@wildo-ai/wildo-module-client 1.1.5 → 1.1.6

package/dist/esm/services/provider-sync-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-sync-runner.js","sourceRoot":"","sources":["../../../../src/services/provider-sync-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,wCAAwC,EACxC,+CAA+C,EAC/C,+BAA+B,GAChC,MAAM,+BAA+B,CAAC;AAGvC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAmDnC;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAChD,wCAAwC,CACpB,CAAC;AAEvB,MAAM,6BAA6B,GAAG,+CAA+C,CAAC;AAEtF;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,4EAA4E;IAC5E,SAAS;IACT,IACE,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7F,CAAC;QACD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,iEAAiE;IACjE,iEAAiE;IACjE,gEAAgE;IAChE,kCAAkC;IAClC,IACE,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9E,CAAC;QACD,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,+DAA+D;IAC/D,mDAAmD;IACnD,IACE,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EACpE,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IAC3D,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,0CAA0C;QAC1C,6DAA6D;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,kBAAkB,CACzB,OAAe,EACf,GAAW,EACX,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE;YACrE,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAqC,CAAC;QAC1C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,8DAA8D;YAC9D,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,yDAAyD;YACzD,4DAA4D;YAC5D,qBAAqB;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,IAAI,6BAA6B,SAAS,6BAA6B,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,4DAA4D;YAC5D,4DAA4D;YAC5D,wDAAwD;YACxD,wCAAwC;YACxC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBACzD,MAAM,IAAI,mCAAmC,gBAAgB,sCAAsC,CAAC;oBACpG,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,sCAAsC;oBACxC,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,CAAC,OAAO,EAAE;gBACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA8B;IAE9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,OAAO,EAAE,IAAa;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,yBAAyB,EAAE,4BAA4B;QACvD,0BAA0B,EAAE,6BAA6B;QACzD,uBAAuB,EAAE,0BAA0B;KACpD,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,EAAE,IAAI,EAAE,CACT,mBAAmB,KAAK,CAAC,MAAM,wCAAwC;YACvE,4CAA4C,KAAK,CAAC,QAAQ,GAAG,CAC9D,CAAC;QACF,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,GAAG,EAAE,IAAI,EAAE,CACT,mBAAmB,KAAK,CAAC,MAAM,2BAA2B;QAC1D,GAAG,OAAO,qCAAqC,KAAK,CAAC,QAAQ,aAAa,SAAS,KAAK,CACzF,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CACzE,OAAO,EACP,KAAK,CAAC,QAAQ,EACd,SAAS,CACV,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE,CAAC,yCAAyC,UAAU,KAAK,CAAC,CAAC;QACzE,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACpE,CAAC;IAED,kEAAkE;IAClE,yDAAyD;IACzD,gEAAgE;IAChE,8DAA8D;IAC9D,iEAAiE;IACjE,+DAA+D;IAC/D,8CAA8C;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7E,GAAG,EAAE,KAAK,EAAE,CACV,oCAAoC,WAAW,UAAU,QAAQ,KAAK,UAAU,MAAM,CACvF,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,KAAK,SAAS;QAC7C,CAAC,CAAC,uBAAuB,SAAS,yDAAyD;YACzF,2FAA2F;QAC7F,CAAC,CAAC,8DAA8D,CAAC;IACnE,MAAM,IAAI,+BAA+B,CACvC,QAAQ,KAAK,CAAC,MAAM,0BAA0B,WAAW,MAAM,aAAa,EAAE,EAC9E,WAAW,EACX,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CACpB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * `runProviderSync` — Phase 2 real shell-out to\n * `wildo config sync --domain config`.\n *\n * Module-registry install/update/remove/adopt flows mutate app\n * source. When that source changes provider implementations,\n * provider companion exports, or provider scopes, the\n * provider-runtime delivery layer must regenerate its outputs\n * (KD-18). The canonical command is owned by the provider\n * workstream — module-registry MUST delegate, not fork.\n *\n * Phase 0.5 / 1 shipped a no-op `runProviderMaterializationHook`\n * that recorded intent. Phase 2 replaces it with a real\n * `child_process.spawn`-based runner that:\n *   - resolves the `wildo` CLI binary from the saas root's\n *     `node_modules/.bin/wildo` (the workspace's own version);\n *   - shells `wildo config sync --domain config` in the saas root;\n *   - times out at the operator-configurable budget;\n *   - classifies stderr-tail patterns into the\n *     `RegistryProviderSyncFailedError.failureKind` discriminator\n *     (`companion-discovery` / `runtime-import-reachability` /\n *     `invalid-scope` / `unknown`) so callers report repairable\n *     failures with first-class UX rather than generic install\n *     noise (`module-registry-analysis.md` / Provider Migration\n *     WIP Seams §1).\n *\n * Hard contract (KD-18): the runner NEVER writes provider runtime\n * artifacts itself. It only invokes the provider workstream's\n * canonical command. Tests assert no provider artifact is touched\n * by this code path.\n */\n\nimport { spawn } from 'node:child_process';\nimport { promises as fs } from 'node:fs';\nimport * as path from 'node:path';\nimport {\n  PROVIDER_LOCK_SECTION_PATH,\n  PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS,\n  PROVIDER_RUNTIME_GENERATED_MODULE_RELATIVE_PATH,\n  RegistryProviderSyncFailedError,\n} from '@wildo-ai/platform-config-lib';\nimport type { RegistryClientLogger } from './types';\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\nexport interface ProviderSyncRunnerInput {\n  /** Absolute path to the SaaS application root. */\n  saasRoot: string;\n  /** Reason for the call — drives diagnostic copy. */\n  reason: 'install' | 'update' | 'remove' | 'adopt' | 'smoke';\n  /** Optional logger. Defaults to no-op. */\n  log?: RegistryClientLogger;\n  /**\n   * Override the wildo CLI binary path. Defaults to\n   * `<saasRoot>/node_modules/.bin/wildo`. Phase 2 tests override\n   * this to point at a stub script.\n   */\n  wildoBinPath?: string;\n  /**\n   * Maximum wall-time before SIGTERM. Default 120s — provider sync\n   * can be heavy on first run (artifact generation + cleanup),\n   * but every additional second is operator-visible.\n   */\n  timeoutMs?: number;\n  /**\n   * If true, do NOT actually shell out — log the intent and\n   * resolve as `mode: 'dry-run'`. Used by the Phase 0.5 smoke\n   * command which intentionally cannot rely on a working\n   * `wildo` binary in the smoke sandbox.\n   */\n  dryRun?: boolean;\n}\n\nexport interface ProviderSyncRunnerResult {\n  invoked: true;\n  /**\n   * `'shell-out'` when the runner spawned `wildo config sync`.\n   * `'dry-run'` when `dryRun: true` was passed (smoke flow).\n   */\n  mode: 'shell-out' | 'dry-run';\n  /** Exit code reported by the wildo binary (0 on success). */\n  exitCode: number | null;\n  /** Wall-clock duration (ms). */\n  durationMs: number;\n  /** Reason that was passed in. */\n  reason: ProviderSyncRunnerInput['reason'];\n  /** Provider-output paths the canonical sync would refresh. */\n  providerJsonRelativePaths: readonly string[];\n  /** Source module the Node-runtime consumes. */\n  providerSourceRelativePath: string;\n  /** Provider lock section the materializer owns end-to-end. */\n  providerLockSectionPath: typeof PROVIDER_LOCK_SECTION_PATH;\n}\n\n/**\n * Provider artifact paths sourced from the canonical\n * `PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS` constant in\n * `platform-config-lib`. Refactored on 2026-05-06 to import the\n * single source of truth instead of duplicating the literal paths\n * here — the artifacts moved from `.wildo-saas/providers/` to\n * `.wildo-saas/generated/providers/` and any duplication would\n * silently drift.\n */\nconst PROVIDER_JSON_RELATIVE_PATHS = Object.values(\n  PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS,\n) as readonly string[];\n\nconst PROVIDER_SOURCE_RELATIVE_PATH = PROVIDER_RUNTIME_GENERATED_MODULE_RELATIVE_PATH;\n\n/**\n * Classify a `wildo config sync` failure based on its stderr tail.\n * The matchers mirror the failure modes the provider workstream\n * surfaces today; new modes get a new branch + a new\n * discriminator value (out of `RegistryProviderSyncFailedError`).\n */\nfunction classifyStderr(\n  stderr: string,\n): 'companion-discovery' | 'runtime-import-reachability' | 'invalid-scope' | 'unknown' {\n  const tail = stderr.slice(-2000);\n  // Companion-export discovery failure — the provider sync walks\n  // each owner package's `./companion` export to discover provider\n  // contributions. A package whose export contract is broken\n  // surfaces a \"companion export\" / \"DiscoveredProviderCompanionContribution\"\n  // error.\n  if (\n    /companion[- ]export|DiscoveredProviderCompanionContribution|companion-discovery/i.test(tail)\n  ) {\n    return 'companion-discovery';\n  }\n  // Runtime-import reachability — the materializer can't resolve a\n  // contributed `runtimeImport` against the owning runtime package\n  // graph. Typical messages mention `runtimeImport`, `Cannot find\n  // module`, or `MODULE_NOT_FOUND`.\n  if (\n    /runtimeImport|MODULE_NOT_FOUND|Cannot find module|cannot resolve/i.test(tail)\n  ) {\n    return 'runtime-import-reachability';\n  }\n  // Scope validation — `defineSaaSProviders({ scopes })` rejects\n  // malformed scope inputs ahead of materialization.\n  if (\n    /defineSaaSProviders|invalid[- ]scope|providers\\.scopes/i.test(tail)\n  ) {\n    return 'invalid-scope';\n  }\n  return 'unknown';\n}\n\nasync function resolveWildoBin(input: ProviderSyncRunnerInput): Promise<string> {\n  if (input.wildoBinPath) return input.wildoBinPath;\n  const candidate = path.join(input.saasRoot, 'node_modules', '.bin', 'wildo');\n  try {\n    await fs.access(candidate);\n    return candidate;\n  } catch {\n    // Fall back to PATH-resolved `wildo`. spawn will raise ENOENT\n    // if it's not on PATH either, surfaced as\n    // `RegistryProviderSyncFailedError(failureKind: 'unknown')`.\n    return 'wildo';\n  }\n}\n\n/**\n * Grace window between SIGTERM and SIGKILL. A well-behaved\n * `wildo config sync` should react to SIGTERM in well under a\n * second — the grace exists for tools that need to flush a buffer\n * or release a file lock. After the window we escalate to SIGKILL\n * so a hung child cannot pin the parent forever.