@wildo-ai/wildo-module-client 1.1.1

package/dist/esm/services/registry-lockfile.service.js

@@ -0,0 +1,99 @@
+/**
+ * `RegistryLockfileService` — section-scoped reader/writer for the
+ * `sections.modules` slice of `wildo-saas.lock.json` (KD-4).
+ *
+ * Phase 1 graduates the locking + atomic-write primitives into
+ * `@wildo-ai/platform-config-lib` (validated by the Phase 0.B
+ * contention spike). This service is a thin wrapper around
+ * `withLockfileSectionMutate` that pre-binds the `modules` section
+ * key + schema, so module-registry callers cannot accidentally
+ * touch sibling sections.
+ *
+ * Hard contracts (KD-4 / KD-15 / KD-18):
+ *   - Mutates ONLY `sections.modules`. The shared library preserves
+ *     `sections.providers`, `sections.i18n`, and every unknown
+ *     `sections.*` payload verbatim — no defensive logic needed
+ *     here.
+ *   - Never writes `.wildo-saas/generated/providers/*.runtime-providers.generated.json`
+ *     or `src/generated/wildo-provider-runtime.generated.ts` —
+ *     those are produced by the provider materialization workflow.
+ *   - Never mutates `sections.providers.runtimeScopes`.
+ */
+import { RegistryModulesLockSectionSchema, withLockfileSectionMutate, readWildoSaasLock, } from '@wildo-ai/platform-config-lib';
+// L6 (third-pass review): the package's barrel-discipline rule says
+// "Never re-export (except in the root `index.ts` of each package)."
+// The previous `export { WILDO_SAAS_LOCK_RELATIVE_PATH }` here AND in
+// `lockfile-repair.service.ts` surfaced the symbol twice from
+// `wildo-module-client`'s root. Consumers that need it can import
+// directly from `@wildo-ai/platform-config-lib`, OR rely on the root
+// `index.ts` to re-export it once.
+const SECTION_KEY = 'modules';
+function emptySection() {
+    return RegistryModulesLockSectionSchema.parse({});
+}
+export const RegistryLockfileService = {
+    /**
+     * Read the current `sections.modules` payload (or an empty section
+     * when missing). Unsynchronized — callers needing read-after-write
+     * coherence should read INSIDE `mutate`.
+     */
+    async read(saasRoot) {
+        const envelope = await readWildoSaasLock({ saasRoot });
+        const raw = envelope.sections.modules;
+        if (raw === undefined)
+            return emptySection();
+        return RegistryModulesLockSectionSchema.parse(raw);
+    },
+    /**
+     * Run `mutator` against the current `sections.modules` payload
+     * under an OS-level lock + atomic-write commit. The mutator can
+     * either mutate-in-place or return a new value; either way the
+     * result is re-validated against `RegistryModulesLockSectionSchema`
+     * before commit.
+     */
+    async mutate(saasRoot, mutator) {
+        return withLockfileSectionMutate({
+            saasRoot,
+            sectionKey: SECTION_KEY,
+            sectionSchema: RegistryModulesLockSectionSchema,
+            initialSection: emptySection,
+        }, mutator);
+    },
+    /** Convenience helper used by Phase 5+ install flow. */
+    async upsertEntry(saasRoot, entry) {
+        await this.mutate(saasRoot, (current) => ({
+            ...current,
+            installed: { ...current.installed, [entry.moduleId]: entry },
+        }));
+    },
+    /**
+     * Find every other lockfile entry whose `files[]` claims any of the
+     * given paths. Used by `update`/`remove` to skip deletes that would
+     * silently pull files out from under modules that own them too
+     * (cross-module file overlap).
+     *
+     * Returns a `Map<relPath, owners[]>` where `owners` excludes
+     * `excludeModuleId`. Empty array → uniquely owned by the excluded
+     * module, safe to delete.
+     */
+    async findFileOwners(args) {
+        const section = await this.read(args.saasRoot);
+        const claimedBy = new Map();
+        for (const p of args.paths)
+            claimedBy.set(p, []);
+        for (const otherModuleId of Object.keys(section.installed)) {
+            if (otherModuleId === args.excludeModuleId)
+                continue;
+            const otherEntry = section.installed[otherModuleId];
+            if (!otherEntry)
+                continue;
+            for (const otherFile of otherEntry.files) {
+                if (claimedBy.has(otherFile)) {
+                    claimedBy.get(otherFile).push(otherModuleId);
+                }
+            }
+        }
+        return claimedBy;
+    },
+};
+//# sourceMappingURL=registry-lockfile.service.js.map

package/dist/esm/services/registry-lockfile.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-lockfile.service.js","sourceRoot":"","sources":["../../../../src/services/registry-lockfile.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iBAAiB,GAGlB,MAAM,+BAA+B,CAAC;AACvC,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,kEAAkE;AAClE,qEAAqE;AACrE,mCAAmC;AAEnC,MAAM,WAAW,GAAG,SAAkB,CAAC;AAEvC,SAAS,YAAY;IACnB,OAAO,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,YAAY,EAAE,CAAC;QAC7C,OAAO,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,OAK8C;QAE9C,OAAO,yBAAyB,CAC9B;YACE,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,gCAAgC;YAC/C,cAAc,EAAE,YAAY;SAC7B,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,KAA+B;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG,OAAO;YACV,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,IAIpB;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,aAAa,KAAK,IAAI,CAAC,eAAe;gBAAE,SAAS;YACrD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACO,CAAC","sourcesContent":["/**\n * `RegistryLockfileService` — section-scoped reader/writer for the\n * `sections.modules` slice of `wildo-saas.lock.json` (KD-4).