@moltzap/identity 2026.902.0

package/dist/registry/contract.js

@@ -0,0 +1,132 @@
+/** @file Complete Registry-owned client, request, and representation contract. */
+import { Data, Schema } from "effect";
+import { AgentCard, verifiedAgentCardSchema, } from "../agent-card.js";
+import { Ed25519PublicKey } from "../agent-key.js";
+import { AgentId, AgentName, canonicalIdentifier, PrincipalId, } from "../identifiers.js";
+/** Idempotency identity for a registration operation. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas share the public domain name they decode.
+export const OperationId = canonicalIdentifier("OperationId", "opn_", 16);
+/** The Registry connection could not be established or used. */
+export class RegistryConnectionError extends Data.TaggedError("RegistryConnectionError") {
+}
+/** The configured complete Registry call deadline expired. */
+export class RegistryRequestTimeoutError extends Data.TaggedError("RegistryRequestTimeoutError") {
+}
+/** A Registry response did not match the selected operation contract. */
+export class RegistryInvalidResponseError extends Data.TaggedError("RegistryInvalidResponseError") {
+}
+const exactStruct = (fields) => Schema.Struct(fields).annotations({
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+/** Closed Registry bootstrap registration request. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas share the public domain name they decode.
+export const RegistryRegisterRequest = exactStruct({
+    operationId: OperationId,
+    principalId: PrincipalId,
+    agentName: AgentName,
+    publicKey: Ed25519PublicKey,
+}).annotations({ identifier: "RegistryRegisterRequest" });
+/** Closed Registry lookup selector. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas share the public domain name they decode.
+export const RegistryLookupRequest = Schema.Union(exactStruct({ agentId: AgentId }), exactStruct({ agentName: AgentName })).annotations({
+    identifier: "RegistryLookupRequest",
+    parseOptions: {
+        exact: true,
+        onExcessProperty: "error",
+    },
+});
+/** Closed Registry list continuation request. */
+// eslint-disable-next-line @typescript-eslint/naming-convention -- Effect Schemas share the public domain name they decode.
+export const RegistryListRequest = exactStruct({
+    afterAgentId: Schema.optional(AgentId),
+}).annotations({ identifier: "RegistryListRequest" });
+/** Package-private validated registration outcome. */
+// eslint-disable-next-line agent-code-guard/no-exported-brand-constructor -- The private RPC descriptor consumes this verified in-process Schema; the package root does not export it.
+export const registerResultSchema = Schema.Union(exactStruct({
+    kind: Schema.Literal("registered"),
+    agentCard: verifiedAgentCardSchema,
+}), exactStruct({ kind: Schema.Literal("name_taken") }), exactStruct({ kind: Schema.Literal("key_already_registered") }), exactStruct({ kind: Schema.Literal("idempotency_conflict") }));
+/** Package-private validated lookup outcome. */
+// eslint-disable-next-line agent-code-guard/no-exported-brand-constructor -- The private RPC descriptor consumes this verified in-process Schema; the package root does not export it.
+export const lookupResultSchema = Schema.Union(exactStruct({
+    kind: Schema.Literal("found"),
+    agentCard: verifiedAgentCardSchema,
+}), exactStruct({ kind: Schema.Literal("not_found") }));
+/** Package-private validated list outcome. */
+export const listResultSchema = exactStruct({
+    kind: Schema.Literal("page"),
+    agentCards: Schema.Array(verifiedAgentCardSchema),
+    hasMore: Schema.Boolean,
+});
+/** Exact registration response representation used by both HTTP adapters. */
+// eslint-disable-next-line agent-code-guard/no-exported-brand-constructor -- Private HTTP and storage adapters share this Schema; the package root does not export it.
+export const registerResponseSchema = Schema.Union(exactStruct({
+    kind: Schema.Literal("registered"),
+    agentCard: AgentCard,
+}), exactStruct({ kind: Schema.Literal("name_taken") }), exactStruct({ kind: Schema.Literal("key_already_registered") }), exactStruct({ kind: Schema.Literal("idempotency_conflict") }));
+/** Exact lookup response representation used by both HTTP adapters. */
+// eslint-disable-next-line agent-code-guard/no-exported-brand-constructor -- Private HTTP adapters share this Schema; the package root does not export it.
+export const lookupResponseSchema = Schema.Union(exactStruct({
+    kind: Schema.Literal("found"),
+    agentCard: AgentCard,
+}), exactStruct({ kind: Schema.Literal("not_found") }));
+/** Exact list response representation used by both HTTP adapters. */
+export const listResponseSchema = exactStruct({
+    kind: Schema.Literal("page"),
+    agentCards: Schema.Array(AgentCard),
+    hasMore: Schema.Boolean,
+});
+/** Exact bootstrap registration HTTP body. */
+export const registrationBody = exactStruct({
+    request: RegistryRegisterRequest,
+});
+/** Exact bootstrap registration request path. */
+export const REGISTER_PATH = "/v1/identities:register";
+/** Exact public lookup request path. */
+export const LOOKUP_PATH = "/v1/identities:lookup";
+/** Exact public list request path. */
+export const LIST_PATH = "/v1/identities:list";
+/** Exact Registry readiness path. */
+export const HEALTH_PATH = "/healthz";
+/** Effect Router patterns escape the literal colon in Registry paths. */
+export const REGISTER_ROUTE = "/v1/identities::register";
+/** Effect Router pattern for the literal lookup path. */
+export const LOOKUP_ROUTE = "/v1/identities::lookup";
+/** Effect Router pattern for the literal list path. */
+export const LIST_ROUTE = "/v1/identities::list";
+/** Exact paths used to classify method mismatches at the fallback route. */
+export const KNOWN_PATHS = new Set([
+    REGISTER_PATH,
+    LOOKUP_PATH,
+    LIST_PATH,
+    HEALTH_PATH,
+]);
+const maximumIdentifier = "agt_AAAAAAAAAAAAAAAAAAAAAA";
+const maximumOperationId = "opn_AAAAAAAAAAAAAAAAAAAAAA";
+const maximumPrincipalId = "prn_AAAAAAAAAAAAAAAAAAAAAA";
+const maximumName = "a".repeat(32);
+const maximumCoordinate = "A".repeat(43);
+const byteLength = (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength;
+/** Derived exact maximum bootstrap registration body size. */
+export const REGISTER_BODY_CAP = byteLength({
+    request: {
+        operationId: maximumOperationId,
+        principalId: maximumPrincipalId,
+        agentName: maximumName,
+        publicKey: {
+            crv: "Ed25519",
+            kty: "OKP",
+            x: maximumCoordinate,
+        },
+    },
+});
+/** Derived exact maximum public lookup body size. */
+export const LOOKUP_BODY_CAP = Math.max(byteLength({ agentId: maximumIdentifier }), byteLength({ agentName: maximumName }));
+/** Derived exact maximum public list body size. */
+export const LIST_BODY_CAP = byteLength({
+    afterAgentId: maximumIdentifier,
+});
+//# sourceMappingURL=contract.js.map