\n */\nconst SIGKILL_GRACE_MS = 5_000;\n\nfunction runWildoConfigSync(\n  binPath: string,\n  cwd: string,\n  timeoutMs: number,\n): Promise<{ exitCode: number | null; stderr: string; durationMs: number; signaled: boolean }> {\n  return new Promise((resolve) => {\n    const startedAt = Date.now();\n    const child = spawn(binPath, ['config', 'sync', '--domain', 'config'], {\n      cwd,\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    let stderr = '';\n    let signaled = false;\n    let killTimer: NodeJS.Timeout | undefined;\n    child.stderr?.on('data', (b: Buffer) => {\n      // Cap captured stderr so a runaway sync can't OOM the parent.\n      stderr += b.toString();\n      if (stderr.length > 16_384) stderr = stderr.slice(-16_384);\n    });\n    const termTimer = setTimeout(() => {\n      // Soft-kill first; record so the caller can synthesize a\n      // diagnostic message that distinguishes a TERM-induced exit\n      // from a normal one.\n      signaled = true;\n      stderr += `\\n[provider-sync] timeout ${timeoutMs}ms exceeded — sent SIGTERM.`;\n      child.kill('SIGTERM');\n      // Escalate to SIGKILL if the child doesn't react within the\n      // grace window. Without this a child stuck in a syscall (or\n      // deliberately ignoring SIGTERM) would leave the parent\n      // blocked on the spawn promise forever.\n      killTimer = setTimeout(() => {\n        if (child.exitCode === null && child.signalCode === null) {\n          stderr += `\\n[provider-sync] SIGTERM grace ${SIGKILL_GRACE_MS}ms exceeded — escalating to SIGKILL.`;\n          try {\n            child.kill('SIGKILL');\n          } catch {\n            /* swallow — best-effort escalation */\n          }\n        }\n      }, SIGKILL_GRACE_MS);\n    }, timeoutMs);\n    child.on('exit', (code) => {\n      clearTimeout(termTimer);\n      if (killTimer) clearTimeout(killTimer);\n      resolve({\n        exitCode: code,\n        stderr,\n        durationMs: Date.now() - startedAt,\n        signaled,\n      });\n    });\n    child.on('error', (err) => {\n      clearTimeout(termTimer);\n      if (killTimer) clearTimeout(killTimer);\n      resolve({\n        exitCode: null,\n        stderr: stderr + `\\n[spawn error] ${err.message}`,\n        durationMs: Date.now() - startedAt,\n        signaled,\n      });\n    });\n  });\n}\n\n/**\n * Run the canonical provider-sync command. Throws\n * `RegistryProviderSyncFailedError` (with classified `failureKind`)\n * when the spawned process exits non-zero or fails to start.\n */\nexport async function runProviderSync(\n  input: ProviderSyncRunnerInput,\n): Promise<ProviderSyncRunnerResult> {\n  const log = input.log;\n  const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const baseResult = {\n    invoked: true as const,\n    reason: input.reason,\n    providerJsonRelativePaths: PROVIDER_JSON_RELATIVE_PATHS,\n    providerSourceRelativePath: PROVIDER_SOURCE_RELATIVE_PATH,\n    providerLockSectionPath: PROVIDER_LOCK_SECTION_PATH,\n  };\n\n  if (input.dryRun) {\n    log?.info?.(\n      `[registry] post-${input.reason} provider sync (dry-run): would shell ` +\n      `\\`wildo config sync --domain config\\` in ${input.saasRoot}.`,\n    );\n    return { ...baseResult, mode: 'dry-run', exitCode: 0, durationMs: 0 };\n  }\n\n  const binPath = await resolveWildoBin(input);\n  log?.info?.(\n    `[registry] post-${input.reason} provider sync: spawning ` +\n    `${binPath} config sync --domain config (cwd=${input.saasRoot}, timeout=${timeoutMs}ms)`,\n  );\n  const { exitCode, stderr, durationMs, signaled } = await runWildoConfigSync(\n    binPath,\n    input.saasRoot,\n    timeoutMs,\n  );\n\n  if (exitCode === 0) {\n    log?.success?.(`[registry] provider sync succeeded in ${durationMs}ms.`);\n    return { ...baseResult, mode: 'shell-out', exitCode, durationMs };\n  }\n\n  // H5: distinguish a timeout-signaled exit from a generic non-zero\n  // exit. `classifyStderr` runs regex against the appended\n  // `[provider-sync] timeout ... SIGTERM/SIGKILL` lines but those\n  // tails match no failure-mode regex — so prior to this branch\n  // operators saw `failureKind: 'unknown'` for a hard timeout. The\n  // typed error now carries the discriminator + a hint to either\n  // raise the timeout or investigate the wedge.\n  const failureKind = signaled ? ('timeout' as const) : classifyStderr(stderr);\n  log?.error?.(\n    `[registry] provider sync failed (${failureKind}, exit=${exitCode}, ${durationMs}ms).`,\n  );\n  const messageSuffix = failureKind === 'timeout'\n    ? `Wall-clock exceeded ${timeoutMs}ms; child was sent SIGTERM (then SIGKILL after grace). ` +\n      'Either raise `timeoutMs` for legitimately heavy syncs or investigate why the sync wedged.'\n    : 'Run `wildo config sync --domain config` manually to inspect.';\n  throw new RegistryProviderSyncFailedError(\n    `Post-${input.reason} provider sync failed (${failureKind}). ${messageSuffix}`,\n    failureKind,\n    stderr.slice(-1024),\n  );\n}\n"]}
+{"version":3,"file":"provider-sync-runner.js","sourceRoot":"","sources":["../../../../src/services/provider-sync-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,wCAAwC,EACxC,+CAA+C,EAC/C,+BAA+B,GAChC,MAAM,+BAA+B,CAAC;AAGvC;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAkDnC;;;;;;;;GAQG;AACH,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAChD,wCAAwC,CACpB,CAAC;AAEvB,MAAM,6BAA6B,GAAG,+CAA+C,CAAC;AAEtF;;;;;GAKG;AACH,SAAS,cAAc,CACrB,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,+DAA+D;IAC/D,iEAAiE;IACjE,2DAA2D;IAC3D,4EAA4E;IAC5E,SAAS;IACT,IACE,kFAAkF,CAAC,IAAI,CAAC,IAAI,CAAC,EAC7F,CAAC;QACD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,iEAAiE;IACjE,iEAAiE;IACjE,gEAAgE;IAChE,kCAAkC;IAClC,IACE,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9E,CAAC;QACD,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,+DAA+D;IAC/D,mDAAmD;IACnD,IACE,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EACpE,CAAC;QACD,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA8B;IAC3D,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,0CAA0C;QAC1C,6DAA6D;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,kBAAkB,CACzB,OAAe,EACf,GAAW,EACX,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE;YACrE,GAAG;YACH,iGAAiG;YACjG,8FAA8F;YAC9F,iGAAiG;YACjG,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,SAAqC,CAAC;QAC1C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,8DAA8D;YAC9D,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,yDAAyD;YACzD,4DAA4D;YAC5D,qBAAqB;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,IAAI,6BAA6B,SAAS,6BAA6B,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,4DAA4D;YAC5D,4DAA4D;YAC5D,wDAAwD;YACxD,wCAAwC;YACxC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;oBACzD,MAAM,IAAI,mCAAmC,gBAAgB,sCAAsC,CAAC;oBACpG,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC;wBACP,sCAAsC;oBACxC,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACvB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,CAAC,OAAO,EAAE;gBACjD,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA8B;IAE9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,UAAU,GAAG;QACjB,OAAO,EAAE,IAAa;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,yBAAyB,EAAE,4BAA4B;QACvD,0BAA0B,EAAE,6BAA6B;QACzD,uBAAuB,EAAE,0BAA0B;KACpD,CAAC;IAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,EAAE,IAAI,EAAE,CACT,mBAAmB,KAAK,CAAC,MAAM,wCAAwC;YACvE,4CAA4C,KAAK,CAAC,QAAQ,GAAG,CAC9D,CAAC;QACF,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,GAAG,EAAE,IAAI,EAAE,CACT,mBAAmB,KAAK,CAAC,MAAM,2BAA2B;QAC1D,GAAG,OAAO,qCAAqC,KAAK,CAAC,QAAQ,aAAa,SAAS,KAAK,CACzF,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,kBAAkB,CACzE,OAAO,EACP,KAAK,CAAC,QAAQ,EACd,SAAS,CACV,CAAC;IAEF,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,GAAG,EAAE,OAAO,EAAE,CAAC,yCAAyC,UAAU,KAAK,CAAC,CAAC;QACzE,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACpE,CAAC;IAED,kEAAkE;IAClE,yDAAyD;IACzD,gEAAgE;IAChE,8DAA8D;IAC9D,iEAAiE;IACjE,+DAA+D;IAC/D,8CAA8C;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7E,GAAG,EAAE,KAAK,EAAE,CACV,oCAAoC,WAAW,UAAU,QAAQ,KAAK,UAAU,MAAM,CACvF,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,KAAK,SAAS;QAC7C,CAAC,CAAC,uBAAuB,SAAS,yDAAyD;YACzF,2FAA2F;QAC7F,CAAC,CAAC,8DAA8D,CAAC;IACnE,MAAM,IAAI,+BAA+B,CACvC,QAAQ,KAAK,CAAC,MAAM,0BAA0B,WAAW,MAAM,aAAa,EAAE,EAC9E,WAAW,EACX,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CACpB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * `runProviderSync` — Phase 2 real shell-out to\n * `wildo config sync --domain config`.\n *\n * Module-registry install/update/remove/adopt flows mutate app\n * source. When that source changes provider implementations,\n * provider companion exports, or provider scopes, the\n * provider-runtime delivery layer must regenerate its outputs\n * (KD-18). The canonical command is owned by the provider\n * workstream — module-registry MUST delegate, not fork.\n *\n * Phase 0.5 / 1 shipped a no-op `runProviderMaterializationHook`\n * that recorded intent. Phase 2 replaces it with a real\n * `child_process.spawn`-based runner that:\n *   - resolves the `wildo` CLI binary from the saas root's\n *     `node_modules/.bin/wildo` (the workspace's own version);\n *   - shells `wildo config sync --domain config` in the saas root;\n *   - times out at the operator-configurable budget;\n *   - classifies stderr-tail patterns into the\n *     `RegistryProviderSyncFailedError.failureKind` discriminator\n *     (`companion-discovery` / `runtime-import-reachability` /\n *     `invalid-scope` / `unknown`) so callers report repairable\n *     failures with first-class UX rather than generic install\n *     noise (`module-registry-analysis.md` / Provider Migration\n *     WIP Seams §1).\n *\n * Hard contract (KD-18): the runner NEVER writes provider runtime\n * artifacts itself. It only invokes the provider workstream's\n * canonical command. Tests assert no provider artifact is touched\n * by this code path.\n */\n\nimport { spawn } from 'node:child_process';\nimport { promises as fs } from 'node:fs';\nimport * as path from 'node:path';\nimport {\n  PROVIDER_LOCK_SECTION_PATH,\n  PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS,\n  PROVIDER_RUNTIME_GENERATED_MODULE_RELATIVE_PATH,\n  RegistryProviderSyncFailedError,\n} from '@wildo-ai/platform-config-lib';\nimport type { RegistryClientLogger } from './types';\n\n/**\n * How long the post-mutation `wildo config sync` may run before it is treated as wedged and killed.\n *\n * Five minutes, not two: the budget exists to stop a WEDGED sync, and a wall clock cannot tell wedged\n * from slow. Measured 2026-09-27 on a scaffolded application (#1765): the same sync took 14.6 s on a\n * quiet machine, 91 s while the framework's watchers were recompiling, and exceeded the old 120 s during\n * an install under that load — so a healthy sync was killed part-way and the install reported a provider\n * sync failure it did not have. The kill stays: a genuinely stuck sync still ends, five minutes on.