@sentinel-atl/registry 0.3.0

package/README.md

@@ -0,0 +1,102 @@
+# @sentinel-atl/registry
+
+Trust Registry API — publish, query, and verify Sentinel Trust Certificates.
+
+Provides an HTTP server for storing and querying STCs (Sentinel Trust Certificates) with SVG trust badges, optional persistent storage, API key auth, CORS, TLS, and rate limiting.
+
+## Install
+
+```bash
+npm install @sentinel-atl/registry
+```
+
+## Quick Start
+
+### CLI
+
+```bash
+npx sentinel-registry                # Start on default port 3200
+npx sentinel-registry --port 8080    # Custom port
+```
+
+### Programmatic
+
+```ts
+import { RegistryServer, CertificateStore } from '@sentinel-atl/registry';
+
+const server = new RegistryServer({ port: 3200 });
+await server.start();
+```
+
+### With Persistent Storage
+
+```ts
+import { RegistryServer, CertificateStore } from '@sentinel-atl/registry';
+import { RedisStore } from '@sentinel-atl/store';
+
+const backend = new RedisStore({ url: 'redis://localhost:6379' });
+const store = new CertificateStore({ backend });
+const server = new RegistryServer({ port: 3200, store });
+await server.start(); // Loads existing certificates from backend
+```
+
+## API Endpoints
+
+### Certificates
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `POST` | `/api/v1/certificates` | Register a new STC |
+| `GET` | `/api/v1/certificates/:id` | Get certificate by ID |
+| `GET` | `/api/v1/certificates` | Query certificates (filters: `package`, `grade`, `minScore`, `limit`, `offset`) |
+| `DELETE` | `/api/v1/certificates/:id` | Remove a certificate |
+
+### Packages
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api/v1/packages/:name` | Latest certificate for package |
+| `GET` | `/api/v1/packages/:name/history` | All certificates for package |
+| `GET` | `/api/v1/packages/:name/badge` | SVG grade badge |
+| `GET` | `/api/v1/packages/:name/badge/score` | SVG score badge |
+
+### Utility
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api/v1/stats` | Registry statistics |
+| `GET` | `/health` | Health check |
+
+## Configuration
+
+```ts
+const server = new RegistryServer({
+  port: 3200,
+  store: new CertificateStore({ backend }),
+  auth: { enabled: true, keys: [{ key: 'secret', scopes: ['admin'] }] },
+  cors: { allowedOrigins: ['https://example.com'] },
+  tls: { certPath: './cert.pem', keyPath: './key.pem' },
+});
+```
+
+## Environment Variables
+
+| Variable | Description |
+|----------|-------------|
+| `SENTINEL_API_KEYS` | API key auth — format: `key1:read,write;key2:admin` |
+| `SENTINEL_CORS_ORIGINS` | Comma-separated allowed origins (default: `*`) |
+| `SENTINEL_TLS_CERT_PATH` | Path to TLS certificate |
+| `SENTINEL_TLS_KEY_PATH` | Path to TLS private key |
+
+## Security
+
+The registry enforces:
+- **Content-Type validation** — POST endpoints require `application/json`
+- **STC schema validation** — Validates all required fields, score ranges, grade values
+- **Security headers** — CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy
+- **HSTS** — Enabled automatically when TLS is active
+- **API key auth** — Optional, with scoped access control
+
+## License
+
+MIT

package/dist/badge.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Badge SVG generator — produces shields.io-style trust badges.
+ *
+ * Badge formats:
+ *   - Trust grade badge:  "Sentinel | A" (green)
+ *   - Trust score badge:  "Trust Score | 87/100" (green)
+ *   - Verified badge:     "Sentinel Verified | ✓" (green)
+ *   - Not found badge:    "Sentinel | Not Found" (gray)
+ */
+export type BadgeStyle = 'flat' | 'flat-square';
+export interface BadgeOptions {
+    /** Left label text */
+    label?: string;
+    /** Right value text */
+    value: string;
+    /** Color of the right side */
+    color: string;
+    /** Badge style */
+    style?: BadgeStyle;
+}
+/**
+ * Generate a trust grade badge SVG.
+ */
+export declare function gradeBadge(grade: string, style?: BadgeStyle): string;
+/**
+ * Generate a trust score badge SVG.
+ */
+export declare function scoreBadge(score: number, style?: BadgeStyle): string;
+/**
+ * Generate a "Sentinel Verified" badge SVG.
+ */
+export declare function verifiedBadge(verified: boolean, style?: BadgeStyle): string;
+/**
+ * Generate a "not found" badge SVG.
+ */
+export declare function notFoundBadge(style?: BadgeStyle): string;
+//# sourceMappingURL=badge.d.ts.map

