@mikrojs/registry 0.16.0-beta.0 → 0.17.0-next.20260722220623

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Bjørge Næss
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { memoryStorage } from './memoryStorage.js';
+export { createRegistry } from './registry.js';
+export type { BuildRecord, DeviceRecord, Registry, RegistryOptions, RegistryStorage, TokenRecord, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAC,cAAc,EAAC,MAAM,eAAe,CAAA;AAC5C,YAAY,EACV,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,eAAe,EACf,WAAW,GACZ,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { memoryStorage } from './memoryStorage.js';
+export { createRegistry } from './registry.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAC,cAAc,EAAC,MAAM,eAAe,CAAA"}

package/dist/memoryStorage.d.ts

@@ -0,0 +1,4 @@
+import type { RegistryStorage } from './types.js';
+/** In-memory storage: everything is lost on restart. For tests and demos. */
+export declare function memoryStorage(): RegistryStorage;
+//# sourceMappingURL=memoryStorage.d.ts.map

package/dist/memoryStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryStorage.d.ts","sourceRoot":"","sources":["../src/memoryStorage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,eAAe,EAAc,MAAM,YAAY,CAAA;AAEvF,6EAA6E;AAC7E,wBAAgB,aAAa,IAAI,eAAe,CAkD/C"}

package/dist/memoryStorage.js

@@ -0,0 +1,53 @@
+/** In-memory storage: everything is lost on restart. For tests and demos. */
+export function memoryStorage() {
+    const blobs = new Map();
+    const builds = new Map();
+    const devices = new Map();
+    const tokens = new Map();
+    return {
+        async putBlob(checksum, data) {
+            blobs.set(checksum, data);
+        },
+        async getBlob(checksum) {
+            return blobs.get(checksum);
+        },
+        async getBuild(checksum) {
+            return builds.get(checksum);
+        },
+        async putBuild(record) {
+            builds.set(record.checksum, record);
+        },
+        async listBuilds() {
+            return [...builds.values()];
+        },
+        async getDevice(deviceId) {
+            return devices.get(deviceId);
+        },
+        async getDeviceByCredentialHash(hash) {
+            for (const device of devices.values()) {
+                if (device.credentialHash === hash)
+                    return device;
+            }
+            return undefined;
+        },
+        async putDevice(record) {
+            devices.set(record.deviceId, record);
+        },
+        async listDevices() {
+            return [...devices.values()];
+        },
+        async getTokenByHash(hash) {
+            return tokens.get(hash);
+        },
+        async putToken(record) {
+            tokens.set(record.tokenHash, record);
+        },
+        async deleteToken(hash) {
+            tokens.delete(hash);
+        },
+        async listTokens() {
+            return [...tokens.values()];
+        },
+    };
+}
+//# sourceMappingURL=memoryStorage.js.map

package/dist/memoryStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memoryStorage.js","sourceRoot":"","sources":["../src/memoryStorage.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;YAC1B,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC5B,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACrC,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7B,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,IAAI;YAClC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI;oBAAE,OAAO,MAAM,CAAA;YACnD,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC9B,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/node.d.ts

@@ -0,0 +1,19 @@
+import { type Server } from 'node:http';
+import type { Registry, RegistryStorage } from './types.js';
+/**
+ * File-backed storage: build blobs as `<dir>/builds/<checksum>.tgz`, records
+ * in `<dir>/builds.json`, `<dir>/devices.json`, and `<dir>/tokens.json`.
+ * Synchronous writes, no locking: one registry process per data dir.
+ */
+export declare function fileStorage(dir: string): RegistryStorage;
+/**
+ * Serve a registry on node:http. Request bodies are buffered, so
+ * `maxBodyBytes` caps them; publish is the only route that needs more than a
+ * few kilobytes.
+ */
+export declare function serve(registry: Registry, options: {
+    port: number;
+    hostname?: string;
+    maxBodyBytes?: number;
+}): Server;
+//# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,MAAM,EAAC,MAAM,WAAW,CAAA;AAGnD,OAAO,KAAK,EAA4B,QAAQ,EAAE,eAAe,EAAc,MAAM,YAAY,CAAA;AAQjG;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAgIxD;AAED;;;;GAIG;AACH,wBAAgB,KAAK,CACnB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAC,GAChE,MAAM,CAiER"}