\n */\nconst DEFAULT_TIMEOUT_MS = 300_000;\n\nexport interface ProviderSyncRunnerInput {\n  /** Absolute path to the SaaS application root. */\n  saasRoot: string;\n  /** Reason for the call — drives diagnostic copy. */\n  reason: 'install' | 'update' | 'remove' | 'adopt' | 'smoke';\n  /** Optional logger. Defaults to no-op. */\n  log?: RegistryClientLogger;\n  /**\n   * Override the wildo CLI binary path. Defaults to\n   * `<saasRoot>/node_modules/.bin/wildo`. Phase 2 tests override\n   * this to point at a stub script.\n   */\n  wildoBinPath?: string;\n  /**\n   * Maximum wall-time before SIGTERM. Default {@link DEFAULT_TIMEOUT_MS} (five minutes): it only ever\n   * elapses on a wedged sync, and a healthy one under load has been measured past two minutes.\n   */\n  timeoutMs?: number;\n  /**\n   * If true, do NOT actually shell out — log the intent and\n   * resolve as `mode: 'dry-run'`. Used by the Phase 0.5 smoke\n   * command which intentionally cannot rely on a working\n   * `wildo` binary in the smoke sandbox.\n   */\n  dryRun?: boolean;\n}\n\nexport interface ProviderSyncRunnerResult {\n  invoked: true;\n  /**\n   * `'shell-out'` when the runner spawned `wildo config sync`.\n   * `'dry-run'` when `dryRun: true` was passed (smoke flow).\n   */\n  mode: 'shell-out' | 'dry-run';\n  /** Exit code reported by the wildo binary (0 on success). */\n  exitCode: number | null;\n  /** Wall-clock duration (ms). */\n  durationMs: number;\n  /** Reason that was passed in. */\n  reason: ProviderSyncRunnerInput['reason'];\n  /** Provider-output paths the canonical sync would refresh. */\n  providerJsonRelativePaths: readonly string[];\n  /** Source module the Node-runtime consumes. */\n  providerSourceRelativePath: string;\n  /** Provider lock section the materializer owns end-to-end. */\n  providerLockSectionPath: typeof PROVIDER_LOCK_SECTION_PATH;\n}\n\n/**\n * Provider artifact paths sourced from the canonical\n * `PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS` constant in\n * `platform-config-lib`. Refactored on 2026-05-06 to import the\n * single source of truth instead of duplicating the literal paths\n * here — the artifacts moved from `.wildo-saas/providers/` to\n * `.wildo-saas/generated/providers/` and any duplication would\n * silently drift.\n */\nconst PROVIDER_JSON_RELATIVE_PATHS = Object.values(\n  PROVIDER_RUNTIME_ARTIFACT_RELATIVE_PATHS,\n) as readonly string[];\n\nconst PROVIDER_SOURCE_RELATIVE_PATH = PROVIDER_RUNTIME_GENERATED_MODULE_RELATIVE_PATH;\n\n/**\n * Classify a `wildo config sync` failure based on its stderr tail.\n * The matchers mirror the failure modes the provider workstream\n * surfaces today; new modes get a new branch + a new\n * discriminator value (out of `RegistryProviderSyncFailedError`).\n */\nfunction classifyStderr(\n  stderr: string,\n): 'companion-discovery' | 'runtime-import-reachability' | 'invalid-scope' | 'unknown' {\n  const tail = stderr.slice(-2000);\n  // Companion-export discovery failure — the provider sync walks\n  // each owner package's `./companion` export to discover provider\n  // contributions. A package whose export contract is broken\n  // surfaces a \"companion export\" / \"DiscoveredProviderCompanionContribution\"\n  // error.\n  if (\n    /companion[- ]export|DiscoveredProviderCompanionContribution|companion-discovery/i.test(tail)\n  ) {\n    return 'companion-discovery';\n  }\n  // Runtime-import reachability — the materializer can't resolve a\n  // contributed `runtimeImport` against the owning runtime package\n  // graph. Typical messages mention `runtimeImport`, `Cannot find\n  // module`, or `MODULE_NOT_FOUND`.\n  if (\n    /runtimeImport|MODULE_NOT_FOUND|Cannot find module|cannot resolve/i.test(tail)\n  ) {\n    return 'runtime-import-reachability';\n  }\n  // Scope validation — `defineSaaSProviders({ scopes })` rejects\n  // malformed scope inputs ahead of materialization.\n  if (\n    /defineSaaSProviders|invalid[- ]scope|providers\\.scopes/i.test(tail)\n  ) {\n    return 'invalid-scope';\n  }\n  return 'unknown';\n}\n\nasync function resolveWildoBin(input: ProviderSyncRunnerInput): Promise<string> {\n  if (input.wildoBinPath) return input.wildoBinPath;\n  const candidate = path.join(input.saasRoot, 'node_modules', '.bin', 'wildo');\n  try {\n    await fs.access(candidate);\n    return candidate;\n  } catch {\n    // Fall back to PATH-resolved `wildo`. spawn will raise ENOENT\n    // if it's not on PATH either, surfaced as\n    // `RegistryProviderSyncFailedError(failureKind: 'unknown')`.\n    return 'wildo';\n  }\n}\n\n/**\n * Grace window between SIGTERM and SIGKILL. A well-behaved\n * `wildo config sync` should react to SIGTERM in well under a\n * second — the grace exists for tools that need to flush a buffer\n * or release a file lock. After the window we escalate to SIGKILL\n * so a hung child cannot pin the parent forever.\n */\nconst SIGKILL_GRACE_MS = 5_000;\n\nfunction runWildoConfigSync(\n  binPath: string,\n  cwd: string,\n  timeoutMs: number,\n): Promise<{ exitCode: number | null; stderr: string; durationMs: number; signaled: boolean }> {\n  return new Promise((resolve) => {\n    const startedAt = Date.now();\n    const child = spawn(binPath, ['config', 'sync', '--domain', 'config'], {\n      cwd,\n      // stdout is IGNORED, not piped: nothing here reads it, and an unread pipe fills at the OS buffer\n      // (~64 KB) and blocks the child mid-write — a finished sync then looked like a wedged one and\n      // was killed at the timeout. stderr stays piped because the diagnostic reads it (bounded below).\n      stdio: ['ignore', 'ignore', 'pipe'],\n    });\n    let stderr = '';\n    let signaled = false;\n    let killTimer: NodeJS.Timeout | undefined;\n    child.stderr?.on('data', (b: Buffer) => {\n      // Cap captured stderr so a runaway sync can't OOM the parent.\n      stderr += b.toString();\n      if (stderr.length > 16_384) stderr = stderr.slice(-16_384);\n    });\n    const termTimer = setTimeout(() => {\n      // Soft-kill first; record so the caller can synthesize a\n      // diagnostic message that distinguishes a TERM-induced exit\n      // from a normal one.\n      signaled = true;\n      stderr += `\\n[provider-sync] timeout ${timeoutMs}ms exceeded — sent SIGTERM.`;\n      child.kill('SIGTERM');\n      // Escalate to SIGKILL if the child doesn't react within the\n      // grace window. Without this a child stuck in a syscall (or\n      // deliberately ignoring SIGTERM) would leave the parent\n      // blocked on the spawn promise forever.\n      killTimer = setTimeout(() => {\n        if (child.exitCode === null && child.signalCode === null) {\n          stderr += `\\n[provider-sync] SIGTERM grace ${SIGKILL_GRACE_MS}ms exceeded — escalating to SIGKILL.`;\n          try {\n            child.kill('SIGKILL');\n          } catch {\n            /* swallow — best-effort escalation */\n          }\n        }\n      }, SIGKILL_GRACE_MS);\n    }, timeoutMs);\n    child.on('exit', (code) => {\n      clearTimeout(termTimer);\n      if (killTimer) clearTimeout(killTimer);\n      resolve({\n        exitCode: code,\n        stderr,\n        durationMs: Date.now() - startedAt,\n        signaled,\n      });\n    });\n    child.on('error', (err) => {\n      clearTimeout(termTimer);\n      if (killTimer) clearTimeout(killTimer);\n      resolve({\n        exitCode: null,\n        stderr: stderr + `\\n[spawn error] ${err.message}`,\n        durationMs: Date.now() - startedAt,\n        signaled,\n      });\n    });\n  });\n}\n\n/**\n * Run the canonical provider-sync command. Throws\n * `RegistryProviderSyncFailedError` (with classified `failureKind`)\n * when the spawned process exits non-zero or fails to start.\n */\nexport async function runProviderSync(\n  input: ProviderSyncRunnerInput,\n): Promise<ProviderSyncRunnerResult> {\n  const log = input.log;\n  const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n  const baseResult = {\n    invoked: true as const,\n    reason: input.reason,\n    providerJsonRelativePaths: PROVIDER_JSON_RELATIVE_PATHS,\n    providerSourceRelativePath: PROVIDER_SOURCE_RELATIVE_PATH,\n    providerLockSectionPath: PROVIDER_LOCK_SECTION_PATH,\n  };\n\n  if (input.dryRun) {\n    log?.info?.(\n      `[registry] post-${input.reason} provider sync (dry-run): would shell ` +\n      `\\`wildo config sync --domain config\\` in ${input.saasRoot}.`,\n    );\n    return { ...baseResult, mode: 'dry-run', exitCode: 0, durationMs: 0 };\n  }\n\n  const binPath = await resolveWildoBin(input);\n  log?.info?.(\n    `[registry] post-${input.reason} provider sync: spawning ` +\n    `${binPath} config sync --domain config (cwd=${input.saasRoot}, timeout=${timeoutMs}ms)`,\n  );\n  const { exitCode, stderr, durationMs, signaled } = await runWildoConfigSync(\n    binPath,\n    input.saasRoot,\n    timeoutMs,\n  );\n\n  if (exitCode === 0) {\n    log?.success?.(`[registry] provider sync succeeded in ${durationMs}ms.`);\n    return { ...baseResult, mode: 'shell-out', exitCode, durationMs };\n  }\n\n  // H5: distinguish a timeout-signaled exit from a generic non-zero\n  // exit. `classifyStderr` runs regex against the appended\n  // `[provider-sync] timeout ... SIGTERM/SIGKILL` lines but those\n  // tails match no failure-mode regex — so prior to this branch\n  // operators saw `failureKind: 'unknown'` for a hard timeout. The\n  // typed error now carries the discriminator + a hint to either\n  // raise the timeout or investigate the wedge.\n  const failureKind = signaled ? ('timeout' as const) : classifyStderr(stderr);\n  log?.error?.(\n    `[registry] provider sync failed (${failureKind}, exit=${exitCode}, ${durationMs}ms).`,\n  );\n  const messageSuffix = failureKind === 'timeout'\n    ? `Wall-clock exceeded ${timeoutMs}ms; child was sent SIGTERM (then SIGKILL after grace). ` +\n      'Either raise `timeoutMs` for legitimately heavy syncs or investigate why the sync wedged.'\n    : 'Run `wildo config sync --domain config` manually to inspect.';\n  throw new RegistryProviderSyncFailedError(\n    `Post-${input.reason} provider sync failed (${failureKind}). ${messageSuffix}`,\n    failureKind,\n    stderr.slice(-1024),\n  );\n}\n"]}

