npm - @clef-sh/agent - Versions diffs - 0.1.20 → 0.1.21 - Mend

@clef-sh/agent 0.1.20 → 0.1.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/agent.cjs CHANGED Viewed

@@ -3969,7 +3969,7 @@ var require_age_encryption = __commonJS({
         }
         return { seed, k2sig };
       }
-      function sign2(message, secretKey, opts2 = {}) {
+      function sign3(message, secretKey, opts2 = {}) {
         const { seed, k2sig } = prepSig(message, secretKey, opts2);
         const drbg = createHmacDrbg(hash.outputLen, Fn2.BYTES, hmac3);
         const sig = drbg(seed, k2sig);
@@ -4015,7 +4015,7 @@ var require_age_encryption = __commonJS({
         utils,
         lengths,
         Point,
-        sign: sign2,
+        sign: sign3,
         verify: verify3,
         recoverPublicKey,
         Signature,
@@ -7310,7 +7310,7 @@ var require_age_encryption = __commonJS({
         }
         return { seed, k2sig };
       }
-      function sign2(message, secretKey, opts2 = {}) {
+      function sign3(message, secretKey, opts2 = {}) {
         const { seed, k2sig } = prepSig(message, secretKey, opts2);
         const drbg = createHmacDrbg2(hash_.outputLen, Fn2.BYTES, hmac3);
         const sig = drbg(seed, k2sig);
@@ -7356,7 +7356,7 @@ var require_age_encryption = __commonJS({
         utils,
         lengths,
         Point,
-        sign: sign2,
+        sign: sign3,
         verify: verify3,
         recoverPublicKey,
         Signature,
@@ -14244,8 +14244,8 @@ var init_schema_date_utils = __esm({
       const date2 = new Date(Date.UTC(Number(yearStr), Number(monthStr) - 1, Number(dayStr), Number(hours), Number(minutes), Number(seconds), Number(ms) ? Math.round(parseFloat(`0.${ms}`) * 1e3) : 0));
       date2.setUTCFullYear(Number(yearStr));
       if (offsetStr.toUpperCase() != "Z") {
-        const [, sign2, offsetH, offsetM] = /([+-])(\d\d):(\d\d)/.exec(offsetStr) || [void 0, "+", 0, 0];
-        const scalar = sign2 === "-" ? 1 : -1;
+        const [, sign3, offsetH, offsetM] = /([+-])(\d\d):(\d\d)/.exec(offsetStr) || [void 0, "+", 0, 0];
+        const scalar = sign3 === "-" ? 1 : -1;
         date2.setTime(date2.getTime() + scalar * (Number(offsetH) * 60 * 60 * 1e3 + Number(offsetM) * 60 * 1e3));
       }
       return date2;
@@ -21950,7 +21950,7 @@ var require_dist_cjs41 = __commonJS({
     var utilBufferFrom = require_dist_cjs8();
     var utilUtf8 = require_dist_cjs9();
     var buffer = require("buffer");
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     var Hash6 = class {
       algorithmIdentifier;
       secret;
@@ -21967,7 +21967,7 @@ var require_dist_cjs41 = __commonJS({
         return Promise.resolve(this.hash.digest());
       }
       reset() {
-        this.hash = this.secret ? crypto18.createHmac(this.algorithmIdentifier, castSourceData(this.secret)) : crypto18.createHash(this.algorithmIdentifier);
+        this.hash = this.secret ? crypto16.createHmac(this.algorithmIdentifier, castSourceData(this.secret)) : crypto16.createHash(this.algorithmIdentifier);
       }
     };
     function castSourceData(toCast, encoding) {
@@ -22196,7 +22196,7 @@ function decode(at, to) {
           const normalizer = mantissa < 0 ? -1 : 1;
           const mantissaStr = "0".repeat(Math.abs(exponent) + 1) + String(BigInt(normalizer) * BigInt(mantissa));
           let numericString;
-          const sign2 = mantissa < 0 ? "-" : "";
+          const sign3 = mantissa < 0 ? "-" : "";
           numericString = exponent === 0 ? mantissaStr : mantissaStr.slice(0, mantissaStr.length + exponent) + "." + mantissaStr.slice(exponent);
           numericString = numericString.replace(/^0+/g, "");
           if (numericString === "") {
@@ -22205,7 +22205,7 @@ function decode(at, to) {
           if (numericString[0] === ".") {
             numericString = "0" + numericString;
           }
-          numericString = sign2 + numericString;
+          numericString = sign3 + numericString;
           _offset = offset + _offset;
           return nv(numericString);
         } else {
@@ -22263,10 +22263,10 @@ function demote(bigInteger) {
   return num;
 }
 function bytesToFloat16(a5, b5) {
-  const sign2 = a5 >> 7;
+  const sign3 = a5 >> 7;
   const exponent = (a5 & 124) >> 2;
   const fraction = (a5 & 3) << 8 | b5;
-  const scalar = sign2 === 0 ? 1 : -1;
+  const scalar = sign3 === 0 ? 1 : -1;
   let exponentComponent;
   let summation;
   if (exponent === 0) {
@@ -45995,8 +45995,8 @@ var require_float = __commonJS({
       })();
       else (function() {
         function writeFloat_ieee754(writeUint, val, buf, pos) {
-          var sign2 = val < 0 ? 1 : 0;
-          if (sign2)
+          var sign3 = val < 0 ? 1 : 0;
+          if (sign3)
             val = -val;
           if (val === 0)
             writeUint(1 / val > 0 ? (
@@ -46009,19 +46009,19 @@ var require_float = __commonJS({
           else if (isNaN(val))
             writeUint(2143289344, buf, pos);
           else if (val > 34028234663852886e22)
-            writeUint((sign2 << 31 | 2139095040) >>> 0, buf, pos);
+            writeUint((sign3 << 31 | 2139095040) >>> 0, buf, pos);
           else if (val < 11754943508222875e-54)
-            writeUint((sign2 << 31 | Math.round(val / 1401298464324817e-60)) >>> 0, buf, pos);
+            writeUint((sign3 << 31 | Math.round(val / 1401298464324817e-60)) >>> 0, buf, pos);
           else {
             var exponent = Math.floor(Math.log(val) / Math.LN2), mantissa = Math.round(val * Math.pow(2, -exponent) * 8388608) & 8388607;
-            writeUint((sign2 << 31 | exponent + 127 << 23 | mantissa) >>> 0, buf, pos);
+            writeUint((sign3 << 31 | exponent + 127 << 23 | mantissa) >>> 0, buf, pos);
           }
         }
         exports3.writeFloatLE = writeFloat_ieee754.bind(null, writeUintLE);
         exports3.writeFloatBE = writeFloat_ieee754.bind(null, writeUintBE);
         function readFloat_ieee754(readUint, buf, pos) {
-          var uint = readUint(buf, pos), sign2 = (uint >> 31) * 2 + 1, exponent = uint >>> 23 & 255, mantissa = uint & 8388607;
-          return exponent === 255 ? mantissa ? NaN : sign2 * Infinity : exponent === 0 ? sign2 * 1401298464324817e-60 * mantissa : sign2 * Math.pow(2, exponent - 150) * (mantissa + 8388608);
+          var uint = readUint(buf, pos), sign3 = (uint >> 31) * 2 + 1, exponent = uint >>> 23 & 255, mantissa = uint & 8388607;
+          return exponent === 255 ? mantissa ? NaN : sign3 * Infinity : exponent === 0 ? sign3 * 1401298464324817e-60 * mantissa : sign3 * Math.pow(2, exponent - 150) * (mantissa + 8388608);
         }
         exports3.readFloatLE = readFloat_ieee754.bind(null, readUintLE);
         exports3.readFloatBE = readFloat_ieee754.bind(null, readUintBE);
@@ -46079,8 +46079,8 @@ var require_float = __commonJS({
       })();
       else (function() {
         function writeDouble_ieee754(writeUint, off0, off1, val, buf, pos) {
-          var sign2 = val < 0 ? 1 : 0;
-          if (sign2)
+          var sign3 = val < 0 ? 1 : 0;
+          if (sign3)
             val = -val;
           if (val === 0) {
             writeUint(0, buf, pos + off0);
@@ -46096,20 +46096,20 @@ var require_float = __commonJS({
             writeUint(2146959360, buf, pos + off1);
           } else if (val > 17976931348623157e292) {
             writeUint(0, buf, pos + off0);
-            writeUint((sign2 << 31 | 2146435072) >>> 0, buf, pos + off1);
