Fix download endpoint returning wrong artifact for unmatched platform

[shwetank-dev]

Summary

Fixes #28 — the bundle download endpoint (/v1/bundles/@:scope/:package/versions/:version/download) was silently serving a wrong-platform artifact when the requested os/arch didn't match any available artifact. For example, requesting os=linux&arch=arm64 for a bundle that only had darwin-arm64 would return the darwin-arm64 artifact with a 200 instead of a 404.

Root cause

The artifact selection logic defaulted to artifacts[0] and never cleared that default when platform params were provided but didn't match:

let artifact = packageVersion.artifacts[0]; // always set
if (queryOs || queryArch) {
  const match = ...; // if no match found, artifact stays as artifacts[0]
}

Fix: resolveArtifact helper

Replaced the inline logic with a resolveArtifact(artifacts, os?, arch?) function that enforces these rules:

Params provided	Artifact state	Result
Neither os nor arch	any/any exists	200 — returns universal artifact
Neither os nor arch	No any/any	404
Only one of os/arch	—	400 — "both os and arch are required"
Both os and arch	Exact match exists	200 — returns matched artifact
Both os and arch	No match	404
Invalid enum values	—	422 — rejected at schema level

Zod schema validation

• Added BundleDownloadParamsSchema to @nimblebrain/mpak-schemas with enum validation (os: darwin/linux/win32, arch: x64/arm64)
• Added BundleVersionPathParamsSchema in apps/registry/src/schemas/bundles.ts for path params
• Replaced inline JSON Schema definitions with toJsonSchema() calls
• Added Fastify generics to remove manual as type casts

Other changes in this branch

• Replaced registry-local generated schemas with shared @nimblebrain/mpak-schemas package
• Added Zod-based type safety to the bundle search route (BundleSearchParamsSchema)
• Added package seed data (echo with universal artifacts, nationalparks with multi-platform artifacts)
• Added search validation tests (invalid pagination, enum rejection, defaults, has_more)

Test plan

• pnpm --filter @nimblebrain/mpak-registry typecheck — passes
• pnpm --filter @nimblebrain/mpak-registry lint — passes
• pnpm --filter @nimblebrain/mpak-registry test — 93 tests pass (7 new download tests)
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/nationalparks/versions/latest/download?os=linux&arch=arm64' → 404
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/nationalparks/versions/latest/download?os=foo&arch=bar' → 422
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/nationalparks/versions/latest/download?os=darwin&arch=arm64' → 200
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/echo/versions/latest/download' → 200 (universal)
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/nationalparks/versions/latest/download' → 404 (no universal)
• Manual: curl 'localhost:3200/v1/bundles/@nimblebraininc/echo/versions/latest/download?os=linux' → 400 (missing arch)

🤖 Generated with Claude Code

[shwetank-dev]

closes #38 #47