handoff-app 2.0.0-2 → 2.0.0-3

package/dist/registry/checkout/index.js

@@ -64,6 +64,7 @@ exports.checkoutEntities = exports.checkoutEntity = exports.resolveConnectionOrT
 const p = __importStar(require("@clack/prompts"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const path_1 = __importDefault(require("path"));
+const entries_1 = require("../../config/entries");
 const runtime_1 = require("../../config/runtime");
 const logger_1 = require("../../utils/logger");
 const client_1 = require("../client");
@@ -92,24 +93,24 @@ const COMPONENT_EXTENSION = /\.(tsx|jsx|ts|js|cjs|mjs)$/i;
  * host has no local workspace to write into) and a resolved registry URL + access token. Throws an
  * actionable {@link CheckoutError} naming the exact misconfiguration.
  */
-const resolveConnectionOrThrow = (handoff) => {
+const resolveConnectionOrThrow = (handoff) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b, _c;
     const mode = (_c = (_b = (_a = handoff.config) === null || _a === void 0 ? void 0 : _a.runtime) === null || _b === void 0 ? void 0 : _b.mode) !== null && _c !== void 0 ? _c : 'workspace';
     if (mode !== 'workspace') {
         throw new CheckoutError(`checkout is only available from a connected workspace (runtime.mode: "workspace"); this project is "${mode}". ` +
             'A registry host stores and serves entities; it has no local workspace to check them out into.');
     }
-    const connection = (0, connection_1.resolveRegistryConnection)(handoff.config);
+    const connection = yield (0, connection_1.resolveAuthenticatedRegistryConnection)(handoff.config, handoff.workingPath);
     if (!connection.url) {
-        throw new CheckoutError(`No registry URL is configured. Set runtime.registryConnection.url, or the "${connection.urlEnv}" environment variable, ` +
-            'to the base URL of the registry to checkout from.');
+        throw new CheckoutError(`No registry is configured. Run \`handoff-app login --url <registry-url>\`, set runtime.registryConnection.url, ` +
+            `or set the "${connection.urlEnv}" environment variable to the base URL of the registry to checkout from.`);
     }
     if (!connection.accessToken) {
-        throw new CheckoutError(`No registry access token is configured. Set the "${connection.accessTokenEnv}" environment variable to the ` +
-            "registry's bearer token to authorize checkout.");
+        throw new CheckoutError(`No registry access token is configured. Run \`handoff-app login --url ${connection.url}\`, or set the ` +
+            `"${connection.accessTokenEnv}" environment variable to a user-issued token for CI.`);
     }
     return connection;
-};
+});
 exports.resolveConnectionOrThrow = resolveConnectionOrThrow;
 /** Map a registry client error to an actionable checkout message. */
 const describeFetchFailure = (error, kind, id, registryUrl) => {
@@ -119,28 +120,69 @@ const describeFetchFailure = (error, kind, id, registryUrl) => {
         case 'runtime_mode_conflict':
             return `The registry at ${registryUrl} is not running in registry mode, so it cannot serve a checkout: ${error.message}`;
         case 'unauthorized':
-            return `The registry rejected the access token (401). Check the configured access token matches the registry's token.`;
+            return `The registry rejected the access token (401). Run \`handoff-app login --url ${registryUrl}\` again, or replace the user-issued CI token.`;
+        case 'forbidden':
+            return `The registry token does not have permission to checkout this content (403). Authorize a token with registry:read access.`;
         default:
             return error.message;
     }
 };
 /**
- * Resolve the local directory the entity is written into: an already-checked-out / locally-declared
- * entity keeps its existing source directory (matched by stable `id`); otherwise it lands under the
- * first configured `entries.{components|patterns}` root (falling back to `components`/`patterns`).
+ * Ask the user which collection directory a new entity should land in when the config is ambiguous.
+ * Under `--force` (or any non-interactive run) there's no one to ask, so we fail with an actionable
+ * message rather than guessing a root.
  */
-const resolveTargetDir = (handoff, kind, id) => __awaiter(void 0, void 0, void 0, function* () {
+const promptForCollectionRoot = (handoff, kind, roots) => __awaiter(void 0, void 0, void 0, function* () {
+    const relative = (root) => path_1.default.relative(handoff.workingPath, root) || '.';
+    if (handoff.force) {