package/dist/badge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.d.ts","sourceRoot":"","sources":["../src/badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC;AAEhD,MAAM,WAAW,YAAY;IAC3B,sBAAsB;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAqED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAOpE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAOpE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAO3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAOxD"}

package/dist/badge.js

@@ -0,0 +1,114 @@
+/**
+ * Badge SVG generator — produces shields.io-style trust badges.
+ *
+ * Badge formats:
+ *   - Trust grade badge:  "Sentinel | A" (green)
+ *   - Trust score badge:  "Trust Score | 87/100" (green)
+ *   - Verified badge:     "Sentinel Verified | ✓" (green)
+ *   - Not found badge:    "Sentinel | Not Found" (gray)
+ */
+// ─── Color Mapping ───────────────────────────────────────────────────
+const GRADE_COLORS = {
+    A: '#4c1', // bright green
+    B: '#97ca00', // yellow-green
+    C: '#dfb317', // yellow
+    D: '#fe7d37', // orange
+    F: '#e05d44', // red
+};
+function scoreColor(score) {
+    if (score >= 90)
+        return GRADE_COLORS.A;
+    if (score >= 75)
+        return GRADE_COLORS.B;
+    if (score >= 60)
+        return GRADE_COLORS.C;
+    if (score >= 40)
+        return GRADE_COLORS.D;
+    return GRADE_COLORS.F;
+}
+// ─── SVG Generator ───────────────────────────────────────────────────
+function escapeXml(str) {
+    return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+function textWidth(text) {
+    // Approximate character widths for Verdana 11px
+    return text.length * 6.5 + 10;
+}
+function renderBadge(options) {
+    const label = options.label ?? 'Sentinel';
+    const { value, color } = options;
+    const isSquare = options.style === 'flat-square';
+    const labelWidth = textWidth(label);
+    const valueWidth = textWidth(value);
+    const totalWidth = labelWidth + valueWidth;
+    const radius = isSquare ? 0 : 3;
+    const escapedLabel = escapeXml(label);
+    const escapedValue = escapeXml(value);
+    return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="20" role="img" aria-label="${escapedLabel}: ${escapedValue}">
+  <title>${escapedLabel}: ${escapedValue}</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset="1" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r">
+    <rect width="${totalWidth}" height="20" rx="${radius}" fill="#fff"/>
+  </clipPath>
+  <g clip-path="url(#r)">
+    <rect width="${labelWidth}" height="20" fill="#555"/>
+    <rect x="${labelWidth}" width="${valueWidth}" height="20" fill="${color}"/>
+    <rect width="${totalWidth}" height="20" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" text-rendering="geometricPrecision" font-size="11">
+    <text aria-hidden="true" x="${labelWidth / 2}" y="15" fill="#010101" fill-opacity=".3">${escapedLabel}</text>
+    <text x="${labelWidth / 2}" y="14">${escapedLabel}</text>
+    <text aria-hidden="true" x="${labelWidth + valueWidth / 2}" y="15" fill="#010101" fill-opacity=".3">${escapedValue}</text>
+    <text x="${labelWidth + valueWidth / 2}" y="14">${escapedValue}</text>
+  </g>
+</svg>`;
+}
+// ─── Public API ──────────────────────────────────────────────────────
+/**
+ * Generate a trust grade badge SVG.
+ */
+export function gradeBadge(grade, style) {
+    return renderBadge({
+        label: 'Sentinel',
+        value: `Grade ${grade}`,
+        color: GRADE_COLORS[grade] ?? '#9f9f9f',
+        style,
+    });
+}
+/**
+ * Generate a trust score badge SVG.
+ */
+export function scoreBadge(score, style) {
+    return renderBadge({
+        label: 'Trust Score',
+        value: `${score}/100`,
+        color: scoreColor(score),
+        style,
+    });
+}
+/**
+ * Generate a "Sentinel Verified" badge SVG.
+ */
+export function verifiedBadge(verified, style) {
+    return renderBadge({
+        label: 'Sentinel',
+        value: verified ? 'Verified ✓' : 'Unverified',
+        color: verified ? '#4c1' : '#9f9f9f',
+        style,
+    });
+}
+/**
+ * Generate a "not found" badge SVG.
+ */
+export function notFoundBadge(style) {
+    return renderBadge({
+        label: 'Sentinel',
+        value: 'Not Found',
+        color: '#9f9f9f',
+        style,
+    });
+}
+//# sourceMappingURL=badge.js.map

