@wildo-ai/wildo-module-client 1.1.1

package/LICENSE

@@ -0,0 +1,34 @@
+Copyright (c) 2026 P2C Consulting, s.à r.l.-S
+RCS Luxembourg B307591
+6C, Porte de France, L-4360 Esch-sur-Alzette, Luxembourg
+
+All rights reserved.
+
+This software and its accompanying materials (the "Software") are the
+confidential and proprietary property of P2C Consulting, s.à r.l.-S (the
+"Licensor"). The Software is made available for viewing only. No licence,
+right, or permission of any kind is granted by its publication or by its
+availability on any package registry or source repository.
+
+Without the Licensor's prior written permission, you may not use, copy,
+reproduce, modify, adapt, translate, merge, publish, distribute, sublicense,
+sell, host, or create derivative works of the Software, in whole or in part,
+nor use it to provide a service to any third party.
+
+Publication of the Software in any public registry is for distribution to
+authorised recipients and for technical evaluation of its packaging only. It
+does not place the Software in the public domain, does not constitute an open
+source release, and does not waive any right of the Licensor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+LICENSOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Third-party components distributed with the Software remain governed by their
+own licences.
+
+Contact: P2C Consulting, s.à r.l.-S, 6C, Porte de France, L-4360
+Esch-sur-Alzette, Luxembourg.

package/dist/esm/.builder.pid

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": 1,
+  "writerPid": 95348,
+  "orchestratorPid": 94847,
+  "orchestratorSessionId": null,
+  "orchestratorStartedAt": "Mon Aug 31 09:18:19 2026",
+  "distDirectory": "/Users/paulcayon/Projects/Wildo.ai/dev/wildo-ai/platform/factory/wildo-module-client/dist/esm",
+  "acquiredAt": "2026-08-31T07:18:20.844Z"
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `@wildo-ai/wildo-module-client` — runtime services for the Wildo
+ * module-registry workstream (KD-3).
+ *
+ * Phase 0.5 surface:
+ *   - `RegistryServerClient` — HTTP client for the registry server.
+ *   - `RegistryCompanionClient` — HTTP client for the dev companion.
+ *   - `RegistryLockfileService` — section-scoped `sections.modules`
+ *     reader/writer.
+ *   - `runProviderMaterializationHook` — post-mutation no-op hook
+ *     that delegates to `wildo config sync --domain config`.
+ *
+ * Phase 1+ adds `ModulePackagerService`, `ModuleAdopterService`,
+ * `LockfileRepairService`, and the real (locked + atomic) lockfile
+ * mutation surface.
+ */
+export * from './services';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,cAAc,YAAY,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,18 @@
+/**
+ * `@wildo-ai/wildo-module-client` — runtime services for the Wildo
+ * module-registry workstream (KD-3).
+ *
+ * Phase 0.5 surface:
+ *   - `RegistryServerClient` — HTTP client for the registry server.
+ *   - `RegistryCompanionClient` — HTTP client for the dev companion.
+ *   - `RegistryLockfileService` — section-scoped `sections.modules`
+ *     reader/writer.
+ *   - `runProviderMaterializationHook` — post-mutation no-op hook
+ *     that delegates to `wildo config sync --domain config`.
+ *
+ * Phase 1+ adds `ModulePackagerService`, `ModuleAdopterService`,
+ * `LockfileRepairService`, and the real (locked + atomic) lockfile
+ * mutation surface.
+ */
+export * from './services/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,cAAc,YAAY,CAAC","sourcesContent":["/**\n * `@wildo-ai/wildo-module-client` — runtime services for the Wildo\n * module-registry workstream (KD-3).\n *\n * Phase 0.5 surface:\n *   - `RegistryServerClient` — HTTP client for the registry server.\n *   - `RegistryCompanionClient` — HTTP client for the dev companion.\n *   - `RegistryLockfileService` — section-scoped `sections.modules`\n *     reader/writer.\n *   - `runProviderMaterializationHook` — post-mutation no-op hook\n *     that delegates to `wildo config sync --domain config`.\n *\n * Phase 1+ adds `ModulePackagerService`, `ModuleAdopterService`,\n * `LockfileRepairService`, and the real (locked + atomic) lockfile\n * mutation surface.\n */\n\nexport * from './services';\n"]}