+            writeUint((sign3 << 31 | 2146435072) >>> 0, buf, pos + off1);
           } else {
             var mantissa;
             if (val < 22250738585072014e-324) {
               mantissa = val / 5e-324;
               writeUint(mantissa >>> 0, buf, pos + off0);
-              writeUint((sign2 << 31 | mantissa / 4294967296) >>> 0, buf, pos + off1);
+              writeUint((sign3 << 31 | mantissa / 4294967296) >>> 0, buf, pos + off1);
             } else {
               var exponent = Math.floor(Math.log(val) / Math.LN2);
               if (exponent === 1024)
                 exponent = 1023;
               mantissa = val * Math.pow(2, -exponent);
               writeUint(mantissa * 4503599627370496 >>> 0, buf, pos + off0);
-              writeUint((sign2 << 31 | exponent + 1023 << 20 | mantissa * 1048576 & 1048575) >>> 0, buf, pos + off1);
+              writeUint((sign3 << 31 | exponent + 1023 << 20 | mantissa * 1048576 & 1048575) >>> 0, buf, pos + off1);
             }
           }
         }
@@ -46117,8 +46117,8 @@ var require_float = __commonJS({
         exports3.writeDoubleBE = writeDouble_ieee754.bind(null, writeUintBE, 4, 0);
         function readDouble_ieee754(readUint, off0, off1, buf, pos) {
           var lo = readUint(buf, pos + off0), hi = readUint(buf, pos + off1);
-          var sign2 = (hi >> 31) * 2 + 1, exponent = hi >>> 20 & 2047, mantissa = 4294967296 * (hi & 1048575) + lo;
-          return exponent === 2047 ? mantissa ? NaN : sign2 * Infinity : exponent === 0 ? sign2 * 5e-324 * mantissa : sign2 * Math.pow(2, exponent - 1075) * (mantissa + 4503599627370496);
+          var sign3 = (hi >> 31) * 2 + 1, exponent = hi >>> 20 & 2047, mantissa = 4294967296 * (hi & 1048575) + lo;
+          return exponent === 2047 ? mantissa ? NaN : sign3 * Infinity : exponent === 0 ? sign3 * 5e-324 * mantissa : sign3 * Math.pow(2, exponent - 1075) * (mantissa + 4503599627370496);
         }
         exports3.readDoubleLE = readDouble_ieee754.bind(null, readUintLE, 0, 4);
         exports3.readDoubleBE = readDouble_ieee754.bind(null, readUintBE, 4, 0);
@@ -46290,11 +46290,11 @@ var require_longbits = __commonJS({
     LongBits.fromNumber = function fromNumber(value) {
       if (value === 0)
         return zero;
-      var sign2 = value < 0;
-      if (sign2)
+      var sign3 = value < 0;
+      if (sign3)
         value = -value;
       var lo = value >>> 0, hi = (value - lo) / 4294967296 >>> 0;
-      if (sign2) {
+      if (sign3) {
         hi = ~hi >>> 0;
         lo = ~lo >>> 0;
         if (++lo > 4294967295) {
@@ -50245,16 +50245,16 @@ var require_parse = __commonJS({
         );
       }
       function parseNumber2(token2, insideTryCatch) {
-        var sign2 = 1;
+        var sign3 = 1;
         if (token2.charAt(0) === "-") {
-          sign2 = -1;
+          sign3 = -1;
           token2 = token2.substring(1);
         }
         switch (token2) {
           case "inf":
           case "INF":
           case "Inf":
-            return sign2 * Infinity;
+            return sign3 * Infinity;
           case "nan":
           case "NAN":
           case "Nan":
@@ -50264,13 +50264,13 @@ var require_parse = __commonJS({
             return 0;
         }
         if (base10Re.test(token2))
-          return sign2 * parseInt(token2, 10);
+          return sign3 * parseInt(token2, 10);
         if (base16Re.test(token2))
-          return sign2 * parseInt(token2, 16);
+          return sign3 * parseInt(token2, 16);
         if (base8Re.test(token2))
-          return sign2 * parseInt(token2, 8);
+          return sign3 * parseInt(token2, 8);
         if (numberRe.test(token2))
-          return sign2 * parseFloat(token2);
+          return sign3 * parseFloat(token2);
         throw illegal(token2, "number", insideTryCatch);
       }
       function parseId(token2, acceptNegative) {
@@ -65384,7 +65384,7 @@ var require_lib = __commonJS({
     "use strict";
     var conversions = {};
     module2.exports = conversions;
-    function sign2(x) {
+    function sign3(x) {
       return x < 0 ? -1 : 1;
     }
     function evenRound(x) {
@@ -65409,7 +65409,7 @@ var require_lib = __commonJS({
           if (!Number.isFinite(x)) {
             throw new TypeError("Argument is not a finite number");
           }
-          x = sign2(x) * Math.floor(Math.abs(x));
+          x = sign3(x) * Math.floor(Math.abs(x));
           if (x < lowerBound || x > upperBound) {
             throw new TypeError("Argument is not in byte range");
           }
@@ -65424,7 +65424,7 @@ var require_lib = __commonJS({
         if (!Number.isFinite(x) || x === 0) {
           return 0;
         }
-        x = sign2(x) * Math.floor(Math.abs(x));
+        x = sign3(x) * Math.floor(Math.abs(x));
         x = x % moduloVal;
         if (!typeOpts.unsigned && x >= moduloBound) {
           return x - moduloVal;
@@ -69656,7 +69656,7 @@ var require_supports_color = __commonJS({
         return 1;
       }
       if ("CI" in env) {
-        if (["TRAVIS", "CIRCLECI", "APPVEYOR", "GITLAB_CI", "GITHUB_ACTIONS", "BUILDKITE"].some((sign2) => sign2 in env) || env.CI_NAME === "codeship") {
+        if (["TRAVIS", "CIRCLECI", "APPVEYOR", "GITLAB_CI", "GITHUB_ACTIONS", "BUILDKITE"].some((sign3) => sign3 in env) || env.CI_NAME === "codeship") {
           return 1;
         }
         return min;
@@ -71184,7 +71184,7 @@ var require_bignumber = __commonJS({
             }
             return arr.reverse();
           }
-          return function(str, baseIn, baseOut, sign2, callerIsToString) {
+          return function(str, baseIn, baseOut, sign3, callerIsToString) {
             var alphabet, d5, e5, k5, r5, x, xc, y, i5 = str.indexOf("."), dp = DECIMAL_PLACES, rm = ROUNDING_MODE;
             if (i5 >= 0) {
               k5 = POW_PRECISION;
@@ -71210,7 +71210,7 @@ var require_bignumber = __commonJS({
             } else {
               x.c = xc;
               x.e = e5;
-              x.s = sign2;
+              x.s = sign3;
               x = div(x, y, dp, rm, baseOut);
               xc = x.c;
               r5 = x.r;
@@ -73441,22 +73441,22 @@ var require_crypto2 = __commonJS({
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.NodeCrypto = void 0;
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     var NodeCrypto = class {
       async sha256DigestBase64(str) {
-        return crypto18.createHash("sha256").update(str).digest("base64");
+        return crypto16.createHash("sha256").update(str).digest("base64");
       }
       randomBytesBase64(count) {
-        return crypto18.randomBytes(count).toString("base64");
+        return crypto16.randomBytes(count).toString("base64");
       }
       async verify(pubkey, data2, signature) {
-        const verifier = crypto18.createVerify("RSA-SHA256");
+        const verifier = crypto16.createVerify("RSA-SHA256");
         verifier.update(data2);
         verifier.end();
         return verifier.verify(pubkey, signature, "base64");
       }
       async sign(privateKey, data2) {
-        const signer = crypto18.createSign("RSA-SHA256");
+        const signer = crypto16.createSign("RSA-SHA256");
         signer.update(data2);
         signer.end();
         return signer.sign(privateKey, "base64");
@@ -73474,7 +73474,7 @@ var require_crypto2 = __commonJS({
        *   string in hexadecimal encoding.