+        throw new CheckoutError(`Cannot determine where to checkout the ${kind}: entries.${kind}s declares individual ${kind}s under different ` +
+            `directories (${roots.map(relative).join(', ')}). Declare a single collection directory in handoff.config, ` +
+            `or run checkout without --force to choose interactively.`);
+    }
+    const choice = yield p.select({
+        message: `Where should the new ${kind} be checked out?`,
+        options: roots.map((root) => ({ value: root, label: relative(root) })),
+        initialValue: roots[0],
+    });
+    if (p.isCancel(choice)) {
+        throw new CheckoutError('Checkout cancelled; no target directory chosen.');
+    }
+    return choice;
+});
+/**
+ * Resolve the collection directory a new entity is cloned into from the configured
+ * `entries.{components|patterns}`. Each entry is either a collection directory (used as-is) or a
+ * single declared entity directory, in which case its parent is the collection root so the new
+ * entity lands as a sibling rather than nested inside. Different parents mean the config is
+ * ambiguous, so we ask the user; with nothing configured we fall back to the default subdir.
+ */
+const resolveCollectionRoot = (handoff, kind) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b, _c, _d;
+    const configuredRoots = kind === 'component' ? (_b = (_a = handoff.config) === null || _a === void 0 ? void 0 : _a.entries) === null || _b === void 0 ? void 0 : _b.components : (_d = (_c = handoff.config) === null || _c === void 0 ? void 0 : _c.entries) === null || _d === void 0 ? void 0 : _d.patterns;
+    if (!(configuredRoots === null || configuredRoots === void 0 ? void 0 : configuredRoots.length)) {
+        return path_1.default.resolve(handoff.workingPath, DEFAULT_ENTITY_DIR[kind]);
+    }
+    const roots = [
+        ...new Set(configuredRoots.map((entry) => {
+            const resolved = path_1.default.resolve(handoff.workingPath, entry);
+            return (0, runtime_1.isComponentDirectory)(resolved) ? path_1.default.dirname(resolved) : resolved;
+        })),
+    ];
+    return roots.length === 1 ? roots[0] : promptForCollectionRoot(handoff, kind, roots);
+});
+/**
+ * Resolve the local directory the entity is written into. An already-checked-out or locally-declared
+ * entity keeps its existing source directory (matched by stable `id`); otherwise it lands as a
+ * sibling under its configured collection root (see {@link resolveCollectionRoot}).
+ */
+const resolveTargetDir = (handoff, kind, id) => __awaiter(void 0, void 0, void 0, function* () {
     const store = kind === 'component' ? handoff.store.components : handoff.store.patterns;
     const existing = yield store.get(id);
     const existingDir = existing === null || existing === void 0 ? void 0 : existing.path;
     if (existingDir) {
         return existingDir;
     }
-    const configuredRoots = kind === 'component' ? (_b = (_a = handoff.config) === null || _a === void 0 ? void 0 : _a.entries) === null || _b === void 0 ? void 0 : _b.components : (_d = (_c = handoff.config) === null || _c === void 0 ? void 0 : _c.entries) === null || _d === void 0 ? void 0 : _d.patterns;
-    const root = (configuredRoots === null || configuredRoots === void 0 ? void 0 : configuredRoots.length)
-        ? path_1.default.resolve(handoff.workingPath, configuredRoots[0])
-        : path_1.default.resolve(handoff.workingPath, DEFAULT_ENTITY_DIR[kind]);
+    const root = yield resolveCollectionRoot(handoff, kind);
     const targetDir = (0, path_2.resolvePathWithin)(root, id);
     if (!targetDir) {
         throw new CheckoutError(`Cannot checkout ${kind} with unsafe id "${id}".`);
@@ -573,10 +615,11 @@ const checkoutSingle = (handoff, kind, id, client, registryUrl) => __awaiter(voi
         }
         throw error;
     }
-    // Pages round-trip as a single verbatim `.md` with no declaration synthesis.
+    // Pages round-trip as a single verbatim `.md` with no declaration synthesis, and aren't
+    // declared in `entries`, so there's nothing to register.
     if (kind === 'page') {
         yield checkoutPage(handoff, id, payload);
-        return;
+        return null;
     }
     const targetDir = yield resolveTargetDir(handoff, kind, id);
     const format = resolveDeclarationFormat(handoff, targetDir);
@@ -593,7 +636,7 @@ const checkoutSingle = (handoff, kind, id, client, registryUrl) => __awaiter(voi
     const conflicts = [...sourceTargets.map((entry) => entry.absolutePath), declarationPath].filter((file) => fs_extra_1.default.existsSync(file));
