@cldmv/gh-broker 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -454,11 +454,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (!names2[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names2, constants);
+          this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -475,10 +475,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         if (this.lhs instanceof code_1.Name && !names2[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names2, constants);
+        this.rhs = optimizeExpr(this.rhs, names2, constants2);
         return this;
       }
       get names() {
@@ -539,8 +539,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names2, constants) {
-        this.code = optimizeExpr(this.code, names2, constants);
+      optimizeNames(names2, constants2) {
+        this.code = optimizeExpr(this.code, names2, constants2);
         return this;
       }
       get names() {
@@ -569,12 +569,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names2, constants))
+          if (n.optimizeNames(names2, constants2))
             continue;
           subtractNames(names2, n.names);
           nodes.splice(i, 1);
@@ -627,12 +627,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        if (!(super.optimizeNames(names2, constants) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        if (!(super.optimizeNames(names2, constants2) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names2, constants);
+        this.condition = optimizeExpr(this.condition, names2, constants2);
         return this;
       }
       get names() {
@@ -655,10 +655,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iteration = optimizeExpr(this.iteration, names2, constants);
+        this.iteration = optimizeExpr(this.iteration, names2, constants2);
         return this;
       }
       get names() {
@@ -694,10 +694,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names2, constants) {
-        if (!super.optimizeNames(names2, constants))
+      optimizeNames(names2, constants2) {
+        if (!super.optimizeNames(names2, constants2))
           return;
-        this.iterable = optimizeExpr(this.iterable, names2, constants);
+        this.iterable = optimizeExpr(this.iterable, names2, constants2);
         return this;
       }
       get names() {
@@ -739,11 +739,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names2, constants) {
+      optimizeNames(names2, constants2) {
         var _a3, _b;
-        super.optimizeNames(names2, constants);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants);
+        super.optimizeNames(names2, constants2);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names2, constants2);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names2, constants2);
         return this;
       }
       get names() {
@@ -1044,7 +1044,7 @@ var require_codegen = __commonJS({
     function addExprNames(names2, from) {
       return from instanceof code_1._CodeOrName ? addNames(names2, from.names) : names2;
     }
-    function optimizeExpr(expr, names2, constants) {
+    function optimizeExpr(expr, names2, constants2) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -1059,14 +1059,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants[n.str];
+        const c = constants2[n.str];
         if (c === void 0 || names2[n.str] !== 1)
           return n;
         delete names2[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names2[c.str] === 1 && constants2[c.str] !== void 0);
       }
     }
     function subtractNames(names2, from) {
@@ -1914,8 +1914,8 @@ var require_keyword = __commonJS({
       var _a3;
       const { gen, keyword, schema, parentSchema, $data, it } = cxt;
       checkAsyncKeyword(it, def);
-      const validate2 = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
-      const validateRef = useKeyword(gen, keyword, validate2);
+      const validate3 = !$data && def.compile ? def.compile.call(it.self, schema, parentSchema, it) : def.validate;
+      const validateRef = useKeyword(gen, keyword, validate3);
       const valid = gen.let("valid");
       cxt.block$data(valid, validateKeyword);
       cxt.ok((_a3 = def.valid) !== null && _a3 !== void 0 ? _a3 : valid);
@@ -2279,8 +2279,8 @@ var require_resolve = __commonJS({
       }
       return count;
     }
-    function getFullPath(resolver, id = "", normalize) {
-      if (normalize !== false)
+    function getFullPath(resolver, id = "", normalize3) {
+      if (normalize3 !== false)
         id = normalizeId(id);
       const p = resolver.parse(id);
       return _getFullPath(resolver, p);
@@ -2988,28 +2988,28 @@ var require_compile = __commonJS({
         if (this.opts.code.process)
           sourceCode = this.opts.code.process(sourceCode, sch);
         const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
-        const validate2 = makeValidate(this, this.scope.get());
-        this.scope.value(validateName, { ref: validate2 });
-        validate2.errors = null;
-        validate2.schema = sch.schema;
-        validate2.schemaEnv = sch;
+        const validate3 = makeValidate(this, this.scope.get());
+        this.scope.value(validateName, { ref: validate3 });
+        validate3.errors = null;
+        validate3.schema = sch.schema;
+        validate3.schemaEnv = sch;
         if (sch.$async)
-          validate2.$async = true;
+          validate3.$async = true;
         if (this.opts.code.source === true) {
-          validate2.source = { validateName, validateCode, scopeValues: gen._values };
+          validate3.source = { validateName, validateCode, scopeValues: gen._values };
         }
         if (this.opts.unevaluated) {
           const { props, items } = schemaCxt;
-          validate2.evaluated = {
+          validate3.evaluated = {
             props: props instanceof codegen_1.Name ? void 0 : props,
             items: items instanceof codegen_1.Name ? void 0 : items,
             dynamicProps: props instanceof codegen_1.Name,
             dynamicItems: items instanceof codegen_1.Name
           };
-          if (validate2.source)
-            validate2.source.evaluated = (0, codegen_1.stringify)(validate2.evaluated);
+          if (validate3.source)
+            validate3.source.evaluated = (0, codegen_1.stringify)(validate3.evaluated);
         }
-        sch.validate = validate2;
+        sch.validate = validate3;
         return sch;
       } catch (e) {
         delete sch.validate;
@@ -3875,7 +3875,7 @@ var require_fast_uri = __commonJS({
       }
       return decodedScheme;
     }
-    function normalize(uri, options) {
+    function normalize3(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
         normalizeString(uri, options);
@@ -4253,7 +4253,7 @@ var require_fast_uri = __commonJS({
     }
     var fastUri = {
       SCHEMES,
-      normalize,
+      normalize: normalize3,
       resolve,
       resolveComponent,
       equal,
@@ -6932,8 +6932,8 @@ var require_formats = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.formatNames = exports.fastFormats = exports.fullFormats = void 0;
-    function fmtDef(validate2, compare) {
-      return { validate: validate2, compare };
+    function fmtDef(validate3, compare) {
+      return { validate: validate3, compare };
     }
     exports.fullFormats = {
       // date: http://tools.ietf.org/html/rfc3339#section-5.6
@@ -7282,12 +7282,12 @@ var require_content_type = __commonJS({
       if (!string4) {
         throw new TypeError("argument string is required");
       }
-      var header = typeof string4 === "object" ? getcontenttype(string4) : string4;
-      if (typeof header !== "string") {
+      var header2 = typeof string4 === "object" ? getcontenttype(string4) : string4;
+      if (typeof header2 !== "string") {
         throw new TypeError("argument string is required to be a string");
       }
-      var index = header.indexOf(";");
-      var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+      var index = header2.indexOf(";");
+      var type = index !== -1 ? header2.slice(0, index).trim() : header2.trim();
       if (!TYPE_REGEXP.test(type)) {
         throw new TypeError("invalid media type");
       }
@@ -7297,7 +7297,7 @@ var require_content_type = __commonJS({
         var match;
         var value;
         PARAM_REGEXP.lastIndex = index;
-        while (match = PARAM_REGEXP.exec(header)) {
+        while (match = PARAM_REGEXP.exec(header2)) {
           if (match.index !== index) {
             throw new TypeError("invalid parameter format");
           }
@@ -7312,23 +7312,23 @@ var require_content_type = __commonJS({
           }
           obj.parameters[key2] = value;
         }
-        if (index !== header.length) {
+        if (index !== header2.length) {
           throw new TypeError("invalid parameter format");
         }
       }
       return obj;
     }
     function getcontenttype(obj) {
-      var header;
+      var header2;
       if (typeof obj.getHeader === "function") {
-        header = obj.getHeader("content-type");
+        header2 = obj.getHeader("content-type");
       } else if (typeof obj.headers === "object") {
-        header = obj.headers && obj.headers["content-type"];
+        header2 = obj.headers && obj.headers["content-type"];
       }
-      if (typeof header !== "string") {
+      if (typeof header2 !== "string") {
         throw new TypeError("content-type header is missing from object");
       }
-      return header;
+      return header2;
     }
     function qstring(val) {
       var str = String(val);
@@ -7349,6 +7349,75 @@ var require_content_type = __commonJS({
 
 // src/config.ts
 import { readFileSync } from "node:fs";
+
+// src/verbs/ghcr/config.ts
+import { isAbsolute, normalize } from "node:path";
+var DEFAULT_MAX_ARCHIVE_BYTES = 16 * 1024 ** 3;
+var TOP_KEYS = /* @__PURE__ */ new Set(["dropDir", "protectReleaseTags", "maxArchiveBytes", "owners"]);
+var OWNER_KEYS = /* @__PURE__ */ new Set(["username", "credential", "images"]);
+var FORBIDDEN_ROOTS = ["/etc", "/proc", "/sys", "/dev", "/run", "/boot", "/root", "/home", "/tmp", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/var/tmp"];
+var IMAGE_GLOB = /^[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?(?:\/[a-z0-9*](?:[a-z0-9._*-]*[a-z0-9*])?)*$/;
+var OWNER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,38})$/;
+var fail = (msg) => {
+  throw new Error(`config.ghcr${msg}`);
+};
+function strictKeys(o, allowed, where) {
+  const extra = Object.keys(o).filter((k) => !allowed.has(k));
+  if (extra.length) fail(`${where}: unknown key(s) ${extra.join(", ")} \u2014 expected ${[...allowed].join(", ")}`);
+}
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseGhcrConfig(raw) {
+  if (!isObject(raw)) return fail(": must be an object");
+  strictKeys(raw, TOP_KEYS, "");
+  const dropDir = raw.dropDir;
+  if (typeof dropDir !== "string" || !isAbsolute(dropDir)) fail('.dropDir: must be an absolute path, e.g. "/srv/gh-broker/ghcr-drop"');
+  const dir = normalize(dropDir).replace(/\/+$/, "");
+  if (!dir || dir !== dropDir.replace(/\/+$/, "")) fail(".dropDir: must be a normalized path (no ., .. or doubled slashes)");
+  if (dir.split("/").filter(Boolean).length < 2) fail(".dropDir: must be at least two levels deep, e.g. /srv/gh-broker/ghcr-drop");
+  for (const root of FORBIDDEN_ROOTS) {
+    if (dir === root || dir.startsWith(`${root}/`)) fail(`.dropDir: may not be under ${root}`);
+  }
+  if (raw.protectReleaseTags !== void 0 && typeof raw.protectReleaseTags !== "boolean") fail(".protectReleaseTags: must be a boolean");
+  let maxArchiveBytes = DEFAULT_MAX_ARCHIVE_BYTES;
+  if (raw.maxArchiveBytes !== void 0) {
+    const m = raw.maxArchiveBytes;
+    if (typeof m !== "number" || !Number.isSafeInteger(m) || m <= 0) fail(".maxArchiveBytes: must be a positive integer");
+    maxArchiveBytes = m;
+  }
+  if (!isObject(raw.owners) || Object.keys(raw.owners).length === 0) fail(".owners: must be an object with at least one owner");
+  const owners = {};
+  for (const [name, v] of Object.entries(raw.owners)) {
+    const owner2 = name.toLowerCase();
+    if (!OWNER_NAME.test(owner2)) fail(`.owners: "${name}" is not a valid GitHub owner name`);
+    if (!isObject(v)) fail(`.owners.${name}: must be an object`);
+    const o = v;
+    strictKeys(o, OWNER_KEYS, `.owners.${name}`);
+    if (typeof o.username !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/.test(o.username)) fail(`.owners.${name}.username: must be the GitHub login that owns the PAT`);
+    if (typeof o.credential !== "string" || !/^cred:[A-Za-z0-9._-]+$/.test(o.credential) || /^cred:\.\.?$/.test(o.credential)) {
+      fail(`.owners.${name}.credential: must be a "cred:<name>" ref`);
+    }
+    if (!Array.isArray(o.images) || o.images.length === 0) fail(`.owners.${name}.images: must be a non-empty list of image names or globs`);
+    for (const img of o.images) {
+      if (typeof img !== "string" || img.length > 255 || !IMAGE_GLOB.test(img)) {
+        fail(`.owners.${name}.images: "${String(img)}" is not a valid image name or glob (lowercase, [a-z0-9._-], "/" between segments, "*" within a segment)`);
+      }
+    }
+    owners[owner2] = { username: o.username, credential: o.credential, images: [...o.images] };
+  }
+  return { dropDir: dir, protectReleaseTags: raw.protectReleaseTags !== false, maxArchiveBytes, owners };
+}
+function ghcrCredRefs(cfg) {
+  return cfg ? Object.values(cfg.owners).map((o) => o.credential) : [];
+}
+function imageGlobToRegExp(glob) {
+  const body = glob.split("*").map((part) => part.replace(/[.\\^$+?()[\]{}|-]/g, "\\$&")).join("[a-z0-9._-]*");
+  return new RegExp(`^${body}$`);
+}
+function imageAllowed(owner2, image2) {
+  return owner2.images.some((g) => imageGlobToRegExp(g).test(image2));
+}
+
+// src/config.ts
 var MODES = ["read", "write"];
 function loadConfig(path) {
   let raw;
@@ -7382,15 +7451,15 @@ function loadConfig(path) {
   });
   if (typeof c.owners !== "object" || c.owners === null) throw new Error("config.owners: must be an object");
   const owners = {};
-  for (const [owner, v] of Object.entries(c.owners)) {
+  for (const [owner2, v] of Object.entries(c.owners)) {
     const o = v;
     if (typeof o.read !== "string" || typeof o.write !== "string") {
-      throw new Error(`config.owners.${owner}: needs "read" and "write" credential refs`);
+      throw new Error(`config.owners.${owner2}: needs "read" and "write" credential refs`);
     }
     if (o.installationId !== void 0 && typeof o.installationId !== "number") {
-      throw new Error(`config.owners.${owner}.installationId: must be a number`);
+      throw new Error(`config.owners.${owner2}.installationId: must be a number`);
     }
-    owners[owner.toLowerCase()] = {
+    owners[owner2.toLowerCase()] = {
       read: o.read,
       write: o.write,
       ...typeof o.installationId === "number" ? { installationId: o.installationId } : {}
@@ -7432,6 +7501,29 @@ function loadConfig(path) {
       ...typeof s.path === "string" ? { path: s.path } : {}
     };
   }
+  let npm;
+  if (c.npm !== void 0) {
+    if (typeof c.npm !== "object" || c.npm === null || Array.isArray(c.npm)) throw new Error("config.npm: must be an object");
+    const n = c.npm;
+    if (typeof n.token !== "string" || !n.token.startsWith("cred:")) throw new Error('config.npm.token: must be a "cred:<name>" ref');
+    if (!Array.isArray(n.scopes) || n.scopes.length === 0) throw new Error('config.npm.scopes: must be a non-empty array of scopes, e.g. ["@cldmv"]');
+    const scopes = n.scopes.map((s, i) => {
