cognitive-modules-cli 2.2.7 → 2.2.9

package/dist/commands/core.d.ts

@@ -0,0 +1,31 @@
+/**
+ * cog core - Minimal "one-file" Core workflow
+ *
+ * Goals:
+ * - A single Markdown file can be a runnable module (optional frontmatter + prompt body)
+ * - Runtime generates loose schemas and always returns a v2.2 envelope on execution
+ * - No registry / conformance / certification required to get started
+ */
+import type { CommandContext, CommandResult } from '../types.js';
+export interface CoreOptions {
+    args?: string;
+    input?: string;
+    noValidate?: boolean;
+    pretty?: boolean;
+    verbose?: boolean;
+    stream?: boolean;
+    dryRun?: boolean;
+    stdin?: boolean;
+    force?: boolean;
+}
+export declare function coreNew(filePath: string, options?: {
+    dryRun?: boolean;
+}): Promise<CommandResult>;
+export declare function coreSchema(filePath: string): Promise<CommandResult>;
+export declare function corePromote(filePath: string, outDir?: string, options?: {
+    dryRun?: boolean;
+    force?: boolean;
+}): Promise<CommandResult>;
+export declare function coreRunText(markdownOrPrompt: string, ctx: CommandContext, options?: CoreOptions): Promise<CommandResult>;
+export declare function coreRun(filePath: string, ctx: CommandContext, options?: CoreOptions): Promise<CommandResult>;
+export declare function core(subcommand: string | undefined, target: string | undefined, ctx: CommandContext, options?: CoreOptions, rest?: string[]): Promise<CommandResult>;