package/dist/registry/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../src/registry/contract.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,IAAI,EAA8B,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGlE,OAAO,EACL,SAAS,EAET,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAA8B,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACL,OAAO,EACP,SAAS,EACT,mBAAmB,EACnB,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAE3B,yDAAyD;AACzD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAK1E,gEAAgE;AAChE,MAAM,OAAO,uBAAwB,SAAQ,IAAI,CAAC,WAAW,CAC3D,yBAAyB,CAC1B;CAAG;AAEJ,8DAA8D;AAC9D,MAAM,OAAO,2BAA4B,SAAQ,IAAI,CAAC,WAAW,CAC/D,6BAA6B,CAC9B;CAAG;AAEJ,yEAAyE;AACzE,MAAM,OAAO,4BAA6B,SAAQ,IAAI,CAAC,WAAW,CAChE,8BAA8B,CAC/B;CAAG;AAEJ,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC;IAChC,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAEL,sDAAsD;AACtD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,SAAS,EAAE,SAAS;IACpB,SAAS,EAAE,gBAAgB;CAC5B,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAK1D,uCAAuC;AACvC,4HAA4H;AAC5H,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAC/C,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACjC,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CACtC,CAAC,WAAW,CAAC;IACZ,UAAU,EAAE,uBAAuB;IACnC,YAAY,EAAE;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAC,CAAC;AAKH,iDAAiD;AACjD,4HAA4H;AAC5H,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;CACvC,CAAC,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAiEtD,sDAAsD;AACtD,uLAAuL;AACvL,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAC9C,WAAW,CAAC;IACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAClC,SAAS,EAAE,uBAAuB;CACnC,CAAC,EACF,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EACnD,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC,EAC/D,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAC9D,CAAC;AAEF,gDAAgD;AAChD,uLAAuL;AACvL,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,CAC5C,WAAW,CAAC;IACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,uBAAuB;CACnC,CAAC,EACF,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CACnD,CAAC;AAEF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,uKAAuK;AACvK,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,KAAK,CAChD,WAAW,CAAC;IACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAClC,SAAS,EAAE,SAAS;CACrB,CAAC,EACF,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EACnD,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC,EAC/D,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAC9D,CAAC;AAEF,uEAAuE;AACvE,2JAA2J;AAC3J,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,KAAK,CAC9C,WAAW,CAAC;IACV,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,SAAS;CACrB,CAAC,EACF,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CACnD,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC,OAAO;CACxB,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,OAAO,EAAE,uBAAuB;CACjC,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,yBAAyB,CAAC;AACvD,wCAAwC;AACxC,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AACnD,sCAAsC;AACtC,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAC/C,qCAAqC;AACrC,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC;AAEtC,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,0BAA0B,CAAC;AACzD,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,uDAAuD;AACvD,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IACjC,aAAa;IACb,WAAW;IACX,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AACxD,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AACxD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACnC,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,UAAU,GAAG,CAAC,KAAc,EAAU,EAAE,CAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC1C,OAAO,EAAE;QACP,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,kBAAkB;QAC/B,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE;YACT,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,KAAK;YACV,CAAC,EAAE,iBAAiB;SACrB;KACF;CACF,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CACrC,UAAU,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAC1C,UAAU,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CACvC,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;IACtC,YAAY,EAAE,iBAAiB;CAChC,CAAC,CAAC"}