+      if (typeof s !== "string" || !/^@[a-z0-9][a-z0-9._~-]*$/.test(s)) throw new Error(`config.npm.scopes[${i}]: must be a lowercase npm scope like "@cldmv"`);
+      return s;
+    });
+    if (n.registry !== void 0 && (typeof n.registry !== "string" || !/^https:\/\//.test(n.registry))) {
+      throw new Error("config.npm.registry: must be an https URL");
+    }
+    if (n.tokenOrgs !== void 0 && (!Array.isArray(n.tokenOrgs) || !n.tokenOrgs.every((o) => typeof o === "string" && /^[a-z0-9][a-z0-9._~-]*$/.test(o)))) {
+      throw new Error('config.npm.tokenOrgs: must be an array of lowercase npm org names, e.g. ["cldmv"]');
+    }
+    npm = {
+      token: n.token,
+      scopes,
+      ...typeof n.registry === "string" ? { registry: n.registry } : {},
+      ...Array.isArray(n.tokenOrgs) ? { tokenOrgs: n.tokenOrgs } : {}
+    };
+  }
   return {
     listen: c.listen,
     upstream: c.upstream,
@@ -7439,7 +7531,9 @@ function loadConfig(path) {
     owners,
     ...app ? { app } : {},
     ...secrets ? { secrets } : {},
-    ...defaultOwner ? { defaultOwner } : {}
+    ...defaultOwner ? { defaultOwner } : {},
+    ...npm ? { npm } : {},
+    ...c.ghcr !== void 0 ? { ghcr: parseGhcrConfig(c.ghcr) } : {}
   };
 }
 function indexTools(tools) {
@@ -7463,6 +7557,20 @@ function loadSecretStore(config2) {
   }
 }
 var SAFE_CRED_NAME = /^[A-Za-z0-9._-]+$/;
+function storeFrom(read) {
+  return {
+    resolve: (ref) => read(credName(ref)),
+    has: (ref) => {
+      const name = credName(ref);
+      try {
+        read(name);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
 function assertSafeName(name) {
   if (name === "." || name === ".." || !SAFE_CRED_NAME.test(name)) {
     throw new Error(`secrets: unsafe credential name "${name}" (allowed: letters, digits, ".", "_", "-")`);
@@ -7474,9 +7582,9 @@ function credName(ref) {
   return assertSafeName(ref.slice(CRED_PREFIX.length));
 }
 function validateRefs(config2, read) {
-  for (const [owner, creds] of Object.entries(config2.owners)) {
+  for (const [owner2, creds] of Object.entries(config2.owners)) {
     for (const ref of [creds.read, creds.write]) {
-      if (!ref.startsWith(CRED_PREFIX)) throw new Error(`secrets: owner "${owner}" ref must be "cred:<name>", got "${ref}"`);
+      if (!ref.startsWith(CRED_PREFIX)) throw new Error(`secrets: owner "${owner2}" ref must be "cred:<name>", got "${ref}"`);
       read(assertSafeName(ref.slice(CRED_PREFIX.length)));
     }
   }
@@ -7486,6 +7594,11 @@ function validateRefs(config2, read) {
     }
     read(assertSafeName(config2.app.privateKey.slice(CRED_PREFIX.length)));
   }
+  if (config2.npm) {
+    if (!config2.npm.token.startsWith(CRED_PREFIX)) throw new Error(`secrets: config.npm.token must be a "cred:<name>" ref, got "${config2.npm.token}"`);
+    assertSafeName(config2.npm.token.slice(CRED_PREFIX.length));
+  }
+  for (const ref of ghcrCredRefs(config2.ghcr)) credName(ref);
 }
 function systemdCredsStore(config2) {
   const dir = process.env.CREDENTIALS_DIRECTORY;
@@ -7507,7 +7620,7 @@ function systemdCredsStore(config2) {
     return val;
   };
   validateRefs(config2, read);
-  return { resolve: (ref) => read(credName(ref)) };
+  return storeFrom(read);
 }
 function fileStore(config2) {
   const path = resolveSecretsPath(config2.secrets?.path);
@@ -7529,7 +7642,7 @@ function fileStore(config2) {
     return token;
   };
   validateRefs(config2, read);
-  return { resolve: (ref) => read(credName(ref)) };
+  return storeFrom(read);
 }
 
 // node_modules/zod/v4/core/core.js
@@ -7644,7 +7757,7 @@ __export(util_exports, {
   getParsedType: () => getParsedType,
   getSizableOrigin: () => getSizableOrigin,
   hexToUint8Array: () => hexToUint8Array,
-  isObject: () => isObject,
+  isObject: () => isObject2,
   isPlainObject: () => isPlainObject,
   issue: () => issue,
   joinValues: () => joinValues,
@@ -7807,7 +7920,7 @@ function slugify(input) {
 }
 var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {
 };
-function isObject(data) {
+function isObject2(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
 var allowsEval = /* @__PURE__ */ cached(() => {
@@ -7826,7 +7939,7 @@ var allowsEval = /* @__PURE__ */ cached(() => {
   }
 });
 function isPlainObject(o) {
-  if (isObject(o) === false)
+  if (isObject2(o) === false)
     return false;
   const ctor = o.constructor;
   if (ctor === void 0)
@@ -7834,7 +7947,7 @@ function isPlainObject(o) {
   if (typeof ctor !== "function")
     return true;
   const prot = ctor.prototype;
-  if (isObject(prot) === false)
+  if (isObject2(prot) === false)
     return false;
   if (Object.prototype.hasOwnProperty.call(prot, "isPrototypeOf") === false) {
     return false;
@@ -9332,10 +9445,10 @@ function isValidJWT(token, algorithm = null) {
     const tokensParts = token.split(".");
     if (tokensParts.length !== 3)
       return false;
-    const [header] = tokensParts;
-    if (!header)
+    const [header2] = tokensParts;
+    if (!header2)
       return false;
-    const parsedHeader = JSON.parse(atob(header));
+    const parsedHeader = JSON.parse(atob(header2));
     if ("typ" in parsedHeader && parsedHeader?.typ !== "JWT")
       return false;
     if (!parsedHeader.alg)
@@ -9639,13 +9752,13 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject2 = isObject;
+  const isObject3 = isObject2;
   const catchall = def.catchall;
   let value;
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject3(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -9772,7 +9885,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return (payload, ctx) => fn(shape, payload, ctx);
   };
   let fastpass;
-  const isObject2 = isObject;
+  const isObject3 = isObject2;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -9781,7 +9894,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject2(input)) {
+    if (!isObject3(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -9904,7 +10017,7 @@ var $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnio
   });
   inst._zod.parse = (payload, ctx) => {
     const input = payload.value;
-    if (!isObject(input)) {
+    if (!isObject2(input)) {
       payload.issues.push({
         code: "invalid_type",
         expected: "object",
@@ -16295,15 +16408,15 @@ var Client = class extends Protocol {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = __toESM(require_content_type(), 1);
-function mediaTypeEssence(header) {
-  if (!header) {
+function mediaTypeEssence(header2) {
+  if (!header2) {
     return void 0;
   }
   try {
-    return import_content_type.default.parse(header).type;
+    return import_content_type.default.parse(header2).type;
   } catch {
-    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
-    if (essence === "" || header.slice(essence.length).includes(",")) {
+    const essence = (header2.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header2.slice(essence.length).includes(",")) {
       return void 0;
     }
     return essence;
@@ -18402,18 +18515,18 @@ var NullObject = /* @__PURE__ */ (() => {
   C.prototype = /* @__PURE__ */ Object.create(null);
   return C;
 })();
-function parse4(header, options) {
+function parse4(header2, options) {
   const stopChar = options?.comma === true ? COMMA : 65536;
-  const len = header.length;
-  let index = skipOWS(header, options?.start ?? 0, len);
+  const len = header2.length;
+  let index = skipOWS(header2, options?.start ?? 0, len);
   const valueStart = index;
-  index = skipValue(header, index, len, stopChar);
-  const valueEnd = trailingOWS(header, valueStart, index);
-  const type = header.slice(valueStart, valueEnd).toLowerCase();
+  index = skipValue(header2, index, len, stopChar);
+  const valueEnd = trailingOWS(header2, valueStart, index);
+  const type = header2.slice(valueStart, valueEnd).toLowerCase();
   if (options?.parameters === false) {
     return { type, index, parameters: new NullObject() };
   }
-  return parseParameters(header, type, index, len, stopChar);
+  return parseParameters(header2, type, index, len, stopChar);
 }
 var SP = 32;
 var HTAB = 9;
@@ -18422,36 +18535,36 @@ var EQ = 61;
 var DQUOTE = 34;
 var BSLASH = 92;
 var COMMA = 44;
-function parseParameters(header, type, index, len, stopChar) {
+function parseParameters(header2, type, index, len, stopChar) {
   const parameters = new NullObject();
   parameter: while (index < len) {
-    if (header.charCodeAt(index) === stopChar)
+    if (header2.charCodeAt(index) === stopChar)
       break;
-    index = skipOWS(header, index + 1, len);
+    index = skipOWS(header2, index + 1, len);
     const keyStart = index;
     while (index < len) {
-      const code = header.charCodeAt(index);
+      const code = header2.charCodeAt(index);
       if (code === stopChar)
         break parameter;
       if (code === SEMI)
         continue parameter;
       if (code === EQ) {
-        const keyEnd = trailingOWS(header, keyStart, index);
-        const key2 = header.slice(keyStart, keyEnd).toLowerCase();
-        index = skipOWS(header, index + 1, len);
-        if (index < len && header.charCodeAt(index) === DQUOTE) {
+        const keyEnd = trailingOWS(header2, keyStart, index);
+        const key2 = header2.slice(keyStart, keyEnd).toLowerCase();
+        index = skipOWS(header2, index + 1, len);
+        if (index < len && header2.charCodeAt(index) === DQUOTE) {
           index++;
           let value = "";
           while (index < len) {
-            const code2 = header.charCodeAt(index++);
+            const code2 = header2.charCodeAt(index++);
             if (code2 === DQUOTE) {
-              index = skipValue(header, index, len, stopChar);
+              index = skipValue(header2, index, len, stopChar);
               if (parameters[key2] === void 0)
                 parameters[key2] = value;
               break;
             }
             if (code2 === BSLASH && index < len) {
-              value += header[index++];
+              value += header2[index++];
               continue;
             }
             value += String.fromCharCode(code2);
@@ -18459,10 +18572,10 @@ function parseParameters(header, type, index, len, stopChar) {
           continue parameter;
         }
         const valueStart = index;
-        index = skipValue(header, index, len, stopChar);
+        index = skipValue(header2, index, len, stopChar);
         if (parameters[key2] === void 0) {
-          const valueEnd = trailingOWS(header, valueStart, index);
-          parameters[key2] = header.slice(valueStart, valueEnd);
+          const valueEnd = trailingOWS(header2, valueStart, index);
+          parameters[key2] = header2.slice(valueStart, valueEnd);
         }
         continue parameter;
       }
@@ -18480,18 +18593,18 @@ function skipValue(str, index, len, stopChar) {
   }
   return index;
 }
-function skipOWS(header, index, len) {
+function skipOWS(header2, index, len) {
   while (index < len) {
-    const char = header.charCodeAt(index);
+    const char = header2.charCodeAt(index);
     if (char !== SP && char !== HTAB)
       break;
     index++;
   }
   return index;
 }
-function trailingOWS(header, start, end) {
+function trailingOWS(header2, start, end) {
   while (end > start) {
-    const char = header.charCodeAt(end - 1);
+    const char = header2.charCodeAt(end - 1);
     if (char !== SP && char !== HTAB)
       break;
     end--;
@@ -18519,8 +18632,8 @@ var stringifyIteratively = (rootValue, replacer, spaceParam) => {
   const isFunctionReplacer = typeof replacer === "function";
   const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null;
   const prepareVal = (parent, key2, val) => {
-    const isObject2 = val !== null && typeof val === "object";
-    const hasToJSON = isObject2 && typeof val.toJSON === "function";
+    const isObject3 = val !== null && typeof val === "object";
+    const hasToJSON = isObject3 && typeof val.toJSON === "function";
     if (hasToJSON) {
       val = val.toJSON(key2);
     }
@@ -19352,6 +19465,23 @@ function audit(entry) {
   console.log(JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry }));
 }
 
+// src/availability.ts
+var GHCR_TOOLS = /* @__PURE__ */ new Set(["ghcr_push", "ghcr_push_status", "ghcr_tags"]);
+function unavailableReason(rule, config2, secrets) {
+  if (rule.name === "npm_scaffold") {
+    if (!config2.npm) return "the npm integration is not configured (enable it with the installer's --npm)";
+    if (!secrets.has(config2.npm.token)) return `its credential "${config2.npm.token.replace(/^cred:/, "")}" is not stored (re-run the installer with --npm)`;
+  }
+  if (GHCR_TOOLS.has(rule.name)) {
+    if (!config2.ghcr) return "GHCR pushes are not configured (config.ghcr)";
+    const refs = ghcrCredRefs(config2.ghcr);
+    if (!refs.some((ref) => secrets.has(ref))) {
+      return `no GHCR credential is stored (${refs.map((r) => `"${r.replace(/^cred:/, "")}"`).join(", ")}; re-run the installer to add one)`;
+    }
+  }
+  return void 0;
+}
+
 // src/verbs/review_thread.ts
 var RESOLVE_THREAD = `
 	mutation($threadId: ID!) {
@@ -19505,14 +19635,14 @@ async function paginateAfter(octokit, budget, route, params, limit) {
   }
   return out.length > limit ? out.slice(0, limit) : out;
 }
-async function listOwnerRepos(octokit, budget, owner, maxRepos) {
+async function listOwnerRepos(octokit, budget, owner2, maxRepos) {
   let raw;
   try {
-    raw = await paginate(octokit, budget, "GET /orgs/{owner}/repos", { owner, type: "all" }, maxRepos);
+    raw = await paginate(octokit, budget, "GET /orgs/{owner}/repos", { owner: owner2, type: "all" }, maxRepos);
   } catch (err) {
     if (err instanceof RateLimited || err instanceof CallBudgetExhausted) throw err;
     if (err.status !== 404) throw err;
-    raw = await paginate(octokit, budget, "GET /users/{username}/repos", { username: owner, type: "all" }, maxRepos);
+    raw = await paginate(octokit, budget, "GET /users/{username}/repos", { username: owner2, type: "all" }, maxRepos);
   }
   return raw.filter((r) => !r.archived).map((r) => r.name);
 }
@@ -19524,19 +19654,19 @@ var DEFAULT_PER_REPO_LIMIT = 200;
 var HARD_PER_REPO_LIMIT = 1e3;
 var DEFAULT_MAX_API_CALLS = 250;
 var HARD_MAX_API_CALLS = 1e3;
-async function listUnlabeledIssues(octokit, budget, owner, repo, state, limit) {
-  const raw = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/issues", { owner, repo, state }, limit);
+async function listUnlabeledIssues(octokit, budget, owner2, repo, state, limit) {
+  const raw = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/issues", { owner: owner2, repo, state }, limit);
   const issuesOnly = raw.filter((it) => !("pull_request" in it));
-  const unlabeled = issuesOnly.filter((it) => it.labels.length === 0).map((it) => toUnlabeledItem(owner, repo, "issue", it));
+  const unlabeled = issuesOnly.filter((it) => it.labels.length === 0).map((it) => toUnlabeledItem(owner2, repo, "issue", it));
   return { scanned: issuesOnly.length, unlabeled };
 }
-async function listUnlabeledPulls(octokit, budget, owner, repo, state, limit, includeDrafts) {
-  const raw = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls", { owner, repo, state }, limit);
-  const unlabeled = raw.filter((it) => includeDrafts || !it.draft).filter((it) => it.labels.length === 0).map((it) => toUnlabeledItem(owner, repo, "pull", it));
+async function listUnlabeledPulls(octokit, budget, owner2, repo, state, limit, includeDrafts) {
+  const raw = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls", { owner: owner2, repo, state }, limit);
+  const unlabeled = raw.filter((it) => includeDrafts || !it.draft).filter((it) => it.labels.length === 0).map((it) => toUnlabeledItem(owner2, repo, "pull", it));
