@sema-agent/sdk 0.0.113 → 0.0.114

package/dist/registry/auth.d.ts

@@ -0,0 +1,55 @@
+/**
+ * RFC 8628 device flow 驱动(G17 R1;registry-core api/auth.ts 是 wire 契约真身)。
+ *
+ * 契约单源纪律:SDK 保持**零运行时依赖**(拆包验字节门)⇒ 下面的路径/grant_type 是对
+ * `@sema-agent/registry-core` 的**值拷贝**,由 registry-auth.test.ts 的同源锚测试机器对账
+ * (registry-core 升键 ⇒ 锚红,不靠人肉)。类型用 type-only import(零运行时)。
+ *
+ * WIRE CASING:OAuth 标准端点,wire 字段 snake_case(access_token/device_code/…)——故意破本包
+ * camelCase 习惯,勿"修"(registry-core 同句)。
+ */
+import type { DeviceCodeResponse, TokenGrantResponse } from "@sema-agent/registry-core";
+import type { TokenProvider } from "./token-provider.js";
+/** 值拷贝 ← registry-core AUTH_V1_PATHS(同源锚测试对账)。 */
+export declare const REGISTRY_AUTH_PATHS: {
+    readonly deviceCode: "/api/v1/auth/device/code";
+    readonly deviceToken: "/api/v1/auth/device/token";
+    readonly deviceApprove: "/api/v1/auth/device/approve";
+    readonly tokenRefresh: "/api/v1/auth/token/refresh";
+    readonly logout: "/api/v1/auth/logout";
+};
+/** 值拷贝 ← registry-core DEVICE_GRANT_TYPE(同源锚测试对账)。 */
+export declare const REGISTRY_DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+export type { DeviceCodeResponse, TokenGrantResponse };
+/** 步骤 1:POST device/code(设计上无凭证)。`clientName` 是同意屏的展示提示(非秘密)。 */
+export declare function requestDeviceCode(baseUrl: string, opts?: {
+    clientName?: string;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<DeviceCodeResponse>;
+/** 步骤 3:轮询 device/token 直到 approved(RFC §3.5:pending=保持 interval;slow_down=+5s——语义
+ *  真身是 registry-core `nextPollInterval`,此处按同判据实现,同源锚测试双向对账)。终态错
+ *  (expired_token/access_denied)typed 抛出。成功先 `tokens.set` 再返回(persist-before-return)。
+ *  `sleep` 可注入(测试);`signal` 中断轮询。 */
+export declare function pollUntilApproved(baseUrl: string, device: Pick<DeviceCodeResponse, "device_code" | "interval" | "expires_in">, opts: {
+    tokens: TokenProvider;
+    fetch?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    signal?: AbortSignal;
+}): Promise<TokenGrantResponse>;
+/** 步骤 4:refresh 轮换(STRICT single-use:成功即旧 grant 作废)。成功先 set 后返回;
+ *  `invalid_grant`(replay/revoked/expired)⇒ **clear + typed**——本地令牌已不可再生,留着只会
+ *  永远循环失败,清掉让宿主直接进登录流。网络层错误原样抛(可重试,令牌不动)。 */
+export declare function refreshTokens(baseUrl: string, opts: {
+    tokens: TokenProvider;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<TokenGrantResponse>;
+/** 步骤 5:logout(RFC 7009:服务端恒 200 不披露存在性)。本地令牌**无条件清**(服务端失败也清——
+ *  logout 的用户意图是"这台机器不再持有";renewal 路径已断或将断,残留本地令牌只是风险)。 */
+export declare function logoutRegistry(baseUrl: string, opts: {
+    tokens: TokenProvider;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/registry/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/registry/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAExF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,kDAAkD;AAClD,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX,sDAAsD;AACtD,eAAO,MAAM,0BAA0B,iDAAiD,CAAC;AAEzF,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;AAyBvD,iEAAiE;AACjE,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC7E,OAAO,CAAC,kBAAkB,CAAC,CAS7B;AAED;;;qCAGqC;AACrC,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,UAAU,GAAG,YAAY,CAAC,EAC3E,IAAI,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACjH,OAAO,CAAC,kBAAkB,CAAC,CAsB7B;AAED;;6CAE6C;AAC7C,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAC1E,OAAO,CAAC,kBAAkB,CAAC,CAiB7B;AAED;2DAC2D;AAC3D,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAC1E,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/registry/auth.js