        */
       async sha256DigestHex(str) {
-        return crypto18.createHash("sha256").update(str).digest("hex");
+        return crypto16.createHash("sha256").update(str).digest("hex");
       }
       /**
        * Computes the HMAC hash of a message using the provided crypto key and the
@@ -73486,7 +73486,7 @@ var require_crypto2 = __commonJS({
        */
       async signWithHmacSha256(key, msg) {
         const cryptoKey = typeof key === "string" ? key : toBuffer(key);
-        return toArrayBuffer(crypto18.createHmac("sha256", cryptoKey).update(msg).digest());
+        return toArrayBuffer(crypto16.createHmac("sha256", cryptoKey).update(msg).digest());
       }
     };
     exports2.NodeCrypto = NodeCrypto;
@@ -74264,10 +74264,10 @@ var require_oauth2client = __commonJS({
        * https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js
        */
       async generateCodeVerifierAsync() {
-        const crypto18 = (0, crypto_1.createCrypto)();
-        const randomString = crypto18.randomBytesBase64(96);
+        const crypto16 = (0, crypto_1.createCrypto)();
+        const randomString = crypto16.randomBytesBase64(96);
         const codeVerifier = randomString.replace(/\+/g, "~").replace(/=/g, "_").replace(/\//g, "-");
-        const unencodedCodeChallenge = await crypto18.sha256DigestBase64(codeVerifier);
+        const unencodedCodeChallenge = await crypto16.sha256DigestBase64(codeVerifier);
         const codeChallenge = unencodedCodeChallenge.split("=")[0].replace(/\+/g, "-").replace(/\//g, "_");
         return { codeVerifier, codeChallenge };
       }
@@ -74711,7 +74711,7 @@ var require_oauth2client = __commonJS({
        * @return Returns a promise resolving to LoginTicket on verification.
        */
       async verifySignedJwtWithCertsAsync(jwt2, certs, requiredAudience, issuers, maxExpiry) {
-        const crypto18 = (0, crypto_1.createCrypto)();
+        const crypto16 = (0, crypto_1.createCrypto)();
         if (!maxExpiry) {
           maxExpiry = _OAuth2Client.DEFAULT_MAX_TOKEN_LIFETIME_SECS_;
         }
@@ -74724,7 +74724,7 @@ var require_oauth2client = __commonJS({
         let envelope;
         let payload2;
         try {
-          envelope = JSON.parse(crypto18.decodeBase64StringUtf8(segments[0]));
+          envelope = JSON.parse(crypto16.decodeBase64StringUtf8(segments[0]));
         } catch (err) {
           if (err instanceof Error) {
             err.message = `Can't parse token envelope: ${segments[0]}': ${err.message}`;
@@ -74735,7 +74735,7 @@ var require_oauth2client = __commonJS({
           throw new Error("Can't parse token envelope: " + segments[0]);
         }
         try {
-          payload2 = JSON.parse(crypto18.decodeBase64StringUtf8(segments[1]));
+          payload2 = JSON.parse(crypto16.decodeBase64StringUtf8(segments[1]));
         } catch (err) {
           if (err instanceof Error) {
             err.message = `Can't parse token payload '${segments[0]}`;
@@ -74752,7 +74752,7 @@ var require_oauth2client = __commonJS({
         if (envelope.alg === "ES256") {
           signature = formatEcdsa.joseToDer(signature, "ES256").toString("base64");
         }
-        const verified = await crypto18.verify(cert, signed, signature);
+        const verified = await crypto16.verify(cert, signed, signature);
         if (!verified) {
           throw new Error("Invalid token signature: " + jwt2);
         }
@@ -75120,14 +75120,14 @@ var require_buffer_equal_constant_time = __commonJS({
 var require_jwa = __commonJS({
   "../../node_modules/jwa/index.js"(exports2, module2) {
     var Buffer3 = require_safe_buffer().Buffer;
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     var formatEcdsa = require_ecdsa_sig_formatter();
     var util2 = require("util");
     var MSG_INVALID_ALGORITHM = '"%s" is not a valid algorithm.\n  Supported algorithms are:\n  "HS256", "HS384", "HS512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "ES256", "ES384", "ES512" and "none".';
     var MSG_INVALID_SECRET = "secret must be a string or buffer";
     var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
     var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-    var supportsKeyObjects = typeof crypto18.createPublicKey === "function";
+    var supportsKeyObjects = typeof crypto16.createPublicKey === "function";
     if (supportsKeyObjects) {
       MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
       MSG_INVALID_SECRET += "or a KeyObject";
@@ -75214,20 +75214,20 @@ var require_jwa = __commonJS({
       return thing;
     }
     function createHmacSigner(bits) {
-      return function sign2(thing, secret) {
+      return function sign3(thing, secret) {
         checkIsSecretKey(secret);
         thing = normalizeInput(thing);
-        var hmac = crypto18.createHmac("sha" + bits, secret);
+        var hmac = crypto16.createHmac("sha" + bits, secret);
         var sig = (hmac.update(thing), hmac.digest("base64"));
         return fromBase649(sig);
       };
     }
     var bufferEqual;
-    var timingSafeEqual2 = "timingSafeEqual" in crypto18 ? function timingSafeEqual3(a5, b5) {
+    var timingSafeEqual2 = "timingSafeEqual" in crypto16 ? function timingSafeEqual3(a5, b5) {
       if (a5.byteLength !== b5.byteLength) {
         return false;
       }
-      return crypto18.timingSafeEqual(a5, b5);
+      return crypto16.timingSafeEqual(a5, b5);
     } : function timingSafeEqual3(a5, b5) {
       if (!bufferEqual) {
         bufferEqual = require_buffer_equal_constant_time();
@@ -75241,10 +75241,10 @@ var require_jwa = __commonJS({
       };
     }
     function createKeySigner(bits) {
-      return function sign2(thing, privateKey) {
+      return function sign3(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto18.createSign("RSA-SHA" + bits);
+        var signer = crypto16.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign(privateKey, "base64"));
         return fromBase649(sig);
       };
@@ -75254,20 +75254,20 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase649(signature);
-        var verifier = crypto18.createVerify("RSA-SHA" + bits);
+        var verifier = crypto16.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify(publicKey, signature, "base64");
       };
     }
     function createPSSKeySigner(bits) {
-      return function sign2(thing, privateKey) {
+      return function sign3(thing, privateKey) {
         checkIsPrivateKey(privateKey);
         thing = normalizeInput(thing);
-        var signer = crypto18.createSign("RSA-SHA" + bits);
+        var signer = crypto16.createSign("RSA-SHA" + bits);
         var sig = (signer.update(thing), signer.sign({
           key: privateKey,
-          padding: crypto18.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto18.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto16.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto16.constants.RSA_PSS_SALTLEN_DIGEST
         }, "base64"));
         return fromBase649(sig);
       };
@@ -75277,18 +75277,18 @@ var require_jwa = __commonJS({
         checkIsPublicKey(publicKey);
         thing = normalizeInput(thing);
         signature = toBase649(signature);
-        var verifier = crypto18.createVerify("RSA-SHA" + bits);
+        var verifier = crypto16.createVerify("RSA-SHA" + bits);
         verifier.update(thing);
         return verifier.verify({
           key: publicKey,
-          padding: crypto18.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: crypto18.constants.RSA_PSS_SALTLEN_DIGEST
+          padding: crypto16.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: crypto16.constants.RSA_PSS_SALTLEN_DIGEST
         }, signature, "base64");
       };
     }
     function createECDSASigner(bits) {
       var inner = createKeySigner(bits);
-      return function sign2() {
+      return function sign3() {
         var signature = inner.apply(null, arguments);
         signature = formatEcdsa.derToJose(signature, "ES" + bits);
         return signature;
@@ -75303,7 +75303,7 @@ var require_jwa = __commonJS({
       };
     }
     function createNoneSigner() {
-      return function sign2() {
+      return function sign3() {
         return "";
       };
     }
@@ -75405,7 +75405,7 @@ var require_sign_stream = __commonJS({
       }.bind(this));
     }
     util2.inherits(SignStream, Stream);
-    SignStream.prototype.sign = function sign2() {
+    SignStream.prototype.sign = function sign3() {
       try {
         var signature = jwsSign({
           header: this.header,
@@ -77440,14 +77440,14 @@ var require_awsrequestsigner = __commonJS({
       }
     };
     exports2.AwsRequestSigner = AwsRequestSigner;
-    async function sign2(crypto18, key, msg) {
-      return await crypto18.signWithHmacSha256(key, msg);
-    }
-    async function getSigningKey(crypto18, key, dateStamp, region, serviceName) {
-      const kDate = await sign2(crypto18, `AWS4${key}`, dateStamp);
-      const kRegion = await sign2(crypto18, kDate, region);
-      const kService = await sign2(crypto18, kRegion, serviceName);
-      const kSigning = await sign2(crypto18, kService, "aws4_request");
+    async function sign3(crypto16, key, msg) {
+      return await crypto16.signWithHmacSha256(key, msg);
+    }
+    async function getSigningKey(crypto16, key, dateStamp, region, serviceName) {
+      const kDate = await sign3(crypto16, `AWS4${key}`, dateStamp);
+      const kRegion = await sign3(crypto16, kDate, region);
+      const kService = await sign3(crypto16, kRegion, serviceName);
+      const kSigning = await sign3(crypto16, kService, "aws4_request");
       return kSigning;
     }
     async function generateAuthenticationHeaderMap(options) {
@@ -77493,7 +77493,7 @@ ${amzDate}
 ${credentialScope}
 ` + await options.crypto.sha256DigestHex(canonicalRequest);
       const signingKey = await getSigningKey(options.crypto, options.securityCredentials.secretAccessKey, dateStamp, options.region, serviceName);
-      const signature = await sign2(options.crypto, signingKey, stringToSign);
+      const signature = await sign3(options.crypto, signingKey, stringToSign);
       const authorizationHeader = `${AWS_ALGORITHM} Credential=${options.securityCredentials.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${(0, crypto_1.fromArrayBufferToHex)(signature)}`;
       return {
         // Do not return x-amz-date if date is available.