package/dist/esm/services/_http-client.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Internal HTTP client utilities shared by `RegistryServerClient`
+ * and `RegistryCompanionClient`.
+ *
+ * Both clients want the same primitives:
+ *   - `joinUrl(base, path)` — single-source-of-truth path joiner
+ *     that tolerates leading/trailing slashes;
+ *   - `fetchWithTimeout(url, init, timeoutMs)` — abort-on-timeout
+ *     wrapper that converts `AbortError`/`TimeoutError` into a
+ *     uniform diagnostic message;
+ *   - `fetchJsonOk(...)` — convenience for liveness probes that
+ *     want a boolean answer.
+ *
+ * The leading underscore signals "package-internal" — these are
+ * intentionally NOT re-exported from `services/index.ts`. Phase 2
+ * services that need fancier HTTP (multipart upload, streaming
+ * download) extend this file rather than copy the primitives.
+ */
+export declare function joinUrl(base: string, path: string): string;
+export interface FetchWithTimeoutInit extends RequestInit {
+    timeoutMs?: number;
+    /** Used in the diagnostic timeout message (e.g. "Registry", "Companion registry"). */
+    diagnosticLabel?: string;
+}
+export declare function fetchWithTimeout(url: string, init?: FetchWithTimeoutInit): Promise<Response>;
+/**
+ * Throws on non-2xx; returns the Response otherwise.
+ *
+ * C-L2 (4th-pass review) waiver: this helper deliberately throws
+ * bare `Error` and is NOT part of the typed `RegistryError`
+ * vocabulary. It exists for liveness probes (`ping()`) that wrap
+ * the call in their own try/catch and convert any thrown exception
+ * to `false`. Future callers MUST do the same — if a caller wants
+ * to surface a typed error to the user, they should not use
+ * `fetchJsonOk` and should call `fetchWithTimeout` directly +
+ * inspect `res.ok` themselves to throw the right
+ * `RegistryUnexpectedStatusError` / `RegistryAuthRequiredError` /
+ * etc. variant.
+ *
+ * @internal — internal lib helper, not re-exported from the
+ * package root.
+ */
+export declare function fetchJsonOk(url: string, init?: FetchWithTimeoutInit): Promise<Response>;
+//# sourceMappingURL=_http-client.d.ts.map

package/dist/esm/services/_http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_http-client.d.ts","sourceRoot":"","sources":["../../../../src/services/_http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAQnB"}