@@ -0,0 +1,106 @@
+import { OAuthFlowError, RegistryApiError } from "./errors.js";
+/** 值拷贝 ← registry-core AUTH_V1_PATHS(同源锚测试对账)。 */
+export const REGISTRY_AUTH_PATHS = {
+    deviceCode: "/api/v1/auth/device/code",
+    deviceToken: "/api/v1/auth/device/token",
+    deviceApprove: "/api/v1/auth/device/approve",
+    tokenRefresh: "/api/v1/auth/token/refresh",
+    logout: "/api/v1/auth/logout",
+};
+/** 值拷贝 ← registry-core DEVICE_GRANT_TYPE(同源锚测试对账)。 */
+export const REGISTRY_DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const joinUrl = (baseUrl, path) => baseUrl.replace(/\/+$/, "") + path;
+const postJson = async (fetchImpl, url, body, signal) => {
+    const res = await fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+        ...(signal ? { signal } : {}),
+    });
+    const parsed = await res.json().catch(() => undefined);
+    return { status: res.status, body: parsed };
+};
+const oauthCodeOf = (body) => {
+    const e = body?.error;
+    return typeof e === "string" ? e : undefined;
+};
+/** 步骤 1:POST device/code(设计上无凭证)。`clientName` 是同意屏的展示提示(非秘密)。 */
+export async function requestDeviceCode(baseUrl, opts = {}) {
+    const f = opts.fetch ?? fetch;
+    const { status, body } = await postJson(f, joinUrl(baseUrl, REGISTRY_AUTH_PATHS.deviceCode), opts.clientName ? { client_name: opts.clientName } : {}, opts.signal);
+    if (status !== 200) {
+        const code = oauthCodeOf(body);
+        if (code)
+            throw new OAuthFlowError(code, body.error_description);
+        throw new RegistryApiError(status, `device/code failed (HTTP ${status})`, body);
+    }
+    return body;
+}
+/** 步骤 3:轮询 device/token 直到 approved(RFC §3.5:pending=保持 interval;slow_down=+5s——语义
+ *  真身是 registry-core `nextPollInterval`,此处按同判据实现,同源锚测试双向对账)。终态错
+ *  (expired_token/access_denied)typed 抛出。成功先 `tokens.set` 再返回(persist-before-return)。
+ *  `sleep` 可注入(测试);`signal` 中断轮询。 */
+export async function pollUntilApproved(baseUrl, device, opts) {
+    const f = opts.fetch ?? fetch;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let intervalSeconds = device.interval;
+    for (;;) {
+        if (opts.signal?.aborted)
+            throw new OAuthFlowError("expired_token", "polling aborted by caller");
+        await sleep(intervalSeconds * 1000);
+        const { status, body } = await postJson(f, joinUrl(baseUrl, REGISTRY_AUTH_PATHS.deviceToken), { grant_type: REGISTRY_DEVICE_GRANT_TYPE, device_code: device.device_code }, opts.signal);
+        if (status === 200) {
+            const grant = body;
+            await opts.tokens.set({ accessToken: grant.access_token, refreshToken: grant.refresh_token });
+            return grant;
+        }
+        const code = oauthCodeOf(body);
+        if (code === "authorization_pending")
+            continue; // keep polling at the current interval
+        if (code === "slow_down") {
+            intervalSeconds += 5; // RFC 8628 §3.5 mandated increment
+            continue;
+        }
+        if (code)
+            throw new OAuthFlowError(code, body.error_description);
+        throw new RegistryApiError(status, `device/token failed (HTTP ${status})`, body);
+    }
+}
+/** 步骤 4:refresh 轮换(STRICT single-use:成功即旧 grant 作废)。成功先 set 后返回;
+ *  `invalid_grant`(replay/revoked/expired)⇒ **clear + typed**——本地令牌已不可再生,留着只会
+ *  永远循环失败,清掉让宿主直接进登录流。网络层错误原样抛(可重试,令牌不动)。 */
+export async function refreshTokens(baseUrl, opts) {
+    const current = await opts.tokens.get();
+    if (!current)
+        throw new OAuthFlowError("invalid_grant", "no refresh token held (not logged in)");
+    const f = opts.fetch ?? fetch;
+    const { status, body } = await postJson(f, joinUrl(baseUrl, REGISTRY_AUTH_PATHS.tokenRefresh), { refresh_token: current.refreshToken }, opts.signal);
+    if (status === 200) {
+        const grant = body;
