('Unhandled registry error', err, {\n          route: `${request.method} ${request.url}`,\n          code,\n        });\n        return reply.code(500).send({ error: 'InternalServerError', code, message: err.message });\n      });\n    },\n    registerRoutes: async (app) => {\n      await app.register(multipart, { limits: { fileSize: 55 * 1024 * 1024 } });\n\n      app.decorate('registry', registry);\n      app.decorate('observability', collector);\n\n      if (jwtConfig) {\n        app.addHook('onRequest', createRegistryAuthMiddleware(jwtConfig));\n      }\n\n      await collector.observeOperation('marketplace-registry.bootstrap', () =>\n        registerPackageRoutes(app, registry),\n      );\n    },\n  });\n\n  return server;\n}\n"]}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@kb-labs/marketplace-registry-api",
+  "description": "HTTP API for KB Labs Marketplace Registry",
+  "version": "2.96.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@fastify/multipart": "^9.0.3",
+    "fastify": "^5.4.0",
+    "@kb-labs/core-contracts": "2.96.0",
+    "@kb-labs/core-platform": "2.96.0",
+    "@kb-labs/gateway-auth": "2.96.0",
+    "@kb-labs/gateway-contracts": "2.96.0",
+    "@kb-labs/marketplace-registry-core": "2.96.0",
+    "@kb-labs/shared-http": "2.96.0",
+    "@kb-labs/marketplace-registry-contracts": "2.96.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5",
+    "vitest": "^3.2.6",
+    "@kb-labs/devkit": "2.96.0"
+  },
+  "engines": {
+    "node": ">=20.0.0",
+    "pnpm": ">=9.0.0"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsup",
+    "clean": "rimraf dist",
+    "dev": "tsup --watch",
+    "lint": "eslint src --ext .ts",
+    "lint:fix": "eslint src --ext .ts --fix",
+    "test": "vitest run --passWithNoTests -c ../../vitest.config.ts",
+    "type-check": "tsc --noEmit"
+  }
+}