   return { scanned: raw.length, unlabeled };
 }
-function toUnlabeledItem(owner, repo, type, it) {
-  return { repo: `${owner}/${repo}`, type, number: it.number, title: it.title, url: it.html_url, createdAt: it.created_at };
+function toUnlabeledItem(owner2, repo, type, it) {
+  return { repo: `${owner2}/${repo}`, type, number: it.number, title: it.title, url: it.html_url, createdAt: it.created_at };
 }
 async function reportUnlabeled(octokit, input) {
   const target = input.target ?? "both";
@@ -19605,11 +19735,11 @@ async function getOrUndefined(octokit, budget, route, params) {
     throw err;
   }
 }
-async function classifyRepo(octokit, budget, owner, repo) {
-  const info = await getOrUndefined(octokit, budget, "GET /repos/{owner}/{repo}", { owner, repo });
+async function classifyRepo(octokit, budget, owner2, repo) {
+  const info = await getOrUndefined(octokit, budget, "GET /repos/{owner}/{repo}", { owner: owner2, repo });
   const defaultBranch = info?.default_branch;
   const workflow = await getOrUndefined(octokit, budget, "GET /repos/{owner}/{repo}/contents/{path}", {
-    owner,
+    owner: owner2,
     repo,
     path: ".github/workflows/next-release.yml",
     ...defaultBranch ? { ref: defaultBranch } : {}
@@ -19617,7 +19747,7 @@ async function classifyRepo(octokit, budget, owner, repo) {
   const v4Workflow = workflow !== void 0;
   if (!v4Workflow) return { tier: "non-v4", signals: { v4Workflow, ...defaultBranch ? { defaultBranch } : {} } };
   const sha = async (branch) => {
-    const b = await getOrUndefined(octokit, budget, "GET /repos/{owner}/{repo}/branches/{branch}", { owner, repo, branch });
+    const b = await getOrUndefined(octokit, budget, "GET /repos/{owner}/{repo}/branches/{branch}", { owner: owner2, repo, branch });
     return b?.commit?.sha;
   };
   const [defaultSha, nextSha, devSha] = await Promise.all([defaultBranch ? sha(defaultBranch) : void 0, sha("next"), sha("dev")]);
@@ -19643,10 +19773,10 @@ var HARD_ALERT_LIMIT = 5e3;
 var DEFAULT_MAX_API_CALLS2 = 700;
 var HARD_MAX_API_CALLS2 = 3e3;
 var SEVERITY_RANK = { critical: 0, high: 1, error: 1, medium: 2, moderate: 2, warning: 3, low: 4, note: 5 };
-function normalizeDependabot(owner, repo, a) {
+function normalizeDependabot(owner2, repo, a) {
   const vuln = a.security_vulnerability;
   const out = {
-    repo: a.repository?.full_name ?? `${owner}/${repo}`,
+    repo: a.repository?.full_name ?? `${owner2}/${repo}`,
     type: "dependabot",
     number: a.number,
     severity: vuln?.severity ?? a.security_advisory?.severity ?? "unknown",
@@ -19664,9 +19794,9 @@ function normalizeDependabot(owner, repo, a) {
   if (vuln?.first_patched_version?.identifier) out.patchedVersion = vuln.first_patched_version.identifier;
   return out;
 }
-function normalizeCodeql(owner, repo, a) {
+function normalizeCodeql(owner2, repo, a) {
   const out = {
-    repo: a.repository?.full_name ?? `${owner}/${repo}`,
+    repo: a.repository?.full_name ?? `${owner2}/${repo}`,
     type: "codeql",
     number: a.number,
     severity: a.rule?.security_severity_level ?? a.rule?.severity ?? "unknown",
@@ -19680,9 +19810,9 @@ function normalizeCodeql(owner, repo, a) {
   if (loc?.path) out.location = loc.start_line !== void 0 ? `${loc.path}:${loc.start_line}` : loc.path;
   return out;
 }
-function normalizeSecret(owner, repo, a) {
+function normalizeSecret(owner2, repo, a) {
   const out = {
-    repo: a.repository?.full_name ?? `${owner}/${repo}`,
+    repo: a.repository?.full_name ?? `${owner2}/${repo}`,
     type: "secrets",
     number: a.number,
     severity: "open",
@@ -19737,9 +19867,9 @@ async function reportSecurityAlerts(octokit, input) {
   const disabled = {};
   let truncatedReason;
   let retryAfterSeconds;
-  const addAll = (type, owner, repo, raws) => {
+  const addAll = (type, owner2, repo, raws) => {
     const spec = SPECS[type];
-    for (const raw of raws) alerts.push(spec.normalize(owner, repo, raw));
+    for (const raw of raws) alerts.push(spec.normalize(owner2, repo, raw));
   };
   try {
     let sweep = [];
@@ -19827,8 +19957,8 @@ async function reportSecurityAlerts(octokit, input) {
   if (input.classify) {
     try {
       for (const row of byRepo) {
-        const [owner, repo] = row.repo.includes("/") ? row.repo.split("/") : [input.owner, row.repo];
-        const t = await classifyRepo(octokit, budget, owner, repo);
+        const [owner2, repo] = row.repo.includes("/") ? row.repo.split("/") : [input.owner, row.repo];
+        const t = await classifyRepo(octokit, budget, owner2, repo);
         row.tier = t.tier;
         row.tierSignals = t.signals;
       }
@@ -19960,9 +20090,9 @@ function decodeContent(data) {
   if (!d || typeof d.content !== "string") return void 0;
   return d.encoding === "base64" ? Buffer.from(d.content, "base64").toString("utf8") : d.content;
 }
-async function getText(octokit, budget, owner, repo, path, ref) {
+async function getText(octokit, budget, owner2, repo, path, ref) {
   try {
-    return decodeContent(await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/contents/{path}", { owner, repo, path, ref }));
+    return decodeContent(await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/contents/{path}", { owner: owner2, repo, path, ref }));
   } catch (err) {
     if (err instanceof RateLimited || err instanceof CallBudgetExhausted) throw err;
     if (err.status === 404) return void 0;
@@ -19970,14 +20100,14 @@ async function getText(octokit, budget, owner, repo, path, ref) {
   }
 }
 async function analyzeRelease(octokit, budget, args) {
-  const { owner, repo } = args;
-  const open = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls", { owner, repo, state: "open", base: args.head }, 200);
+  const { owner: owner2, repo } = args;
+  const open = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls", { owner: owner2, repo, state: "open", base: args.head }, 200);
   const openPrs = open.map(classifyOpenPr);
   let freshness;
   if (args.changelogPath && args.version) {
-    const commits = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls/{pull_number}/commits", { owner, repo, pull_number: args.pull }, 300);
-    const changelog = await getText(octokit, budget, owner, repo, args.changelogPath, args.head) ?? "";
-    const readme = await getText(octokit, budget, owner, repo, "README.md", args.head);
+    const commits = await paginate(octokit, budget, "GET /repos/{owner}/{repo}/pulls/{pull_number}/commits", { owner: owner2, repo, pull_number: args.pull }, 300);
+    const changelog = await getText(octokit, budget, owner2, repo, args.changelogPath, args.head) ?? "";
+    const readme = await getText(octokit, budget, owner2, repo, "README.md", args.head);
     freshness = assessFreshness(args.version, changelog, releaseCommitPrs(commits.map((c) => c.commit?.message ?? "")), readme);
   }
   const decision = decideVerdict({ hasChangelog: Boolean(args.changelogPath), unknownVersion: args.version === null, freshness, openPrs, version: args.version });
@@ -20006,10 +20136,10 @@ function repoFromUrl(repositoryUrl) {
   const parts = repositoryUrl.split("/");
   return { owner: parts[parts.length - 2], repo: parts[parts.length - 1] };
 }
-async function findChangelog(octokit, budget, owner, repo, ref, paths) {
+async function findChangelog(octokit, budget, owner2, repo, ref, paths) {
   for (const path of paths) {
     try {
-      await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/contents/{path}", { owner, repo, path, ref });
+      await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/contents/{path}", { owner: owner2, repo, path, ref });
       return path;
     } catch (err) {
       if (err instanceof RateLimited || err instanceof CallBudgetExhausted) throw err;
@@ -20035,11 +20165,11 @@ async function reportReleasePrs(octokit, input) {
     if (search.total_count > search.items.length) truncatedReason = "max-results";
     else if (search.incomplete_results) truncatedReason = "incomplete-search";
     for (const hit of search.items) {
-      const { owner, repo } = repoFromUrl(hit.repository_url);
-      const pull = await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/pulls/{pull_number}", { owner, repo, pull_number: hit.number });
+      const { owner: owner2, repo } = repoFromUrl(hit.repository_url);
+      const pull = await reqOne(octokit, budget, "GET /repos/{owner}/{repo}/pulls/{pull_number}", { owner: owner2, repo, pull_number: hit.number });
       const version2 = parseReleaseVersion(hit.title);
       const base = {
-        repo: `${owner}/${repo}`,
+        repo: `${owner2}/${repo}`,
         pull: hit.number,
         url: hit.html_url,
         title: hit.title,
@@ -20053,12 +20183,12 @@ async function reportReleasePrs(octokit, input) {
         entry = { ...base, status: "unknown-version" };
       } else {
         const paths = changelogPaths(version2);
-        const found = await findChangelog(octokit, budget, owner, repo, pull.head.ref, paths);
+        const found = await findChangelog(octokit, budget, owner2, repo, pull.head.ref, paths);
         entry = found ? { ...base, status: "ready", changelogPath: found } : { ...base, status: "needs-changelog", checkedPaths: paths };
       }
       releasePrs.push(entry);
       if (input.analyze) {
-        entry.analysis = await analyzeRelease(octokit, budget, { owner, repo, pull: hit.number, head: pull.head.ref, version: version2, ...entry.changelogPath ? { changelogPath: entry.changelogPath } : {} });
+        entry.analysis = await analyzeRelease(octokit, budget, { owner: owner2, repo, pull: hit.number, head: pull.head.ref, version: version2, ...entry.changelogPath ? { changelogPath: entry.changelogPath } : {} });
       }
     }
   } catch (err) {
@@ -20109,18 +20239,18 @@ var DEFAULT_COLOR = "ededed";
 var MAX_LABELS = 100;
 var INPUT_KEYS = /* @__PURE__ */ new Set(["owner", "repo", "issue_number", "add", "remove", "swap", "set", "create_missing", "color"]);
 var SWAP_KEYS = /* @__PURE__ */ new Set(["prefix", "to"]);
-var fail = (msg) => {
+var fail2 = (msg) => {
   throw new Error(`issue_labels: ${msg}`);
 };
 function toList(v, field) {
   if (v === void 0) return [];
   const arr = Array.isArray(v) ? v : [v];
-  if (arr.length === 0) fail(`"${field}" is empty \u2014 pass at least one label name`);
+  if (arr.length === 0) fail2(`"${field}" is empty \u2014 pass at least one label name`);
   for (const x of arr) {
-    if (typeof x !== "string" || !x.trim()) fail(`"${field}" must be a label name or a list of label names`);
+    if (typeof x !== "string" || !x.trim()) fail2(`"${field}" must be a label name or a list of label names`);
   }
   const list = dedupe(arr.map((x) => x.trim()));
-  if (list.length > MAX_LABELS) fail(`"${field}" has ${list.length} labels \u2014 at most ${MAX_LABELS} per call`);
+  if (list.length > MAX_LABELS) fail2(`"${field}" has ${list.length} labels \u2014 at most ${MAX_LABELS} per call`);
   return list;
 }
 var key = (s) => s.toLowerCase();
@@ -20134,15 +20264,15 @@ function statusOf(err) {
 var fmt = (list) => `[${list.join(", ")}]`;
 var names = (data) => Array.isArray(data) ? data.map((l) => l.name) : [];
 function validate(input) {
-  if (typeof input !== "object" || input === null || Array.isArray(input)) fail("arguments must be an object");
+  if (typeof input !== "object" || input === null || Array.isArray(input)) fail2("arguments must be an object");
   const a = input;
   const unknown2 = Object.keys(a).filter((k) => !INPUT_KEYS.has(k));
-  if (unknown2.length) fail(`unknown argument(s): ${unknown2.join(", ")} \u2014 expected ${[...INPUT_KEYS].join(", ")}`);
-  if (typeof a.owner !== "string" || !a.owner.trim()) fail('"owner" must be a non-empty string');
-  if (typeof a.repo !== "string" || !a.repo.trim()) fail('"repo" must be a non-empty string');
-  if (typeof a.issue_number !== "number" || !Number.isInteger(a.issue_number) || a.issue_number <= 0) fail('"issue_number" must be a positive integer');
-  if (a.create_missing !== void 0 && typeof a.create_missing !== "boolean") fail('"create_missing" must be a boolean');
-  if (a.color !== void 0 && (typeof a.color !== "string" || !/^#?[0-9a-f]{6}$/i.test(a.color))) fail('"color" must be a 6-digit hex color, e.g. "ededed"');
+  if (unknown2.length) fail2(`unknown argument(s): ${unknown2.join(", ")} \u2014 expected ${[...INPUT_KEYS].join(", ")}`);
+  if (typeof a.owner !== "string" || !a.owner.trim()) fail2('"owner" must be a non-empty string');
+  if (typeof a.repo !== "string" || !a.repo.trim()) fail2('"repo" must be a non-empty string');
+  if (typeof a.issue_number !== "number" || !Number.isInteger(a.issue_number) || a.issue_number <= 0) fail2('"issue_number" must be a positive integer');
+  if (a.create_missing !== void 0 && typeof a.create_missing !== "boolean") fail2('"create_missing" must be a boolean');
+  if (a.color !== void 0 && (typeof a.color !== "string" || !/^#?[0-9a-f]{6}$/i.test(a.color))) fail2('"color" must be a 6-digit hex color, e.g. "ededed"');
   const add = toList(a.add, "add");
   const remove = toList(a.remove, "remove");
   const set2 = a.set === void 0 ? void 0 : toList(a.set, "set");
@@ -20150,23 +20280,23 @@ function validate(input) {
   let swapPrefix;
   if (a.swap !== void 0) {
     const sw = a.swap;
-    if (typeof sw !== "object" || sw === null || Array.isArray(sw)) fail('"swap" must be an object { prefix, to }');
+    if (typeof sw !== "object" || sw === null || Array.isArray(sw)) fail2('"swap" must be an object { prefix, to }');
     const extra = Object.keys(sw).filter((k) => !SWAP_KEYS.has(k));
-    if (extra.length) fail(`unknown "swap" key(s): ${extra.join(", ")} \u2014 expected prefix, to`);
-    if (typeof sw.prefix !== "string" || !sw.prefix) fail('"swap.prefix" is required');
-    if (sw.to === void 0) fail('"swap.to" needs at least one label');
+    if (extra.length) fail2(`unknown "swap" key(s): ${extra.join(", ")} \u2014 expected prefix, to`);
+    if (typeof sw.prefix !== "string" || !sw.prefix) fail2('"swap.prefix" is required');
+    if (sw.to === void 0) fail2('"swap.to" needs at least one label');
     swapPrefix = sw.prefix;
     swapTo = toList(sw.to, "swap.to");
   }
   if (set2 !== void 0 && (add.length || remove.length || swapPrefix !== void 0)) {
-    fail('"set" replaces the whole label set and cannot be combined with add/remove/swap');
+    fail2('"set" replaces the whole label set and cannot be combined with add/remove/swap');
   }
-  if (set2 === void 0 && !add.length && !remove.length && swapPrefix === void 0) fail("nothing to do \u2014 pass add, remove, swap or set");
+  if (set2 === void 0 && !add.length && !remove.length && swapPrefix === void 0) fail2("nothing to do \u2014 pass add, remove, swap or set");
   const addSide = dedupe([...add, ...swapTo]);
-  if (addSide.length > MAX_LABELS) fail(`${addSide.length} labels to add \u2014 at most ${MAX_LABELS} per call`);
+  if (addSide.length > MAX_LABELS) fail2(`${addSide.length} labels to add \u2014 at most ${MAX_LABELS} per call`);
   const removeKeys = new Set(remove.map(key));
   const clash = addSide.filter((l) => removeKeys.has(key(l)));
-  if (clash.length) fail(`label(s) both added and removed: ${clash.join(", ")}`);
+  if (clash.length) fail2(`label(s) both added and removed: ${clash.join(", ")}`);
   return {
     owner: a.owner,
     repo: a.repo,
@@ -20180,9 +20310,9 @@ function validate(input) {
   };
 }
 async function issueLabels(octokit, input) {
-  const { owner, repo, issue_number, remove, set: set2, swapPrefix, addSide, createMissing, color } = validate(input);