+        await opts.tokens.set({ accessToken: grant.access_token, refreshToken: grant.refresh_token });
+        return grant;
+    }
+    const code = oauthCodeOf(body);
+    if (code === "invalid_grant") {
+        await opts.tokens.clear();
+        throw new OAuthFlowError("invalid_grant", "refresh grant is dead (revoked/replayed/expired) — local tokens cleared; re-run the device flow");
+    }
+    if (code)
+        throw new OAuthFlowError(code, body.error_description);
+    throw new RegistryApiError(status, `token/refresh failed (HTTP ${status})`, body);
+}
+/** 步骤 5:logout(RFC 7009:服务端恒 200 不披露存在性)。本地令牌**无条件清**(服务端失败也清——
+ *  logout 的用户意图是"这台机器不再持有";renewal 路径已断或将断,残留本地令牌只是风险)。 */
+export async function logoutRegistry(baseUrl, opts) {
+    const current = await opts.tokens.get();
+    try {
+        if (current) {
+            const f = opts.fetch ?? fetch;
+            await postJson(f, joinUrl(baseUrl, REGISTRY_AUTH_PATHS.logout), { refresh_token: current.refreshToken }, opts.signal);
+        }
+    }
+    finally {
+        await opts.tokens.clear();
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/registry/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/registry/auth.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2B,MAAM,aAAa,CAAC;AAGxF,kDAAkD;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,2BAA2B;IACxC,aAAa,EAAE,6BAA6B;IAC5C,YAAY,EAAE,4BAA4B;IAC1C,MAAM,EAAE,qBAAqB;CACrB,CAAC;AAEX,sDAAsD;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAG,8CAA8C,CAAC;AAIzF,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,IAAY,EAAU,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;AAE9F,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EACvB,GAAW,EACX,IAAa,EACb,MAAoB,EACwB,EAAE;IAC9C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,MAAM,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAa,EAAkC,EAAE;IACpE,MAAM,CAAC,GAAI,IAAwC,EAAE,KAAK,CAAC;IAC3D,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAA4E,EAAE;IAE9E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnK,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI;YAAE,MAAM,IAAI,cAAc,CAAC,IAAI,EAAG,IAAuC,CAAC,iBAAiB,CAAC,CAAC;QACrG,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,4BAA4B,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAA0B,CAAC;AACpC,CAAC;AAED;;;qCAGqC;AACrC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,MAA2E,EAC3E,IAAkH;IAElH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtC,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;QACjG,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxL,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,IAA0B,CAAC;YACzC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;YAC9F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,uBAAuB;YAAE,SAAS,CAAC,uCAAuC;QACvF,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,eAAe,IAAI,CAAC,CAAC,CAAC,mCAAmC;YACzD,SAAS;QACX,CAAC;QACD,IAAI,IAAI;YAAE,MAAM,IAAI,cAAc,CAAC,IAAI,EAAG,IAAuC,CAAC,iBAAiB,CAAC,CAAC;QACrG,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,6BAA6B,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;6CAE6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2E;IAE3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACjG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrJ,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAA0B,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC9F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,iGAAiG,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,IAAI;QAAE,MAAM,IAAI,cAAc,CAAC,IAAI,EAAG,IAAuC,CAAC,iBAAiB,CAAC,CAAC;IACrG,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,8BAA8B,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC;AACpF,CAAC;AAED;2DAC2D;AAC3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,IAA2E;IAE3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;YAC9B,MAAM,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/registry/client.d.ts