\n *\n * Phase 1 graduates the locking + atomic-write primitives into\n * `@wildo-ai/platform-config-lib` (validated by the Phase 0.B\n * contention spike). This service is a thin wrapper around\n * `withLockfileSectionMutate` that pre-binds the `modules` section\n * key + schema, so module-registry callers cannot accidentally\n * touch sibling sections.\n *\n * Hard contracts (KD-4 / KD-15 / KD-18):\n *   - Mutates ONLY `sections.modules`. The shared library preserves\n *     `sections.providers`, `sections.i18n`, and every unknown\n *     `sections.*` payload verbatim — no defensive logic needed\n *     here.\n *   - Never writes `.wildo-saas/generated/providers/*.runtime-providers.generated.json`\n *     or `src/generated/wildo-provider-runtime.generated.ts` —\n *     those are produced by the provider materialization workflow.\n *   - Never mutates `sections.providers.runtimeScopes`.\n */\n\nimport {\n  RegistryModulesLockSectionSchema,\n  withLockfileSectionMutate,\n  readWildoSaasLock,\n  type RegistryModulesLockSection,\n  type RegistryModulesLockEntry,\n} from '@wildo-ai/platform-config-lib';\n// L6 (third-pass review): the package's barrel-discipline rule says\n// \"Never re-export (except in the root `index.ts` of each package).\"\n// The previous `export { WILDO_SAAS_LOCK_RELATIVE_PATH }` here AND in\n// `lockfile-repair.service.ts` surfaced the symbol twice from\n// `wildo-module-client`'s root. Consumers that need it can import\n// directly from `@wildo-ai/platform-config-lib`, OR rely on the root\n// `index.ts` to re-export it once.\n\nconst SECTION_KEY = 'modules' as const;\n\nfunction emptySection(): RegistryModulesLockSection {\n  return RegistryModulesLockSectionSchema.parse({});\n}\n\nexport const RegistryLockfileService = {\n  /**\n   * Read the current `sections.modules` payload (or an empty section\n   * when missing). Unsynchronized — callers needing read-after-write\n   * coherence should read INSIDE `mutate`.\n   */\n  async read(saasRoot: string): Promise<RegistryModulesLockSection> {\n    const envelope = await readWildoSaasLock({ saasRoot });\n    const raw = envelope.sections.modules;\n    if (raw === undefined) return emptySection();\n    return RegistryModulesLockSectionSchema.parse(raw);\n  },\n\n  /**\n   * Run `mutator` against the current `sections.modules` payload\n   * under an OS-level lock + atomic-write commit. The mutator can\n   * either mutate-in-place or return a new value; either way the\n   * result is re-validated against `RegistryModulesLockSectionSchema`\n   * before commit.\n   */\n  async mutate(\n    saasRoot: string,\n    mutator: (\n      current: RegistryModulesLockSection,\n    ) =>\n      | RegistryModulesLockSection\n      | void\n      | Promise<RegistryModulesLockSection | void>,\n  ): Promise<RegistryModulesLockSection> {\n    return withLockfileSectionMutate(\n      {\n        saasRoot,\n        sectionKey: SECTION_KEY,\n        sectionSchema: RegistryModulesLockSectionSchema,\n        initialSection: emptySection,\n      },\n      mutator,\n    );\n  },\n\n  /** Convenience helper used by Phase 5+ install flow. */\n  async upsertEntry(saasRoot: string, entry: RegistryModulesLockEntry): Promise<void> {\n    await this.mutate(saasRoot, (current) => ({\n      ...current,\n      installed: { ...current.installed, [entry.moduleId]: entry },\n    }));\n  },\n\n  /**\n   * Find every other lockfile entry whose `files[]` claims any of the\n   * given paths. Used by `update`/`remove` to skip deletes that would\n   * silently pull files out from under modules that own them too\n   * (cross-module file overlap).\n   *\n   * Returns a `Map<relPath, owners[]>` where `owners` excludes\n   * `excludeModuleId`. Empty array → uniquely owned by the excluded\n   * module, safe to delete.\n   */\n  async findFileOwners(args: {\n    saasRoot: string;\n    paths: readonly string[];\n    excludeModuleId: string;\n  }): Promise<Map<string, string[]>> {\n    const section = await this.read(args.saasRoot);\n    const claimedBy = new Map<string, string[]>();\n    for (const p of args.paths) claimedBy.set(p, []);\n    for (const otherModuleId of Object.keys(section.installed)) {\n      if (otherModuleId === args.excludeModuleId) continue;\n      const otherEntry = section.installed[otherModuleId];\n      if (!otherEntry) continue;\n      for (const otherFile of otherEntry.files) {\n        if (claimedBy.has(otherFile)) {\n          claimedBy.get(otherFile)!.push(otherModuleId);\n        }\n      }\n    }\n    return claimedBy;\n  },\n} as const;\n"]}

package/dist/esm/services/registry-server-client.d.ts

@@ -0,0 +1,94 @@
+/**
+ * `RegistryServerClient` — HTTP client for the central registry
+ * server (`platform-module-registry`, KD-7).
+ *
+ * Phase 2 fills out the read + download surface (`resolve`,
+ * `info`, `search`, `download`). The wire shapes mirror the
+ * gateway endpoints documented in the analysis plan's "Registry
+ * HTTP API" section. The actual server (Phase 3) ships these
+ * routes; until it does, the client throws typed errors when it
+ * can't reach the server.