package/dist/esm/services/registry-companion-client.d.ts

@@ -1,61 +1,24 @@
 /**
- * `RegistryCompanionClient` — HTTP client for the local dev
- * companion's registry routes.
+ * `RegistryCompanionClient` — liveness probe for the local dev companion, used by
+ * `wildo registry ping` beside the registry-server probe.
  *
- * Distinct from `RegistryServerClient` (which talks to the central
- * `platform-module-registry` server). The companion client targets
- * `/api/companion/registry/*` on `http://localhost:<companion-port>`
- * for AST/source mutations the CLI delegates to the companion
- * (KD-6).
- *
- * Phase 2 ships the four mutation routes as method calls; the
- * companion controller (under
- * `platform/factory/wildo-dev-companion/src/companion-api/controllers/`)
- * implements them with the actual ts-morph + filesystem work in
- * Phase 5+.
- *
- * The four mutations are GATED: the companion refuses any non-`GET` route that does not present the
- * machine-local token, so they take `RegistryCompanionMutationOptions` and `ping` — a `GET` — does
- * not. See that type for why the credential is required rather than optional.
+ * That is all it is. It used to carry four mutation methods (install / update / remove / publish)
+ * against `/api/companion/registry/*` routes that only ever answered a "Phase 5/6 deliverable"
+ * not-implemented envelope and had no caller. Installation shipped CLI-direct instead
+ * (`wildo registry add` / `update` / `remove` / `publish` do the work themselves), so the routes,
+ * these methods and their wire schemas were deleted on 2026-09-25 rather than left describing a
+ * design that was never built. A future companion-owned mutation lane starts from the CLI commands,
+ * not from this file.
  */
-import { type RegistryInstallRequest, type RegistryPublishRequest, type RegistryRemoveRequest, type RegistryRouteResult, type RegistryUpdateRequest } from '@wildo-ai/platform-config-lib';
 export interface RegistryCompanionClientOptions {
     baseUrl: string;
     timeoutMs?: number;
 }
-/**
- * What a MUTATING companion registry call needs, over and above an address.
- *
- * `companionToken` is REQUIRED, and that is the whole point of this second type. Every non-`GET`
- * route under `/api/companion/**` is refused without it, and the four methods below have no caller
- * yet (the routes answer a not-implemented envelope until Phase 5) — so making it required now costs
- * nothing and means the caller Phase 5 writes cannot be written without the credential. An optional
- * field would have been a rule to remember; a required one is a compile error.
- *
- * The value is the content of `<appRoot>/.wildo-saas/state/companion.token` (mode 0600), which the
- * companion mints on every boot. This package has no notion of an application root, so reading it is
- * deliberately the caller's job: `wildo-cli` already owns a hardened no-follow reader
- * (`readCompanionTokenNoFollow`), and a second copy of a permission-checked read is precisely where
- * the checks quietly diverge.
- */
-export interface RegistryCompanionMutationOptions extends RegistryCompanionClientOptions {
-    companionToken: string;
-}
 export declare const RegistryCompanionClient: {
     /**
      * Liveness probe against `/health` (the same endpoint the
      * dev-supervisor monitors). Used by `wildo registry ping`.
      */
-    readonly ping: (options: RegistryCompanionClientOptions) => Promise<boolean>;
-    /**
-     * Ask the companion to install a module: download bytes, copy
-     * source, mutate `wildo.saas.config.ts > moduleRegistries` +
-     * the three `modules-registry.*.ts` files, refresh
-     * `sections.modules`, run provider sync.
-     */
-    readonly install: (options: RegistryCompanionMutationOptions, request: RegistryInstallRequest) => Promise<RegistryRouteResult>;
-    readonly update: (options: RegistryCompanionMutationOptions, request: RegistryUpdateRequest) => Promise<RegistryRouteResult>;
-    readonly remove: (options: RegistryCompanionMutationOptions, request: RegistryRemoveRequest) => Promise<RegistryRouteResult>;
-    readonly publish: (options: RegistryCompanionMutationOptions, request: RegistryPublishRequest) => Promise<RegistryRouteResult>;
+    ping(options: RegistryCompanionClientOptions): Promise<boolean>;
 };
 //# sourceMappingURL=registry-companion-client.d.ts.map

package/dist/esm/services/registry-companion-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-companion-client.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-companion-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAKL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAiBvC,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gCAAiC,SAAQ,8BAA8B;IACtF,cAAc,EAAE,MAAM,CAAC;CACxB;AA2CD,eAAO,MAAM,uBAAuB;IAClC;;;OAGG;6BACiB,8BAA8B,KAAG,OAAO,CAAC,OAAO,CAAC;IAcrE;;;;;OAKG;gCAEQ,gCAAgC,WAChC,sBAAsB,KAC9B,OAAO,CAAC,mBAAmB,CAAC;+BAMpB,gCAAgC,WAChC,qBAAqB,KAC7B,OAAO,CAAC,mBAAmB,CAAC;+BAMpB,gCAAgC,WAChC,qBAAqB,KAC7B,OAAO,CAAC,mBAAmB,CAAC;gCAMpB,gCAAgC,WAChC,sBAAsB,KAC9B,OAAO,CAAC,mBAAmB,CAAC;CAIvB,CAAC"}
+{"version":3,"file":"registry-companion-client.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-companion-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,uBAAuB;IAClC;;;OAGG;kBACiB,8BAA8B,GAAG,OAAO,CAAC,OAAO,CAAC;CAatE,CAAC"}