@@ -79032,24 +79032,24 @@ var require_googleauth = __commonJS({
           const signed = await client.sign(data2);
           return signed.signedBlob;
         }
-        const crypto18 = (0, crypto_1.createCrypto)();
+        const crypto16 = (0, crypto_1.createCrypto)();
         if (client instanceof jwtclient_1.JWT && client.key) {
-          const sign2 = await crypto18.sign(client.key, data2);
-          return sign2;
+          const sign3 = await crypto16.sign(client.key, data2);
+          return sign3;
         }
         const creds = await this.getCredentials();
         if (!creds.client_email) {
           throw new Error("Cannot sign data without `client_email`.");
         }
-        return this.signBlob(crypto18, creds.client_email, data2, endpoint);
+        return this.signBlob(crypto16, creds.client_email, data2, endpoint);
       }
-      async signBlob(crypto18, emailOrUniqueId, data2, endpoint) {
+      async signBlob(crypto16, emailOrUniqueId, data2, endpoint) {
         const url = new URL(endpoint + `${emailOrUniqueId}:signBlob`);
         const res = await this.request({
           method: "POST",
           url: url.href,
           data: {
-            payload: crypto18.encodeBase64StringUtf8(data2)
+            payload: crypto16.encodeBase64StringUtf8(data2)
           },
           retry: true,
           retryConfig: {
@@ -79466,7 +79466,7 @@ var require_src10 = __commonJS({
 var require_object_hash = __commonJS({
   "../../node_modules/object-hash/index.js"(exports2, module2) {
     "use strict";
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     exports2 = module2.exports = objectHash;
     function objectHash(object, options) {
       options = applyDefaults(object, options);
@@ -79484,7 +79484,7 @@ var require_object_hash = __commonJS({
     exports2.keysMD5 = function(object) {
       return objectHash(object, { algorithm: "md5", encoding: "hex", excludeValues: true });
     };
-    var hashes = crypto18.getHashes ? crypto18.getHashes().slice() : ["sha1", "md5"];
+    var hashes = crypto16.getHashes ? crypto16.getHashes().slice() : ["sha1", "md5"];
     hashes.push("passthrough");
     var encodings = ["buffer", "hex", "binary", "base64"];
     function applyDefaults(object, sourceOptions) {
@@ -79530,7 +79530,7 @@ var require_object_hash = __commonJS({
     function hash(object, options) {
       var hashingStream;
       if (options.algorithm !== "passthrough") {
-        hashingStream = crypto18.createHash(options.algorithm);
+        hashingStream = crypto16.createHash(options.algorithm);
       } else {
         hashingStream = new PassThrough();
       }
@@ -142766,8 +142766,8 @@ var require_lodash2 = __commonJS({
       }
       value = toNumber(value);
       if (value === INFINITY || value === -INFINITY) {
-        var sign2 = value < 0 ? -1 : 1;
-        return sign2 * MAX_INTEGER;
+        var sign3 = value < 0 ? -1 : 1;
+        return sign3 * MAX_INTEGER;
       }
       return value === value ? value : 0;
     }
@@ -142852,8 +142852,8 @@ var require_lodash4 = __commonJS({
       }
       value = toNumber(value);
       if (value === INFINITY || value === -INFINITY) {
-        var sign2 = value < 0 ? -1 : 1;
-        return sign2 * MAX_INTEGER;
+        var sign3 = value < 0 ? -1 : 1;
+        return sign3 * MAX_INTEGER;
       }
       return value === value ? value : 0;
     }
@@ -143010,8 +143010,8 @@ var require_lodash8 = __commonJS({
       }
       value = toNumber(value);
       if (value === INFINITY || value === -INFINITY) {
-        var sign2 = value < 0 ? -1 : 1;
-        return sign2 * MAX_INTEGER;
+        var sign3 = value < 0 ? -1 : 1;
+        return sign3 * MAX_INTEGER;
       }
       return value === value ? value : 0;
     }
@@ -143055,7 +143055,7 @@ var require_sign = __commonJS({
     var isPlainObject = require_lodash6();
     var isString = require_lodash7();
     var once = require_lodash8();
-    var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey2 } = require("crypto");
+    var { KeyObject, createSecretKey, createPrivateKey: createPrivateKey3 } = require("crypto");
     var SUPPORTED_ALGS = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "HS256", "HS384", "HS512", "none"];
     if (PS_SUPPORTED) {
       SUPPORTED_ALGS.splice(3, 0, "PS256", "PS384", "PS512");
@@ -143149,7 +143149,7 @@ var require_sign = __commonJS({
       }
       if (secretOrPrivateKey != null && !(secretOrPrivateKey instanceof KeyObject)) {
         try {
-          secretOrPrivateKey = createPrivateKey2(secretOrPrivateKey);
+          secretOrPrivateKey = createPrivateKey3(secretOrPrivateKey);
         } catch (_) {
           try {
             secretOrPrivateKey = createSecretKey(typeof secretOrPrivateKey === "string" ? Buffer.from(secretOrPrivateKey) : secretOrPrivateKey);
@@ -163257,8 +163257,8 @@ var require_int2 = __commonJS({
     var stringifyNumber = require_stringifyNumber();
     var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
     function intResolve(str, offset, radix, { intAsBigInt }) {
-      const sign2 = str[0];
-      if (sign2 === "-" || sign2 === "+")
+      const sign3 = str[0];
+      if (sign3 === "-" || sign3 === "+")
         offset += 1;
       str = str.substring(offset).replace(/_/g, "");
       if (intAsBigInt) {
@@ -163274,10 +163274,10 @@ var require_int2 = __commonJS({
             break;
         }
         const n3 = BigInt(str);
-        return sign2 === "-" ? BigInt(-1) * n3 : n3;
+        return sign3 === "-" ? BigInt(-1) * n3 : n3;
       }
       const n2 = parseInt(str, radix);
-      return sign2 === "-" ? -1 * n2 : n2;
+      return sign3 === "-" ? -1 * n2 : n2;
     }
     function intStringify(node, radix, prefix) {
       const { value } = node;
@@ -163424,11 +163424,11 @@ var require_timestamp2 = __commonJS({
     "use strict";
     var stringifyNumber = require_stringifyNumber();
     function parseSexagesimal(str, asBigInt) {
-      const sign2 = str[0];
-      const parts = sign2 === "-" || sign2 === "+" ? str.substring(1) : str;
+      const sign3 = str[0];
+      const parts = sign3 === "-" || sign3 === "+" ? str.substring(1) : str;
       const num = (n2) => asBigInt ? BigInt(n2) : Number(n2);
       const res = parts.replace(/_/g, "").split(":").reduce((res2, p2) => res2 * num(60) + num(p2), num(0));
-      return sign2 === "-" ? num(-1) * res : res;
+      return sign3 === "-" ? num(-1) * res : res;
     }
     function stringifySexagesimal(node) {
       let { value } = node;
@@ -163437,9 +163437,9 @@ var require_timestamp2 = __commonJS({
         num = (n2) => BigInt(n2);
       else if (isNaN(value) || !isFinite(value))
         return stringifyNumber.stringifyNumber(node);
-      let sign2 = "";
+      let sign3 = "";
       if (value < 0) {
-        sign2 = "-";
+        sign3 = "-";
         value *= num(-1);
       }
       const _60 = num(60);
@@ -163454,7 +163454,7 @@ var require_timestamp2 = __commonJS({
           parts.unshift(value);
         }
       }
-      return sign2 + parts.map((n2) => String(n2).padStart(2, "0")).join(":").replace(/000000\d*$/, "");
+      return sign3 + parts.map((n2) => String(n2).padStart(2, "0")).join(":").replace(/000000\d*$/, "");
     }
     var intTime = {
       identify: (value) => typeof value === "bigint" || Number.isInteger(value),
@@ -163771,7 +163771,7 @@ var require_Document = __commonJS({
     var applyReviver = require_applyReviver();
     var createNode = require_createNode();
     var directives = require_directives();
-    var Document = class _Document {
+    var Document2 = class _Document {
       constructor(value, replacer, options) {
         this.commentBefore = null;
         this.comment = null;
@@ -164061,7 +164061,7 @@ var require_Document = __commonJS({
         return true;
       throw new Error("Expected a YAML collection as document contents");
     }
-    exports2.Document = Document;
+    exports2.Document = Document2;
   }
 });
@@ -165424,13 +165424,13 @@ var require_compose_node = __commonJS({
 var require_compose_doc = __commonJS({
   "../../node_modules/yaml/dist/compose/compose-doc.js"(exports2) {
     "use strict";