package/dist/node.js

@@ -0,0 +1,213 @@
+import { mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { createServer } from 'node:http';
+import * as pathlib from 'node:path';
+import { CLIENT_IP_HEADER } from './util.js';
+/** Publish is the only route with a large body; everything else is a small
+ *  JSON document. Bodies are buffered before routing, so this is what keeps an
+ *  unauthenticated POST from being an out-of-memory button. */
+const DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
+/**
+ * File-backed storage: build blobs as `<dir>/builds/<checksum>.tgz`, records
+ * in `<dir>/builds.json`, `<dir>/devices.json`, and `<dir>/tokens.json`.
+ * Synchronous writes, no locking: one registry process per data dir.
+ */
+export function fileStorage(dir) {
+    const buildsDir = pathlib.join(dir, 'builds');
+    mkdirSync(buildsDir, { recursive: true });
+    const buildsPath = pathlib.join(dir, 'builds.json');
+    const devicesPath = pathlib.join(dir, 'devices.json');
+    const tokensPath = pathlib.join(dir, 'tokens.json');
+    /** Parsed indexes, keyed by path and invalidated by mtime. Every check-in
+     *  reads devices.json before it can authenticate the caller, so without this
+     *  an anonymous request with a junk credential costs a full parse of the
+     *  fleet, synchronously, on the shared event loop. */
+    const cache = new Map();
+    function mtimeOf(path) {
+        try {
+            return statSync(path).mtimeMs;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Keys are untrusted (device ids, token hashes), so the index has no
+     *  prototype: `constructor` or `__proto__` must be an ordinary miss, not a
+     *  hit on `Object.prototype` or a write that corrupts it. */
+    function readIndex(path) {
+        const mtimeMs = mtimeOf(path);
+        const cached = cache.get(path);
+        if (cached !== undefined && mtimeMs !== undefined && cached.mtimeMs === mtimeMs) {
+            return cached.index;
+        }
+        const index = Object.create(null);
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        }
+        catch {
+            return index;
+        }
+        if (typeof parsed !== 'object' || parsed === null)
+            return index;
+        for (const key of Object.getOwnPropertyNames(parsed)) {
+            // defineProperty, not assignment: a `__proto__` key must land as an own
+            // property rather than reaching a setter.
+            Object.defineProperty(index, key, {
+                value: parsed[key],
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
+        }
+        if (mtimeMs !== undefined)
+            cache.set(path, { mtimeMs, index });
+        return index;
+    }
+    function writeIndex(path, index) {
+        // Rewritten in full on every check-in, so a kill or a full disk mid-write
+        // must not truncate it: devices.json holds every credential hash, and
+        // losing it unenrolls the fleet with no way back but physical access.
+        const tmp = `${path}.tmp`;
+        try {
+            writeFileSync(tmp, JSON.stringify(index, null, 2) + '\n');
+            renameSync(tmp, path);
+        }
+        catch (err) {
+            // Callers mutate the cached index in place, so a write that did not land
+            // leaves it ahead of the file: drop it rather than serve what is not
+            // stored.
+            cache.delete(path);
+            throw err;
+        }
+        const mtimeMs = mtimeOf(path);
+        if (mtimeMs === undefined)
+            cache.delete(path);
+        else
+            cache.set(path, { mtimeMs, index });
+    }
+    return {
+        async putBlob(checksum, data) {
+            writeFileSync(pathlib.join(buildsDir, `${checksum}.tgz`), data);
+        },
+        async getBlob(checksum) {
+            try {
+                return new Uint8Array(readFileSync(pathlib.join(buildsDir, `${checksum}.tgz`)));
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async getBuild(checksum) {
+            return readIndex(buildsPath)[checksum];
+        },
+        async putBuild(record) {
+            const index = readIndex(buildsPath);
+            index[record.checksum] = record;
+            writeIndex(buildsPath, index);
+        },
+        async listBuilds() {
+            return Object.values(readIndex(buildsPath));
+        },
+        async getDevice(deviceId) {
+            return readIndex(devicesPath)[deviceId];
+        },
+        async getDeviceByCredentialHash(hash) {
+            return Object.values(readIndex(devicesPath)).find((d) => d.credentialHash === hash);
+        },
+        async putDevice(record) {
+            const index = readIndex(devicesPath);
+            index[record.deviceId] = record;
+            writeIndex(devicesPath, index);
+        },
+        async listDevices() {
+            return Object.values(readIndex(devicesPath));
+        },
+        async getTokenByHash(hash) {
+            return readIndex(tokensPath)[hash];
+        },