     if (!(yield confirmOverwrite(handoff, conflicts))) {
         logger_1.Logger.warn(`Checkout of ${kind} "${id}" cancelled; no files were written.`);
-        return;
+        return null;
     }
     yield fs_extra_1.default.ensureDir(targetDir);
     const written = [];
@@ -605,15 +648,44 @@ const checkoutSingle = (handoff, kind, id, client, registryUrl) => __awaiter(voi
     written.push(declarationPath);
     logger_1.Logger.success(`Checked out ${kind} "${id}" into ${path_1.default.relative(handoff.workingPath, targetDir) || '.'} ` +
         `(${payload.files.length} source file(s) + ${declarationFileName}).`);
+    return targetDir;
+});
+/**
+ * Declare freshly checked-out entities in `entries.{components|patterns}` so the workspace build
+ * picks them up. Ones already covered by a collection directory load on their own and are left
+ * alone; the rest are added to the config automatically. If the config can't be edited (a computed
+ * or unusual `entries` array), we print the paths for the user to add so nothing is silently orphaned.
+ */
+const registerCheckedOut = (handoff, kind, targetDirs) => __awaiter(void 0, void 0, void 0, function* () {
+    if (kind === 'page') {
+        return;
+    }
+    const entryKind = kind === 'component' ? 'components' : 'patterns';
+    const uncovered = targetDirs.filter((dir) => !(0, entries_1.isEntryCovered)(handoff, entryKind, dir));
+    if (uncovered.length === 0) {
+        return;
+    }
+    const result = yield (0, entries_1.writeEntries)(handoff, entryKind, uncovered);
+    if (result.status === 'added') {
+        const where = result.configPath ? path_1.default.relative(handoff.workingPath, result.configPath) || path_1.default.basename(result.configPath) : 'handoff.config';
+        logger_1.Logger.success(`Updated ${where} with ${result.added.length} ${entryKind} path(s).`);
+        return;
+    }
+    const where = result.configPath ? path_1.default.relative(handoff.workingPath, result.configPath) : 'handoff.config';
+    logger_1.Logger.warn(`Could not update ${where} automatically. Add these to entries.${entryKind} manually:`);
+    result.pending.forEach((rel) => logger_1.Logger.warn(`  - ${rel}`));
 });
 /**
  * Checkout a single component, pattern, or page from the connected registry into this workspace.
  * Overwriting existing local files requires `--force` or an interactive confirmation.
  */
 const checkoutEntity = (handoff, kind, id) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, exports.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, exports.resolveConnectionOrThrow)(handoff);
     const client = (0, client_1.createRegistryClient)({ baseUrl: connection.url, accessToken: connection.accessToken });
-    yield checkoutSingle(handoff, kind, id, client, connection.url);
+    const targetDir = yield checkoutSingle(handoff, kind, id, client, connection.url);
+    if (targetDir) {
+        yield registerCheckedOut(handoff, kind, [targetDir]);
+    }
 });
 exports.checkoutEntity = checkoutEntity;
 /**
@@ -623,7 +695,7 @@ exports.checkoutEntity = checkoutEntity;
  * prompting is per entity (skipped under `--force`).
  */
 const checkoutEntities = (handoff, kind) => __awaiter(void 0, void 0, void 0, function* () {
-    const connection = (0, exports.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, exports.resolveConnectionOrThrow)(handoff);
     const client = (0, client_1.createRegistryClient)({ baseUrl: connection.url, accessToken: connection.accessToken });
     let summaries;
     try {
@@ -641,15 +713,21 @@ const checkoutEntities = (handoff, kind) => __awaiter(void 0, void 0, void 0, fu
     }
     let checkedOut = 0;
     const failed = [];
+    const targetDirs = [];
     for (const { id } of summaries) {
         try {
-            yield checkoutSingle(handoff, kind, id, client, connection.url);
+            const targetDir = yield checkoutSingle(handoff, kind, id, client, connection.url);
+            if (targetDir) {
+                targetDirs.push(targetDir);
+            }
             checkedOut += 1;
         }
         catch (error) {
             failed.push({ id, message: error instanceof Error ? error.message : String(error) });
         }
     }
+    // Register everything checked out in one pass, so the config is edited (and confirmed) once.
+    yield registerCheckedOut(handoff, kind, targetDirs);
     logger_1.Logger.success(`${kind[0].toUpperCase()}${kind.slice(1)}s checkout complete — ${checkedOut} checked out${failed.length ? `, ${failed.length} failed` : ''}.`);
     if (failed.length > 0) {
         for (const failure of failed) {