package/dist/badge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"badge.js","sourceRoot":"","sources":["../src/badge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAiBH,wEAAwE;AAExE,MAAM,YAAY,GAA2B;IAC3C,CAAC,EAAE,MAAM,EAAM,eAAe;IAC9B,CAAC,EAAE,SAAS,EAAG,eAAe;IAC9B,CAAC,EAAE,SAAS,EAAG,SAAS;IACxB,CAAC,EAAE,SAAS,EAAG,SAAS;IACxB,CAAC,EAAE,SAAS,EAAG,MAAM;CACtB,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,wEAAwE;AAExE,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,gDAAgD;IAChD,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,OAAqB;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,KAAK,aAAa,CAAC;IAEjD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,kDAAkD,UAAU,wCAAwC,YAAY,KAAK,YAAY;WAC/H,YAAY,KAAK,YAAY;;;;;;mBAMrB,UAAU,qBAAqB,MAAM;;;mBAGrC,UAAU;eACd,UAAU,YAAY,UAAU,uBAAuB,KAAK;mBACxD,UAAU;;;kCAGK,UAAU,GAAG,CAAC,6CAA6C,YAAY;eAC1F,UAAU,GAAG,CAAC,YAAY,YAAY;kCACnB,UAAU,GAAG,UAAU,GAAG,CAAC,6CAA6C,YAAY;eACvG,UAAU,GAAG,UAAU,GAAG,CAAC,YAAY,YAAY;;OAE3D,CAAC;AACR,CAAC;AAED,wEAAwE;AAExE;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAkB;IAC1D,OAAO,WAAW,CAAC;QACjB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,SAAS,KAAK,EAAE;QACvB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS;QACvC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAkB;IAC1D,OAAO,WAAW,CAAC;QACjB,KAAK,EAAE,aAAa;QACpB,KAAK,EAAE,GAAG,KAAK,MAAM;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB,EAAE,KAAkB;IACjE,OAAO,WAAW,CAAC;QACjB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY;QAC7C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACpC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,OAAO,WAAW,CAAC;QACjB,KAAK,EAAE,UAAU;QACjB,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,SAAS;QAChB,KAAK;KACN,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+process.on('unhandledRejection', (err) => {
+    console.error('Unhandled rejection:', err);
+    process.exit(1);
+});
+process.on('uncaughtException', (err) => {
+    console.error('Uncaught exception:', err);
+    process.exit(1);
+});
+/**
+ * sentinel-registry — CLI for running the Trust Registry API server.
+ *
+ * Usage:
+ *   sentinel-registry                    Start on default port 3200
+ *   sentinel-registry --port 8080        Start on custom port
+ */
+import { RegistryServer } from './server.js';
+import { authConfigFromEnv, corsConfigFromEnv, tlsConfigFromEnv } from '@sentinel-atl/hardening';
+const args = process.argv.slice(2);
+if (args.includes('--help') || args.includes('-h')) {
+    console.log('🗂️  Sentinel Trust Registry');
+    console.log();
+    console.log('Usage:');
+    console.log('  sentinel-registry                    Start on port 3200');
+    console.log('  sentinel-registry --port <port>      Start on custom port');
+    console.log();
+    console.log('Endpoints:');
+    console.log('  POST   /api/v1/certificates          Register an STC');
+    console.log('  GET    /api/v1/certificates/:id       Get by ID');
+    console.log('  GET    /api/v1/certificates           Query certificates');
+    console.log('  DELETE /api/v1/certificates/:id       Remove');
+    console.log('  GET    /api/v1/packages/:name         Latest cert for package');
+    console.log('  GET    /api/v1/packages/:name/badge   SVG trust badge');
+    console.log('  GET    /api/v1/stats                  Registry stats');
+    console.log('  GET    /health                        Health check');
+    process.exit(0);
+}
+const portIdx = args.indexOf('--port');
+const port = portIdx !== -1 ? parseInt(args[portIdx + 1]) : 3200;
+const server = new RegistryServer({
+    port,
+    auth: authConfigFromEnv(),
+    cors: corsConfigFromEnv(),
+    tls: tlsConfigFromEnv(),
+});
+console.log('🗂️  Sentinel Trust Registry');
+const { port: actualPort } = await server.start();
+const proto = server.isTLS() ? 'https' : 'http';
+console.log(`  Listening on ${proto}://localhost:${actualPort}`);
+console.log();
+console.log('  Endpoints:');
+console.log('    POST   /api/v1/certificates');
+console.log('    GET    /api/v1/certificates/:id');
+console.log('    GET    /api/v1/packages/:name');
+console.log('    GET    /api/v1/packages/:name/badge');
+console.log('    GET    /api/v1/stats');
+console.log('    GET    /health');
+console.log();
+const shutdown = async () => {
+    console.log('\n  Shutting down...');
+    await server.stop();
+    process.exit(0);
+};