package/dist/esm/services/registry-companion-client.js

@@ -1,65 +1,17 @@
 /**
- * `RegistryCompanionClient` — HTTP client for the local dev
- * companion's registry routes.
+ * `RegistryCompanionClient` — liveness probe for the local dev companion, used by
+ * `wildo registry ping` beside the registry-server probe.
  *
- * Distinct from `RegistryServerClient` (which talks to the central
- * `platform-module-registry` server). The companion client targets
- * `/api/companion/registry/*` on `http://localhost:<companion-port>`
- * for AST/source mutations the CLI delegates to the companion
- * (KD-6).
- *
- * Phase 2 ships the four mutation routes as method calls; the
- * companion controller (under
- * `platform/factory/wildo-dev-companion/src/companion-api/controllers/`)
- * implements them with the actual ts-morph + filesystem work in
- * Phase 5+.
- *
- * The four mutations are GATED: the companion refuses any non-`GET` route that does not present the
- * machine-local token, so they take `RegistryCompanionMutationOptions` and `ping` — a `GET` — does
- * not. See that type for why the credential is required rather than optional.
+ * That is all it is. It used to carry four mutation methods (install / update / remove / publish)
+ * against `/api/companion/registry/*` routes that only ever answered a "Phase 5/6 deliverable"
+ * not-implemented envelope and had no caller. Installation shipped CLI-direct instead
+ * (`wildo registry add` / `update` / `remove` / `publish` do the work themselves), so the routes,
+ * these methods and their wire schemas were deleted on 2026-09-25 rather than left describing a
+ * design that was never built. A future companion-owned mutation lane starts from the CLI commands,
+ * not from this file.
  */
-import { REGISTRY_COMPANION_ROUTES, RegistryMalformedPayloadError, RegistryRouteResultSchema, RegistryUnexpectedStatusError, } from '@wildo-ai/platform-config-lib';
 import { fetchWithTimeout, joinUrl } from './_http-client.js';
-import { formatZodIssuesAsSingleLine } from './_zod-issue-formatting.js';
 const DIAGNOSTIC_LABEL = 'Companion registry';
-/**
- * The header the companion's P-29b token floor reads on a mutating route.
- *
- * A wire contract between two processes that share no package, so it is named at both ends rather
- * than at neither. Its server twin is `COMPANION_TOKEN_HEADER` in the companion's
- * `core/auth/companion-auth-floor.companion.service.ts`; the CLI's is in
- * `wildo-cli/src/services/companion/companion-local-token.utils.ts`. Move one, move all three.
- */
-// semantic-literal-boundary: private companion HTTP protocol, translated only at this client edge.
-const COMPANION_TOKEN_HEADER = 'x-wildo-companion-token';
-async function postJson(options, routePath, body) {
-    const url = joinUrl(options.baseUrl, routePath);
-    const res = await fetchWithTimeout(url, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', [COMPANION_TOKEN_HEADER]: options.companionToken },
-        body: JSON.stringify(body),
-        timeoutMs: options.timeoutMs,
-        diagnosticLabel: DIAGNOSTIC_LABEL,
-    });
-    if (!res.ok) {
-        // 3rd-pass M5: typed `RegistryUnexpectedStatusError` instead of
-        // bare `new Error(...)` so callers can `isRegistryError(err)` and
-        // discriminate by status code without re-parsing message text.
-        // The companion deliberately reuses the same error vocabulary
-        // as `RegistryServerClient` since the wire shape (status + URL +
-        // action) is identical even though the lane is different.
-        throw new RegistryUnexpectedStatusError(options.baseUrl, res.status, res.statusText, `companion ${routePath}`);
-    }
-    // 6th-pass M3: typed JSON-parse — a misconfigured proxy returning
-    // HTML at 2xx would otherwise throw a bare `SyntaxError` that
-    // bypasses the typed-error contract.
-    try {
-        return (await res.json());
-    }
-    catch (err) {
-        throw new RegistryMalformedPayloadError(options.baseUrl, `companion ${routePath}`, `response is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
 export const RegistryCompanionClient = {
     /**
      * Liveness probe against `/health` (the same endpoint the
@@ -79,45 +31,5 @@ export const RegistryCompanionClient = {
             return false;
         }
     },
-    /**
-     * Ask the companion to install a module: download bytes, copy
-     * source, mutate `wildo.saas.config.ts > moduleRegistries` +
-     * the three `modules-registry.*.ts` files, refresh
-     * `sections.modules`, run provider sync.
-     */
-    async install(options, request) {
-        const raw = await postJson(options, REGISTRY_COMPANION_ROUTES.install, request);
-        return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.install, raw);
-    },
-    async update(options, request) {
-        const raw = await postJson(options, REGISTRY_COMPANION_ROUTES.update, request);
-        return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.update, raw);
-    },
-    async remove(options, request) {
-        const raw = await postJson(options, REGISTRY_COMPANION_ROUTES.remove, request);
-        return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.remove, raw);
-    },
-    async publish(options, request) {
-        const raw = await postJson(options, REGISTRY_COMPANION_ROUTES.publish, request);
-        return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.publish, raw);
-    },
 };
-/**
- * M5: thin wrapper around `RegistryRouteResultSchema.parse(raw)` that
- * converts a Zod parse failure into the typed
- * `RegistryMalformedPayloadError` instead of letting a bare `ZodError`
- * bubble up. Keeps the typed-handler contract aligned with
- * `RegistryServerClient`.
- */
-function parseCompanionResult(baseUrl, routePath, raw) {
-    const parsed = RegistryRouteResultSchema.safeParse(raw);
-    if (!parsed.success) {
-        // 7th-pass C-L2: format the issues array for operator
-        // readability instead of using Zod 4's JSON-stringified
-        // `error.message`.
-        const detail = formatZodIssuesAsSingleLine(parsed.error);
-        throw new RegistryMalformedPayloadError(baseUrl, `companion ${routePath}`, detail);
-    }
-    return parsed.data;
-}
 //# sourceMappingURL=registry-companion-client.js.map