package/dist/registry/http.d.ts

@@ -0,0 +1,27 @@
+/** @file Authenticated Registry HTTP routes, bounded framing, and exact envelopes. */
+import { HttpRouter } from "@effect/platform";
+import { Effect } from "effect";
+import type { RegistryStorage } from "./storage.js";
+import { verifyBootstrapRegistration } from "./admission.js";
+import { type RegistryRpcClient } from "./rpc.js";
+type RegistryHttpAppInput = Readonly<{
+    client: RegistryRpcClient;
+    storage: RegistryStorage;
+    admissionCredential: Parameters<typeof verifyBootstrapRegistration>[0]["admissionCredential"];
+    nonceCapacity: number;
+    requestSemaphore: Effect.Semaphore;
+}>;
+/**
+ * Builds the complete Registry HTTP application.
+ *
+ * @param input Complete Registry boundary dependencies.
+ * @param input.client In-process RPC client for domain operations.
+ * @param input.storage Durable registration nonce storage.
+ * @param input.admissionCredential Bootstrap admission secret.
+ * @param input.nonceCapacity Maximum live bootstrap nonces.
+ * @param input.requestSemaphore Immediate global request admission.
+ * @returns The complete Registry HTTP application.
+ */
+export declare function makeRegistryHttpApp(input: RegistryHttpAppInput): HttpRouter.HttpRouter<never, never>;
+export {};
+//# sourceMappingURL=http.d.ts.map

package/dist/registry/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/registry/http.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EACL,UAAU,EAGX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAS,MAAM,EAAkB,MAAM,QAAQ,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAepD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAmB7D,OAAO,EAAE,KAAK,iBAAiB,EAA0B,MAAM,UAAU,CAAC;AAE1E,KAAK,oBAAoB,GAAG,QAAQ,CAAC;IACnC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,mBAAmB,EAAE,UAAU,CAC7B,OAAO,2BAA2B,CACnC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC,SAAS,CAAC;CACpC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,uCAQ9D"}