-  const issue2 = `${owner}/${repo}#${issue_number}`;
-  const base = { owner, repo, issue_number };
+  const { owner: owner2, repo, issue_number, remove, set: set2, swapPrefix, addSide, createMissing, color } = validate(input);
+  const issue2 = `${owner2}/${repo}#${issue_number}`;
+  const base = { owner: owner2, repo, issue_number };
   const readLabels = async () => names((await octokit.request("GET /repos/{owner}/{repo}/issues/{issue_number}/labels", { ...base, per_page: MAX_LABELS })).data);
   const before = await readLabels();
   const beforeKeys = new Set(before.map(key));
@@ -20192,7 +20322,7 @@ async function issueLabels(octokit, input) {
   const missing = [];
   for (const name of toResolve) {
     try {
-      const res = await octokit.request("GET /repos/{owner}/{repo}/labels/{name}", { owner, repo, name });
+      const res = await octokit.request("GET /repos/{owner}/{repo}/labels/{name}", { owner: owner2, repo, name });
       resolved.push(res.data.name);
     } catch (err) {
       if (statusOf(err) !== 404) throw err;
@@ -20200,7 +20330,7 @@ async function issueLabels(octokit, input) {
     }
   }
   if (missing.length && !createMissing) {
-    fail(`label(s) not found in ${owner}/${repo}: ${missing.join(", ")} \u2014 nothing was changed. Check the spelling (list_label), or pass create_missing: true to create them.`);
+    fail2(`label(s) not found in ${owner2}/${repo}: ${missing.join(", ")} \u2014 nothing was changed. Check the spelling (list_label), or pass create_missing: true to create them.`);
   }
   const removals = [];
   if (set2 === void 0) {
@@ -20223,7 +20353,7 @@ async function issueLabels(octokit, input) {
   const canon = (n) => canonical().find((c) => key(c) === key(n)) ?? n;
   try {
     for (const name of missing) {
-      const res = await octokit.request("POST /repos/{owner}/{repo}/labels", { owner, repo, name, color });
+      const res = await octokit.request("POST /repos/{owner}/{repo}/labels", { owner: owner2, repo, name, color });
       created.push(res.data.name);
     }
     if (set2 !== void 0) {
@@ -20336,7 +20466,7 @@ function truncationFrom(err) {
   if (err instanceof CallBudgetExhausted) return { truncated: true, truncatedReason: "max-api-calls" };
   return void 0;
 }
-async function computeForPull(octokit, budget, owner, repo, pullNumber, headSha, verbosity, logLines, fetchFailedJobLogs) {
+async function computeForPull(octokit, budget, owner2, repo, pullNumber, headSha, verbosity, logLines, fetchFailedJobLogs) {
   const summary = { passed: 0, failed: 0, pending: 0 };
   const failures = [];
   try {
@@ -20344,7 +20474,7 @@ async function computeForPull(octokit, budget, owner, repo, pullNumber, headSha,
       octokit,
       budget,
       "GET /repos/{owner}/{repo}/actions/runs",
-      { owner, repo, head_sha: headSha },
+      { owner: owner2, repo, head_sha: headSha },
       100,
       (d) => d.workflow_runs
     );
@@ -20360,7 +20490,7 @@ async function computeForPull(octokit, budget, owner, repo, pullNumber, headSha,
           octokit,
           budget,
           "GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs",
-          { owner, repo, run_id: run.id },
+          { owner: owner2, repo, run_id: run.id },
           100,
           (d) => d.jobs
         );
@@ -20389,12 +20519,12 @@ async function computeForPull(octokit, budget, owner, repo, pullNumber, headSha,
 function clampVerbosity(v) {
   return Math.min(Math.max(v ?? 0, 0), 3);
 }
-async function ciStatusForHeadSha(octokit, owner, repo, pullNumber, headSha, opts = {}) {
+async function ciStatusForHeadSha(octokit, owner2, repo, pullNumber, headSha, opts = {}) {
   const budget = new CallBudget(Math.min(opts.maxApiCalls ?? DEFAULT_MAX_API_CALLS4, HARD_MAX_API_CALLS4));
   return computeForPull(
     octokit,
     budget,
-    owner,
+    owner2,
     repo,
     pullNumber,
     headSha,
@@ -20468,13 +20598,1279 @@ var REPORT_CI_STATUS_SCHEMA = {
   }
 };
 
+// src/verbs/npm-registry.ts
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+var NpmOtpRequired = class extends Error {
+  constructor(what) {
+    super(`npm: ${what} needs a one-time password (missing, expired or already used)`);
+    this.name = "NpmOtpRequired";
+  }
+};
+var NpmHttpError = class extends Error {
+  status;
+  constructor(what, status, detail) {
+    super(`npm: ${what} failed (HTTP ${status})${detail ? `: ${detail}` : ""}`);
+    this.name = "NpmHttpError";
+    this.status = status;
+  }
+};
+function escapePackageName(name) {
+  return name.replace("/", "%2f");
+}
+function errorDetail(body) {
+  try {
+    const j = JSON.parse(body);
+    const msg = [j.error, j.message, j.reason].find((v) => typeof v === "string" && v);
+    if (typeof msg === "string") return msg.slice(0, 300);
+  } catch {
+  }
+  return body.trim().slice(0, 300);
+}
+var NpmRegistry = class {
+  base;
+  token;
+  fetchImpl;
+  constructor(opts) {
+    this.base = (opts.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
+    this.token = opts.token;
+    this.fetchImpl = opts.fetch ?? globalThis.fetch;
+  }
+  get registry() {
+    return this.base;
+  }
+  async send(what, method, path, opts = {}) {
+    const headers = {
+      authorization: `Bearer ${this.token}`,
+      accept: "application/json",
+      "user-agent": "gh-broker (npm_scaffold)"
+    };
+    if (opts.otp) headers["npm-otp"] = opts.otp;
+    if (opts.body !== void 0) headers["content-type"] = "application/json";
+    const res = await this.fetchImpl(`${this.base}${path}`, {
+      method,
+      headers,
+      ...opts.body !== void 0 ? { body: JSON.stringify(opts.body) } : {}
+    });
+    const body = await res.text();
+    if (res.status === 401) {
+      const auth7 = (res.headers.get("www-authenticate") ?? "").toLowerCase();
+      if (auth7.includes("otp") || /one-time pass/i.test(body)) throw new NpmOtpRequired(what);
+    }
+    return { status: res.status, body };
+  }
+  /**
+   * The package's registry document, or undefined when it does not exist (or is not visible to
+   * the token). `?write=true` reads from the primary rather than a cache, as npm itself does
+   * before a write: a stale 404 here is the one thing that could let a placeholder land on a
+   * package that already exists.
+   */
+  async packument(name) {
+    const res = await this.send("package lookup", "GET", `/${escapePackageName(name)}?write=true`);
+    if (res.status === 404) return void 0;
+    if (res.status !== 200) throw new NpmHttpError("package lookup", res.status, errorDetail(res.body));
+    return JSON.parse(res.body);
+  }
+  /** First publish of a package: PUT of the full document with the tarball attached. */
+  async publish(document, name, otp) {
+    const res = await this.send("publish", "PUT", `/${escapePackageName(name)}`, { otp, body: document });
+    if (res.status < 200 || res.status >= 300) throw new NpmHttpError("publish", res.status, errorDetail(res.body));
+  }
+  /**
+   * Adds a GitHub Actions trusted publisher. A 409 means the package already has a trusted
+   * publisher, which may or may not be this one, so it is reported as `conflict` for the
+   * caller to check against listGithubTrust rather than as success.
+   */
+  async addGithubTrust(name, claims, otp) {
+    const body = [{ type: "github", claims: { repository: claims.repository, workflow_ref: { file: claims.file } }, permissions: ["createPackage"] }];
+    const res = await this.send("trusted publisher setup", "POST", `/-/package/${escapePackageName(name)}/trust`, { otp, body });
+    if (res.status === 409) return { conflict: true };
+    if (res.status < 200 || res.status >= 300) throw new NpmHttpError("trusted publisher setup", res.status, errorDetail(res.body));
+    let parsed;
+    try {
+      parsed = JSON.parse(res.body);
+    } catch {
+      return { conflict: false };
+    }
+    const first = Array.isArray(parsed) ? parsed[0] : parsed;
+    return { config: first && typeof first === "object" ? first : void 0, conflict: false };
+  }
+  /** The package's trusted-publisher configurations (`npm trust list`). May need an OTP. */
+  async listTrust(name, otp) {
+    const res = await this.send("trusted publisher lookup", "GET", `/-/package/${escapePackageName(name)}/trust`, otp ? { otp } : {});
+    if (res.status !== 200) throw new NpmHttpError("trusted publisher lookup", res.status, errorDetail(res.body));
+    let parsed;
+    try {
+      parsed = JSON.parse(res.body);
+    } catch {
+      throw new NpmHttpError("trusted publisher lookup", res.status, "response is not JSON");
+    }
+    return (Array.isArray(parsed) ? parsed : [parsed]).filter((c) => Boolean(c) && typeof c === "object");
+  }
+};
+
+// src/verbs/npm-tarball.ts
+import { createHash } from "node:crypto";
+import { gzipSync } from "node:zlib";
+var MTIME = 499162500;
+var BLOCK = 512;
+function header(name, size) {
+  const h = Buffer.alloc(BLOCK, 0);
+  const put = (value, offset, length) => {
+    h.write(value, offset, length, "ascii");
+  };
+  const octal = (n, length) => n.toString(8).padStart(length - 1, "0") + "\0";
+  put(name, 0, 100);
+  put(octal(420, 8), 100, 8);
+  put(octal(0, 8), 108, 8);
+  put(octal(0, 8), 116, 8);
+  put(octal(size, 12), 124, 12);
+  put(octal(MTIME, 12), 136, 12);
+  put("        ", 148, 8);
+  put("0", 156, 1);
+  put("ustar\0", 257, 6);
+  put("00", 263, 2);
+  let sum = 0;
+  for (const byte of h) sum += byte;
+  put(sum.toString(8).padStart(6, "0") + "\0 ", 148, 8);
+  return h;
+}
+function buildTarball(files) {
+  const parts = [];
+  for (const f of files) {
+    const name = `package/${f.path}`;
+    if (!/^[\x20-\x7e]+$/.test(name) || name.length > 100) throw new Error(`npm-tarball: unsupported path "${f.path}"`);
+    const body = Buffer.from(f.content, "utf8");
+    parts.push(header(name, body.length), body, Buffer.alloc((BLOCK - body.length % BLOCK) % BLOCK, 0));
+  }
+  parts.push(Buffer.alloc(BLOCK * 2, 0));
+  return gzipSync(Buffer.concat(parts), { level: 9 });
+}
+function tarballDigests(tarball) {
+  return {
+    integrity: `sha512-${createHash("sha512").update(tarball).digest("base64")}`,
+    shasum: createHash("sha1").update(tarball).digest("hex")
+  };
+}
+
+// src/verbs/npm_scaffold.ts
+var PLACEHOLDER_VERSION = "0.0.0-stage";
+var SCAFFOLD_MARKER = "gh-broker";
+var DEFAULT_WORKFLOW = "publish.yml";
+var INPUT_KEYS2 = /* @__PURE__ */ new Set(["owner", "repo", "package", "otp", "workflow"]);
+var PACKAGE_NAME = /^@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*$/;
+var NPM_SCAFFOLD_SCHEMA = {
+  type: "object",
+  properties: {
+    owner: { type: "string", description: "Repository owner (a configured owner)." },
+    repo: { type: "string", description: "Repository whose package.json names the package." },
+    package: { type: "string", description: 'Scoped package name, e.g. "@cldmv/new-thing". Must be under a scope in config.npm.scopes.' },
+    otp: { type: "string", description: "One-time password the user read from their authenticator. Ask the user for it right before calling; codes expire in about 30 seconds." },
+    workflow: { type: "string", description: `The repo's publish workflow file in .github/workflows. Default "publish.yml".` }
+  },
+  required: ["owner", "repo", "package", "otp"],
+  additionalProperties: false
+};
+var fail3 = (msg) => {
+  throw new Error(`npm_scaffold: ${msg}`);
+};
+function validate2(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) fail3("arguments must be an object");
+  const a = input;
+  const unknown2 = Object.keys(a).filter((k) => !INPUT_KEYS2.has(k));
+  if (unknown2.length) fail3(`unknown argument(s): ${unknown2.join(", ")} \u2014 expected ${[...INPUT_KEYS2].join(", ")}`);
+  if (typeof a.owner !== "string" || !/^[A-Za-z0-9-]+$/.test(a.owner)) fail3('"owner" must be a GitHub owner name');
+  if (typeof a.repo !== "string" || !/^[A-Za-z0-9._-]+$/.test(a.repo)) fail3('"repo" must be a repository name');
+  if (typeof a.package !== "string" || a.package.length > 214 || !PACKAGE_NAME.test(a.package)) fail3('"package" must be a lowercase scoped npm package name, e.g. "@cldmv/new-thing"');
+  if (typeof a.otp !== "string" || !/^[0-9]{6,8}$/.test(a.otp)) fail3('"otp" must be the 6-8 digit code from the authenticator');
+  if (a.workflow !== void 0 && (typeof a.workflow !== "string" || !/^[A-Za-z0-9._-]+\.ya?ml$/.test(a.workflow))) {
+    fail3('"workflow" must be a workflow file name in .github/workflows, e.g. "publish.yml"');
+  }
+  return {
+    owner: a.owner,
+    repo: a.repo,
+    package: a.package,
+    otp: a.otp,
+    workflow: a.workflow ?? DEFAULT_WORKFLOW
+  };
+}
+function statusOf2(err) {
+  return err?.status;
+}
+async function repoFile(octokit, owner2, repo, path, ref) {
+  try {
+    const res = await octokit.request("GET /repos/{owner}/{repo}/contents/{path}", { owner: owner2, repo, path, ref });
+    const d = res.data;
+    if (d.type !== "file" || typeof d.content !== "string") return void 0;
+    return d.encoding === "base64" ? Buffer.from(d.content, "base64").toString("utf8") : d.content;
+  } catch (err) {
+    if (statusOf2(err) === 404) return void 0;
+    throw err;
+  }
+}
+async function checkRepo(octokit, args) {
+  let info;
+  try {
+    info = (await octokit.request("GET /repos/{owner}/{repo}", { owner: args.owner, repo: args.repo })).data;
+  } catch (err) {
+    if (statusOf2(err) === 404) fail3(`repository ${args.owner}/${args.repo} not found`);
+    throw err;
+  }
+  const asked = `${args.owner}/${args.repo}`;
+  const repository = info.full_name ?? asked;
+  if (repository.toLowerCase() !== asked.toLowerCase()) fail3(`${asked} redirects to ${repository} (renamed or transferred) \u2014 call with the repository's current owner and name`);
+  if (info.archived) fail3(`repository ${repository} is archived`);
+  const ref = info.default_branch ?? "HEAD";
+  const raw = await repoFile(octokit, args.owner, args.repo, "package.json", ref);
+  if (raw === void 0) fail3(`${repository} has no package.json on ${ref}`);
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    return fail3(`${repository}'s package.json on ${ref} is not valid JSON`);
+  }
+  if (pkg.name !== args.package) fail3(`${repository}'s package.json on ${ref} names ${JSON.stringify(pkg.name)}, not "${args.package}"`);
+  if (pkg.private === true) fail3(`${repository}'s package.json is marked "private": true, so it is not meant to be published`);
+  if (await repoFile(octokit, args.owner, args.repo, `.github/workflows/${args.workflow}`, ref) === void 0) {
+    fail3(`${repository} has no .github/workflows/${args.workflow} on ${ref} \u2014 the trusted publisher must name the workflow that publishes`);
+  }
+  return {
+    repository,
+    isPrivate: info.private !== false,
+    ...typeof pkg.license === "string" ? { license: pkg.license } : {},
+    ...typeof pkg.description === "string" ? { description: pkg.description } : {}
+  };
+}
+function placeholderDocument(name, facts, access, registry2) {
+  const repoUrl = `https://github.com/${facts.repository}`;
+  const manifest = {
+    name,
+    version: PLACEHOLDER_VERSION,
+    description: `Placeholder for ${name}. Releases are published from ${repoUrl} by CI.`,
+    license: facts.license ?? "UNLICENSED",
+    repository: { type: "git", url: `git+${repoUrl}.git` },
+    homepage: `${repoUrl}#readme`,
+    scaffoldedBy: SCAFFOLD_MARKER
+  };
+  const readme = `# ${name}
+
+This version is a placeholder that reserves the package name so the repository's release workflow can publish it with npm trusted publishing.