package/dist/esm/services/_http-client.js

@@ -0,0 +1,75 @@
+/**
+ * Internal HTTP client utilities shared by `RegistryServerClient`
+ * and `RegistryCompanionClient`.
+ *
+ * Both clients want the same primitives:
+ *   - `joinUrl(base, path)` — single-source-of-truth path joiner
+ *     that tolerates leading/trailing slashes;
+ *   - `fetchWithTimeout(url, init, timeoutMs)` — abort-on-timeout
+ *     wrapper that converts `AbortError`/`TimeoutError` into a
+ *     uniform diagnostic message;
+ *   - `fetchJsonOk(...)` — convenience for liveness probes that
+ *     want a boolean answer.
+ *
+ * The leading underscore signals "package-internal" — these are
+ * intentionally NOT re-exported from `services/index.ts`. Phase 2
+ * services that need fancier HTTP (multipart upload, streaming
+ * download) extend this file rather than copy the primitives.
+ */
+const DEFAULT_TIMEOUT_MS = 10_000;
+export function joinUrl(base, path) {
+    const normalized = path.startsWith('/') ? path : `/${path}`;
+    return `${base.replace(/\/$/, '')}${normalized}`;
+}
+export async function fetchWithTimeout(url, init = {}) {
+    const timeoutMs = init.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const label = init.diagnosticLabel ?? 'HTTP';
+    const signal = AbortSignal.timeout(timeoutMs);
+    // Strip the wrapper-only fields before forwarding to `fetch`. The
+    // `_` names are conventional unused-binding markers.
+    //
+    // 6th-pass M1 — tsconfig premise (corrected): the wider repo's
+    // `engine/tsconfig.common.json` currently sets both `noUnusedLocals`
+    // and `noUnusedParameters` to `false`, so any unused binding (with
+    // or without `_` prefix) compiles clean today. If either flag is
+    // ever flipped to `true`, TypeScript's underscore-prefix convention
+    // applies to parameters reliably and to destructured `let`/`const`
+    // bindings depending on TS version + setting — so the `_` prefix
+    // here is a defensive signal of "intentional discard" should that
+    // happen. Today it's purely cosmetic.
+    const { timeoutMs: _timeoutMs, diagnosticLabel: _diagnosticLabel, ...rest } = init;
+    try {
+        return await fetch(url, { ...rest, signal });
+    }
+    catch (err) {
+        if (err instanceof Error && (err.name === 'AbortError' || err.name === 'TimeoutError')) {
+            throw new Error(`${label} request timed out after ${timeoutMs}ms (${url})`);
+        }
+        throw err;
+    }
+}
+/**
+ * Throws on non-2xx; returns the Response otherwise.
+ *
+ * C-L2 (4th-pass review) waiver: this helper deliberately throws
+ * bare `Error` and is NOT part of the typed `RegistryError`
+ * vocabulary. It exists for liveness probes (`ping()`) that wrap
+ * the call in their own try/catch and convert any thrown exception
+ * to `false`. Future callers MUST do the same — if a caller wants
+ * to surface a typed error to the user, they should not use
+ * `fetchJsonOk` and should call `fetchWithTimeout` directly +
+ * inspect `res.ok` themselves to throw the right
+ * `RegistryUnexpectedStatusError` / `RegistryAuthRequiredError` /
+ * etc. variant.
+ *
+ * @internal — internal lib helper, not re-exported from the
+ * package root.
+ */
+export async function fetchJsonOk(url, init = {}) {
+    const res = await fetchWithTimeout(url, init);
+    if (!res.ok) {
+        throw new Error(`${init.diagnosticLabel ?? 'HTTP'} request rejected (${res.status} ${res.statusText}) at ${url}`);
+    }
+    return res;
+}
+//# sourceMappingURL=_http-client.js.map