package/dist/esm/services/registry-companion-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-companion-client.js","sourceRoot":"","sources":["../../../../src/services/registry-companion-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,GAM9B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAEtE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C;;;;;;;GAOG;AACH,mGAAmG;AACnG,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AA0BzD,KAAK,UAAU,QAAQ,CACrB,OAAyC,EACzC,SAAiB,EACjB,IAAa;IAEb,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE;QACjG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,eAAe,EAAE,gBAAgB;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,gEAAgE;QAChE,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,UAAU,EACd,aAAa,SAAS,EAAE,CACzB,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,8DAA8D;IAC9D,qCAAqC;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,6BAA6B,CACrC,OAAO,CAAC,OAAO,EACf,aAAa,SAAS,EAAE,EACxB,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,OAAuC;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,gBAAgB;aAClC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,OAAyC,EACzC,OAA+B;QAE/B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAyC,EACzC,OAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxF,OAAO,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAyC,EACzC,OAA8B;QAE9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxF,OAAO,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,yBAAyB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,OAAyC,EACzC,OAA+B;QAE/B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAU,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;CACO,CAAC;AAEX;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,OAAe,EACf,SAAiB,EACjB,GAAY;IAEZ,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,sDAAsD;QACtD,wDAAwD;QACxD,mBAAmB;QACnB,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,6BAA6B,CACrC,OAAO,EACP,aAAa,SAAS,EAAE,EACxB,MAAM,CACP,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC","sourcesContent":["/**\n * `RegistryCompanionClient` — HTTP client for the local dev\n * companion's registry routes.\n *\n * Distinct from `RegistryServerClient` (which talks to the central\n * `platform-module-registry` server). The companion client targets\n * `/api/companion/registry/*` on `http://localhost:<companion-port>`\n * for AST/source mutations the CLI delegates to the companion\n * (KD-6).\n *\n * Phase 2 ships the four mutation routes as method calls; the\n * companion controller (under\n * `platform/factory/wildo-dev-companion/src/companion-api/controllers/`)\n * implements them with the actual ts-morph + filesystem work in\n * Phase 5+.\n *\n * The four mutations are GATED: the companion refuses any non-`GET` route that does not present the\n * machine-local token, so they take `RegistryCompanionMutationOptions` and `ping` — a `GET` — does\n * not. See that type for why the credential is required rather than optional.\n */\n\nimport {\n  REGISTRY_COMPANION_ROUTES,\n  RegistryMalformedPayloadError,\n  RegistryRouteResultSchema,\n  RegistryUnexpectedStatusError,\n  type RegistryInstallRequest,\n  type RegistryPublishRequest,\n  type RegistryRemoveRequest,\n  type RegistryRouteResult,\n  type RegistryUpdateRequest,\n} from '@wildo-ai/platform-config-lib';\nimport { fetchWithTimeout, joinUrl } from './_http-client';\nimport { formatZodIssuesAsSingleLine } from './_zod-issue-formatting';\n\nconst DIAGNOSTIC_LABEL = 'Companion registry';\n\n/**\n * The header the companion's P-29b token floor reads on a mutating route.\n *\n * A wire contract between two processes that share no package, so it is named at both ends rather\n * than at neither. Its server twin is `COMPANION_TOKEN_HEADER` in the companion's\n * `core/auth/companion-auth-floor.companion.service.ts`; the CLI's is in\n * `wildo-cli/src/services/companion/companion-local-token.utils.ts`. Move one, move all three.\n */\n// semantic-literal-boundary: private companion HTTP protocol, translated only at this client edge.\nconst COMPANION_TOKEN_HEADER = 'x-wildo-companion-token';\n\nexport interface RegistryCompanionClientOptions {\n  baseUrl: string;\n  timeoutMs?: number;\n}\n\n/**\n * What a MUTATING companion registry call needs, over and above an address.\n *\n * `companionToken` is REQUIRED, and that is the whole point of this second type. Every non-`GET`\n * route under `/api/companion/**` is refused without it, and the four methods below have no caller\n * yet (the routes answer a not-implemented envelope until Phase 5) — so making it required now costs\n * nothing and means the caller Phase 5 writes cannot be written without the credential. An optional\n * field would have been a rule to remember; a required one is a compile error.\n *\n * The value is the content of `<appRoot>/.wildo-saas/state/companion.token` (mode 0600), which the\n * companion mints on every boot. This package has no notion of an application root, so reading it is\n * deliberately the caller's job: `wildo-cli` already owns a hardened no-follow reader\n * (`readCompanionTokenNoFollow`), and a second copy of a permission-checked read is precisely where\n * the checks quietly diverge.\n */\nexport interface RegistryCompanionMutationOptions extends RegistryCompanionClientOptions {\n  companionToken: string;\n}\n\nasync function postJson<R>(\n  options: RegistryCompanionMutationOptions,\n  routePath: string,\n  body: unknown,\n): Promise<R> {\n  const url = joinUrl(options.baseUrl, routePath);\n  const res = await fetchWithTimeout(url, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json', [COMPANION_TOKEN_HEADER]: options.companionToken },\n    body: JSON.stringify(body),\n    timeoutMs: options.timeoutMs,\n    diagnosticLabel: DIAGNOSTIC_LABEL,\n  });\n  if (!res.ok) {\n    // 3rd-pass M5: typed `RegistryUnexpectedStatusError` instead of\n    // bare `new Error(...)` so callers can `isRegistryError(err)` and\n    // discriminate by status code without re-parsing message text.\n    // The companion deliberately reuses the same error vocabulary\n    // as `RegistryServerClient` since the wire shape (status + URL +\n    // action) is identical even though the lane is different.\n    throw new RegistryUnexpectedStatusError(\n      options.baseUrl,\n      res.status,\n      res.statusText,\n      `companion ${routePath}`,\n    );\n  }\n  // 6th-pass M3: typed JSON-parse — a misconfigured proxy returning\n  // HTML at 2xx would otherwise throw a bare `SyntaxError` that\n  // bypasses the typed-error contract.\n  try {\n    return (await res.json()) as R;\n  } catch (err) {\n    throw new RegistryMalformedPayloadError(\n      options.baseUrl,\n      `companion ${routePath}`,\n      `response is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,\n    );\n  }\n}\n\nexport const RegistryCompanionClient = {\n  /**\n   * Liveness probe against `/health` (the same endpoint the\n   * dev-supervisor monitors). Used by `wildo registry ping`.\n   */\n  async ping(options: RegistryCompanionClientOptions): Promise<boolean> {\n    const url = joinUrl(options.baseUrl, '/health');\n    try {\n      const res = await fetchWithTimeout(url, {\n        method: 'GET',\n        timeoutMs: options.timeoutMs,\n        diagnosticLabel: DIAGNOSTIC_LABEL,\n      });\n      return res.ok;\n    } catch {\n      return false;\n    }\n  },\n\n  /**\n   * Ask the companion to install a module: download bytes, copy\n   * source, mutate `wildo.saas.config.ts > moduleRegistries` +\n   * the three `modules-registry.*.ts` files, refresh\n   * `sections.modules`, run provider sync.\n   */\n  async install(\n    options: RegistryCompanionMutationOptions,\n    request: RegistryInstallRequest,\n  ): Promise<RegistryRouteResult> {\n    const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.install, request);\n    return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.install, raw);\n  },\n\n  async update(\n    options: RegistryCompanionMutationOptions,\n    request: RegistryUpdateRequest,\n  ): Promise<RegistryRouteResult> {\n    const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.update, request);\n    return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.update, raw);\n  },\n\n  async remove(\n    options: RegistryCompanionMutationOptions,\n    request: RegistryRemoveRequest,\n  ): Promise<RegistryRouteResult> {\n    const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.remove, request);\n    return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.remove, raw);\n  },\n\n  async publish(\n    options: RegistryCompanionMutationOptions,\n    request: RegistryPublishRequest,\n  ): Promise<RegistryRouteResult> {\n    const raw = await postJson<unknown>(options, REGISTRY_COMPANION_ROUTES.publish, request);\n    return parseCompanionResult(options.baseUrl, REGISTRY_COMPANION_ROUTES.publish, raw);\n  },\n} as const;\n\n/**\n * M5: thin wrapper around `RegistryRouteResultSchema.parse(raw)` that\n * converts a Zod parse failure into the typed\n * `RegistryMalformedPayloadError` instead of letting a bare `ZodError`\n * bubble up. Keeps the typed-handler contract aligned with\n * `RegistryServerClient`.\n */\nfunction parseCompanionResult(\n  baseUrl: string,\n  routePath: string,\n  raw: unknown,\n): RegistryRouteResult {\n  const parsed = RegistryRouteResultSchema.safeParse(raw);\n  if (!parsed.success) {\n    // 7th-pass C-L2: format the issues array for operator\n    // readability instead of using Zod 4's JSON-stringified\n    // `error.message`.\n    const detail = formatZodIssuesAsSingleLine(parsed.error);\n    throw new RegistryMalformedPayloadError(\n      baseUrl,\n      `companion ${routePath}`,\n      detail,\n    );\n  }\n  return parsed.data;\n}\n"]}
+{"version":3,"file":"registry-companion-client.js","sourceRoot":"","sources":["../../../../src/services/registry-companion-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAO9C,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,OAAuC;QAChD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE;gBACtC,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe,EAAE,gBAAgB;aAClC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["/**\n * `RegistryCompanionClient` — liveness probe for the local dev companion, used by\n * `wildo registry ping` beside the registry-server probe.\n *\n * That is all it is. It used to carry four mutation methods (install / update / remove / publish)\n * against `/api/companion/registry/*` routes that only ever answered a \"Phase 5/6 deliverable\"\n * not-implemented envelope and had no caller. Installation shipped CLI-direct instead\n * (`wildo registry add` / `update` / `remove` / `publish` do the work themselves), so the routes,\n * these methods and their wire schemas were deleted on 2026-09-25 rather than left describing a\n * design that was never built. A future companion-owned mutation lane starts from the CLI commands,\n * not from this file.\n */\n\nimport { fetchWithTimeout, joinUrl } from './_http-client';\n\nconst DIAGNOSTIC_LABEL = 'Companion registry';\n\nexport interface RegistryCompanionClientOptions {\n  baseUrl: string;\n  timeoutMs?: number;\n}\n\nexport const RegistryCompanionClient = {\n  /**\n   * Liveness probe against `/health` (the same endpoint the\n   * dev-supervisor monitors). Used by `wildo registry ping`.\n   */\n  async ping(options: RegistryCompanionClientOptions): Promise<boolean> {\n    const url = joinUrl(options.baseUrl, '/health');\n    try {\n      const res = await fetchWithTimeout(url, {\n        method: 'GET',\n        timeoutMs: options.timeoutMs,\n        diagnosticLabel: DIAGNOSTIC_LABEL,\n      });\n      return res.ok;\n    } catch {\n      return false;\n    }\n  },\n};\n"]}

package/dist/esm/services/registry-lockfile.service.d.ts

@@ -19,7 +19,7 @@
  *     those are produced by the provider materialization workflow.
  *   - Never mutates `sections.providers.runtimeScopes`.
  */
-import { type RegistryModulesLockSection, type RegistryModulesLockEntry } from '@wildo-ai/platform-config-lib';
+import { type RegistryModulesLockSection, type RegistryModulesLockEntryInput } from '@wildo-ai/platform-config-lib';
 export declare const RegistryLockfileService: {
     /**
      * Read the current `sections.modules` payload (or an empty section
@@ -35,8 +35,12 @@ export declare const RegistryLockfileService: {
      * before commit.
      */
     readonly mutate: (saasRoot: string, mutator: (current: RegistryModulesLockSection) => RegistryModulesLockSection | void | Promise<RegistryModulesLockSection | void>) => Promise<RegistryModulesLockSection>;
-    /** Convenience helper used by Phase 5+ install flow. */
-    readonly upsertEntry: (saasRoot: string, entry: RegistryModulesLockEntry) => Promise<void>;
+    /**
+     * Insert or replace one module's entry. The entry is parsed here, so its defaults (`distribution`,
+     * `files`) apply in one place and a malformed entry is refused naming the module, before the lockfile
+     * is touched (`mutate` then re-validates the whole section).
+     */
+    readonly upsertEntry: (saasRoot: string, input: RegistryModulesLockEntryInput) => Promise<void>;
     /**
      * Find every other lockfile entry whose `files[]` claims any of the
      * given paths. Used by `update`/`remove` to skip deletes that would

package/dist/esm/services/registry-lockfile.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-lockfile.service.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-lockfile.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAIL,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC9B,MAAM,+BAA+B,CAAC;AAevC,eAAO,MAAM,uBAAuB;IAClC;;;;OAIG;8BACkB,MAAM,KAAG,OAAO,CAAC,0BAA0B,CAAC;IAOjE;;;;;;OAMG;gCAES,MAAM,WACP,CACP,OAAO,EAAE,0BAA0B,KAEjC,0BAA0B,GAC1B,IAAI,GACJ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,KAC7C,OAAO,CAAC,0BAA0B,CAAC;IAYtC,wDAAwD;qCAC5B,MAAM,SAAS,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC;IAOnF;;;;;;;;;OASG;oCACwB;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;KACzB,KAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAgB1B,CAAC"}
+{"version":3,"file":"registry-lockfile.service.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-lockfile.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAIL,KAAK,0BAA0B,EAE/B,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAevC,eAAO,MAAM,uBAAuB;IAClC;;;;OAIG;8BACkB,MAAM,KAAG,OAAO,CAAC,0BAA0B,CAAC;IAOjE;;;;;;OAMG;gCAES,MAAM,WACP,CACP,OAAO,EAAE,0BAA0B,KAEjC,0BAA0B,GAC1B,IAAI,GACJ,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,KAC7C,OAAO,CAAC,0BAA0B,CAAC;IAYtC;;;;OAIG;qCACyB,MAAM,SAAS,6BAA6B,KAAG,OAAO,CAAC,IAAI,CAAC;IAQxF;;;;;;;;;OASG;oCACwB;QACzB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;KACzB,KAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAgB1B,CAAC"}