+
+${facts.description ? `${facts.description}
+
+` : ""}Source and real releases: ${repoUrl}
+`;
+  const tarball = buildTarball([
+    { path: "package.json", content: JSON.stringify(manifest, null, "	") + "\n" },
+    { path: "README.md", content: readme }
+  ]);
+  const { integrity, shasum } = tarballDigests(tarball);
+  const tarballName = `${name}-${PLACEHOLDER_VERSION}.tgz`;
+  const unscoped = name.split("/")[1];
+  return {
+    _id: name,
+    name,
+    description: manifest.description,
+    "dist-tags": { latest: PLACEHOLDER_VERSION },
+    access,
+    versions: {
+      [PLACEHOLDER_VERSION]: {
+        ...manifest,
+        readme,
+        _id: `${name}@${PLACEHOLDER_VERSION}`,
+        dist: { integrity, shasum, tarball: `${registry2}/${name}/-/${unscoped}-${PLACEHOLDER_VERSION}.tgz` }
+      }
+    },
+    _attachments: { [tarballName]: { content_type: "application/octet-stream", data: tarball.toString("base64"), length: tarball.length } }
+  };
+}
+async function npmScaffold(input, deps) {
+  const args = validate2(input);
+  const scope = args.package.split("/")[0];
+  if (!deps.scopes.includes(scope)) fail3(`scope ${scope} is not in config.npm.scopes (${deps.scopes.join(", ")})`);
+  const facts = await checkRepo(deps.octokit, args);
+  const access = facts.isPrivate ? "restricted" : "public";
+  const base = {
+    package: args.package,
+    repository: facts.repository,
+    workflow: args.workflow,
+    access,
+    version: PLACEHOLDER_VERSION,
+    url: `https://www.npmjs.com/package/${args.package}`
+  };
+  const existing = await deps.registry.packument(args.package);
+  if (!existing) {
+    try {
+      await deps.registry.publish(placeholderDocument(args.package, facts, access, deps.registry.registry), args.package, args.otp);
+    } catch (err) {
+      if (err instanceof NpmOtpRequired) {
+        return { ...base, status: "needs_otp", done: [], remaining: ["publish", "trust"], message: "npm refused the one-time password before publishing; nothing was written. Call again with a fresh code." };
+      }
+      throw err;
+    }
+    return {
+      ...base,
+      status: "needs_otp",
+      done: ["publish"],
+      remaining: ["trust"],
+      message: "The placeholder is published. Each npm write needs its own one-time password: call again with the next code (wait for the authenticator to change) to add the trusted publisher."
+    };
+  }
+  const versions = Object.keys(existing.versions ?? {});
+  const placeholder = existing.versions?.[PLACEHOLDER_VERSION];
+  const ours = versions.length === 1 && versions[0] === PLACEHOLDER_VERSION && placeholder?.scaffoldedBy === SCAFFOLD_MARKER;
+  if (!ours) fail3(`${args.package} already exists on the registry (${versions.length} version(s)) and was not created by npm_scaffold \u2014 set up its trusted publisher on npmjs.com instead`);
+  const madeFor = placeholder?.repository?.url;
+  if (typeof madeFor !== "string" || madeFor.toLowerCase() !== `git+https://github.com/${facts.repository}.git`.toLowerCase()) {
+    fail3(`${args.package}'s placeholder was published for ${typeof madeFor === "string" ? madeFor : "an unrecorded repository"}, not ${facts.repository}`);
+  }
+  let out;
+  try {
+    out = await deps.registry.addGithubTrust(args.package, { repository: facts.repository, file: args.workflow }, args.otp);
+  } catch (err) {
+    if (err instanceof NpmOtpRequired) {
+      return {
+        ...base,
+        status: "needs_otp",
+        done: [],
+        remaining: ["trust"],
+        skipped: ["publish"],
+        message: "The placeholder is published, but npm refused the one-time password for the trusted publisher (expired or already used). Call again with a new code to finish."
+      };
+    }
+    throw err;
+  }
+  let alreadyThere = false;
+  if (out.conflict) {
+    const access2 = `https://www.npmjs.com/package/${args.package}/access`;
+    let configs;
+    try {
+      configs = await deps.registry.listTrust(args.package);
+    } catch (err) {
+      if (err instanceof NpmOtpRequired) fail3(`${args.package} already has a trusted publisher, and npm needs another one-time password to show which; check it at ${access2}`);
+      throw err;
+    }
+    const claimsOf = (c) => c.claims ?? {};
+    const matches = configs.find((c) => {
+      const cl = claimsOf(c);
+      return c.type === "github" && typeof cl.repository === "string" && cl.repository.toLowerCase() === facts.repository.toLowerCase() && cl.workflow_ref?.file === args.workflow;
+    });
+    if (!matches) {
+      const existingList = configs.map((c) => `${String(c.type)} ${String(claimsOf(c).repository)} (${String(claimsOf(c).workflow_ref?.file)})`).join("; ") || "unreadable";
+      fail3(`${args.package} already has a different trusted publisher: ${existingList}. Change it at ${access2}`);
+    }
+    alreadyThere = true;
+    out = { config: matches, conflict: true };
+  }
+  const trustId = typeof out.config?.id === "string" ? out.config.id : void 0;
+  return {
+    ...base,
+    status: "done",
+    done: alreadyThere ? [] : ["trust"],
+    skipped: alreadyThere ? ["publish", "trust"] : ["publish"],
+    ...trustId ? { trustId } : {},
+    message: `${args.package} exists with a trusted publisher for ${facts.repository} (.github/workflows/${args.workflow}); its next release can publish through OIDC.`
+  };
+}
+
+// src/verbs/ghcr/archive.ts
+import { closeSync, constants, fstatSync, openSync, readlinkSync, realpathSync } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { dirname, isAbsolute as isAbsolute2, join as join3, normalize as normalize2 } from "node:path";
+
+// src/verbs/ghcr/tar.ts
+import { readSync } from "node:fs";
+import { posix } from "node:path";
+var BLOCK2 = 512;
+var MAX_TAR_MEMBERS = 1e5;
+var MAX_EXT_HEADER = 1024 * 1024;
+var MAX_LINK_DEPTH = 16;
+var TarError = class extends Error {
+};
+var fail4 = (msg) => {
+  throw new TarError(`archive: ${msg}`);
+};
+function readAt(fd, position, length) {
+  const buf = Buffer.alloc(length);
+  let got = 0;
+  while (got < length) {
+    const n = readSync(fd, buf, got, length - got, position + got);
+    if (n === 0) break;
+    got += n;
+  }
+  if (got !== length) fail4(`truncated at byte ${position + got}`);
+  return buf;
+}
+function cstr(buf, start, len) {
+  const slice = buf.subarray(start, start + len);
+  const nul = slice.indexOf(0);
+  return slice.subarray(0, nul === -1 ? len : nul).toString("utf8");
+}
+function parseSize(buf) {
+  const field = buf.subarray(124, 136);
+  if (field[0] & 128) {
+    let n = 0;
+    for (let i = 1; i < field.length; i++) n = n * 256 + field[i];
+    if (!Number.isSafeInteger(n)) fail4("member size out of range");
+    return n;
+  }
+  const s = cstr(field, 0, 12).trim();
+  if (!/^[0-7]*$/.test(s)) fail4("bad size field in tar header");
+  return s ? parseInt(s, 8) : 0;
+}
+function checksumOk(buf) {
+  const stored = cstr(buf, 148, 8).trim();
+  if (!/^[0-7]+$/.test(stored)) return false;
+  let sum = 0;
+  for (let i = 0; i < BLOCK2; i++) sum += i >= 148 && i < 156 ? 32 : buf[i];
+  return sum === parseInt(stored, 8);
+}
+function parsePax(data) {
+  const out = {};
+  let i = 0;
+  while (i < data.length) {
+    const sp = data.indexOf(32, i);
+    if (sp === -1) break;
+    const len = parseInt(data.subarray(i, sp).toString("ascii"), 10);
+    if (!Number.isInteger(len) || len <= 0 || i + len > data.length) fail4("bad PAX header record");
+    const rec = data.subarray(sp + 1, i + len - 1).toString("utf8");
+    const eq = rec.indexOf("=");
+    if (eq > 0) out[rec.slice(0, eq)] = rec.slice(eq + 1);
+    i += len;
+  }
+  return out;
+}
+function normName(name) {
+  const n = posix.normalize(`/${name}`).slice(1);
+  return n.replace(/\/+$/, "");
+}
+function indexTar(fd, size) {
+  const files = /* @__PURE__ */ new Map();
+  const links = /* @__PURE__ */ new Map();
+  let pos = 0;
+  let members = 0;
+  let pax = {};
+  let longName;
+  let longLink;
+  while (pos + BLOCK2 <= size) {
+    const hdr = readAt(fd, pos, BLOCK2);
+    if (hdr.every((b) => b === 0)) break;
+    if (!checksumOk(hdr)) fail4(`bad tar header checksum at byte ${pos}`);
+    if (++members > MAX_TAR_MEMBERS) fail4(`more than ${MAX_TAR_MEMBERS} members`);
+    const type = String.fromCharCode(hdr[156]);
+    let memberSize = parseSize(hdr);
+    const dataAt = pos + BLOCK2;
+    const next = dataAt + Math.ceil(memberSize / BLOCK2) * BLOCK2;
+    if (type === "x" || type === "g" || type === "L" || type === "K") {
+      if (memberSize > MAX_EXT_HEADER) fail4("extended header too large");
+      const data = readAt(fd, dataAt, memberSize);
+      if (type === "x") pax = parsePax(data);
+      else if (type === "L") longName = cstr(data, 0, data.length);
+      else if (type === "K") longLink = cstr(data, 0, data.length);
+      pos = next;
+      continue;
+    }
+    const prefix = cstr(hdr, 345, 155);
+    const rawName = pax.path ?? longName ?? (prefix ? `${prefix}/${cstr(hdr, 0, 100)}` : cstr(hdr, 0, 100));
+    const linkName = pax.linkpath ?? longLink ?? cstr(hdr, 157, 100);
+    if (pax.size !== void 0) {
+      if (!/^\d+$/.test(pax.size)) fail4("bad PAX size");
+      memberSize = Number(pax.size);
+    }
+    const dataEnd = dataAt + Math.ceil(memberSize / BLOCK2) * BLOCK2;
+    pax = {};
+    longName = void 0;
+    longLink = void 0;
+    const name = normName(rawName);
+    if (type === "0" || type === "\0" || type === "7") {
+      if (dataAt + memberSize > size) fail4(`member "${name}" runs past the end of the file`);
+      files.set(name, { offset: dataAt, size: memberSize });
+      links.delete(name);
+    } else if (type === "1") {
+      links.set(name, { target: normName(linkName), hard: true });
+      files.delete(name);
+    } else if (type === "2") {
+      links.set(name, { target: normName(posix.join(posix.dirname(name), linkName)), hard: false });
+      files.delete(name);
+    }
+    pos = dataEnd;
+  }
+  for (const [name, link] of links) {
+    let target = link.target;
+    for (let depth = 0; ; depth++) {
+      if (depth > MAX_LINK_DEPTH) fail4(`link loop at "${name}"`);
+      const hit = files.get(target);
+      if (hit) {
+        files.set(name, hit);
+        break;
+      }
+      const hop = links.get(target);
+      if (!hop) break;
+      target = hop.target;
+    }
+  }
+  return { files };
+}
+function readMember(fd, m, max, what) {
+  if (m.size > max) fail4(`${what} is ${m.size} bytes \u2014 larger than the ${max}-byte limit`);
+  return readAt(fd, m.offset, m.size);
+}
+function peekMember(fd, m, n) {
+  return readAt(fd, m.offset, Math.min(n, m.size));
+}
+
+// src/verbs/ghcr/archive.ts
+var MEDIA = {
+  ociIndex: "application/vnd.oci.image.index.v1+json",
+  ociManifest: "application/vnd.oci.image.manifest.v1+json",
+  ociConfig: "application/vnd.oci.image.config.v1+json",
+  ociLayer: "application/vnd.oci.image.layer.v1.tar",
+  ociLayerGzip: "application/vnd.oci.image.layer.v1.tar+gzip",
+  ociLayerZstd: "application/vnd.oci.image.layer.v1.tar+zstd",
+  dockerList: "application/vnd.docker.distribution.manifest.list.v2+json",
+  dockerManifest: "application/vnd.docker.distribution.manifest.v2+json",
+  dockerConfig: "application/vnd.docker.container.image.v1+json",
+  dockerLayer: "application/vnd.docker.image.rootfs.diff.tar",
+  dockerLayerGzip: "application/vnd.docker.image.rootfs.diff.tar.gzip"
+};
+var MANIFEST_TYPES = /* @__PURE__ */ new Set([MEDIA.ociManifest, MEDIA.dockerManifest]);
+var INDEX_TYPES = /* @__PURE__ */ new Set([MEDIA.ociIndex, MEDIA.dockerList]);
+var LAYER_TYPES = /* @__PURE__ */ new Set([MEDIA.ociLayer, MEDIA.ociLayerGzip, MEDIA.ociLayerZstd, MEDIA.dockerLayer, MEDIA.dockerLayerGzip]);
+var CONFIG_TYPES = /* @__PURE__ */ new Set([MEDIA.ociConfig, MEDIA.dockerConfig]);
+var DIGEST = /^sha256:[a-f0-9]{64}$/;
+var MAX_JSON = 4 * 1024 * 1024;
+var MAX_LAYERS = 256;
+var ArchiveError = class extends Error {
+};
+var fail5 = (msg) => {
+  throw new ArchiveError(`archive: ${msg}`);
+};
+function openArchive(input, dropDir, maxBytes) {
+  if (typeof input !== "string" || !input || input.length > 4096 || input.includes("\0")) fail5('"archive" must be a file path inside the drop directory');
+  const candidate = normalize2(isAbsolute2(input) ? input : join3(dropDir, input));
+  const outside = `"archive" must be an existing file inside the drop directory ${dropDir}`;
+  if (!candidate.startsWith(`${dropDir}/`)) fail5(outside);
+  let realDrop;
+  try {
+    realDrop = realpathSync(dropDir);
+  } catch {
+    return fail5(`drop directory ${dropDir} does not exist \u2014 the installer creates it`);
+  }
+  let realParent;
+  try {
+    realParent = realpathSync(dirname(candidate));
+  } catch {
+    return fail5(outside);
+  }
+  if (realParent !== realDrop && !realParent.startsWith(`${realDrop}/`)) fail5(outside);
+  let fd;
+  try {