package/dist/commands/core.js

@@ -0,0 +1,338 @@
+/**
+ * cog core - Minimal "one-file" Core workflow
+ *
+ * Goals:
+ * - A single Markdown file can be a runnable module (optional frontmatter + prompt body)
+ * - Runtime generates loose schemas and always returns a v2.2 envelope on execution
+ * - No registry / conformance / certification required to get started
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import yaml from 'js-yaml';
+import { loadSingleFileModule } from '../modules/loader.js';
+import { run } from './run.js';
+function ensureMdPath(p) {
+    const ext = path.extname(p).toLowerCase();
+    if (ext === '.md' || ext === '.markdown')
+        return p;
+    return `${p}.md`;
+}
+function toSafeName(base) {
+    // Keep it predictable and filesystem-friendly.
+    const s = base.trim().replace(/\s+/g, '-').replace(/[^a-zA-Z0-9._-]/g, '-');
+    const collapsed = s.replace(/-+/g, '-').replace(/^\-+|\-+$/g, '');
+    return collapsed.length > 0 ? collapsed : 'core-module';
+}
+function coreTemplate(name) {
+    return [
+        '---',
+        `name: ${name}`,
+        'version: 0.1.0',
+        'responsibility: "One-file core module (5-minute path)"',
+        'tier: decision',
+        'schema_strictness: low',
+        'excludes:',
+        '  - do not make network calls',
+        '  - do not write files',
+        '---',
+        '',
+        'You are a Cognitive Module. Return JSON only (no markdown).',
+        'Return a valid v2.2 envelope with meta + data.',
+        '',
+        'INPUT (provided by runtime):',
+        '- query: natural language input (when --args looks like text)',
+        '- code: code input (when --args looks like code)',
+        '',
+        'You MUST treat missing fields as empty.',
+        '',
+        'INPUT VALUES:',
+        'query:',
+        '${query}',
+        '',
+        'code:',
+        '${code}',
+        '',
+        'Output (requirements):',
+        '- ok: true',
+        '- meta.confidence: 0-1',
+        "- meta.risk: one of 'none' | 'low' | 'medium' | 'high' (or extensible enum when allowed)",
+        '- meta.explain: <=280 chars',
+        '- data.rationale: string (long-form explanation for auditing)',
+        '- data: your structured fields (plus data.rationale)',
+        '',
+        'Minimal example (shape only):',
+        '{ "ok": true, "meta": { "confidence": 0.8, "risk": "low", "explain": "..." }, "data": { "rationale": "...", "result": "..." } }',
+        '',
+    ].join('\n');
+}
+function defaultErrorSchema() {
+    return {
+        type: 'object',
+        additionalProperties: true,
+        required: ['code', 'message'],
+        properties: {
+            code: { type: 'string' },
+            message: { type: 'string' },
+            recoverable: { type: 'boolean' },
+        },
+    };
+}
+export async function coreNew(filePath, options = {}) {
+    const abs = path.resolve(process.cwd(), ensureMdPath(filePath));
+    const name = toSafeName(path.basename(abs, path.extname(abs)));
+    const content = coreTemplate(name);
+    if (options.dryRun) {
+        return {
+            success: true,
+            data: {
+                message: `Dry run: would create ${abs}`,
+                location: abs,
+                preview: content,
+            },
+        };
+    }
+    try {
+        await fs.stat(abs);
+        return { success: false, error: `File already exists: ${abs}` };
+    }
+    catch {
+        // ok
+    }
+    await fs.mkdir(path.dirname(abs), { recursive: true });
+    await fs.writeFile(abs, content, 'utf-8');
+    return {
+        success: true,
+        data: {
+            message: `Created one-file module: ${abs}`,
+            location: abs,
+            hint: `Run: cog run ${abs} --args "hello" --pretty`,
+        },
+    };
+}
+export async function coreSchema(filePath) {
+    const abs = path.resolve(process.cwd(), filePath);
+    const mod = await loadSingleFileModule(abs);
+    return {
+        success: true,
+        data: {
+            name: mod.name,
+            version: mod.version,
+            location: mod.location,
+            schema: {
+                meta: mod.metaSchema ?? {},
+                input: mod.inputSchema ?? {},
+                data: mod.dataSchema ?? {},
+                error: mod.errorSchema ?? defaultErrorSchema(),
+            },
+        },
+    };
+}
+function defaultPromoteDir(moduleName) {
+    return path.resolve(process.cwd(), 'cognitive', 'modules', moduleName);
+}
+function isPathWithinRoot(rootDir, targetPath) {
+    const root = path.resolve(rootDir);
+    const target = path.resolve(targetPath);
+    return target === root || target.startsWith(root + path.sep);
+}
+function schemaJsonForV22(mod) {
+    return {
+        meta: mod.metaSchema ?? {},
+        input: mod.inputSchema ?? {},
+        data: mod.dataSchema ?? {},
+        error: mod.errorSchema ?? defaultErrorSchema(),
+    };
+}
+function moduleYamlForV22(mod) {
+    const manifest = {
+        name: mod.name,
+        version: mod.version,
+        responsibility: mod.responsibility,
+        tier: mod.tier ?? 'decision',
+        excludes: mod.excludes ?? [],
+        schema_strictness: mod.schemaStrictness ?? 'low',
+        overflow: mod.overflow ?? undefined,
+        enums: mod.enums ?? undefined,
+        compat: mod.compat ?? undefined,
+        meta: mod.metaConfig ?? undefined,
+    };
+    // Remove undefined keys for cleaner output.
+    for (const k of Object.keys(manifest)) {
+        if (manifest[k] === undefined)
+            delete manifest[k];
+    }
+    return yaml.dump(manifest, { noRefs: true, lineWidth: 120 }).trimEnd() + '\n';
+}
+export async function corePromote(filePath, outDir, options = {}) {
+    const abs = path.resolve(process.cwd(), filePath);
+    const mod = await loadSingleFileModule(abs);
+    const targetDir = outDir ? path.resolve(process.cwd(), outDir) : defaultPromoteDir(mod.name);
+    const cwd = process.cwd();
+    // Promote is meant to generate a project-local v2 module directory. Refuse to write outside cwd
+    // (and especially refuse `--force` deletes) to prevent footguns like `--force /`.
+    if (!isPathWithinRoot(cwd, targetDir) || path.resolve(targetDir) === path.resolve(cwd)) {
+        return { success: false, error: `Refusing to promote outside current directory: ${targetDir}` };
+    }
+    const moduleYamlPath = path.join(targetDir, 'module.yaml');