package/dist/esm/services/_http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_http-client.js","sourceRoot":"","sources":["../../../../src/services/_http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;AACnD,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,OAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,kEAAkE;IAClE,qDAAqD;IACrD,EAAE;IACF,+DAA+D;IAC/D,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,sCAAsC;IACtC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACnF,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,SAAS,OAAO,GAAG,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,OAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,eAAe,IAAI,MAAM,sBAAsB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,QAAQ,GAAG,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Internal HTTP client utilities shared by `RegistryServerClient`\n * and `RegistryCompanionClient`.\n *\n * Both clients want the same primitives:\n *   - `joinUrl(base, path)` — single-source-of-truth path joiner\n *     that tolerates leading/trailing slashes;\n *   - `fetchWithTimeout(url, init, timeoutMs)` — abort-on-timeout\n *     wrapper that converts `AbortError`/`TimeoutError` into a\n *     uniform diagnostic message;\n *   - `fetchJsonOk(...)` — convenience for liveness probes that\n *     want a boolean answer.\n *\n * The leading underscore signals \"package-internal\" — these are\n * intentionally NOT re-exported from `services/index.ts`. Phase 2\n * services that need fancier HTTP (multipart upload, streaming\n * download) extend this file rather than copy the primitives.\n */\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\nexport function joinUrl(base: string, path: string): string {\n  const normalized = path.startsWith('/') ? path : `/${path}`;\n  return `${base.replace(/\\/$/, '')}${normalized}`;\n}\n\nexport interface FetchWithTimeoutInit extends RequestInit {\n  timeoutMs?: number;\n  /** Used in the diagnostic timeout message (e.g. \"Registry\", \"Companion registry\"). */\n  diagnosticLabel?: string;\n}\n\nexport async function fetchWithTimeout(\n  url: string,\n  init: FetchWithTimeoutInit = {},\n): Promise<Response> {\n  const timeoutMs = init.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const label = init.diagnosticLabel ?? 'HTTP';\n  const signal = AbortSignal.timeout(timeoutMs);\n  // Strip the wrapper-only fields before forwarding to `fetch`. The\n  // `_` names are conventional unused-binding markers.\n  //\n  // 6th-pass M1 — tsconfig premise (corrected): the wider repo's\n  // `engine/tsconfig.common.json` currently sets both `noUnusedLocals`\n  // and `noUnusedParameters` to `false`, so any unused binding (with\n  // or without `_` prefix) compiles clean today. If either flag is\n  // ever flipped to `true`, TypeScript's underscore-prefix convention\n  // applies to parameters reliably and to destructured `let`/`const`\n  // bindings depending on TS version + setting — so the `_` prefix\n  // here is a defensive signal of \"intentional discard\" should that\n  // happen. Today it's purely cosmetic.\n  const { timeoutMs: _timeoutMs, diagnosticLabel: _diagnosticLabel, ...rest } = init;\n  try {\n    return await fetch(url, { ...rest, signal });\n  } catch (err) {\n    if (err instanceof Error && (err.name === 'AbortError' || err.name === 'TimeoutError')) {\n      throw new Error(`${label} request timed out after ${timeoutMs}ms (${url})`);\n    }\n    throw err;\n  }\n}\n\n/**\n * Throws on non-2xx; returns the Response otherwise.\n *\n * C-L2 (4th-pass review) waiver: this helper deliberately throws\n * bare `Error` and is NOT part of the typed `RegistryError`\n * vocabulary. It exists for liveness probes (`ping()`) that wrap\n * the call in their own try/catch and convert any thrown exception\n * to `false`. Future callers MUST do the same — if a caller wants\n * to surface a typed error to the user, they should not use\n * `fetchJsonOk` and should call `fetchWithTimeout` directly +\n * inspect `res.ok` themselves to throw the right\n * `RegistryUnexpectedStatusError` / `RegistryAuthRequiredError` /\n * etc. variant.\n *\n * @internal — internal lib helper, not re-exported from the\n * package root.\n */\nexport async function fetchJsonOk(\n  url: string,\n  init: FetchWithTimeoutInit = {},\n): Promise<Response> {\n  const res = await fetchWithTimeout(url, init);\n  if (!res.ok) {\n    throw new Error(\n      `${init.diagnosticLabel ?? 'HTTP'} request rejected (${res.status} ${res.statusText}) at ${url}`,\n    );\n  }\n  return res;\n}\n"]}

package/dist/esm/services/_zod-issue-formatting.d.ts

@@ -0,0 +1,12 @@
+import type { ZodError } from 'zod';
+/**
+ * Render a `ZodError` as one operator-readable line —
+ * `path: message; path: message; …` — bounded at {@link ISSUE_RENDER_LIMIT}
+ * with an explicit `(+N more)` so truncation is never silent.
+ *
+ * Used as the `detail` on `RegistryMalformedPayloadError` and on lockfile
+ * repair findings. The raw `error.message` in Zod 4 is the JSON-stringified
+ * issues array — verbose, multi-line, and unreadable in CLI / SIEM output.
+ */
+export declare function formatZodIssuesAsSingleLine(error: ZodError): string;
+//# sourceMappingURL=_zod-issue-formatting.d.ts.map

package/dist/esm/services/_zod-issue-formatting.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_zod-issue-formatting.d.ts","sourceRoot":"","sources":["../../../../src/services/_zod-issue-formatting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAiCpC;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAOnE"}