+ *
+ * Auth (KD-11): if `authToken` is supplied, every request adds
+ * `Authorization: Bearer <token>`. Public read paths work without
+ * a token; restricted paths return 401/403, surfaced as
+ * `RegistryAuthRequiredError` / `RegistryAuthForbiddenError`.
+ */
+import { type ModuleManifest, type ModuleVersionRecord } from '@wildo-ai/platform-config-lib';
+export interface RegistryServerClientOptions {
+    /** Registry origin (e.g. `https://registry.wildo.ai`). */
+    baseUrl: string;
+    /** Optional bearer / API-key. CLI credentials are per-machine (KD-11). */
+    authToken?: string;
+    /** Request timeout in ms. */
+    timeoutMs?: number;
+}
+export interface RegistryResolveResult {
+    /** Resolved exact version (matches `Sha256DigestSchema` for digest). */
+    version: string;
+    artifactDigest: string;
+}
+export interface RegistryInfoResult {
+    moduleId: string;
+    manifest: ModuleManifest;
+    versions: readonly ModuleVersionRecord[];
+    /** dist-tag → version map (e.g. `latest → 1.2.3`). */
+    tags: Readonly<Record<string, string>>;
+}
+export interface RegistrySearchHit {
+    moduleId: string;
+    description?: string;
+    latestVersion: string;
+}
+export declare const RegistryServerClient: {
+    /**
+     * Liveness probe against `/health`. Returns boolean — used by
+     * `wildo registry ping` smoke. The registry server now relies on
+     * the framework's auto-mounted `HealthController` at the engine
+     * root (`GET /health` always 200; `GET /health/ready` enforces
+     * dependency readiness), so the path has NO `/v1` prefix.
+     */
+    readonly ping: (options: RegistryServerClientOptions) => Promise<boolean>;
+    /**
+     * Resolve a semver range / tag against a registry domain. The
+     * server returns the concrete version + artifact digest so the
+     * caller can verify the download against `artifactDigest`.
+     */
+    readonly resolve: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        moduleId: string;
+        range: string;
+    }) => Promise<RegistryResolveResult>;
+    /**
+     * Fetch full info for a module: manifest, every published
+     * version, dist-tags. Used by `wildo registry info` (Phase 4).
+     */
+    readonly info: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        moduleId: string;
+    }) => Promise<RegistryInfoResult>;
+    /**
+     * Search the registry's metadata index. The shape is
+     * intentionally narrow until Phase 4 designs the search UX.
+     */
+    readonly search: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        query: string;
+    }) => Promise<readonly RegistrySearchHit[]>;
+    /**
+     * Stream-download a published artifact's bytes and verify the
+     * sha256 integrity matches `expectedDigest`. Throws
+     * `RegistryArtifactIntegrityMismatchError` on mismatch — the
+     * digest check is non-negotiable per KD-9 / Security model.
+     */
+    readonly download: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        moduleId: string;
+        version: string;
+        expectedDigest: string;
+    }) => Promise<{
+        bytes: Uint8Array;
+        integrity: string;
+    }>;
+};
+//# sourceMappingURL=registry-server-client.d.ts.map

package/dist/esm/services/registry-server-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-server-client.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-server-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAYL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACzB,MAAM,+BAA+B,CAAC;AA4BvC,MAAM,WAAW,2BAA2B;IAC1C,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoCD,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,oBAAoB;IAC/B;;;;;;OAMG;6BACiB,2BAA2B,KAAG,OAAO,CAAC,OAAO,CAAC;IAalE;;;;OAIG;gCAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACxD,OAAO,CAAC,qBAAqB,CAAC;IAgDjC;;;OAGG;6BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACzC,OAAO,CAAC,kBAAkB,CAAC;IA8B9B;;;OAGG;+BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACtC,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IA6BxC;;;;;OAKG;iCAEQ,2BAA2B,QAC9B;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACxB,KACA,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CA6C5C,CAAC"}

package/dist/esm/services/registry-server-client.js

@@ -0,0 +1,225 @@
+/**
+ * `RegistryServerClient` — HTTP client for the central registry
+ * server (`platform-module-registry`, KD-7).
+ *
+ * Phase 2 fills out the read + download surface (`resolve`,
+ * `info`, `search`, `download`). The wire shapes mirror the
+ * gateway endpoints documented in the analysis plan's "Registry
+ * HTTP API" section. The actual server (Phase 3) ships these
+ * routes; until it does, the client throws typed errors when it
+ * can't reach the server.
+ *
+ * Auth (KD-11): if `authToken` is supplied, every request adds
+ * `Authorization: Bearer <token>`. Public read paths work without
+ * a token; restricted paths return 401/403, surfaced as
+ * `RegistryAuthRequiredError` / `RegistryAuthForbiddenError`.
+ */
+import { z } from 'zod';
+import { formatZodIssuesAsSingleLine } from './_zod-issue-formatting.js';
+import { ModuleManifestSchema, ModuleVersionRecordSchema, RegistryArtifactIntegrityMismatchError, RegistryAuthForbiddenError, RegistryAuthRequiredError, RegistryMalformedPayloadError, RegistryModuleNotFoundError, RegistryUnexpectedStatusError, RegistryVersionNotFoundError, Sha256DigestSchema, } from '@wildo-ai/platform-config-lib';
+import { fetchJsonOk, fetchWithTimeout, joinUrl } from './_http-client.js';
+/**
+ * Zod schema for the `info()` response payload — mirrors
+ * `RegistryInfoResult` and is enforced at the client boundary so a
+ * server schema drift fails fast instead of returning malformed data
+ * to downstream consumers.