+    const promptMdPath = path.join(targetDir, 'prompt.md');
+    const schemaJsonPath = path.join(targetDir, 'schema.json');
+    const moduleYaml = moduleYamlForV22(mod);
+    const promptMd = (mod.prompt ?? '').trim() + '\n';
+    const schemaJson = JSON.stringify(schemaJsonForV22(mod), null, 2) + '\n';
+    const files = [moduleYamlPath, promptMdPath, schemaJsonPath];
+    if (options.dryRun) {
+        return {
+            success: true,
+            data: {
+                message: `Dry run: would promote ${abs} to v2 module directory`,
+                from: abs,
+                to: targetDir,
+                files,
+                preview: {
+                    'module.yaml': moduleYaml,
+                    'prompt.md': promptMd,
+                    'schema.json': schemaJson,
+                },
+            },
+        };
+    }
+    // Avoid overwriting an existing module directory silently.
+    try {
+        await fs.stat(targetDir);
+        if (!options.force) {
+            return { success: false, error: `Target directory already exists: ${targetDir} (use --force to overwrite)` };
+        }
+        await fs.rm(targetDir, { recursive: true, force: true });
+    }
+    catch {
+        // ok
+    }
+    await fs.mkdir(targetDir, { recursive: true });
+    await fs.writeFile(moduleYamlPath, moduleYaml, 'utf-8');
+    await fs.writeFile(promptMdPath, promptMd, 'utf-8');
+    await fs.writeFile(schemaJsonPath, schemaJson, 'utf-8');
+    // Add minimal golden tests (schema validation mode) so `cog test <module>` works out of the box.
+    const testsDir = path.join(targetDir, 'tests');
+    await fs.mkdir(testsDir, { recursive: true });
+    const inputPath = path.join(testsDir, 'smoke.input.json');
+    const expectedPath = path.join(testsDir, 'smoke.expected.json');
+    const smokeInput = {
+        query: 'hello',
+    };
+    const smokeExpected = {
+        $validate: {
+            type: 'object',
+            required: ['ok', 'meta', 'data'],
+            properties: {
+                ok: { const: true },
+                meta: {
+                    type: 'object',
+                    required: ['confidence', 'risk', 'explain'],
+                    properties: {
+                        confidence: { type: 'number', minimum: 0, maximum: 1 },
+                        risk: { type: 'string' },
+                        explain: { type: 'string', maxLength: 280 },
+                    },
+                },
+                data: {
+                    type: 'object',
+                    required: ['rationale'],
+                    properties: {
+                        rationale: { type: 'string' },
+                    },
+                },
+            },
+        },
+    };
+    await fs.writeFile(inputPath, JSON.stringify(smokeInput, null, 2) + '\n', 'utf-8');
+    await fs.writeFile(expectedPath, JSON.stringify(smokeExpected, null, 2) + '\n', 'utf-8');
+    return {
+        success: true,
+        data: {
+            message: `Promoted one-file module to v2 directory`,
+            from: abs,
+            to: targetDir,
+            files: [...files, inputPath, expectedPath],
+            hint: `Run: cog run ${mod.name} --args "hello" --pretty`,
+        },
+    };
+}
+async function readAll(stream) {
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        stream.on('data', (c) => chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(String(c))));
+        stream.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+        stream.on('error', reject);
+        // Ensure flow mode.
+        if (typeof stream.resume === 'function') {
+            stream.resume();
+        }
+    });
+}
+export async function coreRunText(markdownOrPrompt, ctx, options = {}) {
+    const raw = markdownOrPrompt.trim();
+    const content = raw.startsWith('---') ? raw + '\n' : (coreTemplate('stdin-core') + '\n' + raw + '\n');
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'cog-core-stdin-'));
+    const file = path.join(dir, 'stdin.md');
+    await fs.writeFile(file, content, 'utf-8');
+    try {
+        return await coreRun(file, ctx, options);
+    }
+    finally {
+        // Best-effort cleanup.
+        await fs.rm(dir, { recursive: true, force: true });
+    }
+}
+export async function coreRun(filePath, ctx, options = {}) {
+    // Delegate to `cog run` which already supports file paths.
+    return run(filePath, ctx, {
+        args: options.args,
+        input: options.input,
+        noValidate: options.noValidate,
+        pretty: options.pretty,
+        verbose: options.verbose,
+        stream: options.stream,
+    });
+}
+export async function core(subcommand, target, ctx, options = {}, rest = []) {
+    if (!subcommand || subcommand === '--help' || subcommand === '-h') {
+        return {
+            success: true,
+            data: {
+                usage: [
+                    'cog core new [file.md] [--dry-run]',
+                    'cog core schema <file.md> [--pretty]',
+                    'cog core run <file.md> [--args "..."] [--pretty] [--stream] [--no-validate]',
+                    'cog core run --stdin [--args "..."] [--pretty] [--stream] [--no-validate]',
+                    'cog core promote <file.md> [outDir] [--dry-run] [--force]',
+                ],
+            },
+        };
+    }
+    if (subcommand === 'new') {
+        const file = target || 'demo.md';
+        return coreNew(file, { dryRun: options.dryRun });
+    }
+    if (subcommand === 'schema') {
+        if (!target)
+            return { success: false, error: 'Usage: cog core schema <file.md>' };
+        return coreSchema(target);
+    }
+    if (subcommand === 'run') {
+        if (options.stdin) {
+            const inputText = await readAll(process.stdin);
+            return coreRunText(inputText, ctx, options);
+        }
+        if (!target)
+            return { success: false, error: 'Usage: cog core run <file.md> [--args "..."] (or use --stdin)' };
+        return coreRun(target, ctx, options);
+    }
+    if (subcommand === 'promote') {
+        if (!target)
+            return { success: false, error: 'Usage: cog core promote <file.md> [outDir]' };
+        const outDir = rest[0];
+        return corePromote(target, outDir, { dryRun: options.dryRun, force: options.force });
+    }
+    return { success: false, error: `Unknown core subcommand: ${subcommand}` };
+}