-    var Document = require_Document();
+    var Document2 = require_Document();
     var composeNode = require_compose_node();
     var resolveEnd = require_resolve_end();
     var resolveProps = require_resolve_props();
     function composeDoc(options, directives, { offset, start, value, end }, onError) {
       const opts = Object.assign({ _directives: directives }, options);
-      const doc = new Document.Document(void 0, opts);
+      const doc = new Document2.Document(void 0, opts);
       const ctx = {
         atKey: false,
         atRoot: true,
@@ -165469,7 +165469,7 @@ var require_composer = __commonJS({
     "use strict";
     var node_process = require("process");
     var directives = require_directives();
-    var Document = require_Document();
+    var Document2 = require_Document();
     var errors = require_errors3();
     var identity = require_identity();
     var composeDoc = require_compose_doc();
@@ -165656,7 +165656,7 @@ ${end.comment}` : end.comment;
           this.doc = null;
         } else if (forceDoc) {
           const opts = Object.assign({ _directives: this.directives }, this.options);
-          const doc = new Document.Document(void 0, opts);
+          const doc = new Document2.Document(void 0, opts);
           if (this.atDirectives)
             this.onError(endOffset, "MISSING_CHAR", "Missing directives-end indicator line");
           doc.range = [0, endOffset, endOffset];
@@ -167561,7 +167561,7 @@ var require_public_api2 = __commonJS({
   "../../node_modules/yaml/dist/public-api.js"(exports2) {
     "use strict";
     var composer = require_composer();
-    var Document = require_Document();
+    var Document2 = require_Document();
     var errors = require_errors3();
     var log2 = require_log();
     var identity = require_identity();
@@ -167644,7 +167644,7 @@ var require_public_api2 = __commonJS({
       }
       if (identity.isDocument(value) && !_replacer)
         return value.toString(options);
-      return new Document.Document(value, _replacer, options).toString(options);
+      return new Document2.Document(value, _replacer, options).toString(options);
     }
     exports2.parse = parse16;
     exports2.parseAllDocuments = parseAllDocuments;
@@ -167658,7 +167658,7 @@ var require_dist4 = __commonJS({
   "../../node_modules/yaml/dist/index.js"(exports2) {
     "use strict";
     var composer = require_composer();
-    var Document = require_Document();
+    var Document2 = require_Document();
     var Schema2 = require_Schema();
     var errors = require_errors3();
     var Alias = require_Alias();
@@ -167674,7 +167674,7 @@ var require_dist4 = __commonJS({
     var publicApi = require_public_api2();
     var visit = require_visit();
     exports2.Composer = composer.Composer;
-    exports2.Document = Document.Document;
+    exports2.Document = Document2.Document;
     exports2.Schema = Schema2.Schema;
     exports2.YAMLError = errors.YAMLError;
     exports2.YAMLParseError = errors.YAMLParseError;
@@ -183469,7 +183469,7 @@ var require_sign2 = __commonJS({
   "../../node_modules/math-intrinsics/sign.js"(exports2, module2) {
     "use strict";
     var $isNaN = require_isNaN();
-    module2.exports = function sign2(number) {
+    module2.exports = function sign3(number) {
       if ($isNaN(number) || number === 0) {
         return number;
       }
@@ -183833,7 +183833,7 @@ var require_get_intrinsic = __commonJS({
     var min = require_min();
     var pow = require_pow();
     var round = require_round();
-    var sign2 = require_sign2();
+    var sign3 = require_sign2();
     var $Function = Function;
     var getEvalledConstructor = function(expressionSyntax) {
       try {
@@ -183947,7 +183947,7 @@ var require_get_intrinsic = __commonJS({
       "%Math.min%": min,
       "%Math.pow%": pow,
       "%Math.round%": round,
-      "%Math.sign%": sign2,
+      "%Math.sign%": sign3,
       "%Reflect.getPrototypeOf%": $ReflectGPO
     };
     if (getProto) {
@@ -185737,14 +185737,14 @@ var require_etag = __commonJS({
   "../../node_modules/etag/index.js"(exports2, module2) {
     "use strict";
     module2.exports = etag;
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     var Stats = require("fs").Stats;
     var toString = Object.prototype.toString;
     function entitytag(entity) {
       if (entity.length === 0) {
         return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"';
       }
-      var hash = crypto18.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
+      var hash = crypto16.createHash("sha1").update(entity, "utf8").digest("base64").substring(0, 27);
       var len = typeof entity === "string" ? Buffer.byteLength(entity, "utf8") : entity.length;
       return '"' + len.toString(16) + "-" + hash + '"';
     }
@@ -189145,17 +189145,17 @@ var require_content_disposition = __commonJS({
 // ../../node_modules/cookie-signature/index.js
 var require_cookie_signature = __commonJS({
   "../../node_modules/cookie-signature/index.js"(exports2) {
-    var crypto18 = require("crypto");
+    var crypto16 = require("crypto");
     exports2.sign = function(val, secret) {
       if ("string" != typeof val) throw new TypeError("Cookie value must be provided as a string.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
-      return val + "." + crypto18.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
+      return val + "." + crypto16.createHmac("sha256", secret).update(val).digest("base64").replace(/\=+$/, "");
     };
     exports2.unsign = function(input, secret) {
       if ("string" != typeof input) throw new TypeError("Signed cookie string must be provided.");
       if (null == secret) throw new TypeError("Secret key must be provided.");
       var tentativeValue = input.slice(0, input.lastIndexOf(".")), expectedInput = exports2.sign(tentativeValue, secret), expectedBuffer = Buffer.from(expectedInput), inputBuffer = Buffer.from(input);
-      return expectedBuffer.length === inputBuffer.length && crypto18.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
+      return expectedBuffer.length === inputBuffer.length && crypto16.timingSafeEqual(expectedBuffer, inputBuffer) ? tentativeValue : false;
     };
   }
 });
@@ -189897,7 +189897,7 @@ var require_response = __commonJS({
     var path4 = require("node:path");
     var pathIsAbsolute = require("node:path").isAbsolute;
     var statuses = require_statuses();
-    var sign2 = require_cookie_signature().sign;
+    var sign3 = require_cookie_signature().sign;
     var normalizeType = require_utils4().normalizeType;
     var normalizeTypes = require_utils4().normalizeTypes;
     var setCharset = require_utils4().setCharset;
@@ -190188,7 +190188,7 @@ var require_response = __commonJS({
       }
       var val = typeof value === "object" ? "j:" + JSON.stringify(value) : String(value);
       if (signed) {
-        val = "s:" + sign2(val, secret);
+        val = "s:" + sign3(val, secret);
       }
       if (opts.maxAge != null) {
         var maxAge = opts.maxAge - 0;
@@ -190739,9 +190739,6 @@ var AgeDecryptor = class {
   }
 };
-// ../runtime/src/poller.ts
-var crypto16 = __toESM(require("crypto"));
 // ../runtime/src/artifact-decryptor.ts
 var crypto14 = __toESM(require("crypto"));
@@ -191003,44 +191000,6 @@ var ArtifactDecryptor = class {
   }
 };
-// ../runtime/src/signature.ts
-var crypto15 = __toESM(require("crypto"));
-function buildSigningPayload(artifact) {
-  const fields = [
-    "clef-sig-v3",
-    String(artifact.version),
-    artifact.identity,
-    artifact.environment,
-    artifact.revision,
-    artifact.packedAt,
-    artifact.ciphertextHash,
-    artifact.expiresAt ?? "",
-    artifact.envelope?.provider ?? "",
-    artifact.envelope?.keyId ?? "",
-    artifact.envelope?.wrappedKey ?? "",
-    artifact.envelope?.algorithm ?? "",
-    artifact.envelope?.iv ?? "",
-    artifact.envelope?.authTag ?? ""
-  ];
-  return Buffer.from(fields.join("\n"), "utf-8");
-}
-function verifySignature(payload2, signatureBase64, publicKeyBase64) {
-  const keyObj = crypto15.createPublicKey({
-    key: Buffer.from(publicKeyBase64, "base64"),
-    format: "der",
-    type: "spki"
-  });