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;IACvC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEjG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACvC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAEjE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;IAChC,IAAI;IACJ,IAAI,EAAE,iBAAiB,EAAE;IACzB,IAAI,EAAE,iBAAiB,EAAE;IACzB,GAAG,EAAE,gBAAgB,EAAE;CACxB,CAAC,CAAC;AAEH,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AAC5C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,gBAAgB,UAAU,EAAE,CAAC,CAAC;AACjE,OAAO,CAAC,GAAG,EAAE,CAAC;AACd,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC5B,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAC/C,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;AACjD,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;AACvD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AACxC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAClC,OAAO,CAAC,GAAG,EAAE,CAAC;AAEd,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;IAC1B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @sentinel-atl/registry — Trust Registry API
+ *
+ * Publish, query, and verify Sentinel Trust Certificates.
+ * Serves SVG trust badges for READMEs and dashboards.
+ *
+ * Usage:
+ *   sentinel-registry --port 3200
+ */
+export { CertificateStore, type CertificateStoreOptions, type RegistryEntry, type RegistryQuery, type RegistryStats, } from './store.js';
+export { RegistryServer, type RegistryServerOptions, } from './server.js';
+export { gradeBadge, scoreBadge, verifiedBadge, notFoundBadge, type BadgeStyle, type BadgeOptions, } from './badge.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+/**
+ * @sentinel-atl/registry — Trust Registry API
+ *
+ * Publish, query, and verify Sentinel Trust Certificates.
+ * Serves SVG trust badges for READMEs and dashboards.
+ *
+ * Usage:
+ *   sentinel-registry --port 3200
+ */
+export { CertificateStore, } from './store.js';
+export { RegistryServer, } from './server.js';
+export { gradeBadge, scoreBadge, verifiedBadge, notFoundBadge, } from './badge.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,GAKjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,GAEf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,GAGd,MAAM,YAAY,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Trust Registry HTTP API — REST endpoints for publishing and querying STCs.
+ *
+ * Endpoints:
+ *   POST   /api/v1/certificates          Register a new STC
+ *   GET    /api/v1/certificates/:id       Get certificate by ID
+ *   GET    /api/v1/certificates           Query certificates
+ *   DELETE /api/v1/certificates/:id       Remove a certificate
+ *
+ *   GET    /api/v1/packages/:name         Get latest certificate for a package
+ *   GET    /api/v1/packages/:name/history Get all certificates for a package
+ *   GET    /api/v1/packages/:name/badge   SVG badge for a package
+ *   GET    /api/v1/packages/:name/badge/score   Score badge
+ *
+ *   GET    /api/v1/stats                  Registry stats
+ *   GET    /health                        Health check
+ */
+import { CertificateStore } from './store.js';
+import { type AuthConfig, type CorsConfig, type TlsConfig } from '@sentinel-atl/hardening';
+export interface RegistryServerOptions {
+    /** Port to listen on */
+    port?: number;
+    /** Pre-configured certificate store */
+    store?: CertificateStore;
+    /** API key authentication config */
+    auth?: AuthConfig;
+    /** CORS configuration */
+    cors?: CorsConfig;
+    /** TLS configuration */
+    tls?: TlsConfig;
+}
+export declare class RegistryServer {
+    private server;
+    private store;
+    private port;
+    private authConfig;
+    private corsConfig;
+    private tlsConfig?;
+    constructor(options?: RegistryServerOptions);
+    getStore(): CertificateStore;
+    start(): Promise<{
+        port: number;
+    }>;
+    stop(): Promise<void>;
+    isTLS(): boolean;
+    private handleRequest;
+    private handleRegister;
+    private handleGetById;
+    private handleDelete;
+    private handleQuery;
+    private handleGetPackage;
+    private handlePackageHistory;
+    private handleBadge;
+    private handleScoreBadge;
+    private formatEntry;
+    private sendJson;
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAC;AAElE,OAAO,EAKL,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EACjD,MAAM,yBAAyB,CAAC;AAKjC,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oCAAoC;IACpC,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,yBAAyB;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,wBAAwB;IACxB,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAAC,CAAY;gBAElB,OAAO,CAAC,EAAE,qBAAqB;IAa3C,QAAQ,IAAI,gBAAgB;IAItB,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBlC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAU3B,KAAK,IAAI,OAAO;YAMF,aAAa;YAyEb,cAAc;IAuC5B,OAAO,CAAC,aAAa;YAQP,YAAY;IAQ1B,OAAO,CAAC,WAAW;IAwBnB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,WAAW;IAoBnB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,QAAQ;CAIjB"}