+        async putToken(record) {
+            const index = readIndex(tokensPath);
+            index[record.tokenHash] = record;
+            writeIndex(tokensPath, index);
+        },
+        async deleteToken(hash) {
+            // Deleted in place rather than rebuilt: `Object.fromEntries` would hand
+            // back an index with an ordinary prototype, and these keys are untrusted.
+            const index = readIndex(tokensPath);
+            Reflect.deleteProperty(index, hash);
+            writeIndex(tokensPath, index);
+        },
+        async listTokens() {
+            return Object.values(readIndex(tokensPath));
+        },
+    };
+}
+/**
+ * Serve a registry on node:http. Request bodies are buffered, so
+ * `maxBodyBytes` caps them; publish is the only route that needs more than a
+ * few kilobytes.
+ */
+export function serve(registry, options) {
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const server = createServer(async (req, res) => {
+        try {
+            const chunks = [];
+            let received = 0;
+            for await (const chunk of req) {
+                received += chunk.byteLength;
+                // Enforced while reading, before routing or auth: an oversized body
+                // must never be held in full, whoever sent it.
+                if (received > maxBodyBytes) {
+                    res.writeHead(413, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Request body too large' }));
+                    req.destroy();
+                    return;
+                }
+                chunks.push(chunk);
+            }
+            const body = Buffer.concat(chunks);
+            // Behind a TLS-terminating proxy the socket is plain http, but the
+            // origin the registry puts in offer urls has to be the one devices
+            // reach: the client rejects a non-https offer url outright.
+            const forwardedProto = req.headers['x-forwarded-proto'];
+            const proto = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto)
+                ?.split(',')[0]
+                ?.trim();
+            const scheme = proto === 'https' ? 'https' : 'http';
+            const url = `${scheme}://${req.headers.host ?? 'localhost'}${req.url ?? '/'}`;
+            // The client's own value for the peer-address header is dropped: it
+            // feeds rate limiting, so only the socket may set it.
+            const headers = Object.entries(req.headers).flatMap(([name, value]) => name.toLowerCase() === CLIENT_IP_HEADER
+                ? []
+                : typeof value === 'string'
+                    ? [[name, value]]
+                    : (value ?? []).map((v) => [name, v]));
+            const remoteAddress = req.socket.remoteAddress;
+            if (remoteAddress !== undefined)
+                headers.push([CLIENT_IP_HEADER, remoteAddress]);
+            const request = new Request(url, {
+                method: req.method,
+                headers,
+                body: body.byteLength > 0 ? body : undefined,
+            });
+            const response = await registry.fetch(request);
+            const responseHeaders = {};
+            response.headers.forEach((value, name) => {
+                responseHeaders[name] = value;
+            });
+            res.writeHead(response.status, responseHeaders);
+            res.end(Buffer.from(await response.arrayBuffer()));
+        }
+        catch (err) {
+            // The message can name filesystem paths; it belongs in the log, not the
+            // response.
+            // eslint-disable-next-line no-console
+            console.error('registry: request failed', err);
+            res.writeHead(500, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Internal server error' }));
+        }
+    });
+    server.listen(options.port, options.hostname);
+    return server;
+}
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAC,MAAM,SAAS,CAAA;AACpF,OAAO,EAAC,YAAY,EAAc,MAAM,WAAW,CAAA;AACnD,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AAGpC,OAAO,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAA;AAE1C;;+DAE+D;AAC/D,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE/C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC7C,SAAS,CAAC,SAAS,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;IAEnD;;;0DAGsD;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6D,CAAA;IAElF,SAAS,OAAO,CAAC,IAAY;QAC3B,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC;IAED;;iEAE6D;IAC7D,SAAS,SAAS,CAAI,IAAY;QAChC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAChF,OAAO,MAAM,CAAC,KAA0B,CAAA;QAC1C,CAAC;QACD,MAAM,KAAK,GAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAsB,CAAA;QACzE,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,wEAAwE;YACxE,0CAA0C;YAC1C,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE;gBAChC,KAAK,EAAG,MAA4B,CAAC,GAAG,CAAC;gBACzC,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,IAAI;aACnB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAC,OAAO,EAAE,KAAK,EAAC,CAAC,CAAA;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,SAAS,UAAU,CAAI,IAAY,EAAE,KAAwB;QAC3D,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAA;QACzB,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,qEAAqE;YACrE,UAAU;YACV,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAClB,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;;YACxC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAC,OAAO,EAAE,KAAK,EAAC,CAAC,CAAA;IACxC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;YAC1B,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACjE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,QAAQ;YACpB,IAAI,CAAC;gBACH,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,QAAQ,MAAM,CAAC,CAAC,CAAC,CAAA;YACjF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAA;YAClB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACrB,OAAO,SAAS,CAAc,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,KAAK,GAAG,SAAS,CAAc,UAAU,CAAC,CAAA;YAChD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAA;YAC/B,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAc,UAAU,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,OAAO,SAAS,CAAe,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,yBAAyB,CAAC,IAAI;YAClC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAe,WAAW,CAAC,CAAC,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,CACjC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,MAAM,KAAK,GAAG,SAAS,CAAe,WAAW,CAAC,CAAA;YAClD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAA;YAC/B,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QAChC,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAe,WAAW,CAAC,CAAC,CAAA;QAC5D,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,IAAI;YACvB,OAAO,SAAS,CAAc,UAAU,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,MAAM,KAAK,GAAG,SAAS,CAAc,UAAU,CAAC,CAAA;YAChD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAA;YAChC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,KAAK,GAAG,SAAS,CAAc,UAAU,CAAC,CAAA;YAChD,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YACnC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC/B,CAAC;QACD,KAAK,CAAC,UAAU;YACd,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAc,UAAU,CAAC,CAAC,CAAA;QAC1D,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CACnB,QAAkB,EAClB,OAAiE;IAEjE,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAA;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,QAAQ,GAAG,CAAC,CAAA;YAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBAC9B,QAAQ,IAAK,KAAgB,CAAC,UAAU,CAAA;gBACxC,oEAAoE;gBACpE,+CAA+C;gBAC/C,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,kBAAkB,EAAC,CAAC,CAAA;oBACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAE,wBAAwB,EAAC,CAAC,CAAC,CAAA;oBAC1D,GAAG,CAAC,OAAO,EAAE,CAAA;oBACb,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAElC,mEAAmE;YACnE,mEAAmE;YACnE,4DAA4D;YAC5D,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;YACvD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;gBAChF,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,EAAE,IAAI,EAAE,CAAA;YACV,MAAM,MAAM,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;YACnD,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,CAAA;YAC7E,oEAAoE;YACpE,sDAAsD;YACtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CACpE,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB;gBACrC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAqB,CAAC;oBACrC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAqB,CAAC,CAC9D,CAAA;YACD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAA;YAC9C,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAA;YAEhF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC7C,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC9C,MAAM,eAAe,GAA2B,EAAE,CAAA;YAClD,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBACvC,eAAe,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YAC/B,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;YAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,YAAY;YACZ,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;YAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAC,cAAc,EAAE,kBAAkB,EAAC,CAAC,CAAA;YACxD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAE,uBAAuB,EAAC,CAAC,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC,CAAC,CAAA;IACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,10 @@
+import type { Registry, RegistryOptions } from './types.js';
+/**
+ * Create a registry as a portable fetch handler. Implements the required
+ * contract (publish, build download with Range, enroll + re-mint, browser
+ * login) and the advisory reference check-in protocol from
+ * docs/registry-spec.md. No orgs, no config sync; the `create` publish field
+ * is accepted and ignored (apps are created implicitly on first publish).
+ */
+export declare function createRegistry(options: RegistryOptions): Registry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA4B,QAAQ,EAAE,eAAe,EAAc,MAAM,YAAY,CAAA;AA4GjG;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAylCjE"}