@@ -0,0 +1,32 @@
+import type { TokenProvider } from "./token-provider.js";
+export interface RegistryClientConfig {
+    /** registry base URL(如 `https://registry.example.com`;同源 BFF 形可相对)。 */
+    baseUrl: string;
+    /** 令牌存储(宿主实现;见 token-provider.ts 的 persist-before-return 契约)。 */
+    tokens: TokenProvider;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+}
+export interface RegistryRequestOptions {
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    path: string;
+    body?: unknown;
+    /** 条件请求头位(R2 的 effective ETag / me.config CAS 走这里)。 */
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+export declare class RegistryClient {
+    private readonly baseUrl;
+    private readonly tokens;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    /** single-flight refresh:并发 401 共享同一次 refresh。🔴 必要而非优化——rotation 是 STRICT
+     *  single-use,两个并发 refresh 里后到的那个必吃 invalid_grant 并把刚续上的会话整个清掉。 */
+    private refreshInFlight;
+    constructor(config: RegistryClientConfig);
+    request<T>(opts: RegistryRequestOptions): Promise<T>;
+    private refreshOnce;
+    private rawRequest;
+    private settle;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/registry/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/registry/client.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC;uEACmE;IACnE,OAAO,CAAC,eAAe,CAA+B;gBAE1C,MAAM,EAAE,oBAAoB;IAOlC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,CAAC,CAAC;IAQ1D,OAAO,CAAC,WAAW;YASL,UAAU;IA0BxB,OAAO,CAAC,MAAM;CAKf"}