package/dist/esm/services/_zod-issue-formatting.js

@@ -0,0 +1,47 @@
+/**
+ * Package-internal mirror of `summarizeZodIssues` from `@wildo-ai/saas-models`,
+ * which is the canonical authority every other Wildo surface delegates to.
+ *
+ * zod-issue-formatter-mirror: engine/saas-models/src/errors/zod-issue-formatting.shared.utils.ts
+ *
+ * Why a mirror rather than an import: this package declares exactly ONE
+ * workspace dependency (`@wildo-ai/platform-config-lib`) plus a `zod` peer.
+ * Importing `saas-models` would pull its decorator-bound schema tree into a
+ * lean registry client to save a handful of lines — a bad trade. The boundary
+ * is the reason for the duplication; keep the RENDERING identical, and mirror
+ * any change to the canonical helper's path / root-label / overflow semantics
+ * here.
+ *
+ * The marker above is not decoration — `pnpm check:zod-issue-formatter-mirror`
+ * discovers this file by it and fails if the constants below drift from the
+ * canonical source it names. If the dependency constraint that justifies this
+ * mirror ever stops holding, delete the file and import the canonical formatter
+ * rather than keeping a mirror nobody needs.
+ *
+ * Within this package this is the single source: `registry-server-client.ts`
+ * and `lockfile-repair.service.ts` both call it instead of re-inlining the
+ * `.slice(0, 5).map(...).join('; ')` chain.
+ */
+/** Label for an issue whose `path` is empty — the value itself failed. */
+const ROOT_ISSUE_PATH_LABEL = '<root>';
+/** Issue cap; a malformed payload can fail on hundreds of paths. */
+const ISSUE_RENDER_LIMIT = 5;
+/**
+ * Render a `ZodError` as one operator-readable line —
+ * `path: message; path: message; …` — bounded at {@link ISSUE_RENDER_LIMIT}
+ * with an explicit `(+N more)` so truncation is never silent.
+ *
+ * Used as the `detail` on `RegistryMalformedPayloadError` and on lockfile
+ * repair findings. The raw `error.message` in Zod 4 is the JSON-stringified
+ * issues array — verbose, multi-line, and unreadable in CLI / SIEM output.
+ */
+export function formatZodIssuesAsSingleLine(error) {
+    const rendered = error.issues
+        .slice(0, ISSUE_RENDER_LIMIT)
+        .map((issue) => `${issue.path.join('.') || ROOT_ISSUE_PATH_LABEL}: ${issue.message}`);
+    const omitted = error.issues.length - ISSUE_RENDER_LIMIT;
+    if (omitted > 0)
+        rendered.push(`(+${omitted} more)`);
+    return rendered.join('; ');
+}
+//# sourceMappingURL=_zod-issue-formatting.js.map

package/dist/esm/services/_zod-issue-formatting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_zod-issue-formatting.js","sourceRoot":"","sources":["../../../../src/services/_zod-issue-formatting.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAEvC,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAe;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM;SAC1B,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,qBAAqB,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,kBAAkB,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,QAAQ,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC","sourcesContent":["import type { ZodError } from 'zod';\n\n/**\n * Package-internal mirror of `summarizeZodIssues` from `@wildo-ai/saas-models`,\n * which is the canonical authority every other Wildo surface delegates to.\n *\n * zod-issue-formatter-mirror: engine/saas-models/src/errors/zod-issue-formatting.shared.utils.ts\n *\n * Why a mirror rather than an import: this package declares exactly ONE\n * workspace dependency (`@wildo-ai/platform-config-lib`) plus a `zod` peer.\n * Importing `saas-models` would pull its decorator-bound schema tree into a\n * lean registry client to save a handful of lines — a bad trade. The boundary\n * is the reason for the duplication; keep the RENDERING identical, and mirror\n * any change to the canonical helper's path / root-label / overflow semantics\n * here.\n *\n * The marker above is not decoration — `pnpm check:zod-issue-formatter-mirror`\n * discovers this file by it and fails if the constants below drift from the\n * canonical source it names. If the dependency constraint that justifies this\n * mirror ever stops holding, delete the file and import the canonical formatter\n * rather than keeping a mirror nobody needs.\n *\n * Within this package this is the single source: `registry-server-client.ts`\n * and `lockfile-repair.service.ts` both call it instead of re-inlining the\n * `.slice(0, 5).map(...).join('; ')` chain.\n */\n\n/** Label for an issue whose `path` is empty — the value itself failed. */\nconst ROOT_ISSUE_PATH_LABEL = '<root>';\n\n/** Issue cap; a malformed payload can fail on hundreds of paths. */\nconst ISSUE_RENDER_LIMIT = 5;\n\n/**\n * Render a `ZodError` as one operator-readable line —\n * `path: message; path: message; …` — bounded at {@link ISSUE_RENDER_LIMIT}\n * with an explicit `(+N more)` so truncation is never silent.\n *\n * Used as the `detail` on `RegistryMalformedPayloadError` and on lockfile\n * repair findings. The raw `error.message` in Zod 4 is the JSON-stringified\n * issues array — verbose, multi-line, and unreadable in CLI / SIEM output.\n */\nexport function formatZodIssuesAsSingleLine(error: ZodError): string {\n  const rendered = error.issues\n    .slice(0, ISSUE_RENDER_LIMIT)\n    .map((issue) => `${issue.path.join('.') || ROOT_ISSUE_PATH_LABEL}: ${issue.message}`);\n  const omitted = error.issues.length - ISSUE_RENDER_LIMIT;\n  if (omitted > 0) rendered.push(`(+${omitted} more)`);\n  return rendered.join('; ');\n}\n"]}