package/dist/registry/checkout/tokens.js

@@ -61,7 +61,9 @@ const describeFetchFailure = (error, target, registryUrl) => {
         case 'runtime_mode_conflict':
             return `The registry at ${registryUrl} is not running in registry mode, so it cannot serve a checkout: ${error.message}`;
         case 'unauthorized':
-            return `The registry rejected the access token (401). Check the configured access token matches the registry's token.`;
+            return `The registry rejected the access token (401). Run \`handoff-app login --url ${registryUrl}\` again, or replace the user-issued CI token.`;
+        case 'forbidden':
+            return `The registry token does not have permission to checkout design tokens (403). Authorize a token with registry:read access.`;
         default:
             return error.message;
     }
@@ -99,7 +101,7 @@ const checkoutTokens = (handoff, setId) => __awaiter(void 0, void 0, void 0, fun
     if (setId && !(0, sets_1.isTokenSetId)(setId)) {
         throw new index_1.CheckoutError(`Unknown or unsafe token set id "${setId}".`);
     }
-    const connection = (0, index_1.resolveConnectionOrThrow)(handoff);
+    const connection = yield (0, index_1.resolveConnectionOrThrow)(handoff);
     const client = (0, client_1.createRegistryClient)({ baseUrl: connection.url, accessToken: connection.accessToken });
     let ids;
     if (setId) {

package/dist/registry/connection.d.ts

@@ -28,3 +28,12 @@ export interface ResolvedRegistryConnection {
  * Callers inspect the resolved URL and access token to surface specific configuration errors.
  */
 export declare const resolveRegistryConnection: (config: Config | null | undefined) => ResolvedRegistryConnection;
+/**
+ * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
+ * in what the environment does not provide. A valid login supplies both the registry URL and the
+ * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
+ * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
+ * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
+ * applies to the URL it was issued for.
+ */
+export declare const resolveAuthenticatedRegistryConnection: (config: Config | null | undefined, workingPath?: string) => Promise<ResolvedRegistryConnection>;

package/dist/registry/connection.js

@@ -8,8 +8,18 @@
  * access token is always read from an env-var name (never persisted as a value). This is the single
  * source the publish (and later checkout) client reads its target + credentials from.
  */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+exports.resolveAuthenticatedRegistryConnection = exports.resolveRegistryConnection = exports.DEFAULT_REGISTRY_ACCESS_TOKEN_ENV = exports.DEFAULT_REGISTRY_URL_ENV = void 0;
+const store_1 = require("../cli/auth/store");
 /** Default env-var name holding the remote registry base URL. */
 exports.DEFAULT_REGISTRY_URL_ENV = 'HANDOFF_REGISTRY_URL';
 /** Default env-var name holding the connected-workspace access token. */
@@ -34,3 +44,21 @@ const resolveRegistryConnection = (config) => {
     };
 };
 exports.resolveRegistryConnection = resolveRegistryConnection;
+/**
+ * Resolve the same connection for an authenticated CLI operation, letting a saved device login fill
+ * in what the environment does not provide. A valid login supplies both the registry URL and the
+ * access token, so `handoff-app login` alone is enough to publish and checkout. Environment values
+ * keep precedence for deterministic CI: `HANDOFF_REGISTRY_URL` (or inline config) wins over the
+ * saved URL, and `HANDOFF_REGISTRY_ACCESS_TOKEN` wins over the saved token. The saved token only
+ * applies to the URL it was issued for.
+ */
+const resolveAuthenticatedRegistryConnection = (config_1, ...args_1) => __awaiter(void 0, [config_1, ...args_1], void 0, function* (config, workingPath = process.cwd()) {
+    const connection = (0, exports.resolveRegistryConnection)(config);
+    const auth = yield (0, store_1.readCliAuth)(workingPath);
+    if (!(0, store_1.cliAuthTokenIsValid)(auth))
+        return connection;
+    const url = connection.url || auth.remoteUrl;
+    const accessToken = connection.accessToken || ((0, store_1.cliAuthMatchesRegistry)(auth, url) ? auth.accessToken : '');
+    return Object.assign(Object.assign({}, connection), { url, accessToken });
+});
+exports.resolveAuthenticatedRegistryConnection = resolveAuthenticatedRegistryConnection;