package/dist/registry/http.js

@@ -0,0 +1,258 @@
+/** @file Authenticated Registry HTTP routes, bounded framing, and exact envelopes. */
+import { HttpRouter, HttpServerRequest, HttpServerResponse, } from "@effect/platform";
+import { NodeHttpServerRequest } from "@effect/platform-node";
+import { Cause, Effect, Option, Schema } from "effect";
+import { decodeCanonicalJson, encodeCanonicalJson } from "../canonical-json.js";
+import { httpEnvelope, InternalServerError, MalformedRequestError, MethodNotAllowedError, OverloadedError, PayloadTooLargeError, RouteNotFoundError, UnsupportedMediaTypeError, VersionMismatchError, } from "../http-errors.js";
+import { MOLTZAP_VERSION } from "../version.js";
+import { verifyBootstrapRegistration } from "./admission.js";
+import { HEALTH_PATH, KNOWN_PATHS, LIST_BODY_CAP, LIST_PATH, LIST_ROUTE, listResponseSchema, LOOKUP_BODY_CAP, LOOKUP_PATH, LOOKUP_ROUTE, lookupResponseSchema, REGISTER_BODY_CAP, REGISTER_PATH, REGISTER_ROUTE, registerResponseSchema, RegistryListRequest, RegistryLookupRequest, } from "./contract.js";
+import { withBootstrapAdmission } from "./rpc.js";
+/**
+ * Builds the complete Registry HTTP application.
+ *
+ * @param input Complete Registry boundary dependencies.
+ * @param input.client In-process RPC client for domain operations.
+ * @param input.storage Durable registration nonce storage.
+ * @param input.admissionCredential Bootstrap admission secret.
+ * @param input.nonceCapacity Maximum live bootstrap nonces.
+ * @param input.requestSemaphore Immediate global request admission.
+ * @returns The complete Registry HTTP application.
+ */
+export function makeRegistryHttpApp(input) {
+    return HttpRouter.empty.pipe(HttpRouter.post(REGISTER_ROUTE, registerHandler(input)), lookupRoute(input), listRoute(input), healthRoute(input.storage), fallbackRoute());
+}
+const JSON_CONTENT_TYPE = "application/json";
+const SIGNATURE_HEADERS = [
+    "content-digest",
+    "signature-input",
+    "signature",
+    "authorization",
+];
+const SINGLE_VALUE_HEADERS = [
+    "host",
+    "content-type",
+    "content-encoding",
+    "content-length",
+    "transfer-encoding",
+    "moltzap-version",
+    ...SIGNATURE_HEADERS,
+];
+function lookupRoute(input) {
+    return HttpRouter.post(LOOKUP_ROUTE, publicReadHandler({
+        path: LOOKUP_PATH,
+        bodyCap: LOOKUP_BODY_CAP,
+        requestSchema: RegistryLookupRequest,
+        resultSchema: lookupResponseSchema,
+        invoke: (request) => input.client.lookup(request),
+        requestSemaphore: input.requestSemaphore,
+    }));
+}
+function listRoute(input) {
+    return HttpRouter.post(LIST_ROUTE, publicReadHandler({
+        path: LIST_PATH,
+        bodyCap: LIST_BODY_CAP,
+        requestSchema: RegistryListRequest,
+        resultSchema: listResponseSchema,
+        invoke: (request) => input.client.list(request),
+        requestSemaphore: input.requestSemaphore,
+    }));
+}
+function healthRoute(storage) {
+    return HttpRouter.get(HEALTH_PATH, Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (request.url !== HEALTH_PATH) {
+            return errorResponse(new RouteNotFoundError());
+        }
+        return yield* storage.checkReadiness().pipe(Effect.match({
+            onFailure: () => HttpServerResponse.empty({ status: 503 }),
+            onSuccess: () => HttpServerResponse.empty({ status: 204 }),
+        }), Effect.catchAllCause(() => Effect.succeed(HttpServerResponse.empty({ status: 503 }))));
+    }));
+}
+function fallbackRoute() {
+    return HttpRouter.all("*", Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (request.url.includes("?")) {
+            return errorResponse(new RouteNotFoundError());
+        }
+        const path = request.url.split("?", 1)[0] ?? "";
+        return KNOWN_PATHS.has(path)
+            ? errorResponse(new MethodNotAllowedError())
+            : errorResponse(new RouteNotFoundError());
+    }));
+}
+function registerHandler(input) {
+    return recoverHttpResponse(Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (request.url !== REGISTER_PATH) {
+            return yield* new RouteNotFoundError();
+        }
+        yield* validateRequestFraming({
+            request,
+            maximumBytes: REGISTER_BODY_CAP,
+            profile: "registration",
+        });
+        return yield* executeWithPermit(input.requestSemaphore, Effect.gen(function* () {
+            const bodyBytes = yield* readBoundedBody(request, REGISTER_BODY_CAP);
+            const registration = yield* verifyBootstrapRegistration({
+                httpRequest: request,
+                bodyBytes,
+                admissionCredential: input.admissionCredential,
+                nonceCapacity: input.nonceCapacity,
+                storage: input.storage,
+            });
+            const result = yield* withBootstrapAdmission(input.client.register(registration));
+            return yield* resultResponse(registerResponseSchema, result);
+        }));
+    }));
+}
+function publicReadHandler(input) {
+    return recoverHttpResponse(Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest;
+        if (request.url !== input.path) {
+            return yield* new RouteNotFoundError();
+        }
+        yield* validateRequestFraming({
+            request,
+            maximumBytes: input.bodyCap,
+            profile: "public-read",
+        });
+        return yield* executeWithPermit(input.requestSemaphore, Effect.gen(function* () {
+            const bodyBytes = yield* readBoundedBody(request, input.bodyCap);
+            if (request.headers["moltzap-version"] !== MOLTZAP_VERSION) {
+                return yield* new VersionMismatchError();
+            }
+            const decoded = yield* decodeCanonicalJson(input.requestSchema, bodyBytes).pipe(