package/dist/esm/services/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types';
+export * from './registry-server-client';
+export * from './registry-companion-client';
+export * from './registry-lockfile.service';
+export * from './provider-sync-runner';
+export * from './provider-materialization-hook';
+export * from './module-packager.service';
+export * from './module-adopter.service';
+export * from './lockfile-repair.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC"}

package/dist/esm/services/index.js

@@ -0,0 +1,10 @@
+export * from './types.js';
+export * from './registry-server-client.js';
+export * from './registry-companion-client.js';
+export * from './registry-lockfile.service.js';
+export * from './provider-sync-runner.js';
+export * from './provider-materialization-hook.js';
+export * from './module-packager.service.js';
+export * from './module-adopter.service.js';
+export * from './lockfile-repair.service.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC","sourcesContent":["export * from './types';\nexport * from './registry-server-client';\nexport * from './registry-companion-client';\nexport * from './registry-lockfile.service';\nexport * from './provider-sync-runner';\nexport * from './provider-materialization-hook';\nexport * from './module-packager.service';\nexport * from './module-adopter.service';\nexport * from './lockfile-repair.service';\n"]}

package/dist/esm/services/lockfile-repair.service.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `LockfileRepairService` — Phase 2 read-only lockfile diagnostics.
+ *
+ * Backs `wildo registry repair-lockfile` (CLI command lands in a
+ * later step). The service does NOT mutate the lockfile by
+ * default — its job is to surface a structured diagnostic the
+ * operator can act on:
+ *   - validate the canonical envelope shape;
+ *   - validate `sections.modules` against
+ *     `RegistryModulesLockSectionSchema`;
+ *   - report which `installed[*].files` are missing on disk
+ *     (drift between the lockfile and the source tree);
+ *   - report which `installed[*].artifactDigest` strings are not
+ *     `Sha256DigestSchema`-shaped (residue from pre-tightening
+ *     publishes).
+ *
+ * Mutating repair is a Phase 7 deliverable — surfacing the gaps is
+ * what unblocks the operator now.
+ *
+ * `i18n` validation is intentionally NOT performed here (KD-15 +
+ * Review-pass-2 / MEDIUM-5): repair is the wrong place to
+ * second-guess companion-owned section semantics. The shared
+ * lockfile library STILL validates i18n on the companion-owned
+ * read path; this service only owns module diagnostics.
+ */
+import { type RegistryModulesLockEntry } from '@wildo-ai/platform-config-lib';
+export type LockfileRepairFinding = {
+    severity: 'error';
+    kind: 'envelope-malformed';
+    message: string;
+    detail?: string;
+} | {
+    severity: 'error';
+    kind: 'modules-section-malformed';
+    message: string;
+    detail?: string;
+} | {
+    severity: 'warn';
+    kind: 'module-file-missing';
+    moduleId: string;
+    filePath: string;
+} | {
+    severity: 'warn';
+    kind: 'module-digest-not-sha256';
+    moduleId: string;
+    observedDigest: string;
+};
+export interface LockfileRepairReport {
+    /** Absolute path the report covers. */
+    lockfilePath: string;
+    /** True when no errors were produced (warnings allowed). */
+    ok: boolean;
+    findings: readonly LockfileRepairFinding[];
+}
+export declare const LockfileRepairService: {
+    /** Compute the lockfile path for a saas root. */
+    readonly pathFor: (saasRoot: string) => string;
+    /**
+     * Read the envelope + run every diagnostic. Read-only.
+     */
+    readonly inspect: (saasRoot: string) => Promise<LockfileRepairReport>;
+    /**
+     * Per-entry diagnostic helper. Exposed so Phase 7 mutating-
+     * repair flows can reuse the same predicates.
+     */
+    readonly collectEntryFindings: (saasRoot: string, moduleId: string, entry: RegistryModulesLockEntry, findings: LockfileRepairFinding[]) => Promise<void>;
+};
+//# sourceMappingURL=lockfile-repair.service.d.ts.map