package/dist/registry/db/driver.d.ts

@@ -14,7 +14,7 @@ import type { Config } from '../../types/config';
 export type RegistryDatabaseDriver = 'pg' | 'neon';
 /** Default env-var name holding the database connection string. */
 export declare const DEFAULT_DATABASE_URL_ENV = "DATABASE_URL";
-/** Default env-var name holding the registry management API bearer token. */
+/** @deprecated Fixed registry server secrets are no longer authorized. */
 export declare const DEFAULT_REGISTRY_API_TOKEN_ENV = "HANDOFF_REGISTRY_API_TOKEN";
 /** Default registry database driver when none is configured. */
 export declare const DEFAULT_REGISTRY_DRIVER: RegistryDatabaseDriver;
@@ -30,9 +30,10 @@ export interface ResolvedRegistryDatabase {
 /** Resolve the env-var name holding the database URL (defaults to `DATABASE_URL`). */
 export declare const resolveDatabaseUrlEnv: (config: Config | null | undefined) => string;
 /**
- * Resolve the env-var *name* holding the registry management API bearer token (defaults to
- * `HANDOFF_REGISTRY_API_TOKEN`). Like the database URL, only the name is ever persisted — the token
- * value is resolved from the environment at request time and never written to config.
+ * Resolve the legacy fixed-token env-var name for configuration compatibility.
+ *
+ * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
+ * user-issued access token or `handoff-app login`.
  */
 export declare const resolveApiTokenEnv: (config: Config | null | undefined) => string;
 /** Resolve the configured registry database driver (defaults to `pg`). */

package/dist/registry/db/driver.js

@@ -14,7 +14,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveApiTokenEnv = exports.resolveDatabaseUrlEnv = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_DATABASE_URL_ENV = void 0;
 /** Default env-var name holding the database connection string. */
 exports.DEFAULT_DATABASE_URL_ENV = 'DATABASE_URL';
-/** Default env-var name holding the registry management API bearer token. */
+/** @deprecated Fixed registry server secrets are no longer authorized. */
 exports.DEFAULT_REGISTRY_API_TOKEN_ENV = 'HANDOFF_REGISTRY_API_TOKEN';
 /** Default registry database driver when none is configured. */
 exports.DEFAULT_REGISTRY_DRIVER = 'pg';
@@ -26,9 +26,10 @@ const resolveDatabaseUrlEnv = (config) => {
 };
 exports.resolveDatabaseUrlEnv = resolveDatabaseUrlEnv;
 /**
- * Resolve the env-var *name* holding the registry management API bearer token (defaults to
- * `HANDOFF_REGISTRY_API_TOKEN`). Like the database URL, only the name is ever persisted — the token
- * value is resolved from the environment at request time and never written to config.
+ * Resolve the legacy fixed-token env-var name for configuration compatibility.
+ *
+ * @deprecated The returned env var is intentionally ignored by registry authorization. Use a
+ * user-issued access token or `handoff-app login`.
  */
 const resolveApiTokenEnv = (config) => {
     var _a, _b, _c;