-  const signature = Buffer.from(signatureBase64, "base64");
-  const keyType = keyObj.asymmetricKeyType;
-  if (keyType === "ed25519") {
-    return crypto15.verify(null, payload2, keyObj, signature);
-  }
-  if (keyType === "ec") {
-    return crypto15.verify("sha256", payload2, keyObj, signature);
-  }
-  throw new Error(`Unsupported key type for signature verification: ${keyType}`);
-}
 // ../core/dist/index.mjs
 var YAML = __toESM(require_dist4(), 1);
 var YAML2 = __toESM(require_dist4(), 1);
@@ -191053,7 +191012,10 @@ var YAML8 = __toESM(require_dist4(), 1);
 var YAML9 = __toESM(require_dist4(), 1);
 var YAML10 = __toESM(require_dist4(), 1);
 var YAML11 = __toESM(require_dist4(), 1);
+var crypto22 = __toESM(require("crypto"), 1);
+var crypto32 = __toESM(require("crypto"), 1);
 var YAML12 = __toESM(require_dist4(), 1);
+var YAML13 = __toESM(require_dist4(), 1);
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
 var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
@@ -191354,10 +191316,10 @@ var require_lib3 = __commonJS2({
     module2.exports.sync = writeFileSync7;
     module2.exports._getTmpname = getTmpname;
     module2.exports._cleanupOnExit = cleanupOnExit;
-    var fs21 = __require("fs");
-    var crypto42 = __require("node:crypto");
+    var fs22 = __require("fs");
+    var crypto62 = __require("node:crypto");
     var { onExit } = require_cjs2();
-    var path28 = __require("path");
+    var path29 = __require("path");
     var { promisify: promisify6 } = __require("util");
     var activeFiles = {};
     var threadId = (function getId() {
@@ -191370,24 +191332,24 @@ var require_lib3 = __commonJS2({
     })();
     var invocations = 0;
     function getTmpname(filename) {
-      return filename + "." + crypto42.createHash("sha1").update(__filename).update(String(process.pid)).update(String(threadId)).update(String(++invocations)).digest().readUInt32BE(0);
+      return filename + "." + crypto62.createHash("sha1").update(__filename).update(String(process.pid)).update(String(threadId)).update(String(++invocations)).digest().readUInt32BE(0);
     }
     function cleanupOnExit(tmpfile) {
       return () => {
         try {
-          fs21.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
+          fs22.unlinkSync(typeof tmpfile === "function" ? tmpfile() : tmpfile);
         } catch {
         }
       };
     }
     function serializeActiveFile(absoluteName) {
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         if (!activeFiles[absoluteName]) {
           activeFiles[absoluteName] = [];
         }
-        activeFiles[absoluteName].push(resolve);
+        activeFiles[absoluteName].push(resolve2);
         if (activeFiles[absoluteName].length === 1) {
-          resolve();
+          resolve2();
         }
       });
     }
@@ -191410,13 +191372,13 @@ var require_lib3 = __commonJS2({
       let fd;
       let tmpfile;
       const removeOnExitHandler = onExit(cleanupOnExit(() => tmpfile));
-      const absoluteName = path28.resolve(filename);
+      const absoluteName = path29.resolve(filename);
       try {
         await serializeActiveFile(absoluteName);
-        const truename = await promisify6(fs21.realpath)(filename).catch(() => filename);
+        const truename = await promisify6(fs22.realpath)(filename).catch(() => filename);
         tmpfile = getTmpname(truename);
         if (!options.mode || !options.chown) {
-          const stats = await promisify6(fs21.stat)(truename).catch(() => {
+          const stats = await promisify6(fs22.stat)(truename).catch(() => {
           });
           if (stats) {
             if (options.mode == null) {
@@ -191427,45 +191389,45 @@ var require_lib3 = __commonJS2({
             }
           }
         }
-        fd = await promisify6(fs21.open)(tmpfile, "w", options.mode);
+        fd = await promisify6(fs22.open)(tmpfile, "w", options.mode);
         if (options.tmpfileCreated) {
           await options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data2)) {
-          await promisify6(fs21.write)(fd, data2, 0, data2.length, 0);
+          await promisify6(fs22.write)(fd, data2, 0, data2.length, 0);
         } else if (data2 != null) {
-          await promisify6(fs21.write)(fd, String(data2), 0, String(options.encoding || "utf8"));
+          await promisify6(fs22.write)(fd, String(data2), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          await promisify6(fs21.fsync)(fd);
+          await promisify6(fs22.fsync)(fd);
         }
-        await promisify6(fs21.close)(fd);
+        await promisify6(fs22.close)(fd);
         fd = null;
         if (options.chown) {
-          await promisify6(fs21.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
+          await promisify6(fs22.chown)(tmpfile, options.chown.uid, options.chown.gid).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
         if (options.mode) {
-          await promisify6(fs21.chmod)(tmpfile, options.mode).catch((err) => {
+          await promisify6(fs22.chmod)(tmpfile, options.mode).catch((err) => {
             if (!isChownErrOk(err)) {
               throw err;
             }
           });
         }
-        await promisify6(fs21.rename)(tmpfile, truename);
+        await promisify6(fs22.rename)(tmpfile, truename);
       } finally {
         if (fd) {
-          await promisify6(fs21.close)(fd).catch(
+          await promisify6(fs22.close)(fd).catch(
             /* istanbul ignore next */
             () => {
             }
           );
         }
         removeOnExitHandler();
-        await promisify6(fs21.unlink)(tmpfile).catch(() => {
+        await promisify6(fs22.unlink)(tmpfile).catch(() => {
         });
         activeFiles[absoluteName].shift();
         if (activeFiles[absoluteName].length > 0) {
@@ -191498,13 +191460,13 @@ var require_lib3 = __commonJS2({
         options = {};
       }
       try {
-        filename = fs21.realpathSync(filename);
+        filename = fs22.realpathSync(filename);
       } catch (ex) {
       }
       const tmpfile = getTmpname(filename);
       if (!options.mode || !options.chown) {
         try {
-          const stats = fs21.statSync(filename);
+          const stats = fs22.statSync(filename);
           options = Object.assign({}, options);
           if (!options.mode) {
             options.mode = stats.mode;
@@ -191520,23 +191482,23 @@ var require_lib3 = __commonJS2({
       const removeOnExitHandler = onExit(cleanup);
       let threw = true;
       try {
-        fd = fs21.openSync(tmpfile, "w", options.mode || 438);
+        fd = fs22.openSync(tmpfile, "w", options.mode || 438);
         if (options.tmpfileCreated) {
           options.tmpfileCreated(tmpfile);
         }
         if (ArrayBuffer.isView(data2)) {
-          fs21.writeSync(fd, data2, 0, data2.length, 0);
+          fs22.writeSync(fd, data2, 0, data2.length, 0);
         } else if (data2 != null) {
-          fs21.writeSync(fd, String(data2), 0, String(options.encoding || "utf8"));
+          fs22.writeSync(fd, String(data2), 0, String(options.encoding || "utf8"));
         }
         if (options.fsync !== false) {
-          fs21.fsyncSync(fd);
+          fs22.fsyncSync(fd);
         }
-        fs21.closeSync(fd);
+        fs22.closeSync(fd);
         fd = null;
         if (options.chown) {
           try {
-            fs21.chownSync(tmpfile, options.chown.uid, options.chown.gid);
+            fs22.chownSync(tmpfile, options.chown.uid, options.chown.gid);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
@@ -191545,19 +191507,19 @@ var require_lib3 = __commonJS2({
         }
         if (options.mode) {
           try {
-            fs21.chmodSync(tmpfile, options.mode);
+            fs22.chmodSync(tmpfile, options.mode);
           } catch (err) {
             if (!isChownErrOk(err)) {
               throw err;
             }
           }
         }
-        fs21.renameSync(tmpfile, filename);
+        fs22.renameSync(tmpfile, filename);
         threw = false;
       } finally {
         if (fd) {
           try {
-            fs21.closeSync(fd);
+            fs22.closeSync(fd);
           } catch (ex) {
           }
         }