+    fd = openSync(candidate, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ELOOP") return fail5(`${candidate} is a symlink \u2014 put the archive file itself in the drop directory`);
+    if (code === "ENOENT" || code === "ENOTDIR") return fail5(`${candidate} not found`);
+    if (code === "EACCES") return fail5(`${candidate} is not readable by the broker \u2014 make it group-readable (chmod g+r)`);
+    return fail5(`cannot open ${candidate} (${code ?? "error"})`);
+  }
+  try {
+    const real = readlinkSync(`/proc/self/fd/${fd}`);
+    if (!real.startsWith(`${realDrop}/`)) fail5(outside);
+    const st = fstatSync(fd);
+    if (!st.isFile()) fail5(`${candidate} is not a regular file`);
+    if (st.nlink !== 1) fail5(`${candidate} has ${st.nlink} hard links \u2014 copy the archive instead of linking it`);
+    if (st.size === 0) fail5(`${candidate} is empty`);
+    if (st.size > maxBytes) fail5(`${candidate} is ${st.size} bytes \u2014 over the ${maxBytes}-byte limit (ghcr.maxArchiveBytes)`);
+    let closed = false;
+    return {
+      fd,
+      path: real,
+      size: st.size,
+      close() {
+        if (closed) return;
+        closed = true;
+        closeSync(fd);
+      }
+    };
+  } catch (err) {
+    closeSync(fd);
+    throw err;
+  }
+}
+var sha256 = (b) => `sha256:${createHash2("sha256").update(b).digest("hex")}`;
+function parseJson(buf, what) {
+  try {
+    return JSON.parse(buf.toString("utf8"));
+  } catch {
+    return fail5(`${what} is not valid JSON`);
+  }
+}
+function blobMember(index, digest, what) {
+  if (typeof digest !== "string" || !DIGEST.test(digest)) fail5(`${what} has an unsupported digest (only sha256 is accepted)`);
+  const m = index.files.get(`blobs/sha256/${digest.slice("sha256:".length)}`);
+  if (!m) fail5(`${what} ${digest} is missing from the archive`);
+  return m;
+}
+function readBlobJson(fd, index, d, what) {
+  const m = blobMember(index, d.digest, what);
+  const bytes = readMember(fd, m, MAX_JSON, what);
+  if (sha256(bytes) !== d.digest) fail5(`${what} does not match its digest`);
+  return { bytes, json: parseJson(bytes, what) };
+}
+function images(manifests, index) {
+  if (!Array.isArray(manifests)) return fail5("index has no manifests list");
+  const list = manifests.filter(
+    (d) => d?.annotations?.["vnd.docker.reference.type"] !== "attestation-manifest" && !(d?.platform?.os === "unknown" && d?.platform?.architecture === "unknown")
+  );
+  if (list.length <= 1) return list;
+  return list.filter((d) => typeof d?.digest === "string" && DIGEST.test(d.digest) && index.files.has(`blobs/sha256/${d.digest.slice("sha256:".length)}`));
+}
+function sniff(fd, m) {
+  const head = peekMember(fd, m, 4);
+  if (head.length >= 2 && head[0] === 31 && head[1] === 139) return "gzip";
+  if (head.length >= 4 && head.readUInt32LE(0) === 4247762216) return "zstd";
+  return "none";
+}
+function layerPlan(fd, m, declared, sourceDigest) {
+  if (declared !== void 0 && !LAYER_TYPES.has(declared)) fail5(`layer media type "${declared}" is not supported (non-distributable and foreign layers are refused)`);
+  const kind = sniff(fd, m);
+  if (kind === "gzip") {
+    const mediaType = declared === MEDIA.ociLayerGzip || declared === MEDIA.dockerLayerGzip ? declared : MEDIA.ociLayerGzip;
+    return { member: m, mediaType, sourceDigest, sourceSize: m.size, compress: false };
+  }
+  if (kind === "zstd") return { member: m, mediaType: MEDIA.ociLayerZstd, sourceDigest, sourceSize: m.size, compress: false };
+  return { member: m, mediaType: MEDIA.ociLayerGzip, sourceDigest, sourceSize: m.size, compress: true };
+}
+function planImage(fd, size) {
+  const index = indexTar(fd, size);
+  const top = index.files.get("index.json");
+  if (top) return planOciLayout(fd, index, top);
+  const legacy = index.files.get("manifest.json");
+  if (legacy) return planDockerArchive(fd, index, legacy);
+  return fail5("not an image archive (no index.json or manifest.json) \u2014 create it with `docker save <image> -o <file>`");
+}
+function planOciLayout(fd, index, top) {
+  const root = parseJson(readMember(fd, top, MAX_JSON, "index.json"), "index.json");
+  let list = images(root.manifests, index);
+  let desc = list.length === 1 ? list[0] : void 0;
+  if (desc && INDEX_TYPES.has(desc.mediaType ?? "")) {
+    const nested = readBlobJson(fd, index, desc, "nested index").json;
+    list = images(nested.manifests, index);
+    desc = list.length === 1 ? list[0] : void 0;
+  }
+  if (!desc) fail5(`archive holds ${list.length} images \u2014 save exactly one single-platform image per archive`);
+  const d = desc;
+  if (!MANIFEST_TYPES.has(d.mediaType ?? "")) fail5(`manifest media type "${d.mediaType}" is not supported`);
+  const { bytes, json } = readBlobJson(fd, index, d, "image manifest");
+  const man = json;
+  if (!man.config || !Array.isArray(man.layers)) fail5("image manifest has no config or layers");
+  if (man.layers.length > MAX_LAYERS) fail5(`image has ${man.layers.length} layers \u2014 at most ${MAX_LAYERS}`);
+  const cfg = man.config;
+  if (!CONFIG_TYPES.has(cfg.mediaType ?? "")) fail5(`config media type "${cfg.mediaType}" is not supported`);
+  const cfgMember = blobMember(index, cfg.digest, "image config");
+  if (cfgMember.size !== cfg.size) fail5("image config size does not match its descriptor");
+  let changed = false;
+  const layers = man.layers.map((l, i) => {
+    const m = blobMember(index, l.digest, `layer ${i + 1}`);
+    if (m.size !== l.size) fail5(`layer ${i + 1} size does not match its descriptor`);
+    const plan = layerPlan(fd, m, l.mediaType, l.digest);
+    if (plan.compress || plan.mediaType !== l.mediaType) changed = true;
+    return plan;
+  });
+  return {
+    format: "oci-layout",
+    config: { member: cfgMember, mediaType: cfg.mediaType, digest: cfg.digest, sourceDigest: cfg.digest, sourceSize: cfgMember.size, compress: false },
+    layers,
+    ...changed ? {} : { verbatimManifest: { bytes, mediaType: d.mediaType, digest: d.digest } },
+    ...man.annotations ? { annotations: man.annotations } : {}
+  };
+}
+function planDockerArchive(fd, index, legacy) {
+  const list = parseJson(readMember(fd, legacy, MAX_JSON, "manifest.json"), "manifest.json");
+  if (!Array.isArray(list) || list.length !== 1) fail5(`archive holds ${Array.isArray(list) ? list.length : 0} images \u2014 save exactly one image per archive`);
+  const entry = list[0];
+  if (typeof entry.Config !== "string" || !Array.isArray(entry.Layers)) fail5("manifest.json entry has no Config or Layers");
+  if (entry.Layers.length > MAX_LAYERS) fail5(`image has ${entry.Layers.length} layers \u2014 at most ${MAX_LAYERS}`);
+  const member = (name, what) => {
+    const m = typeof name === "string" ? index.files.get(name.replace(/^\.?\//, "")) : void 0;
+    if (!m) fail5(`${what} "${String(name)}" is missing from the archive`);
+    return m;
+  };
+  const cfgMember = member(entry.Config, "image config");
+  const cfgBytes = readMember(fd, cfgMember, MAX_JSON, "image config");
+  parseJson(cfgBytes, "image config");
+  const layers = entry.Layers.map((name, i) => layerPlan(fd, member(name, `layer ${i + 1}`), void 0, void 0));
+  return {
+    format: "docker-archive",
+    config: { member: cfgMember, mediaType: MEDIA.ociConfig, digest: sha256(cfgBytes), sourceSize: cfgMember.size, compress: false },
+    layers
+  };
+}
+
+// src/verbs/ghcr/registry.ts
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+var GHCR_BASE = "https://ghcr.io";
+var MAX_BODY = 1024 * 1024;
+var IDLE_TIMEOUT_MS = 10 * 60 * 1e3;
+var MAX_TAG_PAGES = 20;
+var MANIFEST_ACCEPT = [
+  "application/vnd.oci.image.manifest.v1+json",
+  "application/vnd.oci.image.index.v1+json",
+  "application/vnd.docker.distribution.manifest.v2+json",
+  "application/vnd.docker.distribution.manifest.list.v2+json"
+].join(", ");
+var RegistryError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
+var Registry = class {
+  base;
+  username;
+  password;
+  repository;
+  token;
+  scope;
+  constructor(opts) {
+    this.base = new URL(opts.base ?? GHCR_BASE);
+    this.username = opts.username;
+    this.password = opts.password;
+    this.repository = opts.repository;
+  }
+  /** The registry host name as used in image references (e.g. "ghcr.io"). */
+  get host() {
+    return this.base.host;
+  }
+  /** Replace every secret (and anything that looks like one) in a message. */
+  clean(msg) {
+    let out = msg;
+    for (const s of [this.password, this.token]) if (s && s.length >= 4) out = out.split(s).join("[redacted]");
+    return out.replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi, "$1 [redacted]").replace(/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, "[redacted]").replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "[redacted]");
+  }
+  err(step, res) {
+    let detail = "";
+    try {
+      const j = JSON.parse(res.body.toString("utf8"));
+      if (Array.isArray(j.errors)) detail = j.errors.map((e) => `${String(e.code ?? "")}: ${String(e.message ?? "")}`).join("; ");
+    } catch {
+      detail = res.body.toString("utf8").replace(/\s+/g, " ").trim();
+    }
+    const hint = res.status === 401 || res.status === 403 ? " \u2014 check the ghcr credential is a classic PAT with write:packages, not expired, and allowed for this package" : "";
+    const shown = this.clean(detail).slice(0, 300);
+    return new RegistryError(this.clean(`ghcr: ${step} failed: HTTP ${res.status}${shown ? ` (${shown})` : ""}${hint}`), res.status);
+  }
+  /** Resolve a registry-provided URL and refuse anything that would leave the registry's origin. */
+  sameOrigin(raw, step) {
+    let u;
+    try {
+      u = new URL(raw, this.base);
+    } catch {
+      throw new RegistryError(`ghcr: ${step}: registry returned an unparseable URL`);
+    }
+    if (u.origin !== this.base.origin) throw new RegistryError(`ghcr: ${step}: registry pointed at another host (${u.host}) \u2014 refused`);
+    return u;
+  }
+  url(path) {
+    return new URL(path, this.base);
+  }
+  send(method, url2, headers, body, onBytes) {
+    const fn = url2.protocol === "https:" ? httpsRequest : httpRequest;
+    return new Promise((resolve, reject) => {
+      const req2 = fn(url2, { method, headers }, (res) => {
+        const chunks = [];
+        let len = 0;
+        res.on("data", (c) => {
+          if (len < MAX_BODY) chunks.push(c);
+          len += c.length;
+        });
+        res.on("end", () => resolve({ status: res.statusCode ?? 0, headers: res.headers, body: Buffer.concat(chunks).subarray(0, MAX_BODY) }));
+        res.on("error", reject);
+      });
+      req2.setTimeout(IDLE_TIMEOUT_MS, () => req2.destroy(new Error(`${method} timed out`)));
+      req2.on("error", (e) => reject(new RegistryError(this.clean(`ghcr: ${method} ${url2.pathname} failed: ${e.message}`))));
+      if (body === void 0) req2.end();
+      else if (Buffer.isBuffer(body)) req2.end(body);
+      else {
+        const src = body();
+        src.on("error", (e) => req2.destroy(e));
+        if (onBytes) src.on("data", (c) => onBytes(c.length));
+        src.pipe(req2);
+      }
+    });
+  }
+  /** Exchange the PAT for a registry token scoped to this repository. */
+  async login(actions) {
+    const u = this.url("/token");
+    u.searchParams.set("service", this.base.host);
+    u.searchParams.set("scope", `repository:${this.repository}:${actions}`);
+    const basic = Buffer.from(`${this.username}:${this.password}`).toString("base64");
+    const res = await this.send("GET", u, { Authorization: `Basic ${basic}`, Accept: "application/json" }, void 0);
+    if (res.status !== 200) throw this.err("token exchange", res);
+    let token;
+    try {
+      const j = JSON.parse(res.body.toString("utf8"));
+      token = j.token ?? j.access_token;
+    } catch {
+    }
+    if (typeof token !== "string" || !token) throw new RegistryError("ghcr: token exchange returned no token");
+    this.token = token;
+    this.scope = actions;
+  }
+  /** One request with the registry token; on 401 re-login once and retry. */
+  async authed(method, url2, headers, body, onBytes) {
+    if (!this.token) await this.login("pull");
+    const go = () => this.send(method, url2, { ...headers, Authorization: `Bearer ${this.token}` }, body, onBytes);
+    const res = await go();
+    if (res.status !== 401) return res;
+    await this.login(this.scope ?? "pull");
+    return go();
+  }
+  async blobExists(digest) {
+    const res = await this.authed("HEAD", this.url(`/v2/${this.repository}/blobs/${digest}`), {}, void 0);
+    if (res.status >= 200 && res.status < 400) return true;
+    if (res.status === 404) return false;
+    throw this.err(`checking blob ${digest}`, res);
+  }
+  /**
+   * Upload one blob whose digest and size are known. `body` must produce a fresh stream
+   * each call (a retry after a 401 restarts the upload). `onBytes` reports progress.