package/dist/registry/db/index.d.ts

@@ -1,4 +1,4 @@
-export { buildMetadata, componentFiles, components, docsArtifacts, patternFiles, patterns, registrySchema, type BuildMetadataEntityKind, type DocsArtifactEntityKind, type RegistryReviewMetadata, } from './schema';
+export { buildMetadata, componentFiles, components, docsArtifacts, patternFiles, patterns, registryAccessTokens, registryAuthActionTokens, registryAuthRateLimits, registryDeviceAuthorizations, registryInstallations, registrySchema, registryUsers, type BuildMetadataEntityKind, type DocsArtifactEntityKind, type RegistryAccessScope, type RegistryAuthActionPurpose, type RegistryDeviceAuthorizationStatus, type RegistryRateLimitBucket, type RegistryReviewMetadata, type RegistryUserRole, type RegistryUserStatus, } from './schema';
 export type { ArtifactBuildStatus as RegistryBuildStatus } from '../../artifacts/types';
 export { DEFAULT_DATABASE_URL_ENV, DEFAULT_REGISTRY_DRIVER, DEFAULT_REGISTRY_API_TOKEN_ENV, resolveApiTokenEnv, resolveDatabaseUrlEnv, resolveRegistryDriver, resolveRegistryDatabase, type RegistryDatabaseDriver, type ResolvedRegistryDatabase, } from './driver';
 export { createRegistryDbConnection, type CreateRegistryDbConnectionParams, type RegistryDatabase, type RegistryDbConnection, } from './client';

package/dist/registry/db/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.resolveApiTokenEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registrySchema = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
+exports.runRegistryMigrations = exports.getMigrationsFolder = exports.createRegistryDbConnection = exports.resolveRegistryDatabase = exports.resolveRegistryDriver = exports.resolveDatabaseUrlEnv = exports.resolveApiTokenEnv = exports.DEFAULT_REGISTRY_API_TOKEN_ENV = exports.DEFAULT_REGISTRY_DRIVER = exports.DEFAULT_DATABASE_URL_ENV = exports.registryUsers = exports.registrySchema = exports.registryInstallations = exports.registryDeviceAuthorizations = exports.registryAuthRateLimits = exports.registryAuthActionTokens = exports.registryAccessTokens = exports.patterns = exports.patternFiles = exports.docsArtifacts = exports.components = exports.componentFiles = exports.buildMetadata = void 0;
 var schema_1 = require("./schema");
 Object.defineProperty(exports, "buildMetadata", { enumerable: true, get: function () { return schema_1.buildMetadata; } });
 Object.defineProperty(exports, "componentFiles", { enumerable: true, get: function () { return schema_1.componentFiles; } });
@@ -8,7 +8,13 @@ Object.defineProperty(exports, "components", { enumerable: true, get: function (
 Object.defineProperty(exports, "docsArtifacts", { enumerable: true, get: function () { return schema_1.docsArtifacts; } });
 Object.defineProperty(exports, "patternFiles", { enumerable: true, get: function () { return schema_1.patternFiles; } });
 Object.defineProperty(exports, "patterns", { enumerable: true, get: function () { return schema_1.patterns; } });
+Object.defineProperty(exports, "registryAccessTokens", { enumerable: true, get: function () { return schema_1.registryAccessTokens; } });
+Object.defineProperty(exports, "registryAuthActionTokens", { enumerable: true, get: function () { return schema_1.registryAuthActionTokens; } });
+Object.defineProperty(exports, "registryAuthRateLimits", { enumerable: true, get: function () { return schema_1.registryAuthRateLimits; } });
+Object.defineProperty(exports, "registryDeviceAuthorizations", { enumerable: true, get: function () { return schema_1.registryDeviceAuthorizations; } });
+Object.defineProperty(exports, "registryInstallations", { enumerable: true, get: function () { return schema_1.registryInstallations; } });
 Object.defineProperty(exports, "registrySchema", { enumerable: true, get: function () { return schema_1.registrySchema; } });
+Object.defineProperty(exports, "registryUsers", { enumerable: true, get: function () { return schema_1.registryUsers; } });
 var driver_1 = require("./driver");
 Object.defineProperty(exports, "DEFAULT_DATABASE_URL_ENV", { enumerable: true, get: function () { return driver_1.DEFAULT_DATABASE_URL_ENV; } });
 Object.defineProperty(exports, "DEFAULT_REGISTRY_DRIVER", { enumerable: true, get: function () { return driver_1.DEFAULT_REGISTRY_DRIVER; } });