+            // eslint-disable-next-line agent-code-guard/no-effect-error-coalescing -- Every canonical body or request-schema failure has the same public malformed-request meaning.
+            Effect.mapError(() => new MalformedRequestError()));
+            const result = yield* input.invoke(decoded);
+            return yield* resultResponse(input.resultSchema, result);
+        }));
+    }));
+}
+function recoverHttpResponse(effect) {
+    return effect.pipe(Effect.catchAll((error) => Effect.succeed(errorResponse(error))), Effect.catchAllCause((cause) => Effect.logError("Registry request failed", Cause.squash(cause)).pipe(Effect.as(errorResponse(new InternalServerError())))));
+}
+function executeWithPermit(semaphore, effect) {
+    return semaphore
+        .withPermitsIfAvailable(1)(effect)
+        .pipe(Effect.flatMap(Option.match({
+        onNone: () => Effect.fail(new OverloadedError()),
+        onSome: Effect.succeed,
+    })));
+}
+function validateRequestFraming(input) {
+    if (requestFramingIsMalformed(input)) {
+        return rejectBeforeBodyRead(input.request, new MalformedRequestError());
+    }
+    if (mediaTypeIsUnsupported(input.request)) {
+        return rejectBeforeBodyRead(input.request, new UnsupportedMediaTypeError());
+    }
+    return validateDeclaredLength(input.request, input.maximumBytes);
+}
+function requestFramingIsMalformed(input) {
+    if (SINGLE_VALUE_HEADERS.some((name) => rawHeaderCount(input.request, name) > 1)) {
+        return true;
+    }
+    if (input.request.headers["content-length"] !== undefined &&
+        input.request.headers["transfer-encoding"] !== undefined) {
+        return true;
+    }
+    return (input.profile === "public-read" &&
+        SIGNATURE_HEADERS.some((name) => rawHeaderCount(input.request, name) !== 0));
+}
+function rawHeaderCount(request, name) {
+    const incoming = NodeHttpServerRequest.toIncomingMessage(request);
+    let count = 0;
+    for (let index = 0; index < incoming.rawHeaders.length; index += 2) {
+        if (incoming.rawHeaders[index]?.toLowerCase() === name) {
+            count += 1;
+        }
+    }
+    return count;
+}
+function mediaTypeIsUnsupported(request) {
+    return (request.headers["content-type"] !== JSON_CONTENT_TYPE ||
+        request.headers["content-encoding"] !== undefined);
+}
+function validateDeclaredLength(request, maximumBytes) {
+    const headerIsPresent = request.headers["content-length"] !== undefined;
+    const declaredLength = canonicalContentLength(request);
+    if (headerIsPresent && declaredLength === undefined) {
+        return rejectBeforeBodyRead(request, new MalformedRequestError());
+    }
+    if (declaredLength !== undefined && declaredLength > maximumBytes) {
+        return rejectBeforeBodyRead(request, new PayloadTooLargeError());
+    }
+    return Effect.void;
+}
+function canonicalContentLength(request) {
+    const value = request.headers["content-length"];
+    if (value === undefined || !/^(?:0|[1-9]\d*)$/.test(value)) {
+        return undefined;
+    }
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : undefined;
+}
+function rejectBeforeBodyRead(request, error) {
+    return Effect.sync(() => {
+        NodeHttpServerRequest.toIncomingMessage(request).resume();
+    }).pipe(Effect.zipRight(Effect.fail(error)));
+}
+function readBoundedBody(request, maximumBytes) {
+    // #ignore-sloppy-code-next-line[async-keyword]: This Effect callback constructor does not use the JavaScript keyword.
+    return Effect.async((resume) => {
+        const incoming = NodeHttpServerRequest.toIncomingMessage(request);
+        const body = new Uint8Array(maximumBytes);
+        let length = 0;
+        const reader = {
+            cleanup: () => {
+                incoming.off("data", reader.onData);
+                incoming.off("end", reader.onEnd);
+                incoming.off("error", reader.onError);
+            },
+            onData: (chunk) => {
+                if (length + chunk.byteLength > maximumBytes) {
+                    reader.cleanup();
+                    incoming.resume();
+                    resume(Effect.fail(new PayloadTooLargeError()));
+                    return;
+                }
+                body.set(chunk, length);
+                length += chunk.byteLength;
+            },
+            onEnd: () => {
+                reader.cleanup();
+                resume(Effect.succeed(body.slice(0, length)));
+            },
+            onError: () => {
+                reader.cleanup();
+                resume(Effect.fail(new MalformedRequestError()));
+            },
+        };
+        incoming.on("data", reader.onData);
+        incoming.once("end", reader.onEnd);
+        incoming.once("error", reader.onError);
+        return Effect.sync(() => {
+            reader.cleanup();
+            incoming.resume();
+        });
+    });
+}
+function resultResponse(schema, value) {
+    return Schema.encode(schema)(value).pipe(Effect.flatMap(encodeCanonicalJson), Effect.map((bytes) => jsonResponse(bytes, 200)), 
+    // eslint-disable-next-line agent-code-guard/no-effect-error-coalescing -- Response serialization is an internal closed boundary with no client-actionable detail.
+    Effect.mapError(() => new InternalServerError()));
+}
+function errorResponse(error) {
+    const envelope = httpEnvelope(error);
+    return jsonResponse(new TextEncoder().encode(`{"error":"${envelope.code}"}`), envelope.status);
+}
+function jsonResponse(bodyBytes, status) {
+    return HttpServerResponse.uint8Array(bodyBytes, {
+        status,
+        contentType: JSON_CONTENT_TYPE,