@@ -191594,54 +191556,54 @@ var require_polyfills = __commonJS2({
     }
     var chdir;
     module2.exports = patch;
-    function patch(fs21) {
+    function patch(fs22) {
       if (constants2.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs21);
-      }
-      if (!fs21.lutimes) {
-        patchLutimes(fs21);
-      }
-      fs21.chown = chownFix(fs21.chown);
-      fs21.fchown = chownFix(fs21.fchown);
-      fs21.lchown = chownFix(fs21.lchown);
-      fs21.chmod = chmodFix(fs21.chmod);
-      fs21.fchmod = chmodFix(fs21.fchmod);
-      fs21.lchmod = chmodFix(fs21.lchmod);
-      fs21.chownSync = chownFixSync(fs21.chownSync);
-      fs21.fchownSync = chownFixSync(fs21.fchownSync);
-      fs21.lchownSync = chownFixSync(fs21.lchownSync);
-      fs21.chmodSync = chmodFixSync(fs21.chmodSync);
-      fs21.fchmodSync = chmodFixSync(fs21.fchmodSync);
-      fs21.lchmodSync = chmodFixSync(fs21.lchmodSync);
-      fs21.stat = statFix(fs21.stat);
-      fs21.fstat = statFix(fs21.fstat);
-      fs21.lstat = statFix(fs21.lstat);
-      fs21.statSync = statFixSync(fs21.statSync);
-      fs21.fstatSync = statFixSync(fs21.fstatSync);
-      fs21.lstatSync = statFixSync(fs21.lstatSync);
-      if (fs21.chmod && !fs21.lchmod) {
-        fs21.lchmod = function(path28, mode, cb) {
+        patchLchmod(fs22);
+      }
+      if (!fs22.lutimes) {
+        patchLutimes(fs22);
+      }
+      fs22.chown = chownFix(fs22.chown);
+      fs22.fchown = chownFix(fs22.fchown);
+      fs22.lchown = chownFix(fs22.lchown);
+      fs22.chmod = chmodFix(fs22.chmod);
+      fs22.fchmod = chmodFix(fs22.fchmod);
+      fs22.lchmod = chmodFix(fs22.lchmod);
+      fs22.chownSync = chownFixSync(fs22.chownSync);
+      fs22.fchownSync = chownFixSync(fs22.fchownSync);
+      fs22.lchownSync = chownFixSync(fs22.lchownSync);
+      fs22.chmodSync = chmodFixSync(fs22.chmodSync);
+      fs22.fchmodSync = chmodFixSync(fs22.fchmodSync);
+      fs22.lchmodSync = chmodFixSync(fs22.lchmodSync);
+      fs22.stat = statFix(fs22.stat);
+      fs22.fstat = statFix(fs22.fstat);
+      fs22.lstat = statFix(fs22.lstat);
+      fs22.statSync = statFixSync(fs22.statSync);
+      fs22.fstatSync = statFixSync(fs22.fstatSync);
+      fs22.lstatSync = statFixSync(fs22.lstatSync);
+      if (fs22.chmod && !fs22.lchmod) {
+        fs22.lchmod = function(path29, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs21.lchmodSync = function() {
+        fs22.lchmodSync = function() {
         };
       }
-      if (fs21.chown && !fs21.lchown) {
-        fs21.lchown = function(path28, uid, gid, cb) {
+      if (fs22.chown && !fs22.lchown) {
+        fs22.lchown = function(path29, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs21.lchownSync = function() {
+        fs22.lchownSync = function() {
         };
       }
       if (platform2 === "win32") {
-        fs21.rename = typeof fs21.rename !== "function" ? fs21.rename : (function(fs$rename) {
+        fs22.rename = typeof fs22.rename !== "function" ? fs22.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs21.stat(to, function(stater, st) {
+                  fs22.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -191657,9 +191619,9 @@ var require_polyfills = __commonJS2({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs21.rename);
+        })(fs22.rename);
       }
-      fs21.read = typeof fs21.read !== "function" ? fs21.read : (function(fs$read) {
+      fs22.read = typeof fs22.read !== "function" ? fs22.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -191667,22 +191629,22 @@ var require_polyfills = __commonJS2({
             callback = function(er, _, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs21, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs22, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs21, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs22, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs21.read);
-      fs21.readSync = typeof fs21.readSync !== "function" ? fs21.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs22.read);
+      fs22.readSync = typeof fs22.readSync !== "function" ? fs22.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs21, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs22, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -191692,11 +191654,11 @@ var require_polyfills = __commonJS2({
             }
           }
         };
-      })(fs21.readSync);
-      function patchLchmod(fs22) {
-        fs22.lchmod = function(path28, mode, callback) {
-          fs22.open(
-            path28,
+      })(fs22.readSync);
+      function patchLchmod(fs23) {
+        fs23.lchmod = function(path29, mode, callback) {
+          fs23.open(
+            path29,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -191704,80 +191666,80 @@ var require_polyfills = __commonJS2({
                 if (callback) callback(err);
                 return;
               }
-              fs22.fchmod(fd, mode, function(err2) {
-                fs22.close(fd, function(err22) {
+              fs23.fchmod(fd, mode, function(err2) {
+                fs23.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs22.lchmodSync = function(path28, mode) {
-          var fd = fs22.openSync(path28, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs23.lchmodSync = function(path29, mode) {
+          var fd = fs23.openSync(path29, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs22.fchmodSync(fd, mode);
+            ret = fs23.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs22.closeSync(fd);
+                fs23.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs22.closeSync(fd);
+              fs23.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs22) {
-        if (constants2.hasOwnProperty("O_SYMLINK") && fs22.futimes) {
-          fs22.lutimes = function(path28, at, mt, cb) {
-            fs22.open(path28, constants2.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs23) {
+        if (constants2.hasOwnProperty("O_SYMLINK") && fs23.futimes) {
+          fs23.lutimes = function(path29, at, mt, cb) {
+            fs23.open(path29, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs22.futimes(fd, at, mt, function(er2) {
-                fs22.close(fd, function(er22) {
+              fs23.futimes(fd, at, mt, function(er2) {
+                fs23.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs22.lutimesSync = function(path28, at, mt) {
-            var fd = fs22.openSync(path28, constants2.O_SYMLINK);
+          fs23.lutimesSync = function(path29, at, mt) {
+            var fd = fs23.openSync(path29, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs22.futimesSync(fd, at, mt);
+              ret = fs23.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs22.closeSync(fd);
+                  fs23.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs22.closeSync(fd);
+                fs23.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs22.futimes) {
-          fs22.lutimes = function(_a2, _b, _c5, cb) {
+        } else if (fs23.futimes) {
+          fs23.lutimes = function(_a2, _b, _c5, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs22.lutimesSync = function() {
+          fs23.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs21, target, mode, function(er) {
+          return orig.call(fs22, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -191787,7 +191749,7 @@ var require_polyfills = __commonJS2({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs21, target, mode);
+            return orig.call(fs22, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -191796,7 +191758,7 @@ var require_polyfills = __commonJS2({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs21, target, uid, gid, function(er) {
+          return orig.call(fs22, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -191806,7 +191768,7 @@ var require_polyfills = __commonJS2({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs21, target, uid, gid);
+            return orig.call(fs22, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -191826,13 +191788,13 @@ var require_polyfills = __commonJS2({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs21, target, options, callback) : orig.call(fs21, target, callback);