+ */
+const RegistryInfoResponseSchema = z.object({
+    moduleId: z.string().min(1),
+    manifest: ModuleManifestSchema,
+    versions: z.array(ModuleVersionRecordSchema),
+    tags: z.record(z.string(), z.string()),
+});
+const RegistrySearchResponseSchema = z.object({
+    hits: z.array(z.object({
+        moduleId: z.string().min(1),
+        description: z.string().optional(),
+        latestVersion: z.string(),
+    })),
+});
+const DIAGNOSTIC_LABEL = 'Registry';
+function authHeaders(options) {
+    return options.authToken ? { Authorization: `Bearer ${options.authToken}` } : {};
+}
+async function classifyAuthError(res, registryUrl, action) {
+    if (res.status === 401)
+        return new RegistryAuthRequiredError(registryUrl);
+    if (res.status === 403)
+        return new RegistryAuthForbiddenError(action);
+    return null;
+}
+/**
+ * 6th-pass M3: typed JSON-parse helper. A misconfigured proxy that
+ * returns HTML at 2xx (or a truncated stream) would otherwise throw a
+ * bare `SyntaxError` from `await res.json()`, bypassing every
+ * `isRegistryError(err)` handler. This helper translates the parse
+ * failure into a `RegistryMalformedPayloadError` so the typed-error
+ * contract is universal across the client surface.
+ */
+async function parseJsonOrThrow(res, registryUrl, action) {
+    try {
+        return await res.json();
+    }
+    catch (err) {
+        throw new RegistryMalformedPayloadError(registryUrl, action, `response is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export const RegistryServerClient = {
+    /**
+     * Liveness probe against `/health`. Returns boolean — used by
+     * `wildo registry ping` smoke. The registry server now relies on
+     * the framework's auto-mounted `HealthController` at the engine
+     * root (`GET /health` always 200; `GET /health/ready` enforces
+     * dependency readiness), so the path has NO `/v1` prefix.
+     */
+    async ping(options) {
+        try {
+            await fetchJsonOk(joinUrl(options.baseUrl, '/health'), {
+                method: 'GET',
+                timeoutMs: options.timeoutMs,
+                diagnosticLabel: DIAGNOSTIC_LABEL,
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    /**
+     * Resolve a semver range / tag against a registry domain. The
+     * server returns the concrete version + artifact digest so the
+     * caller can verify the download against `artifactDigest`.
+     */
+    async resolve(options, args) {
+        const url = joinUrl(options.baseUrl, `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}/resolve?range=${encodeURIComponent(args.range)}`);
+        const res = await fetchWithTimeout(url, {
+            method: 'GET',
+            headers: authHeaders(options),
+            timeoutMs: options.timeoutMs,
+            diagnosticLabel: DIAGNOSTIC_LABEL,
+        });
+        if (res.status === 404) {
+            throw new RegistryVersionNotFoundError(args.moduleId, args.range);
+        }
+        const authErr = await classifyAuthError(res, options.baseUrl, `resolve ${args.moduleId}`);
+        if (authErr)
+            throw authErr;
+        if (!res.ok) {
+            throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `resolve ${args.moduleId}`);
+        }
+        // 6th-pass M3: typed JSON-parse (was bare `SyntaxError` for
+        // malformed proxy responses).
+        const json = (await parseJsonOrThrow(res, options.baseUrl, `resolve ${args.moduleId}`));
+        const digest = String(json.artifactDigest ?? '');
+        // 6th-pass M4: typed digest validation (was bare `ZodError`).
+        const digestParse = Sha256DigestSchema.safeParse(digest);
+        if (!digestParse.success) {
+            throw new RegistryMalformedPayloadError(options.baseUrl, `resolve ${args.moduleId}`, `artifactDigest is not a valid sha256:<64-hex> string: ${formatZodIssuesAsSingleLine(digestParse.error)}`);
+        }
+        if (typeof json.version !== 'string' || json.version.length === 0) {
+            // 3rd-pass M6: typed `RegistryMalformedPayloadError` instead of
+            // bare `Error` so callers' `isRegistryError(err)` handlers fire
+            // correctly.
+            throw new RegistryMalformedPayloadError(options.baseUrl, `resolve ${args.moduleId}`, 'response missing required `version` string');
+        }
+        return { version: json.version, artifactDigest: digest };
+    },
+    /**
+     * Fetch full info for a module: manifest, every published
+     * version, dist-tags. Used by `wildo registry info` (Phase 4).
+     */
+    async info(options, args) {
+        const url = joinUrl(options.baseUrl, `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}`);
+        const res = await fetchWithTimeout(url, {
+            method: 'GET',
+            headers: authHeaders(options),
+            timeoutMs: options.timeoutMs,
+            diagnosticLabel: DIAGNOSTIC_LABEL,
+        });
+        if (res.status === 404)
+            throw new RegistryModuleNotFoundError(args.moduleId);
+        const authErr = await classifyAuthError(res, options.baseUrl, `info ${args.moduleId}`);
+        if (authErr)
+            throw authErr;
+        if (!res.ok) {
+            throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `info ${args.moduleId}`);
+        }
+        // 6th-pass M3: typed JSON-parse.