package/dist/esm/services/registry-lockfile.service.js

@@ -19,7 +19,7 @@
  *     those are produced by the provider materialization workflow.
  *   - Never mutates `sections.providers.runtimeScopes`.
  */
-import { RegistryModulesLockSectionSchema, withLockfileSectionMutate, readWildoSaasLock, } from '@wildo-ai/platform-config-lib';
+import { RegistryModulesLockSectionSchema, withLockfileSectionMutate, readWildoSaasLock, RegistryModulesLockEntrySchema, } from '@wildo-ai/platform-config-lib';
 // L6 (third-pass review): the package's barrel-discipline rule says
 // "Never re-export (except in the root `index.ts` of each package)."
 // The previous `export { WILDO_SAAS_LOCK_RELATIVE_PATH }` here AND in
@@ -59,8 +59,13 @@ export const RegistryLockfileService = {
             initialSection: emptySection,
         }, mutator);
     },
-    /** Convenience helper used by Phase 5+ install flow. */
-    async upsertEntry(saasRoot, entry) {
+    /**
+     * Insert or replace one module's entry. The entry is parsed here, so its defaults (`distribution`,
+     * `files`) apply in one place and a malformed entry is refused naming the module, before the lockfile
+     * is touched (`mutate` then re-validates the whole section).
+     */
+    async upsertEntry(saasRoot, input) {
+        const entry = RegistryModulesLockEntrySchema.parse(input);
         await this.mutate(saasRoot, (current) => ({
             ...current,
             installed: { ...current.installed, [entry.moduleId]: entry },

package/dist/esm/services/registry-lockfile.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-lockfile.service.js","sourceRoot":"","sources":["../../../../src/services/registry-lockfile.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iBAAiB,GAGlB,MAAM,+BAA+B,CAAC;AACvC,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,kEAAkE;AAClE,qEAAqE;AACrE,mCAAmC;AAEnC,MAAM,WAAW,GAAG,SAAkB,CAAC;AAEvC,SAAS,YAAY;IACnB,OAAO,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,YAAY,EAAE,CAAC;QAC7C,OAAO,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,OAK8C;QAE9C,OAAO,yBAAyB,CAC9B;YACE,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,gCAAgC;YAC/C,cAAc,EAAE,YAAY;SAC7B,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,KAA+B;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG,OAAO;YACV,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,IAIpB;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,aAAa,KAAK,IAAI,CAAC,eAAe;gBAAE,SAAS;YACrD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACO,CAAC","sourcesContent":["/**\n * `RegistryLockfileService` — section-scoped reader/writer for the\n * `sections.modules` slice of `wildo-saas.lock.json` (KD-4).\n *\n * Phase 1 graduates the locking + atomic-write primitives into\n * `@wildo-ai/platform-config-lib` (validated by the Phase 0.B\n * contention spike). This service is a thin wrapper around\n * `withLockfileSectionMutate` that pre-binds the `modules` section\n * key + schema, so module-registry callers cannot accidentally\n * touch sibling sections.\n *\n * Hard contracts (KD-4 / KD-15 / KD-18):\n *   - Mutates ONLY `sections.modules`. The shared library preserves\n *     `sections.providers`, `sections.i18n`, and every unknown\n *     `sections.*` payload verbatim — no defensive logic needed\n *     here.\n *   - Never writes `.wildo-saas/generated/providers/*.runtime-providers.generated.json`\n *     or `src/generated/wildo-provider-runtime.generated.ts` —\n *     those are produced by the provider materialization workflow.\n *   - Never mutates `sections.providers.runtimeScopes`.\n */\n\nimport {\n  RegistryModulesLockSectionSchema,\n  withLockfileSectionMutate,\n  readWildoSaasLock,\n  type RegistryModulesLockSection,\n  type RegistryModulesLockEntry,\n} from '@wildo-ai/platform-config-lib';\n// L6 (third-pass review): the package's barrel-discipline rule says\n// \"Never re-export (except in the root `index.ts` of each package).\"\n// The previous `export { WILDO_SAAS_LOCK_RELATIVE_PATH }` here AND in\n// `lockfile-repair.service.ts` surfaced the symbol twice from\n// `wildo-module-client`'s root. Consumers that need it can import\n// directly from `@wildo-ai/platform-config-lib`, OR rely on the root\n// `index.ts` to re-export it once.\n\nconst SECTION_KEY = 'modules' as const;\n\nfunction emptySection(): RegistryModulesLockSection {\n  return RegistryModulesLockSectionSchema.parse({});\n}\n\nexport const RegistryLockfileService = {\n  /**\n   * Read the current `sections.modules` payload (or an empty section\n   * when missing). Unsynchronized — callers needing read-after-write\n   * coherence should read INSIDE `mutate`.\n   */\n  async read(saasRoot: string): Promise<RegistryModulesLockSection> {\n    const envelope = await readWildoSaasLock({ saasRoot });\n    const raw = envelope.sections.modules;\n    if (raw === undefined) return emptySection();\n    return RegistryModulesLockSectionSchema.parse(raw);\n  },\n\n  /**\n   * Run `mutator` against the current `sections.modules` payload\n   * under an OS-level lock + atomic-write commit. The mutator can\n   * either mutate-in-place or return a new value; either way the\n   * result is re-validated against `RegistryModulesLockSectionSchema`\n   * before commit.\n   */\n  async mutate(\n    saasRoot: string,\n    mutator: (\n      current: RegistryModulesLockSection,\n    ) =>\n      | RegistryModulesLockSection\n      | void\n      | Promise<RegistryModulesLockSection | void>,\n  ): Promise<RegistryModulesLockSection> {\n    return withLockfileSectionMutate(\n      {\n        saasRoot,\n        sectionKey: SECTION_KEY,\n        sectionSchema: RegistryModulesLockSectionSchema,\n        initialSection: emptySection,\n      },\n      mutator,\n    );\n  },\n\n  /** Convenience helper used by Phase 5+ install flow. */\n  async upsertEntry(saasRoot: string, entry: RegistryModulesLockEntry): Promise<void> {\n    await this.mutate(saasRoot, (current) => ({\n      ...current,\n      installed: { ...current.installed, [entry.moduleId]: entry },\n    }));\n  },\n\n  /**\n   * Find every other lockfile entry whose `files[]` claims any of the\n   * given paths. Used by `update`/`remove` to skip deletes that would\n   * silently pull files out from under modules that own them too\n   * (cross-module file overlap).\n   *\n   * Returns a `Map<relPath, owners[]>` where `owners` excludes\n   * `excludeModuleId`. Empty array → uniquely owned by the excluded\n   * module, safe to delete.\n   */\n  async findFileOwners(args: {\n    saasRoot: string;\n    paths: readonly string[];\n    excludeModuleId: string;\n  }): Promise<Map<string, string[]>> {\n    const section = await this.read(args.saasRoot);\n    const claimedBy = new Map<string, string[]>();\n    for (const p of args.paths) claimedBy.set(p, []);\n    for (const otherModuleId of Object.keys(section.installed)) {\n      if (otherModuleId === args.excludeModuleId) continue;\n      const otherEntry = section.installed[otherModuleId];\n      if (!otherEntry) continue;\n      for (const otherFile of otherEntry.files) {\n        if (claimedBy.has(otherFile)) {\n          claimedBy.get(otherFile)!.push(otherModuleId);\n        }\n      }\n    }\n    return claimedBy;\n  },\n} as const;\n"]}
+{"version":3,"file":"registry-lockfile.service.js","sourceRoot":"","sources":["../../../../src/services/registry-lockfile.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EACzB,iBAAiB,EAEjB,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,8DAA8D;AAC9D,kEAAkE;AAClE,qEAAqE;AACrE,mCAAmC;AAEnC,MAAM,WAAW,GAAG,SAAkB,CAAC;AAEvC,SAAS,YAAY;IACnB,OAAO,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,YAAY,EAAE,CAAC;QAC7C,OAAO,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,OAK8C;QAE9C,OAAO,yBAAyB,CAC9B;YACE,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,gCAAgC;YAC/C,cAAc,EAAE,YAAY;SAC7B,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,KAAoC;QACtE,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxC,GAAG,OAAO;YACV,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,IAIpB;QACC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,aAAa,KAAK,IAAI,CAAC,eAAe;gBAAE,SAAS;YACrD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,SAAS,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACO,CAAC","sourcesContent":["/**\n * `RegistryLockfileService` — section-scoped reader/writer for the\n * `sections.modules` slice of `wildo-saas.lock.json` (KD-4).\n *\n * Phase 1 graduates the locking + atomic-write primitives into\n * `@wildo-ai/platform-config-lib` (validated by the Phase 0.B\n * contention spike). This service is a thin wrapper around\n * `withLockfileSectionMutate` that pre-binds the `modules` section\n * key + schema, so module-registry callers cannot accidentally\n * touch sibling sections.\n *\n * Hard contracts (KD-4 / KD-15 / KD-18):\n *   - Mutates ONLY `sections.modules`. The shared library preserves\n *     `sections.providers`, `sections.i18n`, and every unknown\n *     `sections.*` payload verbatim — no defensive logic needed\n *     here.\n *   - Never writes `.wildo-saas/generated/providers/*.runtime-providers.generated.json`\n *     or `src/generated/wildo-provider-runtime.generated.ts` —\n *     those are produced by the provider materialization workflow.\n *   - Never mutates `sections.providers.runtimeScopes`.\n */\n\nimport {\n  RegistryModulesLockSectionSchema,\n  withLockfileSectionMutate,\n  readWildoSaasLock,\n  type RegistryModulesLockSection,\n  RegistryModulesLockEntrySchema,\n  type RegistryModulesLockEntryInput,\n} from '@wildo-ai/platform-config-lib';\n// L6 (third-pass review): the package's barrel-discipline rule says\n// \"Never re-export (except in the root `index.ts` of each package).\"\n// The previous `export { WILDO_SAAS_LOCK_RELATIVE_PATH }` here AND in\n// `lockfile-repair.service.ts` surfaced the symbol twice from\n// `wildo-module-client`'s root. Consumers that need it can import\n// directly from `@wildo-ai/platform-config-lib`, OR rely on the root\n// `index.ts` to re-export it once.\n\nconst SECTION_KEY = 'modules' as const;\n\nfunction emptySection(): RegistryModulesLockSection {\n  return RegistryModulesLockSectionSchema.parse({});\n}\n\nexport const RegistryLockfileService = {\n  /**\n   * Read the current `sections.modules` payload (or an empty section\n   * when missing). Unsynchronized — callers needing read-after-write\n   * coherence should read INSIDE `mutate`.\n   */\n  async read(saasRoot: string): Promise<RegistryModulesLockSection> {\n    const envelope = await readWildoSaasLock({ saasRoot });\n    const raw = envelope.sections.modules;\n    if (raw === undefined) return emptySection();\n    return RegistryModulesLockSectionSchema.parse(raw);\n  },\n\n  /**\n   * Run `mutator` against the current `sections.modules` payload\n   * under an OS-level lock + atomic-write commit. The mutator can\n   * either mutate-in-place or return a new value; either way the\n   * result is re-validated against `RegistryModulesLockSectionSchema`\n   * before commit.\n   */\n  async mutate(\n    saasRoot: string,\n    mutator: (\n      current: RegistryModulesLockSection,\n    ) =>\n      | RegistryModulesLockSection\n      | void\n      | Promise<RegistryModulesLockSection | void>,\n  ): Promise<RegistryModulesLockSection> {\n    return withLockfileSectionMutate(\n      {\n        saasRoot,\n        sectionKey: SECTION_KEY,\n        sectionSchema: RegistryModulesLockSectionSchema,\n        initialSection: emptySection,\n      },\n      mutator,\n    );\n  },\n\n  /**\n   * Insert or replace one module's entry. The entry is parsed here, so its defaults (`distribution`,\n   * `files`) apply in one place and a malformed entry is refused naming the module, before the lockfile\n   * is touched (`mutate` then re-validates the whole section).\n   */\n  async upsertEntry(saasRoot: string, input: RegistryModulesLockEntryInput): Promise<void> {\n    const entry = RegistryModulesLockEntrySchema.parse(input);\n    await this.mutate(saasRoot, (current) => ({\n      ...current,\n      installed: { ...current.installed, [entry.moduleId]: entry },\n    }));\n  },\n\n  /**\n   * Find every other lockfile entry whose `files[]` claims any of the\n   * given paths. Used by `update`/`remove` to skip deletes that would\n   * silently pull files out from under modules that own them too\n   * (cross-module file overlap).\n   *\n   * Returns a `Map<relPath, owners[]>` where `owners` excludes\n   * `excludeModuleId`. Empty array → uniquely owned by the excluded\n   * module, safe to delete.\n   */\n  async findFileOwners(args: {\n    saasRoot: string;\n    paths: readonly string[];\n    excludeModuleId: string;\n  }): Promise<Map<string, string[]>> {\n    const section = await this.read(args.saasRoot);\n    const claimedBy = new Map<string, string[]>();\n    for (const p of args.paths) claimedBy.set(p, []);\n    for (const otherModuleId of Object.keys(section.installed)) {\n      if (otherModuleId === args.excludeModuleId) continue;\n      const otherEntry = section.installed[otherModuleId];\n      if (!otherEntry) continue;\n      for (const otherFile of otherEntry.files) {\n        if (claimedBy.has(otherFile)) {\n          claimedBy.get(otherFile)!.push(otherModuleId);\n        }\n      }\n    }\n    return claimedBy;\n  },\n} as const;\n"]}