package/dist/registry/client.js

@@ -0,0 +1,77 @@
+/**
+ * RegistryClient(G17 R1)——registry user-plane 的授权请求引擎:Bearer 注入 + 401 时 single-flight
+ * refresh + 原请求重试一次。R2 的资源族(scopes/effective/me.config)挂在 `request()` 上。
+ *
+ * 为什么不复用 worker 的 Transport:①错误族不同源(worker 的 toApiError 按 errorCode envelope,
+ * registry 是 OAuth/REST 混合);②重试语义不同(这里的 401→refresh→retry 是**凭证生命周期**,不是
+ * 网络重试——放进 Transport 的 RETRYABLE_STATUS 会把语义搅在一起);③worker Transport 的
+ * buildHeaders 闭包捕获静态 token,而这里 token 每次请求都可能已被 refresh 换新(必须 per-request
+ * 从 TokenProvider 读)。故 R1 用一个薄 fetch 引擎;若 R2 发现网络重试确有需要,再评估共享底座。
+ */
+import { OAuthFlowError, RegistryApiError } from "./errors.js";
+import { refreshTokens } from "./auth.js";
+export class RegistryClient {
+    baseUrl;
+    tokens;
+    fetchImpl;
+    timeoutMs;
+    /** single-flight refresh:并发 401 共享同一次 refresh。🔴 必要而非优化——rotation 是 STRICT
+     *  single-use,两个并发 refresh 里后到的那个必吃 invalid_grant 并把刚续上的会话整个清掉。 */
+    refreshInFlight;
+    constructor(config) {
+        this.baseUrl = config.baseUrl;
+        this.tokens = config.tokens;
+        this.fetchImpl = config.fetch ?? fetch;
+        this.timeoutMs = config.timeoutMs ?? 30_000;
+    }
+    async request(opts) {
+        const first = await this.rawRequest(opts);
+        if (first.status !== 401)
+            return this.settle(first);
+        // 401 → single-flight refresh → 原请求重试一次(仅一次:重试仍 401 = 服务端真拒,typed 直出)。
+        await this.refreshOnce(opts.signal);
+        return this.settle(await this.rawRequest(opts));
+    }
+    refreshOnce(signal) {
+        if (!this.refreshInFlight) {
+            this.refreshInFlight = refreshTokens(this.baseUrl, { tokens: this.tokens, fetch: this.fetchImpl, ...(signal ? { signal } : {}) }).finally(() => {
+                this.refreshInFlight = undefined;
+            });
+        }
+        return this.refreshInFlight;
+    }
+    async rawRequest(opts) {
+        const current = await this.tokens.get();
+        if (!current)
+            throw new OAuthFlowError("invalid_grant", "not logged in (TokenProvider is empty) — run the device flow first");
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), this.timeoutMs);
+        const onOuterAbort = () => ac.abort();
+        opts.signal?.addEventListener("abort", onOuterAbort, { once: true });
+        try {
+            const res = await this.fetchImpl(this.baseUrl.replace(/\/+$/, "") + opts.path, {
+                method: opts.method,
+                headers: {
+                    authorization: `Bearer ${current.accessToken}`,
+                    ...(opts.body !== undefined ? { "content-type": "application/json" } : {}),
+                    ...(opts.headers ?? {}),
+                },
+                ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+                signal: ac.signal,
+            });
+            const body = await res.json().catch(() => undefined);
+            return { status: res.status, body, headers: res.headers };
+        }
+        finally {
+            clearTimeout(timer);
+            opts.signal?.removeEventListener("abort", onOuterAbort);
+        }
+    }
+    settle(r) {
+        if (r.status >= 200 && r.status < 300)
+            return r.body;
+        const msg = r.body?.error;
+        throw new RegistryApiError(r.status, typeof msg === "string" ? msg : `registry request failed (HTTP ${r.status})`, r.body);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/registry/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/registry/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAqB1C,MAAM,OAAO,cAAc;IACR,OAAO,CAAS;IAChB,MAAM,CAAgB;IACtB,SAAS,CAAe;IACxB,SAAS,CAAS;IACnC;uEACmE;IAC3D,eAAe,CAA+B;IAEtD,YAAY,MAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAA4B;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAI,KAAK,CAAC,CAAC;QACvD,uEAAuE;QACvE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAI,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC7I,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAA4B;QACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,oEAAoE,CAAC,CAAC;QAC9H,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,GAAS,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE;gBAC7E,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;oBAC9C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;iBACxB;gBACD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,EAAE,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5D,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,MAAM,CAAI,CAAoC;QACpD,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,CAAC,CAAC,IAAS,CAAC;QAC1D,MAAM,GAAG,GAAI,CAAC,CAAC,IAAwC,EAAE,KAAK,CAAC;QAC/D,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7H,CAAC;CACF"}

package/dist/registry/errors.d.ts

@@ -0,0 +1,24 @@
+/**
+ * registry user-plane 错误族(G17,设计稿 §2.3:worker 面的 toApiError 家族**不复用**——status 语义
+ * 不同源;OAuth 错误按 RFC 是 400 + `error` 码,worker 的 400 是 validation)。
+ */
+/** registry HTTP 面的通用 typed 错误(非 OAuth 端点,或 OAuth 端点的非 OAuth 形失败)。 */
+export declare class RegistryApiError extends Error {
+    readonly status: number;
+    /** 服务端 body(已 parse;parse 失败为 undefined)。诊断用,分支请用 status。 */
+    readonly body?: unknown | undefined;
+    constructor(status: number, message: string, 
+    /** 服务端 body(已 parse;parse 失败为 undefined)。诊断用,分支请用 status。 */
+    body?: unknown | undefined);
+}
+/** RFC 8628/OAuth 错误码集(值拷贝自 `@sema-agent/registry-core` OAUTH_ERROR_CODES——真身在那边,
+ *  registry-auth.test.ts 的同源锚机器对账)。 */
+export type OAuthFlowErrorCode = "authorization_pending" | "slow_down" | "expired_token" | "access_denied" | "invalid_request" | "unsupported_grant_type" | "invalid_grant" | "server_error";
+/** OAuth/device-flow 语义错误——`code` 是唯一分支判据(RFC:`error_description` 只是人读诊断)。
+ *  终态语义:`expired_token`(重开流程)/`access_denied`(用户拒绝,别静默重开)/
+ *  `invalid_grant`(refresh 已废,回登录——SDK 已顺手清了 TokenProvider)。 */
+export declare class OAuthFlowError extends Error {
+    readonly code: OAuthFlowErrorCode;
+    constructor(code: OAuthFlowErrorCode, description?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/registry/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/registry/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,sEAAsE;AACtE,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAEvB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO;gBAHd,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM;IACf,6DAA6D;IACpD,IAAI,CAAC,EAAE,OAAO,YAAA;CAK1B;AAED;uCACuC;AACvC,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,wBAAwB,GACxB,eAAe,GACf,cAAc,CAAC;AAEnB;;gEAEgE;AAChE,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,IAAI,EAAE,kBAAkB;gBAAxB,IAAI,EAAE,kBAAkB,EACjC,WAAW,CAAC,EAAE,MAAM;CAKvB"}