+   */
+  async uploadBlob(digest, size, body, onBytes) {
+    for (let attempt = 0; ; attempt++) {
+      let sent = 0;
+      const count = (n) => {
+        sent += n;
+        onBytes?.(n);
+      };
+      const res = await this.tryUpload(digest, size, body, count);
+      if (res === "ok") return;
+      if (attempt >= 1) throw this.err(`uploading blob ${digest}`, res);
+      onBytes?.(-sent);
+      await this.login("push,pull");
+    }
+  }
+  async tryUpload(digest, size, body, onBytes) {
+    const start = await this.authed("POST", this.url(`/v2/${this.repository}/blobs/uploads/`), { "Content-Length": "0" }, Buffer.alloc(0));
+    if (start.status === 401) return start;
+    if (start.status !== 202 || typeof start.headers.location !== "string") throw this.err("starting a blob upload", start);
+    const patchUrl = this.sameOrigin(start.headers.location, "blob upload");
+    const auth7 = { Authorization: `Bearer ${this.token}` };
+    const patch = await this.send("PATCH", patchUrl, { ...auth7, "Content-Type": "application/octet-stream", "Content-Length": String(size) }, body, onBytes);
+    if (patch.status === 401) return patch;
+    if (patch.status !== 202 && patch.status !== 204) throw this.err(`uploading blob ${digest}`, patch);
+    const putUrl = this.sameOrigin(typeof patch.headers.location === "string" ? patch.headers.location : patchUrl.href, "blob upload");
+    putUrl.searchParams.set("digest", digest);
+    const done = await this.send("PUT", putUrl, { ...auth7, "Content-Length": "0" }, Buffer.alloc(0));
+    if (done.status === 401) return done;
+    if (done.status !== 201) throw this.err(`finishing blob ${digest}`, done);
+    return "ok";
+  }
+  /** True when `reference` (tag or digest) already names a manifest in this repository. */
+  async manifestExists(reference) {
+    const res = await this.authed("HEAD", this.url(`/v2/${this.repository}/manifests/${reference}`), { Accept: MANIFEST_ACCEPT }, void 0);
+    if (res.status === 200) return true;
+    if (res.status === 404) return false;
+    throw this.err(`checking tag ${reference}`, res);
+  }
+  async putManifest(tag, mediaType, bytes) {
+    const res = await this.authed("PUT", this.url(`/v2/${this.repository}/manifests/${tag}`), { "Content-Type": mediaType, "Content-Length": String(bytes.length) }, bytes);
+    if (res.status !== 201 && res.status !== 200) throw this.err(`pushing manifest for tag ${tag}`, res);
+  }
+  /** Every tag in the repository; `undefined` when the repository doesn't exist yet. */
+  async listTags() {
+    const tags = [];
+    let url2 = this.url(`/v2/${this.repository}/tags/list?n=1000`);
+    for (let page = 0; url2 && page < MAX_TAG_PAGES; page++) {
+      const res = await this.authed("GET", url2, { Accept: "application/json" }, void 0);
+      if (res.status === 404) return void 0;
+      if (res.status !== 200) throw this.err("listing tags", res);
+      let j;
+      try {
+        j = JSON.parse(res.body.toString("utf8"));
+      } catch {
+        throw new RegistryError("ghcr: listing tags returned invalid JSON");
+      }
+      if (Array.isArray(j.tags)) {
+        for (const t of j.tags) if (typeof t === "string") tags.push(t);
+      }
+      const link = typeof res.headers.link === "string" ? /<([^>]+)>;\s*rel="next"/.exec(res.headers.link) : null;
+      url2 = link ? this.sameOrigin(link[1], "listing tags") : void 0;
+    }
+    return tags;
+  }
+};
+
+// src/verbs/ghcr/push.ts
+import { createReadStream } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { createGzip } from "node:zlib";
+import { PassThrough, Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var RELEASE_TAG = /^v?\d+\.\d+\.\d+$/;
+var GZIP_LEVEL = 6;
+var PushRefused = class extends Error {
+};
+function memberStream(fd, plan) {
+  if (plan.member.size === 0) {
+    const empty = new PassThrough();
+    empty.end();
+    return empty;
+  }
+  return createReadStream("", { fd, start: plan.member.offset, end: plan.member.offset + plan.member.size - 1, autoClose: false });
+}
+function gzipStream(fd, plan) {
+  const src = memberStream(fd, plan);
+  const gz = createGzip({ level: GZIP_LEVEL });
+  src.on("error", (e) => gz.destroy(e));
+  return src.pipe(gz);
+}
+async function gzipDigest(fd, plan) {
+  const hash = createHash3("sha256");
+  let size = 0;
+  await pipeline(
+    gzipStream(fd, plan),
+    new Writable({
+      write(chunk, _enc, cb) {
+        hash.update(chunk);
+        size += chunk.length;
+        cb();
+      }
+    })
+  );
+  return { digest: `sha256:${hash.digest("hex")}`, size };
+}
+var sha2562 = (b) => `sha256:${createHash3("sha256").update(b).digest("hex")}`;
+async function pushImage(registry2, fd, plan, tag, opts) {
+  const progress = { phase: "preparing", layersTotal: plan.layers.length, blobsUploaded: 0, blobsSkipped: 0, bytesTotal: 0, bytesSent: 0 };
+  const report = () => opts.onProgress?.({ ...progress });
+  report();
+  const layers = [];
+  for (const l of plan.layers) {
+    if (l.compress) {
+      const { digest, size } = await gzipDigest(fd, l);
+      layers.push({ mediaType: l.mediaType, digest, size });
+    } else {
+      layers.push({ mediaType: l.mediaType, digest: l.sourceDigest ?? await rawDigest(fd, l), size: l.sourceSize });
+    }
+  }
+  const config2 = { mediaType: plan.config.mediaType, digest: plan.config.digest, size: plan.config.sourceSize };
+  progress.bytesTotal = config2.size + layers.reduce((n, d) => n + d.size, 0);
+  progress.phase = "uploading";
+  report();
+  const blobs = [{ desc: config2, plan: plan.config }, ...layers.map((desc, i) => ({ desc, plan: plan.layers[i] }))];
+  const seen = /* @__PURE__ */ new Set();
+  for (const { desc, plan: p } of blobs) {
+    if (seen.has(desc.digest) || await registry2.blobExists(desc.digest)) {
+      seen.add(desc.digest);
+      progress.blobsSkipped++;
+      report();
+      continue;
+    }
+    seen.add(desc.digest);
+    await registry2.uploadBlob(desc.digest, desc.size, () => p.compress ? gzipStream(fd, p) : memberStream(fd, p), (n) => {
+      progress.bytesSent += n;
+      report();
+    });
+    progress.blobsUploaded++;
+    report();
+  }
+  progress.phase = "manifest";
+  report();
+  let bytes;
+  let mediaType;
+  if (plan.verbatimManifest) {
+    bytes = plan.verbatimManifest.bytes;
+    mediaType = plan.verbatimManifest.mediaType;
+  } else {
+    mediaType = MEDIA.ociManifest;
+    const cfg = { ...config2, mediaType: config2.mediaType === MEDIA.dockerConfig ? MEDIA.ociConfig : config2.mediaType };
+    bytes = Buffer.from(
+      JSON.stringify({
+        schemaVersion: 2,
+        mediaType,
+        config: cfg,
+        layers: layers.map((l) => ({ ...l, mediaType: l.mediaType === MEDIA.dockerLayerGzip ? MEDIA.ociLayerGzip : l.mediaType })),
+        ...plan.annotations ? { annotations: plan.annotations } : {}
+      })
+    );
+  }
+  if (opts.protectReleaseTags && RELEASE_TAG.test(tag) && await registry2.manifestExists(tag)) {
+    throw new PushRefused(`ghcr_push: tag ${tag} already exists on ${registry2.repository} and release tags are protected \u2014 push a new version instead`);
+  }
+  await registry2.putManifest(tag, mediaType, bytes);
+  progress.phase = "done";
+  report();
+  return { digest: sha2562(bytes), mediaType, size: progress.bytesTotal, blobsUploaded: progress.blobsUploaded, blobsSkipped: progress.blobsSkipped };
+}
+async function rawDigest(fd, plan) {
+  const hash = createHash3("sha256");
+  await pipeline(
+    memberStream(fd, plan),
+    new Writable({
+      write(chunk, _enc, cb) {
+        hash.update(chunk);
+        cb();
+      }
+    })
+  );
+  return `sha256:${hash.digest("hex")}`;
+}
+
+// src/verbs/ghcr/jobs.ts
+import { randomUUID } from "node:crypto";
+var QueueFull = class extends Error {
+};
+var JobQueue = class {
+  jobs = /* @__PURE__ */ new Map();
+  pending = [];
+  running = false;
+  maxPending;
+  keepFinished;
+  constructor({ maxPending = 8, keepFinished = 50 } = {}) {
+    this.maxPending = maxPending;
+    this.keepFinished = keepFinished;
+  }
+  /** Queued + running jobs. */
+  activeCount() {
+    return this.pending.length + (this.running ? 1 : 0);
+  }
+  submit(meta2, hooks) {
+    if (this.activeCount() >= this.maxPending) throw new QueueFull(`ghcr_push: ${this.activeCount()} pushes are already queued or running \u2014 wait for one to finish (ghcr_push_status)`);
+    const job = { ...meta2, job: randomUUID(), state: "queued", createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+    this.jobs.set(job.job, job);
+    this.pending.push({ job, hooks });
+    const snapshot = { ...job };
+    void this.pump();
+    return snapshot;
+  }
+  get(id) {
+    const j = this.jobs.get(id);
+    return j ? structuredClone(j) : void 0;
+  }
+  list(owner2) {
+    return [...this.jobs.values()].filter((j) => j.owner === owner2).map((j) => structuredClone(j));
+  }
+  /** Resolves once nothing is queued or running (for tests and orderly shutdown). */
+  async idle() {
+    while (this.activeCount() > 0) await new Promise((r) => setTimeout(r, 5));
+  }
+  async pump() {
+    if (this.running) return;
+    const next = this.pending.shift();
+    if (!next) return;
+    this.running = true;
+    const { job, hooks } = next;
+    job.state = "running";
+    job.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      job.result = await hooks.run((p) => {
+        job.progress = p;
+      });
+      job.state = "succeeded";
+    } catch (err) {
+      job.state = "failed";
+      job.error = hooks.describeError ? hooks.describeError(err) : "push failed";
+    } finally {
+      job.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        hooks.finally?.(structuredClone(job));
+      } catch {
+      }
+      this.running = false;
+      this.prune();
+      void this.pump();
+    }
+  }
+  prune() {
+    const finished = [...this.jobs.values()].filter((j) => j.state === "succeeded" || j.state === "failed");
+    for (const j of finished.slice(0, Math.max(0, finished.length - this.keepFinished))) this.jobs.delete(j.job);
+  }
+};
+
+// src/verbs/ghcr_push.ts
+var IMAGE = /^[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*)*$/;
+var TAG = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+var JOB_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var PUSH_KEYS = /* @__PURE__ */ new Set(["owner", "image", "tag", "archive"]);
+var STATUS_KEYS = /* @__PURE__ */ new Set(["owner", "job"]);
+var TAGS_KEYS = /* @__PURE__ */ new Set(["owner", "image"]);
+function strictArgs(verb, input, keys) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error(`${verb}: arguments must be an object`);
+  const a = input;
+  const unknown2 = Object.keys(a).filter((k) => !keys.has(k));
+  if (unknown2.length) throw new Error(`${verb}: unknown argument(s): ${unknown2.join(", ")} \u2014 expected ${[...keys].join(", ")}`);
+  if (typeof a.owner !== "string" || !a.owner.trim()) throw new Error(`${verb}: "owner" must be a non-empty string`);
+  return a;
+}
+var GhcrService = class {
+  cfg;
+  secrets;
+  base;
+  queue;
+  constructor(cfg, secrets, opts = {}) {
+    this.cfg = cfg;
+    this.secrets = secrets;
+    this.base = opts.base ?? GHCR_BASE;
+    this.queue = opts.queue ?? new JobQueue();
+  }
+  config(verb) {
+    if (!this.cfg) throw new Error(`${verb}: GHCR is not configured \u2014 add a "ghcr" block to the config (see docs/TOOLS.md#ghcr_push)`);
+    return this.cfg;
+  }
+  ownerConfig(verb, owner2) {
+    const o = this.config(verb).owners[owner2.toLowerCase()];
+    if (!o) throw new Error(`${verb}: owner "${owner2}" has no GHCR configuration (config.ghcr.owners)`);
+    if (!this.secrets.has(o.credential)) throw new Error(`${verb}: owner "${owner2}"'s GHCR credential "${o.credential.replace(/^cred:/, "")}" is not stored (re-run the installer to add it)`);
+    return o;
+  }
+  image(verb, owner2, oc, raw) {
+    if (typeof raw !== "string" || !raw) throw new Error(`${verb}: "image" must be a non-empty string`);
+    const lower = raw.toLowerCase();
+    if (lower.startsWith("ghcr.io/") || lower.startsWith(`${owner2}/`)) {
+      throw new Error(`${verb}: "image" is the name under ghcr.io/${owner2}/ \u2014 pass e.g. "hoot", not "${raw}"`);
+    }
+    if (!IMAGE.test(raw) || raw.length + owner2.length + 1 > 255) throw new Error(`${verb}: "image" "${raw}" is not a valid image name (lowercase [a-z0-9], separators . _ __ -, "/" between segments)`);
+    if (!imageAllowed(oc, raw)) throw new Error(`${verb}: ghcr.io/${owner2}/${raw} is not on the allowlist (config.ghcr.owners.${owner2}.images: ${oc.images.join(", ")})`);
+    return raw;
+  }
+  registry(owner2, oc, image2) {
+    return new Registry({ base: this.base, username: oc.username, password: this.secrets.resolve(oc.credential), repository: `${owner2}/${image2}` });
+  }
+  async push(input) {
+    const verb = "ghcr_push";
+    const a = strictArgs(verb, input, PUSH_KEYS);
+    const owner2 = a.owner.toLowerCase();
+    const cfg = this.config(verb);
+    const oc = this.ownerConfig(verb, owner2);
+    const image2 = this.image(verb, owner2, oc, a.image);
+    if (typeof a.tag !== "string" || !TAG.test(a.tag)) throw new Error(`${verb}: "tag" must be a valid tag ([A-Za-z0-9_][A-Za-z0-9._-]{0,127})`);
+    const tag = a.tag;
+    const archive = openArchive(a.archive, cfg.dropDir, cfg.maxArchiveBytes);
+    let handedOff = false;
+    let registry2;
+    try {
+      const plan = planImage(archive.fd, archive.size);
+      registry2 = this.registry(owner2, oc, image2);
+      const ref = `${registry2.host}/${owner2}/${image2}`;
+      await registry2.login("push,pull");
+      if (cfg.protectReleaseTags && RELEASE_TAG.test(tag) && await registry2.manifestExists(tag)) {
+        throw new Error(`${verb}: tag ${tag} already exists on ${ref} and release tags are protected \u2014 push a new version instead`);
+      }
+      const reg = registry2;
+      const job = this.queue.submit(
+        { owner: owner2, image: ref, tag, archive: archive.path, archiveBytes: archive.size, format: plan.format },
+        {
+          run: (progress) => pushImage(reg, archive.fd, plan, tag, { protectReleaseTags: cfg.protectReleaseTags, onProgress: progress }),
+          describeError: (err) => reg.clean(err?.message ?? String(err)),
+          finally: (done) => {
+            archive.close();
+            audit({
+              tool: verb,
+              owner: owner2,
+              mode: "write",
+              repo: ref,
+              decision: "custom",
+              ok: done.state === "succeeded",
+              detail: done.state === "succeeded" ? `job=${done.job} tag=${tag} digest=${done.result?.digest} size=${done.result?.size} uploaded=${done.result?.blobsUploaded} skipped=${done.result?.blobsSkipped} archive=${archive.path}` : `job=${done.job} tag=${tag} archive=${archive.path} error=${done.error}`
+            });
+          }
+        }
+      );
+      handedOff = true;
+      audit({ tool: verb, owner: owner2, mode: "write", repo: ref, decision: "custom", ok: true, detail: `job=${job.job} queued tag=${tag} archive=${archive.path} bytes=${archive.size} format=${plan.format} layers=${plan.layers.length}` });
+      return { ...job };
+    } catch (err) {
+      if (!registry2) throw err;
+      throw new Error(registry2.clean(err?.message ?? String(err)));
+    } finally {
+      if (!handedOff) archive.close();
+    }
+  }
+  status(input) {
+    const verb = "ghcr_push_status";
+    const a = strictArgs(verb, input, STATUS_KEYS);
+    const owner2 = a.owner.toLowerCase();
+    this.ownerConfig(verb, owner2);
+    if (a.job === void 0) return { jobs: this.queue.list(owner2) };
+    if (typeof a.job !== "string" || !JOB_ID.test(a.job)) throw new Error(`${verb}: "job" must be a job id returned by ghcr_push`);
+    const job = this.queue.get(a.job);
+    if (!job || job.owner !== owner2) throw new Error(`${verb}: no job ${a.job} for owner ${owner2} (jobs are kept in memory; a broker restart forgets them)`);
+    return job;
+  }
+  async tags(input) {
+    const verb = "ghcr_tags";
+    const a = strictArgs(verb, input, TAGS_KEYS);
+    const owner2 = a.owner.toLowerCase();
+    const oc = this.ownerConfig(verb, owner2);
+    const image2 = this.image(verb, owner2, oc, a.image);
+    const registry2 = this.registry(owner2, oc, image2);
+    try {
+      await registry2.login("pull");
+      const tags = await registry2.listTags();
+      return { image: `${registry2.host}/${owner2}/${image2}`, exists: tags !== void 0, tags: tags ?? [] };
+    } catch (err) {
+      throw new Error(registry2.clean(err?.message ?? String(err)));
+    }
+  }
+};
+var owner = { type: "string", description: "registry owner (org/user login) \u2014 must be configured in config.ghcr.owners" };
+var image = { type: "string", description: 'image name under ghcr.io/<owner>/, e.g. "hoot" \u2014 must match config.ghcr.owners.<owner>.images' };
+var GHCR_PUSH_SCHEMA = {
+  type: "object",
+  required: ["owner", "image", "tag", "archive"],
+  additionalProperties: false,
+  properties: {
+    owner,
+    image,
+    tag: { type: "string", pattern: "^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", description: 'tag to push, e.g. "1.4.0" or "latest"' },
+    archive: {
+      type: "string",
+      description: "a `docker save` archive (docker-archive or OCI layout) inside the configured drop directory \u2014 absolute, or relative to it. Must be a regular, group-readable file; symlinks and hard links are refused."