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/registry/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/registry/http.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,YAAY,EAEZ,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EACL,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAA0B,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAY1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAC1B,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EACvD,WAAW,CAAC,KAAK,CAAC,EAClB,SAAS,CAAC,KAAK,CAAC,EAChB,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAC1B,aAAa,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,iBAAiB,GAAG;IACxB,gBAAgB;IAChB,iBAAiB;IACjB,WAAW;IACX,eAAe;CACP,CAAC;AACX,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,cAAc;IACd,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,iBAAiB;IACjB,GAAG,iBAAiB;CACZ,CAAC;AAEX,SAAS,WAAW,CAAC,KAA2B;IAC9C,OAAO,UAAU,CAAC,IAAI,CACpB,YAAY,EACZ,iBAAiB,CAAC;QAChB,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,eAAe;QACxB,aAAa,EAAE,qBAAqB;QACpC,YAAY,EAAE,oBAAoB;QAClC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACjD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAA2B;IAC5C,OAAO,UAAU,CAAC,IAAI,CACpB,UAAU,EACV,iBAAiB,CAAC;QAChB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,aAAa;QACtB,aAAa,EAAE,mBAAmB;QAClC,YAAY,EAAE,kBAAkB;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB;IAC3C,OAAO,UAAU,CAAC,GAAG,CACnB,WAAW,EACX,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,aAAa,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,CACzC,MAAM,CAAC,KAAK,CAAC;YACX,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC1D,SAAS,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SAC3D,CAAC,EACF,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAC1D,CACF,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,UAAU,CAAC,GAAG,CACnB,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC,CAAC,aAAa,CAAC,IAAI,qBAAqB,EAAE,CAAC;YAC5C,CAAC,CAAC,aAAa,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAQxB;IACC,OAAO,mBAAmB,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,CAAC,sBAAsB,CAAC;YAC5B,OAAO;YACP,YAAY,EAAE,iBAAiB;YAC/B,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAC7B,KAAK,CAAC,gBAAgB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC;gBACtD,WAAW,EAAE,OAAO;gBACpB,SAAS;gBACT,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,sBAAsB,CAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CACpC,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAKxB,KASD;IACC,OAAO,mBAAmB,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,CAAC,sBAAsB,CAAC;YAC5B,OAAO;YACP,YAAY,EAAE,KAAK,CAAC,OAAO;YAC3B,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAC7B,KAAK,CAAC,gBAAgB,EACtB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAC3C,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,mBAAmB,CACxC,KAAK,CAAC,aAAa,EACnB,SAAS,CACV,CAAC,IAAI;YACJ,wKAAwK;YACxK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,qBAAqB,EAAE,CAAC,CACnD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAID,SAAS,mBAAmB,CAC1B,MAIC;IAED,OAAO,MAAM,CAAC,IAAI,CAChB,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAChE,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7B,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC,CACpD,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,SAA2B,EAC3B,MAA8B;IAE9B,OAAO,SAAS;SACb,sBAAsB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACjC,IAAI,CACH,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,KAAK,CAAC;QACX,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC,OAAO;KACvB,CAAC,CACH,CACF,CAAC;AACN,CAAC;AAED,SAAS,sBAAsB,CAAC,KAI/B;IAIC,IAAI,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,qBAAqB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,yBAAyB,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,yBAAyB,CAAC,KAGlC;IACC,IACE,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS;QACrD,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,CAAC,OAAO,KAAK,aAAa;QAC/B,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,OAA4C,EAC5C,IAAY;IAEZ,MAAM,QAAQ,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YACvD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA4C;IAE5C,OAAO,CACL,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,iBAAiB;QACrD,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA4C,EAC5C,YAAoB;IAEpB,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,SAAS,CAAC;IACxE,MAAM,cAAc,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,eAAe,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,GAAG,YAAY,EAAE,CAAC;QAClE,OAAO,oBAAoB,CAAC,OAAO,EAAE,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAA4C;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAA4C,EAC5C,KAAQ;IAER,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;QACtB,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AASD,SAAS,eAAe,CACtB,OAA4C,EAC5C,YAAoB;IAEpB,sHAAsH;IACtH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,MAAM,GAAe;YACzB,OAAO,EAAE,GAAG,EAAE;gBACZ,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChB,IAAI,MAAM,GAAG,KAAK,CAAC,UAAU,GAAG,YAAY,EAAE,CAAC;oBAC7C,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;oBAChD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAC7B,CAAC;YACD,KAAK,EAAE,GAAG,EAAE;gBACV,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,EAAE,GAAG,EAAE;gBACZ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;SACF,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACtB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,MAA2B,EAC3B,KAAQ;IAER,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EACnC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/C,kKAAkK;IAClK,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAwB;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,YAAY,CACjB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,QAAQ,CAAC,IAAI,IAAI,CAAC,EACxD,QAAQ,CAAC,MAAM,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,SAAqB,EACrB,MAAc;IAEd,OAAO,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE;QAC9C,MAAM;QACN,WAAW,EAAE,iBAAiB;KAC/B,CAAC,CAAC;AACL,CAAC"}