package/dist/commands/index.d.ts

@@ -14,3 +14,4 @@ export * from './validate.js';
 export * from './migrate.js';
 export * from './test.js';
 export * from './search.js';
+export * from './core.js';

package/dist/commands/index.js

@@ -14,3 +14,4 @@ export * from './validate.js';
 export * from './migrate.js';
 export * from './test.js';
 export * from './search.js';
+export * from './core.js';

package/dist/commands/pipe.js

@@ -5,6 +5,7 @@
 import * as readline from 'node:readline';
 import { findModule, getDefaultSearchPaths, runModule } from '../modules/index.js';
 import { ErrorCodes, attachContext, makeErrorEnvelope } from '../errors/index.js';
+import { writeAuditRecord } from '../audit.js';
 export async function pipe(ctx, options) {
     const searchPaths = getDefaultSearchPaths(ctx.cwd);
     // Find module
@@ -22,6 +23,17 @@ export async function pipe(ctx, options) {
             data: errorEnvelope,
         };
     }
+    if (ctx.policy?.requireV22) {
+        if (module.formatVersion !== 'v2.2') {
+            const errorEnvelope = attachContext(makeErrorEnvelope({
+                code: ErrorCodes.INVALID_INPUT,
+                message: `Certified profile requires v2.2 modules; got: ${module.formatVersion ?? 'unknown'} (${module.format})`,
+                suggestion: "Migrate the module to v2.2, or run with `--profile strict` / `--profile default`",
+            }), { module: options.module, provider: ctx.provider.name });
+            console.log(JSON.stringify(errorEnvelope));
+            return { success: false, error: errorEnvelope.error.message, data: errorEnvelope };
+        }
+    }
     // Read from stdin
     const rl = readline.createInterface({
         input: process.stdin,
@@ -34,6 +46,8 @@ export async function pipe(ctx, options) {
     }
     const input = lines.join('\n');
     try {
+        const policy = ctx.policy;
+        const startedAt = Date.now();
         // Check if input is JSON
         let inputData;
         try {
@@ -42,18 +56,47 @@ export async function pipe(ctx, options) {
         catch {
             // Not JSON, use as args
         }
+        const validate = (() => {
+            if (options.noValidate)
+                return false;
+            if (!policy)
+                return true;
+            if (policy.validate === 'off')
+                return false;
+            if (policy.validate === 'on')
+                return true;
+            return policy.profile !== 'core';
+        })();
+        const enableRepair = policy?.enableRepair ?? true;
         // Run module with v2.2 envelope format
         const result = await runModule(module, ctx.provider, {
             args: inputData ? undefined : input,
             input: inputData,
-            validateInput: !options.noValidate,
-            validateOutput: !options.noValidate,
+            validateInput: validate,
+            validateOutput: validate,
             useV22: true, // Always use v2.2 envelope
+            enableRepair,
+            policy,
         });
         const output = attachContext(result, {
             module: options.module,
             provider: ctx.provider.name,
         });
+        if (policy?.audit) {
+            const rec = await writeAuditRecord({
+                ts: new Date().toISOString(),
+                kind: 'pipe',
+                policy,
+                provider: ctx.provider.name,
+                module: { name: module.name, version: module.version, location: module.location, formatVersion: module.formatVersion },
+                input: { raw: input, parsed: inputData },
+                result: output,
+                notes: [`duration_ms=${Date.now() - startedAt}`],
+            });
+            if (rec) {
+                console.error(`Audit: ${rec.path}`);
+            }
+        }
         // Output v2.2 envelope format to stdout
         console.log(JSON.stringify(output));
         return {