+        const json = await parseJsonOrThrow(res, options.baseUrl, `info ${args.moduleId}`);
+        const parsed = RegistryInfoResponseSchema.safeParse(json);
+        if (!parsed.success) {
+            throw new RegistryMalformedPayloadError(options.baseUrl, `info ${args.moduleId}`, formatZodIssuesAsSingleLine(parsed.error));
+        }
+        return parsed.data;
+    },
+    /**
+     * Search the registry's metadata index. The shape is
+     * intentionally narrow until Phase 4 designs the search UX.
+     */
+    async search(options, args) {
+        const url = joinUrl(options.baseUrl, `/v1/registry/${encodeURIComponent(args.domain)}/modules?q=${encodeURIComponent(args.query)}`);
+        const res = await fetchWithTimeout(url, {
+            method: 'GET',
+            headers: authHeaders(options),
+            timeoutMs: options.timeoutMs,
+            diagnosticLabel: DIAGNOSTIC_LABEL,
+        });
+        const authErr = await classifyAuthError(res, options.baseUrl, `search`);
+        if (authErr)
+            throw authErr;
+        if (!res.ok) {
+            throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, 'search');
+        }
+        // 6th-pass M3: typed JSON-parse.
+        const json = await parseJsonOrThrow(res, options.baseUrl, 'search');
+        const parsed = RegistrySearchResponseSchema.safeParse(json);
+        if (!parsed.success) {
+            throw new RegistryMalformedPayloadError(options.baseUrl, 'search', formatZodIssuesAsSingleLine(parsed.error));
+        }
+        return parsed.data.hits;
+    },
+    /**
+     * Stream-download a published artifact's bytes and verify the
+     * sha256 integrity matches `expectedDigest`. Throws
+     * `RegistryArtifactIntegrityMismatchError` on mismatch — the
+     * digest check is non-negotiable per KD-9 / Security model.
+     */
+    async download(options, args) {
+        // 7th-pass C-M1: caller-supplied digest is a developer-contract
+        // violation if malformed, not a registry-runtime condition.
+        // Throw `TypeError` (matching `C-L3` precedent for
+        // `getModuleStagingPaths` argument-shape violations) so the
+        // typed `RegistryError` vocabulary stays reserved for
+        // registry-runtime errors. Prior `Sha256DigestSchema.parse(...)`
+        // leaked a bare `ZodError` that bypassed
+        // `isRegistryError(err)` handlers but ALSO confused
+        // typed-handler maintainers about the contract.
+        const digestParse = Sha256DigestSchema.safeParse(args.expectedDigest);
+        if (!digestParse.success) {
+            throw new TypeError(`download() expectedDigest must be a valid sha256:<64-hex> string (got: ${JSON.stringify(args.expectedDigest)}). ${formatZodIssuesAsSingleLine(digestParse.error)}`);
+        }
+        const url = joinUrl(options.baseUrl, `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}/${encodeURIComponent(args.version)}/artifact`);
+        const res = await fetchWithTimeout(url, {
+            method: 'GET',
+            headers: authHeaders(options),
+            timeoutMs: options.timeoutMs,
+            diagnosticLabel: DIAGNOSTIC_LABEL,
+        });
+        if (res.status === 404)
+            throw new RegistryVersionNotFoundError(args.moduleId, args.version);
+        const authErr = await classifyAuthError(res, options.baseUrl, `download ${args.moduleId}@${args.version}`);
+        if (authErr)
+            throw authErr;
+        if (!res.ok) {
+            throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `download ${args.moduleId}@${args.version}`);
+        }
+        const buf = new Uint8Array(await res.arrayBuffer());
+        const { createHash } = await import('node:crypto');
+        const observed = `sha256:${createHash('sha256').update(buf).digest('hex')}`;
+        if (observed !== args.expectedDigest) {
+            throw new RegistryArtifactIntegrityMismatchError(args.moduleId, args.version, args.expectedDigest, observed);
+        }
+        return { bytes: buf, integrity: observed };
+    },
+};
+//# sourceMappingURL=registry-server-client.js.map

package/dist/esm/services/registry-server-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-server-client.js","sourceRoot":"","sources":["../../../../src/services/registry-server-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,sCAAsC,EACtC,0BAA0B,EAC1B,yBAAyB,EAEzB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,EAC7B,4BAA4B,EAC5B,kBAAkB,GAGnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,KAAK,CACX,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KAC1B,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAWpC,SAAS,WAAW,CAAC,OAAoC;IACvD,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAa,EAAE,WAAmB,EAAE,MAAc;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAa,EACb,WAAmB,EACnB,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CACrC,WAAW,EACX,MAAM,EACN,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAsBD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,OAAoC;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;gBACrD,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,gBAAgB;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAAoC,EACpC,IAAyD;QAEzD,MAAM,GAAG,GAAG,OAAO,CACjB,OAAO,CAAC,OAAO,EACf,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC/I,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,4DAA4D;QAC5D,8BAA8B;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC,CAGrF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACjD,8DAA8D;QAC9D,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,WAAW,IAAI,