package/dist/registry/migrations/0001_registry.d.ts

@@ -0,0 +1,6 @@
+/** @file Initial PostgreSQL schema for Registry metadata, cards, operations, and replay nonces. */
+import { SqlClient } from "@effect/sql/SqlClient";
+import { Effect } from "effect";
+/** Canonical initial Registry schema exercised by Effect Migrator. */
+export declare const registryMigration: Effect.Effect<void, import("@effect/sql/SqlError").SqlError, SqlClient>;
+//# sourceMappingURL=0001_registry.d.ts.map

package/dist/registry/migrations/0001_registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0001_registry.d.ts","sourceRoot":"","sources":["../../../src/registry/migrations/0001_registry.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,yEA8Be,CAAC"}

package/dist/registry/migrations/0001_registry.js

@@ -0,0 +1,36 @@
+/** @file Initial PostgreSQL schema for Registry metadata, cards, operations, and replay nonces. */
+import { SqlClient } from "@effect/sql/SqlClient";
+import { Effect } from "effect";
+/** Canonical initial Registry schema exercised by Effect Migrator. */
+export const registryMigration = Effect.gen(function* () {
+    const sql = yield* SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE moltzap_registry_metadata (
+      singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+      moltzap_version text NOT NULL,
+      signer_thumbprint text NOT NULL
+    );
+    CREATE TABLE moltzap_registry_agents (
+      agent_id text PRIMARY KEY,
+      agent_id_bytes bytea NOT NULL UNIQUE,
+      principal_id text NOT NULL,
+      agent_name text NOT NULL UNIQUE,
+      public_key_thumbprint text NOT NULL UNIQUE,
+      agent_card_bytes bytea NOT NULL
+    );
+    CREATE TABLE moltzap_registry_operations (
+      public_key_thumbprint text NOT NULL,
+      operation_id text NOT NULL,
+      request_bytes bytea NOT NULL,
+      result_bytes bytea NOT NULL,
+      PRIMARY KEY (public_key_thumbprint, operation_id)
+    );
+    CREATE TABLE moltzap_registry_nonces (
+      nonce text PRIMARY KEY,
+      expires_at bigint NOT NULL
+    );
+    CREATE INDEX moltzap_registry_nonces_expiry
+      ON moltzap_registry_nonces (expires_at);
+  `);
+}).pipe(Effect.withSpan("registryMigration"));
+//# sourceMappingURL=0001_registry.js.map