+    }
+  }
+};
+var GHCR_PUSH_STATUS_SCHEMA = {
+  type: "object",
+  required: ["owner"],
+  additionalProperties: false,
+  properties: {
+    owner,
+    job: { type: "string", description: "job id returned by ghcr_push; omit to list this owner's recent jobs" }
+  }
+};
+var GHCR_TAGS_SCHEMA = {
+  type: "object",
+  required: ["owner", "image"],
+  additionalProperties: false,
+  properties: { owner, image }
+};
+var GHCR_CATALOG = {
+  ghcr_push: {
+    description: "Push a container image to ghcr.io/<owner>/<image>:<tag> from a `docker save` archive in the broker's drop directory, without holding a registry token. The image must be on config.ghcr's allowlist; an existing release tag (1.2.3 / v1.2.3) is never overwritten while protectReleaseTags is on. Starts a background job and returns its id at once \u2014 poll ghcr_push_status. Runs on the owner's GHCR credential (classic PAT, write:packages).",
+    inputSchema: GHCR_PUSH_SCHEMA
+  },
+  ghcr_push_status: {
+    description: "Progress of a ghcr_push job (phase, blobs uploaded/skipped, bytes sent), then its final manifest digest or error. Omit job to list this owner's recent jobs. Jobs are kept in memory; a broker restart forgets them.",
+    inputSchema: GHCR_PUSH_STATUS_SCHEMA
+  },
+  ghcr_tags: {
+    description: "List the tags of an allowlisted image on ghcr.io/<owner>/<image>, e.g. to verify a push landed. Runs on the owner's GHCR credential (pull scope).",
+    inputSchema: GHCR_TAGS_SCHEMA
+  }
+};
+
 // src/router.ts
+var GHCR_TOOLS2 = /* @__PURE__ */ new Set(["ghcr_push", "ghcr_push_status", "ghcr_tags"]);
 var Router = class {
   config;
   secrets;
   upstream;
   appAuth;
   rules;
+  /** GHCR verbs run on config.ghcr's own credential, not the owner's GitHub PAT (created on first use). */
+  ghcr;
   constructor(config2, secrets, upstream, appAuth) {
     this.config = config2;
     this.secrets = secrets;
@@ -20484,7 +21880,7 @@ var Router = class {
   }
   /** Tools advertised to the agent (used to build tools/list). */
   advertisedTools() {
-    return this.config.tools;
+    return this.config.tools.filter((rule) => !unavailableReason(rule, this.config, this.secrets));
   }
   async call(tool, args) {
     const rule = this.rules.get(tool);
@@ -20492,32 +21888,52 @@ var Router = class {
       audit({ tool, decision: "deny", detail: "not in allowlist" });
       throw new Error(`tool "${tool}" is not allowed`);
     }
-    let owner = extractOwner(args);
-    if (!owner && rule.mode === "read" && this.config.defaultOwner && this.config.owners[this.config.defaultOwner]) {
-      owner = this.config.defaultOwner.toLowerCase();
+    const unavailable = unavailableReason(rule, this.config, this.secrets);
+    if (unavailable) {
+      audit({ tool, decision: "deny", detail: `unavailable: ${unavailable}` });
+      throw new Error(`tool "${tool}" is not available on this broker: ${unavailable}`);
+    }
+    if (GHCR_TOOLS2.has(tool)) return this.callGhcr(tool, args, rule);
+    let owner2 = extractOwner(args);
+    if (!owner2 && rule.mode === "read" && this.config.defaultOwner && this.config.owners[this.config.defaultOwner]) {
+      owner2 = this.config.defaultOwner.toLowerCase();
     }
-    if (!owner) {
+    if (!owner2) {
       audit({ tool, decision: "error", detail: "no owner in args" });
       throw new Error(`tool "${tool}": could not determine repo owner from arguments`);
     }
-    const creds = this.config.owners[owner];
+    const creds = this.config.owners[owner2];
     if (!creds) {
-      audit({ tool, owner, decision: "error", detail: "no creds for owner" });
-      throw new Error(`no credentials configured for owner "${owner}" \u2014 add it to config.owners + creds`);
+      audit({ tool, owner: owner2, decision: "error", detail: "no creds for owner" });
+      throw new Error(`no credentials configured for owner "${owner2}" \u2014 add it to config.owners + creds`);
     }
     const token = this.secrets.resolve(rule.mode === "write" ? creds.write : creds.read);
-    const repo = typeof args.repo === "string" ? `${owner}/${args.repo}` : owner;
+    const repo = typeof args.repo === "string" ? `${owner2}/${args.repo}` : owner2;
     const decision = rule.custom ? "custom" : rule.augment ? "augment" : "forward";
     try {
-      const out = rule.custom ? await this.dispatchCustom(tool, args, owner, token) : rule.augment ? await this.dispatchAugmented(tool, args, owner, token) : await this.upstream.forward(tool, args, token);
-      audit({ tool, owner, mode: rule.mode, repo, decision, ok: true });
+      const out = rule.custom ? await this.dispatchCustom(tool, args, owner2, token) : rule.augment ? await this.dispatchAugmented(tool, args, owner2, token) : await this.upstream.forward(tool, args, token);
+      audit({ tool, owner: owner2, mode: rule.mode, repo, decision, ok: true });
       return out;
     } catch (err) {
-      audit({ tool, owner, mode: rule.mode, repo, decision, ok: false, detail: err.message });
+      audit({ tool, owner: owner2, mode: rule.mode, repo, decision, ok: false, detail: err.message });
       throw err;
     }
   }
-  async dispatchCustom(tool, args, owner, token) {
+  /** GHCR verbs: config.ghcr checks the owner and image itself; no GitHub PAT is resolved. */
+  async callGhcr(tool, args, rule) {
+    const owner2 = extractOwner(args) ?? "";
+    const repo = typeof args.image === "string" ? `${owner2}/${args.image}` : owner2;
+    try {
+      this.ghcr ??= new GhcrService(this.config.ghcr, this.secrets);
+      const out = tool === "ghcr_push" ? await this.ghcr.push(args) : tool === "ghcr_tags" ? await this.ghcr.tags(args) : this.ghcr.status(args);
+      audit({ tool, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: true });
+      return { content: [{ type: "text", text: JSON.stringify(out) }] };
+    } catch (err) {
+      audit({ tool, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: false, detail: err.message });
+      throw err;
+    }
+  }
+  async dispatchCustom(tool, args, owner2, token) {
     switch (tool) {
       // DEFERRED: link_issue (App-token-only addClosingIssueReference) is not wired in — see docs.
       // Re-enable by restoring this case + the import above + the catalog block, adding a
@@ -20563,7 +21979,14 @@ var Router = class {
       case "report_ci_status": {
         const octokit = new Octokit({ auth: token });
         const reportArgs = args;
-        const out = await reportCiStatus(octokit, reportArgs, this.makeJobLogsFetcher(owner, reportArgs.repo, token));
+        const out = await reportCiStatus(octokit, reportArgs, this.makeJobLogsFetcher(owner2, reportArgs.repo, token));
+        return { content: [{ type: "text", text: JSON.stringify(out) }] };
+      }
+      case "npm_scaffold": {
+        const npm = this.config.npm;
+        const octokit = new Octokit({ auth: this.secrets.resolve(this.config.owners[owner2].read) });
+        const registry2 = new NpmRegistry({ token: this.secrets.resolve(npm.token), ...npm.registry ? { registry: npm.registry } : {} });
+        const out = await npmScaffold(args, { octokit, registry: registry2, scopes: npm.scopes });
         return { content: [{ type: "text", text: JSON.stringify(out) }] };
       }
       default:
@@ -20578,11 +22001,11 @@ var Router = class {
    * just yields an empty map — report_ci_status treats a lookup miss as "no
    * logTail for this job", never a hard failure of the whole report.
    */
-  makeJobLogsFetcher(owner, repo, token) {
+  makeJobLogsFetcher(owner2, repo, token) {
     return async (runId, tailLines) => {
       const map = /* @__PURE__ */ new Map();
       try {
-        const result = await this.upstream.forward("get_job_logs", { owner, repo, run_id: runId, failed_only: true, return_content: true, tail_lines: tailLines }, token);
+        const result = await this.upstream.forward("get_job_logs", { owner: owner2, repo, run_id: runId, failed_only: true, return_content: true, tail_lines: tailLines }, token);
         const textBlock = result.content?.find((c) => c.type === "text");
         if (!textBlock?.text) return map;
         const parsed = JSON.parse(textBlock.text);
@@ -20610,7 +22033,7 @@ var Router = class {
    * rather than thrown — a shape mismatch should degrade to "no CI data added," not
    * break an otherwise-successful PR read.
    */
-  async dispatchAugmented(tool, args, owner, token) {
+  async dispatchAugmented(tool, args, owner2, token) {
     switch (tool) {
       case "pull_request_read": {
         const { ciVerbosity, logLines, ...upstreamArgs } = args;
@@ -20629,10 +22052,10 @@ var Router = class {
         if (typeof p.number !== "number" || typeof p.head?.sha !== "string") return result;
         const repo = String(upstreamArgs.repo ?? "");
         const octokit = new Octokit({ auth: token });
-        const ci = await ciStatusForHeadSha(octokit, owner, repo, p.number, p.head.sha, {
+        const ci = await ciStatusForHeadSha(octokit, owner2, repo, p.number, p.head.sha, {
           verbosity: Number(ciVerbosity),
           logLines: logLines !== void 0 ? Number(logLines) : void 0,
-          fetchFailedJobLogs: this.makeJobLogsFetcher(owner, repo, token)
+          fetchFailedJobLogs: this.makeJobLogsFetcher(owner2, repo, token)
         });
         textBlock.text = JSON.stringify({ ...pr, ci });
         return result;
@@ -21291,8 +22714,8 @@ function getDERfromPEM(pem) {
   const decoded = atob(pemB64);
   return string2ArrayBuffer(decoded);
 }
-function getEncodedMessage(header, payload) {
-  return `${base64encodeJSON(header)}.${base64encodeJSON(payload)}`;
+function getEncodedMessage(header2, payload) {
+  return `${base64encodeJSON(header2)}.${base64encodeJSON(payload)}`;
 }
 function base64encode(buffer) {
   var binary = "";
@@ -21338,7 +22761,7 @@ async function getToken({ privateKey, payload }) {
     name: "RSASSA-PKCS1-v1_5",
     hash: { name: "SHA-256" }
   };
-  const header = { alg: "RS256", typ: "JWT" };
+  const header2 = { alg: "RS256", typ: "JWT" };
   const privateKeyDER = getDERfromPEM(convertedPrivateKey);
   const importedKey = await subtle.importKey(
     "pkcs8",
@@ -21347,7 +22770,7 @@ async function getToken({ privateKey, payload }) {
     false,
     ["sign"]
   );
-  const encodedMessage = getEncodedMessage(header, payload);
+  const encodedMessage = getEncodedMessage(header2, payload);
   const encodedMessageArrBuf = string2ArrayBuffer(encodedMessage);
   const signatureArrBuf = await subtle.sign(
     algorithm.name,
@@ -21994,8 +23417,8 @@ var AppAuth = class {
     this.privateKey = secrets.resolve(config2.app.privateKey);
   }
   /** App-authed Octokit for this owner's installation, or null if none configured. */
-  octokitFor(owner) {
-    const installationId = this.config.owners[owner]?.installationId;
+  octokitFor(owner2) {
+    const installationId = this.config.owners[owner2]?.installationId;
     if (installationId === void 0) return null;
     let ok = this.cache.get(installationId);
     if (!ok) {
@@ -22030,6 +23453,11 @@ async function buildCatalog(config2, secrets, upstream) {
   }
   const tools = [];
   for (const rule of config2.tools) {
+    const unavailable = unavailableReason(rule, config2, secrets);
+    if (unavailable) {
+      console.error(`catalog: "${rule.name}" is not exposed: ${unavailable}`);
+      continue;
+    }
     if (rule.custom) {
       if (rule.name === "resolve_review_thread") {
         tools.push({
@@ -22049,6 +23477,12 @@ async function buildCatalog(config2, secrets, upstream) {
           description: 'Edit the labels on one issue or PR without touching any other label on it. add / remove take one label or several (combinable in one call); swap { prefix, to } removes every label starting with prefix and adds to (e.g. prefix "status: ", to "status: verified"); set replaces the whole set and only as an explicit choice. Labels already present (add) or absent (remove) are no-ops. A label name to add that does not exist in the repo refuses the call and changes nothing, unless create_missing is true. Returns the resulting label set plus what was added, removed and created. Runs on the write PAT (Issues: write).',
           inputSchema: ISSUE_LABELS_SCHEMA
         });
+      } else if (rule.name === "npm_scaffold") {
+        tools.push({
+          name: "npm_scaffold",
+          description: "Create a new npm package and register its GitHub Actions trusted publisher, so the repo's publish workflow can release it through OIDC from then on. Publishes a broker-built placeholder (0.0.0-stage, no code) and never publishes a version of an existing package. Every npm write needs its own one-time password from the user, so it takes two calls: the first publishes the placeholder and returns status needs_otp; ask the user for the next code and call again to add the trusted publisher. Ask for each code right before the call. A refused or expired code also returns needs_otp with the remaining steps. Checks first that the repo's package.json names the package and that the workflow file exists. Uses the broker's npm token (no 2FA bypass) and the read PAT.",
+          inputSchema: NPM_SCAFFOLD_SCHEMA
+        });
       } else if (rule.name === "report_unlabeled") {
         tools.push({
           name: "report_unlabeled",
@@ -22073,6 +23507,8 @@ async function buildCatalog(config2, secrets, upstream) {
           description: "Report CI health for a PR, or every open PR in a repo, at a chosen verbosity: 0 counts only, 1 adds which run/job failed, 2 adds which step failed, 3 adds a tail of the failing job's log. Detail beyond tier 0 is only fetched for runs that are actually failing. Runs on the read PAT.",
           inputSchema: REPORT_CI_STATUS_SCHEMA
         });
+      } else if (GHCR_CATALOG[rule.name]) {
+        tools.push({ name: rule.name, ...GHCR_CATALOG[rule.name] });
       }
       continue;
     }