package/dist/commands/run.js

@@ -2,25 +2,56 @@
  * cog run - Run a Cognitive Module
  * Always returns v2.2 envelope format for consistency
  */
-import { findModule, getDefaultSearchPaths, runModule, runModuleStream } from '../modules/index.js';
+import * as path from 'node:path';
+import * as fs from 'node:fs/promises';
+import { findModule, getDefaultSearchPaths, loadSingleFileModule, runModule, runModuleStream } from '../modules/index.js';
 import { ErrorCodes, attachContext, makeErrorEnvelope } from '../errors/index.js';
+import { writeAuditRecord } from '../audit.js';
 export async function run(moduleName, ctx, options = {}) {
+    // Allow "single-file modules": if moduleName resolves to a file, load it directly.
+    let module = null;
+    const candidatePath = path.resolve(ctx.cwd, moduleName);
+    try {
+        const st = await fs.stat(candidatePath);
+        if (st.isFile()) {
+            module = await loadSingleFileModule(candidatePath);
+        }
+    }
+    catch {
+        // Not a file path, fall back to module discovery.
+    }
     const searchPaths = getDefaultSearchPaths(ctx.cwd);
-    // Find module
-    const module = await findModule(moduleName, searchPaths);
     if (!module) {
-        const errorEnvelope = attachContext(makeErrorEnvelope({
-            code: ErrorCodes.MODULE_NOT_FOUND,
-            message: `Module not found: ${moduleName}\nSearch paths: ${searchPaths.join(', ')}`,
-            suggestion: "Use 'cog list' to see installed modules or 'cog search' to find modules in registry",
-        }), { module: moduleName, provider: ctx.provider.name });
-        return {
-            success: false,
-            error: errorEnvelope.error.message,
-            data: errorEnvelope,
-        };
+        // Find module (directory-based)
+        module = await findModule(moduleName, searchPaths);
+        if (!module) {
+            const errorEnvelope = attachContext(makeErrorEnvelope({
+                code: ErrorCodes.MODULE_NOT_FOUND,
+                message: `Module not found: ${moduleName}\nSearch paths: ${searchPaths.join(', ')}`,
+                suggestion: "Use 'cog list' to see installed modules or 'cog search' to find modules in registry",
+            }), { module: moduleName, provider: ctx.provider.name });
+            return {
+                success: false,
+                error: errorEnvelope.error.message,
+                data: errorEnvelope,
+            };
+        }
+    }
+    // Progressive Complexity gate: certified profile can refuse legacy modules.
+    if (ctx.policy?.requireV22) {
+        const fv = module.formatVersion;
+        if (fv !== 'v2.2') {
+            const errorEnvelope = attachContext(makeErrorEnvelope({
+                code: ErrorCodes.INVALID_INPUT,
+                message: `Certified profile requires v2.2 modules; got: ${fv ?? 'unknown'} (${module.format})`,
+                suggestion: "Migrate the module to v2.2 (module.yaml + prompt.md + schema.json), or use `--profile strict` / `--profile default`",
+            }), { module: moduleName, provider: ctx.provider.name });
+            return { success: false, error: errorEnvelope.error.message, data: errorEnvelope };
+        }
     }
     try {
+        const policy = ctx.policy;
+        const startedAt = Date.now();
         // Parse input if provided as JSON
         let inputData;
         if (options.input) {
@@ -40,20 +71,54 @@ export async function run(moduleName, ctx, options = {}) {
                 };
             }
         }
+        // Resolve validation/repair policy.
+        // Priority: explicit --no-validate > policy.validate > default(true)
+        const validate = (() => {
+            if (options.noValidate)
+                return false;
+            if (!policy)
+                return true;
+            if (policy.validate === 'off')
+                return false;
+            if (policy.validate === 'on')
+                return true;
+            // auto
+            return policy.profile !== 'core';
+        })();
+        const enableRepair = policy?.enableRepair ?? true;
         if (options.stream) {
             // Stream NDJSON events to stdout. Final exit code is determined by the end event.
             let finalOk = null;
+            let finalResult = null;
             for await (const ev of runModuleStream(module, ctx.provider, {
                 args: options.args,
                 input: inputData,
-                validateInput: !options.noValidate,
-                validateOutput: !options.noValidate,
+                validateInput: validate,
+                validateOutput: validate,
                 useV22: true,
+                enableRepair,
+                policy,
             })) {
                 // Write each event as one JSON line (NDJSON).
                 process.stdout.write(JSON.stringify(ev) + '\n');
                 if (ev.type === 'end' && ev.result) {
                     finalOk = Boolean(ev.result.ok);
+                    finalResult = ev.result;
+                }
+            }
+            if (policy?.audit) {
+                const rec = await writeAuditRecord({
+                    ts: new Date().toISOString(),
+                    kind: 'run',
+                    policy,
+                    provider: ctx.provider.name,
+                    module: { name: module.name, version: module.version, location: module.location, formatVersion: module.formatVersion },
+                    input: { args: options.args, input: inputData },
+                    result: { ok: finalOk === true, streamed: true, envelope: finalResult },
+                    notes: [`duration_ms=${Date.now() - startedAt}`],
+                });
+                if (rec) {
+                    console.error(`Audit: ${rec.path}`);
                 }
             }
             return {
@@ -67,14 +132,31 @@ export async function run(moduleName, ctx, options = {}) {
                 args: options.args,
                 input: inputData,
                 verbose: options.verbose || ctx.verbose,
-                validateInput: !options.noValidate,
-                validateOutput: !options.noValidate,
+                validateInput: validate,
+                validateOutput: validate,
                 useV22: true, // Always use v2.2 envelope
+                enableRepair,
+                policy,
             });
             const output = attachContext(result, {
                 module: moduleName,
                 provider: ctx.provider.name,
             });
+            if (policy?.audit) {
+                const rec = await writeAuditRecord({
+                    ts: new Date().toISOString(),
+                    kind: 'run',
+                    policy,
+                    provider: ctx.provider.name,
+                    module: { name: module.name, version: module.version, location: module.location, formatVersion: module.formatVersion },
+                    input: { args: options.args, input: inputData },
+                    result: output,
+                    notes: [`duration_ms=${Date.now() - startedAt}`],
+                });
+                if (rec) {
+                    console.error(`Audit: ${rec.path}`);
+                }
+            }
             // Always return full v2.2 envelope
             return {
                 success: result.ok,