CAAC,QAAQ,EAAE,EAC1B,yDAAyD,2BAA2B,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,aAAa;YACb,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,WAAW,IAAI,CAAC,QAAQ,EAAE,EAC1B,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CACR,OAAoC,EACpC,IAA0C;QAE1C,MAAM,GAAG,GAAG,OAAO,CACjB,OAAO,CAAC,OAAO,EACf,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAC/F,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,QAAQ,IAAI,CAAC,QAAQ,EAAE,EACvB,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,OAAoC,EACpC,IAAuC;QAEvC,MAAM,GAAG,GAAG,OAAO,CACjB,OAAO,CAAC,OAAO,EACf,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjG,CAAC;QACD,iCAAiC;QACjC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,QAAQ,EACR,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAoC,EACpC,IAKC;QAED,gEAAgE;QAChE,4DAA4D;QAC5D,mDAAmD;QACnD,4DAA4D;QAC5D,sDAAsD;QACtD,iEAAiE;QACjE,yCAAyC;QACzC,oDAAoD;QACpD,gDAAgD;QAChD,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CACjB,0EAA0E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,2BAA2B,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CACpK,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CACjB,OAAO,CAAC,OAAO,EACf,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAC5I,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;YAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,gBAAgB;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3G,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,6BAA6B,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,IAAI,QAAQ,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,sCAAsC,CAC9C,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,cAAc,EACnB,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;CACO,CAAC","sourcesContent":["/**\n * `RegistryServerClient` — HTTP client for the central registry\n * server (`platform-module-registry`, KD-7).\n *\n * Phase 2 fills out the read + download surface (`resolve`,\n * `info`, `search`, `download`). The wire shapes mirror the\n * gateway endpoints documented in the analysis plan's \"Registry\n * HTTP API\" section. The actual server (Phase 3) ships these\n * routes; until it does, the client throws typed errors when it\n * can't reach the server.\n *\n * Auth (KD-11): if `authToken` is supplied, every request adds\n * `Authorization: Bearer <token>`. Public read paths work without\n * a token; restricted paths return 401/403, surfaced as\n * `RegistryAuthRequiredError` / `RegistryAuthForbiddenError`.\n */\n\nimport { z } from 'zod';\nimport { formatZodIssuesAsSingleLine } from './_zod-issue-formatting';\nimport {\n  ModuleManifestSchema,\n  ModuleVersionRecordSchema,\n  RegistryArtifactIntegrityMismatchError,\n  RegistryAuthForbiddenError,\n  RegistryAuthRequiredError,\n  RegistryError,\n  RegistryMalformedPayloadError,\n  RegistryModuleNotFoundError,\n  RegistryUnexpectedStatusError,\n  RegistryVersionNotFoundError,\n  Sha256DigestSchema,\n  type ModuleManifest,\n  type ModuleVersionRecord,\n} from '@wildo-ai/platform-config-lib';\nimport { fetchJsonOk, fetchWithTimeout, joinUrl } from './_http-client';\n\n/**\n * Zod schema for the `info()` response payload — mirrors\n * `RegistryInfoResult` and is enforced at the client boundary so a\n * server schema drift fails fast instead of returning malformed data\n * to downstream consumers.\n */\nconst RegistryInfoResponseSchema = z.object({\n  moduleId: z.string().min(1),\n  manifest: ModuleManifestSchema,\n  versions: z.array(ModuleVersionRecordSchema),\n  tags: z.record(z.string(), z.string()),\n});\n\nconst RegistrySearchResponseSchema = z.object({\n  hits: z.array(\n    z.object({\n      moduleId: z.string().min(1),\n      description: z.string().optional(),\n      latestVersion: z.string(),\n    }),\n  ),\n});\n\nconst DIAGNOSTIC_LABEL = 'Registry';\n\nexport interface RegistryServerClientOptions {\n  /** Registry origin (e.g. `https://registry.wildo.ai`). */\n  baseUrl: string;\n  /** Optional bearer / API-key. CLI credentials are per-machine (KD-11). */\n  authToken?: string;\n  /** Request timeout in ms. */\n  timeoutMs?: number;\n}\n\nfunction authHeaders(options: RegistryServerClientOptions): Record<string, string> {\n  return options.authToken ? { Authorization: `Bearer ${options.authToken}` } : {};\n}\n\nasync function classifyAuthError(res: Response, registryUrl: string, action: string): Promise<RegistryError | null> {\n  if (res.status === 401) return new RegistryAuthRequiredError(registryUrl);\n  if (res.status === 403) return new RegistryAuthForbiddenError(action);\n  return null;\n}\n\n/**\n * 6th-pass M3: typed JSON-parse helper. A misconfigured proxy that\n * returns HTML at 2xx (or a truncated stream) would otherwise throw a\n * bare `SyntaxError` from `await res.json()`, bypassing every\n * `isRegistryError(err)` handler. This helper translates the parse\n * failure into a `RegistryMalformedPayloadError` so the typed-error\n * contract is universal across the client surface.\n */\nasync function parseJsonOrThrow(\n  res: Response,\n  registryUrl: string,\n  action: string,\n): Promise<unknown> {\n  try {\n    return await res.json();\n  } catch (err) {\n    throw new RegistryMalformedPayloadError(\n      registryUrl,\n      action,\n      `response is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,\n    );\n  }\n}\n\nexport interface RegistryResolveResult {\n  /** Resolved exact version (matches `Sha256DigestSchema` for digest). */\n  version: string;\n  artifactDigest: string;\n}\n\nexport interface RegistryInfoResult {\n  moduleId: string;\n  manifest: ModuleManifest;\n  versions: readonly ModuleVersionRecord[];\n  /** dist-tag → version map (e.g. `latest → 1.2.3`). */\n  tags: Readonly<Record<string, string>>;\n}\n\nexport interface RegistrySearchHit {\n  moduleId: string;\n  description?: string;\n  latestVersion: string;\n}\n\nexport const RegistryServerClient = {\n  /**\n   * Liveness probe against `/health`. Returns boolean — used by\n   * `wildo registry ping` smoke. The registry server now relies on\n   * the framework's auto-mounted `HealthController` at the engine\n   * root (`GET /health` always 200; `GET /health/ready` enforces\n   * dependency readiness), so the path has NO `/v1` prefix.