package/dist/esm/services/registry-server-client.d.ts

@@ -12,9 +12,10 @@
  * Auth (KD-11): if `authToken` is supplied, every request adds
  * `Authorization: Bearer <token>`. Public read paths work without
  * a token; restricted paths return 401/403, surfaced as
- * `RegistryAuthRequiredError` / `RegistryAuthForbiddenError`.
+ * `RegistryAuthRequiredError` (no key sent), `RegistryCredentialRejectedError` (a key sent and refused)
+ * or `RegistryAuthForbiddenError`; a 429 is `RegistryRateLimitedError`.
  */
-import { type ModuleManifest, type ModuleVersionRecord } from '@wildo-ai/platform-config-lib';
+import { type ModuleManifest, type ModuleSearchFilter, type ModuleSearchHit, type RegistryYankNotice, type ModuleVersionRecord } from '@wildo-ai/platform-config-lib';
 export interface RegistryServerClientOptions {
     /** Registry origin (e.g. `https://registry.wildo.ai`). */
     baseUrl: string;
@@ -27,6 +28,11 @@ export interface RegistryResolveResult {
     /** Resolved exact version (matches `Sha256DigestSchema` for digest). */
     version: string;
     artifactDigest: string;
+    /**
+     * Present when the resolved release is yanked. Only an EXACT-version request can resolve to one
+     * (#1758) — ranges and tags never do — so the caller is pinned to it and should warn, not refuse.
+     */
+    yanked?: RegistryYankNotice;
 }
 export interface RegistryInfoResult {
     moduleId: string;
@@ -35,11 +41,8 @@ export interface RegistryInfoResult {
     /** dist-tag → version map (e.g. `latest → 1.2.3`). */
     tags: Readonly<Record<string, string>>;
 }
-export interface RegistrySearchHit {
-    moduleId: string;
-    description?: string;
-    latestVersion: string;
-}
+/** One search hit: the module, its latest version, and (#2014) its kind and provider facts. */
+export type RegistrySearchHit = ModuleSearchHit;
 export declare const RegistryServerClient: {
     /**
      * Liveness probe against `/health`. Returns boolean — used by
@@ -68,12 +71,13 @@ export declare const RegistryServerClient: {
         moduleId: string;
     }) => Promise<RegistryInfoResult>;
     /**
-     * Search the registry's metadata index. The shape is
-     * intentionally narrow until Phase 4 designs the search UX.
+     * Search the registry's metadata index: a module-id substring, and (#2014) the manifest filters —
+     * kind, engine capability and provider maturity. The server refuses an unknown filter value.
      */
     readonly search: (options: RegistryServerClientOptions, args: {
         domain: string;
         query: string;
+        filter?: ModuleSearchFilter;
     }) => Promise<readonly RegistrySearchHit[]>;
     /**
      * Stream-download a published artifact's bytes and verify the
@@ -89,6 +93,28 @@ export declare const RegistryServerClient: {
     }) => Promise<{
         bytes: Uint8Array;
         integrity: string;
+        yanked?: RegistryYankNotice;
+    }>;
+    /**
+     * Yank a release (#1758): ranges and `latest` stop selecting it, and `latest` moves to the highest
+     * live release; an exact pin still installs it, with a warning. Needs a key holding the version UPDATE
+     * role in the domain's owning organization. Returns where `latest` points afterwards.
+     */
+    readonly yank: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        moduleId: string;
+        version: string;
+        reason?: string;
+    }) => Promise<{
+        latest: string | null;
+    }>;
+    /** Restore a yanked release (#1758); `latest` returns to it when it outranks the current target. */
+    readonly unyank: (options: RegistryServerClientOptions, args: {
+        domain: string;
+        moduleId: string;
+        version: string;
+    }) => Promise<{
+        latest: string | null;
     }>;
 };
 //# sourceMappingURL=registry-server-client.d.ts.map

package/dist/esm/services/registry-server-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-server-client.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-server-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAYL,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACzB,MAAM,+BAA+B,CAAC;AA4BvC,MAAM,WAAW,2BAA2B;IAC1C,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoCD,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,oBAAoB;IAC/B;;;;;;OAMG;6BACiB,2BAA2B,KAAG,OAAO,CAAC,OAAO,CAAC;IAalE;;;;OAIG;gCAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACxD,OAAO,CAAC,qBAAqB,CAAC;IAgDjC;;;OAGG;6BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACzC,OAAO,CAAC,kBAAkB,CAAC;IA8B9B;;;OAGG;+BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACtC,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IA6BxC;;;;;OAKG;iCAEQ,2BAA2B,QAC9B;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACxB,KACA,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CA6C5C,CAAC"}
+{"version":3,"file":"registry-server-client.d.ts","sourceRoot":"","sources":["../../../../src/services/registry-server-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAwBL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,+BAA+B,CAAC;AAsBvC,MAAM,WAAW,2BAA2B;IAC1C,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6DD,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,sDAAsD;IACtD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxC;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEhD,eAAO,MAAM,oBAAoB;IAC/B;;;;;;OAMG;6BACiB,2BAA2B,KAAG,OAAO,CAAC,OAAO,CAAC;IAalE;;;;OAIG;gCAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KACxD,OAAO,CAAC,qBAAqB,CAAC;IAkDjC;;;OAGG;6BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KACzC,OAAO,CAAC,kBAAkB,CAAC;IAyB9B;;;OAGG;+BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;KAAE,KACnE,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;IA2BxC;;;;;OAKG;iCAEQ,2BAA2B,QAC9B;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;KACxB,KACA,OAAO,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAiDjF;;;;OAIG;6BAEQ,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAC3E,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAIrC,oGAAoG;+BAEzF,2BAA2B,QAC9B;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAC1D,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAG7B,CAAC"}