package/dist/commands/search.js

@@ -10,8 +10,12 @@ import { RegistryClient } from '../registry/client.js';
  */
 export async function search(query, ctx, options = {}) {
     const { category, limit = 20, registry } = options;
+    const registryUrl = registry ?? ctx.registryUrl;
     try {
-        const client = new RegistryClient(registry);
+        const client = new RegistryClient(registryUrl, {
+            timeoutMs: ctx.registryTimeoutMs,
+            maxBytes: ctx.registryMaxBytes,
+        });
         let results;
         if (category) {
             // Search within category
@@ -93,7 +97,10 @@ export async function search(query, ctx, options = {}) {
  */
 export async function listCategories(ctx, options = {}) {
     try {
-        const client = new RegistryClient(options.registry);
+        const client = new RegistryClient(options.registry ?? ctx.registryUrl, {
+            timeoutMs: ctx.registryTimeoutMs,
+            maxBytes: ctx.registryMaxBytes,
+        });
         const categories = await client.getCategories();
         return {
             success: true,
@@ -119,7 +126,10 @@ export async function listCategories(ctx, options = {}) {
  */
 export async function info(moduleName, ctx, options = {}) {
     try {
-        const client = new RegistryClient(options.registry);
+        const client = new RegistryClient(options.registry ?? ctx.registryUrl, {
+            timeoutMs: ctx.registryTimeoutMs,
+            maxBytes: ctx.registryMaxBytes,
+        });
         const module = await client.getModule(moduleName);
         if (!module) {
             return {

package/dist/commands/update.js

@@ -95,7 +95,10 @@ export async function update(moduleName, ctx, options = {}) {
         // Use undefined instead of empty string for default registry URL
         const registryUrl = info.registryUrl || undefined;
         // Check registry for latest version
-        const client = new RegistryClient(registryUrl);
+        const client = new RegistryClient(registryUrl, {
+            timeoutMs: ctx.registryTimeoutMs,
+            maxBytes: ctx.registryMaxBytes,
+        });
         const registryInfo = await client.getModule(registryModule);
         if (!registryInfo) {
             return {