\n   */\n  async ping(options: RegistryServerClientOptions): Promise<boolean> {\n    try {\n      await fetchJsonOk(joinUrl(options.baseUrl, '/health'), {\n        method: 'GET',\n        timeoutMs: options.timeoutMs,\n        diagnosticLabel: DIAGNOSTIC_LABEL,\n      });\n      return true;\n    } catch {\n      return false;\n    }\n  },\n\n  /**\n   * Resolve a semver range / tag against a registry domain. The\n   * server returns the concrete version + artifact digest so the\n   * caller can verify the download against `artifactDigest`.\n   */\n  async resolve(\n    options: RegistryServerClientOptions,\n    args: { domain: string; moduleId: string; range: string },\n  ): Promise<RegistryResolveResult> {\n    const url = joinUrl(\n      options.baseUrl,\n      `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}/resolve?range=${encodeURIComponent(args.range)}`,\n    );\n    const res = await fetchWithTimeout(url, {\n      method: 'GET',\n      headers: authHeaders(options),\n      timeoutMs: options.timeoutMs,\n      diagnosticLabel: DIAGNOSTIC_LABEL,\n    });\n    if (res.status === 404) {\n      throw new RegistryVersionNotFoundError(args.moduleId, args.range);\n    }\n    const authErr = await classifyAuthError(res, options.baseUrl, `resolve ${args.moduleId}`);\n    if (authErr) throw authErr;\n    if (!res.ok) {\n      throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `resolve ${args.moduleId}`);\n    }\n    // 6th-pass M3: typed JSON-parse (was bare `SyntaxError` for\n    // malformed proxy responses).\n    const json = (await parseJsonOrThrow(res, options.baseUrl, `resolve ${args.moduleId}`)) as {\n      version?: unknown;\n      artifactDigest?: unknown;\n    };\n    const digest = String(json.artifactDigest ?? '');\n    // 6th-pass M4: typed digest validation (was bare `ZodError`).\n    const digestParse = Sha256DigestSchema.safeParse(digest);\n    if (!digestParse.success) {\n      throw new RegistryMalformedPayloadError(\n        options.baseUrl,\n        `resolve ${args.moduleId}`,\n        `artifactDigest is not a valid sha256:<64-hex> string: ${formatZodIssuesAsSingleLine(digestParse.error)}`,\n      );\n    }\n    if (typeof json.version !== 'string' || json.version.length === 0) {\n      // 3rd-pass M6: typed `RegistryMalformedPayloadError` instead of\n      // bare `Error` so callers' `isRegistryError(err)` handlers fire\n      // correctly.\n      throw new RegistryMalformedPayloadError(\n        options.baseUrl,\n        `resolve ${args.moduleId}`,\n        'response missing required `version` string',\n      );\n    }\n    return { version: json.version, artifactDigest: digest };\n  },\n\n  /**\n   * Fetch full info for a module: manifest, every published\n   * version, dist-tags. Used by `wildo registry info` (Phase 4).\n   */\n  async info(\n    options: RegistryServerClientOptions,\n    args: { domain: string; moduleId: string },\n  ): Promise<RegistryInfoResult> {\n    const url = joinUrl(\n      options.baseUrl,\n      `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}`,\n    );\n    const res = await fetchWithTimeout(url, {\n      method: 'GET',\n      headers: authHeaders(options),\n      timeoutMs: options.timeoutMs,\n      diagnosticLabel: DIAGNOSTIC_LABEL,\n    });\n    if (res.status === 404) throw new RegistryModuleNotFoundError(args.moduleId);\n    const authErr = await classifyAuthError(res, options.baseUrl, `info ${args.moduleId}`);\n    if (authErr) throw authErr;\n    if (!res.ok) {\n      throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `info ${args.moduleId}`);\n    }\n    // 6th-pass M3: typed JSON-parse.\n    const json = await parseJsonOrThrow(res, options.baseUrl, `info ${args.moduleId}`);\n    const parsed = RegistryInfoResponseSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new RegistryMalformedPayloadError(\n        options.baseUrl,\n        `info ${args.moduleId}`,\n        formatZodIssuesAsSingleLine(parsed.error),\n      );\n    }\n    return parsed.data;\n  },\n\n  /**\n   * Search the registry's metadata index. The shape is\n   * intentionally narrow until Phase 4 designs the search UX.\n   */\n  async search(\n    options: RegistryServerClientOptions,\n    args: { domain: string; query: string },\n  ): Promise<readonly RegistrySearchHit[]> {\n    const url = joinUrl(\n      options.baseUrl,\n      `/v1/registry/${encodeURIComponent(args.domain)}/modules?q=${encodeURIComponent(args.query)}`,\n    );\n    const res = await fetchWithTimeout(url, {\n      method: 'GET',\n      headers: authHeaders(options),\n      timeoutMs: options.timeoutMs,\n      diagnosticLabel: DIAGNOSTIC_LABEL,\n    });\n    const authErr = await classifyAuthError(res, options.baseUrl, `search`);\n    if (authErr) throw authErr;\n    if (!res.ok) {\n      throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, 'search');\n    }\n    // 6th-pass M3: typed JSON-parse.