package/dist/registry/errors.js

@@ -0,0 +1,29 @@
+/**
+ * registry user-plane 错误族(G17,设计稿 §2.3:worker 面的 toApiError 家族**不复用**——status 语义
+ * 不同源;OAuth 错误按 RFC 是 400 + `error` 码,worker 的 400 是 validation)。
+ */
+/** registry HTTP 面的通用 typed 错误(非 OAuth 端点,或 OAuth 端点的非 OAuth 形失败)。 */
+export class RegistryApiError extends Error {
+    status;
+    body;
+    constructor(status, message, 
+    /** 服务端 body(已 parse;parse 失败为 undefined)。诊断用,分支请用 status。 */
+    body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+        this.name = "RegistryApiError";
+    }
+}
+/** OAuth/device-flow 语义错误——`code` 是唯一分支判据(RFC:`error_description` 只是人读诊断)。
+ *  终态语义:`expired_token`(重开流程)/`access_denied`(用户拒绝,别静默重开)/
+ *  `invalid_grant`(refresh 已废,回登录——SDK 已顺手清了 TokenProvider)。 */
+export class OAuthFlowError extends Error {
+    code;
+    constructor(code, description) {
+        super(description ? `${code}: ${description}` : code);
+        this.code = code;
+        this.name = "OAuthFlowError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/registry/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/registry/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,sEAAsE;AACtE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAGA;IAJX,YACW,MAAc,EACvB,OAAe;IACf,6DAA6D;IACpD,IAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,WAAM,GAAN,MAAM,CAAQ;QAGd,SAAI,GAAJ,IAAI,CAAU;QAGvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAcD;;gEAEgE;AAChE,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IADX,YACW,IAAwB,EACjC,WAAoB;QAEpB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAH7C,SAAI,GAAJ,IAAI,CAAoB;QAIjC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/registry/health.d.ts

@@ -0,0 +1,17 @@
+/**
+ * probeRegistryHealth(G18 顺并进 R1):zero-throw 健康探针——`/api/healthz` 优先,404 回落旧
+ * `/healthz`(老部署),回落命中如实标 `legacy`(消费方可提示升级)。与 worker 面的 probeAuth
+ * 同族姿势:judgement-typed,永不抛。
+ */
+export interface RegistryHealthResult {
+    ok: boolean;
+    /** 回落旧 /healthz 命中时 true(新端点 404 的老部署)。 */
+    legacy?: boolean;
+    /** ok:false 时的原因(网络错文本 / 末次 HTTP status)。 */
+    reason?: string;
+}
+export declare function probeRegistryHealth(baseUrl: string, opts?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<RegistryHealthResult>;
+//# sourceMappingURL=health.d.ts.map

package/dist/registry/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/registry/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,2CAA2C;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,OAAO,CAAC,oBAAoB,CAAC,CAoB/B"}