package/dist/esm/services/lockfile-repair.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile-repair.service.d.ts","sourceRoot":"","sources":["../../../../src/services/lockfile-repair.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,EAIL,KAAK,wBAAwB,EAE9B,MAAM,+BAA+B,CAAC;AAcvC,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,2BAA2B,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,qBAAqB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,0BAA0B,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC5C;AAWD,eAAO,MAAM,qBAAqB;IAChC,iDAAiD;iCAC/B,MAAM,KAAG,MAAM;IAIjC;;OAEG;iCACqB,MAAM,KAAG,OAAO,CAAC,oBAAoB,CAAC;IA8E9D;;;OAGG;8CAES,MAAM,YACN,MAAM,SACT,wBAAwB,YACrB,qBAAqB,EAAE,KAChC,OAAO,CAAC,IAAI,CAAC;CAqBR,CAAC"}

package/dist/esm/services/lockfile-repair.service.js

@@ -0,0 +1,160 @@
+/**
+ * `LockfileRepairService` — Phase 2 read-only lockfile diagnostics.
+ *
+ * Backs `wildo registry repair-lockfile` (CLI command lands in a
+ * later step). The service does NOT mutate the lockfile by
+ * default — its job is to surface a structured diagnostic the
+ * operator can act on:
+ *   - validate the canonical envelope shape;
+ *   - validate `sections.modules` against
+ *     `RegistryModulesLockSectionSchema`;
+ *   - report which `installed[*].files` are missing on disk
+ *     (drift between the lockfile and the source tree);
+ *   - report which `installed[*].artifactDigest` strings are not
+ *     `Sha256DigestSchema`-shaped (residue from pre-tightening
+ *     publishes).
+ *
+ * Mutating repair is a Phase 7 deliverable — surfacing the gaps is
+ * what unblocks the operator now.
+ *
+ * `i18n` validation is intentionally NOT performed here (KD-15 +
+ * Review-pass-2 / MEDIUM-5): repair is the wrong place to
+ * second-guess companion-owned section semantics. The shared
+ * lockfile library STILL validates i18n on the companion-owned
+ * read path; this service only owns module diagnostics.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { z } from 'zod';
+import { formatZodIssuesAsSingleLine } from './_zod-issue-formatting.js';
+import { RegistryModulesLockSectionSchema, Sha256DigestSchema, getWildoSaasLockPath, } from '@wildo-ai/platform-config-lib';
+/**
+ * Permissive envelope schema used by repair only — it accepts any
+ * `sections.*` payload without delegating to per-section schemas
+ * so the repair flow can isolate "envelope is malformed" from
+ * "envelope is fine but modules section is malformed".
+ */
+const RelaxedEnvelopeSchema = z.strictObject({
+    schemaVersion: z.literal(2),
+    generatedAt: z.iso.datetime({ offset: true }),
+    sections: z.record(z.string(), z.unknown()),
+});
+async function fileExists(absPath) {
+    try {
+        await fs.access(absPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export const LockfileRepairService = {
+    /** Compute the lockfile path for a saas root. */
+    pathFor(saasRoot) {
+        return getWildoSaasLockPath(saasRoot);
+    },
+    /**
+     * Read the envelope + run every diagnostic. Read-only.
+     */
+    async inspect(saasRoot) {
+        const lockfilePath = getWildoSaasLockPath(saasRoot);
+        const findings = [];
+        // Read raw bytes ourselves so we can produce per-section
+        // diagnostics: a malformed `modules` section under an
+        // otherwise-valid envelope should report `modules-section-malformed`,
+        // NOT `envelope-malformed` (the latter would tell the operator
+        // to re-author the whole file when only one section is bad).
+        let raw;
+        try {
+            raw = await fs.readFile(lockfilePath, 'utf8');
+        }
+        catch (err) {
+            const errno = err?.code;