package/dist/registry/migrations/0001_registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"0001_registry.js","sourceRoot":"","sources":["../../../src/registry/migrations/0001_registry.ts"],"names":[],"mappings":"AAAA,mGAAmG;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC;IAC7B,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BjB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC"}

package/dist/registry/rpc.d.ts

@@ -0,0 +1,138 @@
+/** @file Private admitted Registry operations and in-process RPC dispatch. */
+import { Rpc, RpcClient, RpcGroup, RpcMiddleware } from "@effect/rpc";
+import { Context, Effect, Layer, Schema } from "effect";
+import type { AgentSigningAuthority } from "../agent-key.js";
+import type { RegistryStorage } from "./storage.js";
+import { AuthenticationFailedError, InternalServerError, MalformedRequestError, MethodNotAllowedError, OverloadedError, PayloadTooLargeError, RouteNotFoundError, UnavailableError, UnsupportedMediaTypeError, VersionMismatchError } from "../http-errors.js";
+interface BootstrapAdmission {
+    readonly admitted: true;
+}
+declare const BootstrapAdmissionContext_base: Context.TagClass<BootstrapAdmissionContext, "@moltzap/identity/BootstrapAdmissionContext", BootstrapAdmission>;
+declare class BootstrapAdmissionContext extends BootstrapAdmissionContext_base {
+}
+declare const RegistryAdmission_base: RpcMiddleware.TagClass<RegistryAdmission, "@moltzap/identity/RegistryAdmission", {
+    readonly provides: typeof BootstrapAdmissionContext;
+    readonly failure: typeof AuthenticationFailedError;
+}>;
+/** Required private RPC admission boundary for Registry registration. */
+export declare class RegistryAdmission extends RegistryAdmission_base {
+}
+/**
+ * Runs private Registry dispatch with one already-verified admission proof.
+ *
+ * @param effect Private registration dispatch to admit.
+ * @returns The dispatch with its admission proof scoped to the current fiber.
+ */
+export declare const withBootstrapAdmission: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+/** Layer installed only inside the Registry process's private RPC runtime. */
+export declare const registryAdmissionLayer: Layer.Layer<RegistryAdmission, never, never>;
+/** The package-private no-serialization Registry operation group. */
+declare const registryOperations: RpcGroup.RpcGroup<Rpc.Rpc<"list", Schema.Struct<{
+    afterAgentId: Schema.optional<Schema.brand<Schema.filter<typeof Schema.String>, "AgentId">>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["page"]>;
+    agentCards: Schema.Array$<Schema.declare<import("../agent-card.js").VerifiedAgentCard, import("../agent-card.js").VerifiedAgentCard, readonly [], never>>;
+    hasMore: typeof Schema.Boolean;
+}>, Schema.Union<[typeof MalformedRequestError, typeof RouteNotFoundError, typeof MethodNotAllowedError, typeof VersionMismatchError, typeof PayloadTooLargeError, typeof UnsupportedMediaTypeError, typeof OverloadedError, typeof UnavailableError, typeof InternalServerError]>, never> | Rpc.Rpc<"lookup", Schema.Union<[Schema.Struct<{
+    agentId: Schema.brand<Schema.filter<typeof Schema.String>, "AgentId">;
+}>, Schema.Struct<{
+    agentName: Schema.brand<Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>, "AgentName">;
+}>]>, Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["found"]>;
+    agentCard: Schema.declare<import("../agent-card.js").VerifiedAgentCard, import("../agent-card.js").VerifiedAgentCard, readonly [], never>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["not_found"]>;
+}>]>, Schema.Union<[typeof MalformedRequestError, typeof RouteNotFoundError, typeof MethodNotAllowedError, typeof VersionMismatchError, typeof PayloadTooLargeError, typeof UnsupportedMediaTypeError, typeof OverloadedError, typeof UnavailableError, typeof InternalServerError]>, never> | Rpc.Rpc<"register", Schema.Struct<{
+    operationId: Schema.brand<Schema.filter<typeof Schema.String>, "OperationId">;
+    principalId: Schema.brand<Schema.filter<typeof Schema.String>, "PrincipalId">;
+    agentName: Schema.brand<Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>, "AgentName">;
+    publicKey: Schema.brand<Schema.transform<Schema.Struct<{
+        crv: Schema.Literal<["Ed25519"]>;
+        kty: Schema.Literal<["OKP"]>;
+        x: Schema.filter<typeof Schema.String>;
+    }>, Schema.declare<Readonly<{
+        crv: "Ed25519";
+        kty: "OKP";
+        x: string;
+    }>, Readonly<{
+        crv: "Ed25519";
+        kty: "OKP";
+        x: string;
+    }>, readonly [], never>>, "Ed25519PublicKey">;
+}>, Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["registered"]>;
+    agentCard: Schema.declare<import("../agent-card.js").VerifiedAgentCard, import("../agent-card.js").VerifiedAgentCard, readonly [], never>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["name_taken"]>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["key_already_registered"]>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["idempotency_conflict"]>;
+}>]>, Schema.Union<[typeof MalformedRequestError, typeof AuthenticationFailedError, typeof RouteNotFoundError, typeof MethodNotAllowedError, typeof VersionMismatchError, typeof PayloadTooLargeError, typeof UnsupportedMediaTypeError, typeof OverloadedError, typeof UnavailableError, typeof InternalServerError]>, typeof RegistryAdmission>>;
+/** Private in-process client for the Registry operation group. */
+export type RegistryRpcClient = RpcClient.FromGroup<typeof registryOperations>;
+/** Connects the private Registry RPC client and server in memory. */
+export declare const makeRegistryRpcClient: Effect.Effect<{
+    readonly list: <const AsMailbox extends boolean = false, const Discard = false>(input: {
+        readonly afterAgentId?: (string & import("effect/Brand").Brand<"AgentId">) | undefined;
+    }, options?: {
+        readonly headers?: import("@effect/platform/Headers").Input | undefined;
+        readonly context?: Context.Context<never> | undefined;
+        readonly discard?: Discard | undefined;
+    } | undefined) => Effect.Effect<Discard extends true ? void : {
+        readonly kind: "page";
+        readonly agentCards: readonly import("../agent-card.js").VerifiedAgentCard[];
+        readonly hasMore: boolean;
+    }, Discard extends true ? never : InternalServerError | MalformedRequestError | MethodNotAllowedError | OverloadedError | PayloadTooLargeError | RouteNotFoundError | UnavailableError | UnsupportedMediaTypeError | VersionMismatchError, never>;
+    readonly lookup: <const AsMailbox extends boolean = false, const Discard = false>(input: {
+        readonly agentId: string & import("effect/Brand").Brand<"AgentId">;
+    } | {
+        readonly agentName: string & import("effect/Brand").Brand<"AgentName">;
+    }, options?: {
+        readonly headers?: import("@effect/platform/Headers").Input | undefined;
+        readonly context?: Context.Context<never> | undefined;
+        readonly discard?: Discard | undefined;
+    } | undefined) => Effect.Effect<Discard extends true ? void : {
+        readonly kind: "found";
+        readonly agentCard: import("../agent-card.js").VerifiedAgentCard;
+    } | {
+        readonly kind: "not_found";
+    }, Discard extends true ? never : InternalServerError | MalformedRequestError | MethodNotAllowedError | OverloadedError | PayloadTooLargeError | RouteNotFoundError | UnavailableError | UnsupportedMediaTypeError | VersionMismatchError, never>;
+    readonly register: <const AsMailbox extends boolean = false, const Discard = false>(input: {
+        readonly operationId: string & import("effect/Brand").Brand<"OperationId">;
+        readonly principalId: string & import("effect/Brand").Brand<"PrincipalId">;
+        readonly agentName: string & import("effect/Brand").Brand<"AgentName">;
+        readonly publicKey: Readonly<{
+            crv: "Ed25519";
+            kty: "OKP";
+            x: string;
+        }> & import("effect/Brand").Brand<"Ed25519PublicKey">;
+    }, options?: {
+        readonly headers?: import("@effect/platform/Headers").Input | undefined;
+        readonly context?: Context.Context<never> | undefined;
+        readonly discard?: Discard | undefined;
+    } | undefined) => Effect.Effect<Discard extends true ? void : {
+        readonly kind: "registered";
+        readonly agentCard: import("../agent-card.js").VerifiedAgentCard;
+    } | {
+        readonly kind: "name_taken";
+    } | {
+        readonly kind: "key_already_registered";
+    } | {
+        readonly kind: "idempotency_conflict";
+    }, Discard extends true ? never : AuthenticationFailedError | InternalServerError | MalformedRequestError | MethodNotAllowedError | OverloadedError | PayloadTooLargeError | RouteNotFoundError | UnavailableError | UnsupportedMediaTypeError | VersionMismatchError, never>;
+}, never, Rpc.Handler<"list"> | Rpc.Handler<"lookup"> | Rpc.Handler<"register"> | RegistryAdmission | import("effect/Scope").Scope>;
+/**
+ * Implements the three private operations over durable Registry storage.
+ *
+ * @param input Private RPC handler dependencies.
+ * @param input.storage Durable Registry operations.
+ * @param input.registrySigningAuthority Registry card issuer.
+ * @returns A layer implementing the complete private operation group.
+ */
+export declare const makeRegistryRpcHandlersLayer: (input: {
+    readonly storage: RegistryStorage;
+    readonly registrySigningAuthority: AgentSigningAuthority;
+}) => Layer.Layer<Rpc.Handler<"list"> | Rpc.Handler<"lookup"> | Rpc.Handler<"register">, never, never>;
+export {};
+//# sourceMappingURL=rpc.d.ts.map