package/dist/registry/health.js

@@ -0,0 +1,26 @@
+export async function probeRegistryHealth(baseUrl, opts = {}) {
+    const f = opts.fetch ?? fetch;
+    const base = baseUrl.replace(/\/+$/, "");
+    const tryOne = async (path) => {
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 5_000);
+        try {
+            const res = await f(base + path, { method: "GET", signal: ac.signal });
+            return { ok: res.status === 200, status: res.status };
+        }
+        catch (err) {
+            return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const modern = await tryOne("/api/healthz");
+    if (modern.ok)
+        return { ok: true };
+    const legacy = await tryOne("/healthz");
+    if (legacy.ok)
+        return { ok: true, legacy: true };
+    return { ok: false, reason: modern.reason ?? legacy.reason ?? `HTTP ${modern.status ?? "?"} (/api/healthz) / ${legacy.status ?? "?"} (/healthz)` };
+}
+//# sourceMappingURL=health.js.map

package/dist/registry/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/registry/health.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,OAAqD,EAAE;IAEvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAA8D,EAAE;QAChG,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,IAAI,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,MAAM,IAAI,GAAG,qBAAqB,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;AACrJ,CAAC"}

package/dist/registry/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `@sema-agent/sdk/registry` — registry user-plane client 族(G17,设计稿
+ * DESIGN-sdk-userplane-and-relay.md §二;subpath export,不进主入口)。
+ *
+ * 主体=user JWT(device flow 取得),与主入口的 worker client(SERVICE_AUTH_TOKEN 主体)刻意分开
+ * ——两套凭证/刷新/错误语义不混构造器。R1=device flow + TokenProvider + healthz + RegistryClient
+ * 骨架;R2=scopes/effective(ETag)/me.config(CAS);R3=壳 12 条路由族收编。
+ *
+ * 契约单源:wire 真身在 `@sema-agent/registry-core`(type-only import + 常量值拷贝,同源锚测试
+ * 机器对账)——SDK 运行时零依赖不破。
+ */
+export { RegistryClient, type RegistryClientConfig, type RegistryRequestOptions } from "./client.js";
+export { InMemoryTokenProvider, type TokenProvider, type RegistryTokens } from "./token-provider.js";
+export { requestDeviceCode, pollUntilApproved, refreshTokens, logoutRegistry, REGISTRY_AUTH_PATHS, REGISTRY_DEVICE_GRANT_TYPE, type DeviceCodeResponse, type TokenGrantResponse, } from "./auth.js";
+export { probeRegistryHealth, type RegistryHealthResult } from "./health.js";
+export { RegistryApiError, OAuthFlowError, type OAuthFlowErrorCode } from "./errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/registry/index.js

@@ -0,0 +1,17 @@
+/**
+ * `@sema-agent/sdk/registry` — registry user-plane client 族(G17,设计稿
+ * DESIGN-sdk-userplane-and-relay.md §二;subpath export,不进主入口)。
+ *
+ * 主体=user JWT(device flow 取得),与主入口的 worker client(SERVICE_AUTH_TOKEN 主体)刻意分开
+ * ——两套凭证/刷新/错误语义不混构造器。R1=device flow + TokenProvider + healthz + RegistryClient
+ * 骨架;R2=scopes/effective(ETag)/me.config(CAS);R3=壳 12 条路由族收编。
+ *
+ * 契约单源:wire 真身在 `@sema-agent/registry-core`(type-only import + 常量值拷贝,同源锚测试
+ * 机器对账)——SDK 运行时零依赖不破。
+ */
+export { RegistryClient } from "./client.js";
+export { InMemoryTokenProvider } from "./token-provider.js";
+export { requestDeviceCode, pollUntilApproved, refreshTokens, logoutRegistry, REGISTRY_AUTH_PATHS, REGISTRY_DEVICE_GRANT_TYPE, } from "./auth.js";
+export { probeRegistryHealth } from "./health.js";
+export { RegistryApiError, OAuthFlowError } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/registry/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAA0D,MAAM,aAAa,CAAC;AACrG,OAAO,EAAE,qBAAqB,EAA2C,MAAM,qBAAqB,CAAC;AACrG,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,0BAA0B,GAG3B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAA6B,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC"}