+            if (errno === 'ENOENT') {
+                // Missing lockfile is "ok" from a repair POV.
+                return { lockfilePath, ok: true, findings: [] };
+            }
+            findings.push({
+                severity: 'error',
+                kind: 'envelope-malformed',
+                message: 'Failed to read lockfile bytes.',
+                detail: err instanceof Error ? err.message : String(err),
+            });
+            return { lockfilePath, ok: false, findings };
+        }
+        let parsedJson;
+        try {
+            parsedJson = JSON.parse(raw);
+        }
+        catch (err) {
+            findings.push({
+                severity: 'error',
+                kind: 'envelope-malformed',
+                message: 'Lockfile is not valid JSON.',
+                detail: err instanceof Error ? err.message : String(err),
+            });
+            return { lockfilePath, ok: false, findings };
+        }
+        const envelopeParsed = RelaxedEnvelopeSchema.safeParse(parsedJson);
+        if (!envelopeParsed.success) {
+            findings.push({
+                severity: 'error',
+                kind: 'envelope-malformed',
+                message: 'Top-level envelope failed to parse.',
+                detail: formatZodIssuesAsSingleLine(envelopeParsed.error),
+            });
+            return { lockfilePath, ok: false, findings };
+        }
+        const envelope = envelopeParsed.data;
+        const modulesPayload = envelope.sections.modules;
+        if (modulesPayload === undefined) {
+            // No modules section present — nothing to inspect.
+            return { lockfilePath, ok: true, findings };
+        }
+        const parsed = RegistryModulesLockSectionSchema.safeParse(modulesPayload);
+        if (!parsed.success) {
+            findings.push({
+                severity: 'error',
+                kind: 'modules-section-malformed',
+                message: '`sections.modules` failed schema validation.',
+                detail: formatZodIssuesAsSingleLine(parsed.error),
+            });
+            return { lockfilePath, ok: false, findings };
+        }
+        const modules = parsed.data;
+        for (const [moduleId, entry] of Object.entries(modules.installed)) {
+            await this.collectEntryFindings(saasRoot, moduleId, entry, findings);
+        }
+        const ok = findings.every((f) => f.severity !== 'error');
+        return { lockfilePath, ok, findings };
+    },
+    /**
+     * Per-entry diagnostic helper. Exposed so Phase 7 mutating-
+     * repair flows can reuse the same predicates.
+     */
+    async collectEntryFindings(saasRoot, moduleId, entry, findings) {
+        if (!Sha256DigestSchema.safeParse(entry.artifactDigest).success) {
+            findings.push({
+                severity: 'warn',
+                kind: 'module-digest-not-sha256',
+                moduleId,
+                observedDigest: entry.artifactDigest,
+            });
+        }
+        for (const filePath of entry.files) {
+            const abs = path.resolve(saasRoot, filePath);
+            if (!(await fileExists(abs))) {
+                findings.push({
+                    severity: 'warn',
+                    kind: 'module-file-missing',
+                    moduleId,
+                    filePath,
+                });
+            }
+        }
+    },
+};
+// L6 (third-pass review): re-export removed — barrel-discipline rule
+// says "Never re-export except in the root `index.ts`." Consumers
+// import the symbol directly from `@wildo-ai/platform-config-lib`.
+//# sourceMappingURL=lockfile-repair.service.js.map