\n    const json = await parseJsonOrThrow(res, options.baseUrl, 'search');\n    const parsed = RegistrySearchResponseSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new RegistryMalformedPayloadError(\n        options.baseUrl,\n        'search',\n        formatZodIssuesAsSingleLine(parsed.error),\n      );\n    }\n    return parsed.data.hits;\n  },\n\n  /**\n   * Stream-download a published artifact's bytes and verify the\n   * sha256 integrity matches `expectedDigest`. Throws\n   * `RegistryArtifactIntegrityMismatchError` on mismatch — the\n   * digest check is non-negotiable per KD-9 / Security model.\n   */\n  async download(\n    options: RegistryServerClientOptions,\n    args: {\n      domain: string;\n      moduleId: string;\n      version: string;\n      expectedDigest: string;\n    },\n  ): Promise<{ bytes: Uint8Array; integrity: string }> {\n    // 7th-pass C-M1: caller-supplied digest is a developer-contract\n    // violation if malformed, not a registry-runtime condition.\n    // Throw `TypeError` (matching `C-L3` precedent for\n    // `getModuleStagingPaths` argument-shape violations) so the\n    // typed `RegistryError` vocabulary stays reserved for\n    // registry-runtime errors. Prior `Sha256DigestSchema.parse(...)`\n    // leaked a bare `ZodError` that bypassed\n    // `isRegistryError(err)` handlers but ALSO confused\n    // typed-handler maintainers about the contract.\n    const digestParse = Sha256DigestSchema.safeParse(args.expectedDigest);\n    if (!digestParse.success) {\n      throw new TypeError(\n        `download() expectedDigest must be a valid sha256:<64-hex> string (got: ${JSON.stringify(args.expectedDigest)}). ${formatZodIssuesAsSingleLine(digestParse.error)}`,\n      );\n    }\n    const url = joinUrl(\n      options.baseUrl,\n      `/v1/registry/${encodeURIComponent(args.domain)}/modules/${encodeURIComponent(args.moduleId)}/${encodeURIComponent(args.version)}/artifact`,\n    );\n    const res = await fetchWithTimeout(url, {\n      method: 'GET',\n      headers: authHeaders(options),\n      timeoutMs: options.timeoutMs,\n      diagnosticLabel: DIAGNOSTIC_LABEL,\n    });\n    if (res.status === 404) throw new RegistryVersionNotFoundError(args.moduleId, args.version);\n    const authErr = await classifyAuthError(res, options.baseUrl, `download ${args.moduleId}@${args.version}`);\n    if (authErr) throw authErr;\n    if (!res.ok) {\n      throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `download ${args.moduleId}@${args.version}`);\n    }\n    const buf = new Uint8Array(await res.arrayBuffer());\n    const { createHash } = await import('node:crypto');\n    const observed = `sha256:${createHash('sha256').update(buf).digest('hex')}`;\n    if (observed !== args.expectedDigest) {\n      throw new RegistryArtifactIntegrityMismatchError(\n        args.moduleId,\n        args.version,\n        args.expectedDigest,\n        observed,\n      );\n    }\n    return { bytes: buf, integrity: observed };\n  },\n} as const;\n"]}

package/dist/esm/services/types.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared structural types consumed across `wildo-module-client`
+ * services.
+ *
+ * The package intentionally avoids importing the CLI's full
+ * `CommandContext` (defined in `wildo-cli/src/kernel/types.ts`)
+ * to keep the dependency arrow CLI → wildo-module-client (KD-3
+ * forbids a reverse edge). Phase 2 services accept a structural
+ * subset of whatever the host (CLI / companion) needs to pass
+ * down — typically just `saasRoot` + a logger sink.
+ *
+ * The single shared type today is `RegistryClientLogger`. Adding
+ * more shared structural types here is fine; importing
+ * `wildo-cli` types is not.
+ */
+export interface RegistryClientLogger {
+    info: (msg: string) => void;
+    success?: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/esm/services/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/services/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B"}

package/dist/esm/services/types.js

@@ -0,0 +1,16 @@
+/**
+ * Shared structural types consumed across `wildo-module-client`
+ * services.
+ *
+ * The package intentionally avoids importing the CLI's full
+ * `CommandContext` (defined in `wildo-cli/src/kernel/types.ts`)
+ * to keep the dependency arrow CLI → wildo-module-client (KD-3
+ * forbids a reverse edge). Phase 2 services accept a structural
+ * subset of whatever the host (CLI / companion) needs to pass
+ * down — typically just `saasRoot` + a logger sink.
+ *
+ * The single shared type today is `RegistryClientLogger`. Adding
+ * more shared structural types here is fine; importing
+ * `wildo-cli` types is not.
+ */
+//# sourceMappingURL=types.js.map

package/dist/esm/services/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/services/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG","sourcesContent":["/**\n * Shared structural types consumed across `wildo-module-client`\n * services.\n *\n * The package intentionally avoids importing the CLI's full\n * `CommandContext` (defined in `wildo-cli/src/kernel/types.ts`)\n * to keep the dependency arrow CLI → wildo-module-client (KD-3\n * forbids a reverse edge). Phase 2 services accept a structural\n * subset of whatever the host (CLI / companion) needs to pass\n * down — typically just `saasRoot` + a logger sink.\n *\n * The single shared type today is `RegistryClientLogger`. Adding\n * more shared structural types here is fine; importing\n * `wildo-cli` types is not.\n */\n\nexport interface RegistryClientLogger {\n  info: (msg: string) => void;\n  success?: (msg: string) => void;\n  warn: (msg: string) => void;\n  error: (msg: string) => void;\n}\n"]}