package/dist/registry/token-provider.d.ts

@@ -0,0 +1,27 @@
+/**
+ * TokenProvider(G17 设计稿 §2.2):token 的**存储归宿主**(桌面 keychain / BFF session /测试内存),
+ * SDK 只定读写契约。zero-ambient:无模块级单例——多账户/多 registry 并存各持各的 provider。
+ */
+export interface RegistryTokens {
+    /** RS256 JWT(1h TTL,过期靠 refresh 换新)。 */
+    accessToken: string;
+    /** 旋转式一次性 refresh token(每次 refresh 换新;replay = invalid_grant)。0600/keychain 级敏感。 */
+    refreshToken: string;
+}
+export interface TokenProvider {
+    /** 当前令牌对;null = 未登录/已登出。 */
+    get(): Promise<RegistryTokens | null>;
+    /** 持久化新令牌对。🔴 rotation 契约:refresh 成功后 SDK **先 set 后返回**——宿主实现必须在
+     *  resolve 前真正落盘(keychain 写完),否则进程崩在窗口里 = 旧 refresh 已被服务端废、新的没存下。 */
+    set(tokens: RegistryTokens): Promise<void>;
+    /** 清空(logout / invalid_grant 后 SDK 自动调)。幂等。 */
+    clear(): Promise<void>;
+}
+/** 内存实现(测试/短命进程)。真宿主请用 keychain/session 存储实现同一接口。 */
+export declare class InMemoryTokenProvider implements TokenProvider {
+    private tokens;
+    get(): Promise<RegistryTokens | null>;
+    set(tokens: RegistryTokens): Promise<void>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=token-provider.d.ts.map

package/dist/registry/token-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-provider.d.ts","sourceRoot":"","sources":["../../src/registry/token-provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,GAAG,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACtC;yEACqE;IACrE,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,+CAA+C;IAC/C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qDAAqD;AACrD,qBAAa,qBAAsB,YAAW,aAAa;IACzD,OAAO,CAAC,MAAM,CAA+B;IACvC,GAAG,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAGrC,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAG1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/registry/token-provider.js

@@ -0,0 +1,18 @@
+/**
+ * TokenProvider(G17 设计稿 §2.2):token 的**存储归宿主**(桌面 keychain / BFF session /测试内存),
+ * SDK 只定读写契约。zero-ambient:无模块级单例——多账户/多 registry 并存各持各的 provider。
+ */
+/** 内存实现(测试/短命进程)。真宿主请用 keychain/session 存储实现同一接口。 */
+export class InMemoryTokenProvider {
+    tokens = null;
+    async get() {
+        return this.tokens;
+    }
+    async set(tokens) {
+        this.tokens = { ...tokens };
+    }
+    async clear() {
+        this.tokens = null;
+    }
+}
+//# sourceMappingURL=token-provider.js.map

package/dist/registry/token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-provider.js","sourceRoot":"","sources":["../../src/registry/token-provider.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH,qDAAqD;AACrD,MAAM,OAAO,qBAAqB;IACxB,MAAM,GAA0B,IAAI,CAAC;IAC7C,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,MAAsB;QAC9B,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/sdk",
-  "version": "0.0.113",
+  "version": "0.0.114",
   "description": "Typed, zero-runtime-dependency SDK for the Sema agent fleet usage plane. The shared substrate for all doors (CC/Codex MCP façade + web). Server-side only — tokens never enter the browser.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -23,7 +23,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
-    "./openapi.yaml": "./openapi.yaml"
+    "./openapi.yaml": "./openapi.yaml",
+    "./registry": {
+      "types": "./dist/registry/index.d.ts",
+      "import": "./dist/registry/index.js"
+    }
   },
   "files": [
     "dist",
@@ -40,5 +44,8 @@
     "prepack": "node -e \"require('fs').copyFileSync('../../spec/openapi.yaml','openapi.yaml');require('fs').copyFileSync('../../LICENSE','LICENSE')\"",
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\"",
     "prepublishOnly": "npm run build"
+  },
+  "devDependencies": {
+    "@sema-agent/registry-core": "^0.10.21"
   }
 }