+          return options ? orig.call(fs22, target, options, callback) : orig.call(fs22, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs21, target, options) : orig.call(fs21, target);
+          var stats = options ? orig.call(fs22, target, options) : orig.call(fs22, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -191859,16 +191821,16 @@ var require_legacy_streams = __commonJS2({
   "../../node_modules/graceful-fs/legacy-streams.js"(exports2, module2) {
     var Stream = __require("stream").Stream;
     module2.exports = legacy;
-    function legacy(fs21) {
+    function legacy(fs22) {
       return {
         ReadStream,
         WriteStream
       };
-      function ReadStream(path28, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path28, options);
+      function ReadStream(path29, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path29, options);
         Stream.call(this);
         var self2 = this;
-        this.path = path28;
+        this.path = path29;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -191902,7 +191864,7 @@ var require_legacy_streams = __commonJS2({
           });
           return;
         }
-        fs21.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs22.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -191913,10 +191875,10 @@ var require_legacy_streams = __commonJS2({
           self2._read();
         });
       }
-      function WriteStream(path28, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path28, options);
+      function WriteStream(path29, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path29, options);
         Stream.call(this);
-        this.path = path28;
+        this.path = path29;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -191941,7 +191903,7 @@ var require_legacy_streams = __commonJS2({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs21.open;
+          this._open = fs22.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -191972,7 +191934,7 @@ var require_clone = __commonJS2({
 });
 var require_graceful_fs = __commonJS2({
   "../../node_modules/graceful-fs/graceful-fs.js"(exports2, module2) {
-    var fs21 = __require("fs");
+    var fs22 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -192004,12 +191966,12 @@ var require_graceful_fs = __commonJS2({
         m3 = "GFS4: " + m3.split(/\n/).join("\nGFS4: ");
         console.error(m3);
       };
-    if (!fs21[gracefulQueue]) {
+    if (!fs22[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs21, queue);
-      fs21.close = (function(fs$close) {
+      publishQueue(fs22, queue);
+      fs22.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs21, fd, function(err) {
+          return fs$close.call(fs22, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -192021,48 +191983,48 @@ var require_graceful_fs = __commonJS2({
           value: fs$close
         });
         return close;
-      })(fs21.close);
-      fs21.closeSync = (function(fs$closeSync) {
+      })(fs22.close);
+      fs22.closeSync = (function(fs$closeSync) {
         function closeSync2(fd) {
-          fs$closeSync.apply(fs21, arguments);
+          fs$closeSync.apply(fs22, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync2, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync2;
-      })(fs21.closeSync);
+      })(fs22.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug(fs21[gracefulQueue]);
-          __require("assert").equal(fs21[gracefulQueue].length, 0);
+          debug(fs22[gracefulQueue]);
+          __require("assert").equal(fs22[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs21[gracefulQueue]);
-    }
-    module2.exports = patch(clone(fs21));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs21.__patched) {
-      module2.exports = patch(fs21);
-      fs21.__patched = true;
-    }
-    function patch(fs22) {
-      polyfills(fs22);
-      fs22.gracefulify = patch;
-      fs22.createReadStream = createReadStream;
-      fs22.createWriteStream = createWriteStream;
-      var fs$readFile = fs22.readFile;
-      fs22.readFile = readFile5;
-      function readFile5(path28, options, cb) {
+      publishQueue(global, fs22[gracefulQueue]);
+    }
+    module2.exports = patch(clone(fs22));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs22.__patched) {
+      module2.exports = patch(fs22);
+      fs22.__patched = true;
+    }
+    function patch(fs23) {
+      polyfills(fs23);
+      fs23.gracefulify = patch;
+      fs23.createReadStream = createReadStream;
+      fs23.createWriteStream = createWriteStream;
+      var fs$readFile = fs23.readFile;
+      fs23.readFile = readFile5;
+      function readFile5(path29, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path28, options, cb);
-        function go$readFile(path29, options2, cb2, startTime) {
-          return fs$readFile(path29, options2, function(err) {
+        return go$readFile(path29, options, cb);
+        function go$readFile(path30, options2, cb2, startTime) {
+          return fs$readFile(path30, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path29, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path30, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -192070,16 +192032,16 @@ var require_graceful_fs = __commonJS2({
           });
         }
       }
-      var fs$writeFile = fs22.writeFile;
-      fs22.writeFile = writeFile;
-      function writeFile(path28, data2, options, cb) {
+      var fs$writeFile = fs23.writeFile;
+      fs23.writeFile = writeFile;
+      function writeFile(path29, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path28, data2, options, cb);
-        function go$writeFile(path29, data22, options2, cb2, startTime) {
-          return fs$writeFile(path29, data22, options2, function(err) {
+        return go$writeFile(path29, data2, options, cb);
+        function go$writeFile(path30, data22, options2, cb2, startTime) {
+          return fs$writeFile(path30, data22, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path29, data22, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path30, data22, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -192087,17 +192049,17 @@ var require_graceful_fs = __commonJS2({
           });
         }
       }
-      var fs$appendFile = fs22.appendFile;
+      var fs$appendFile = fs23.appendFile;
       if (fs$appendFile)
-        fs22.appendFile = appendFile;
-      function appendFile(path28, data2, options, cb) {
+        fs23.appendFile = appendFile;
+      function appendFile(path29, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path28, data2, options, cb);
-        function go$appendFile(path29, data22, options2, cb2, startTime) {
-          return fs$appendFile(path29, data22, options2, function(err) {
+        return go$appendFile(path29, data2, options, cb);
+        function go$appendFile(path30, data22, options2, cb2, startTime) {
+          return fs$appendFile(path30, data22, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path29, data22, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path30, data22, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -192105,9 +192067,9 @@ var require_graceful_fs = __commonJS2({
           });
         }
       }
-      var fs$copyFile = fs22.copyFile;
+      var fs$copyFile = fs23.copyFile;
       if (fs$copyFile)
-        fs22.copyFile = copyFile;
+        fs23.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -192125,34 +192087,34 @@ var require_graceful_fs = __commonJS2({
           });
         }
       }
-      var fs$readdir = fs22.readdir;
-      fs22.readdir = readdir;
+      var fs$readdir = fs23.readdir;
+      fs23.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path28, options, cb) {
+      function readdir(path29, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path29, options2, cb2, startTime) {
-          return fs$readdir(path29, fs$readdirCallback(
-            path29,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path30, options2, cb2, startTime) {
+          return fs$readdir(path30, fs$readdirCallback(
+            path30,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path29, options2, cb2, startTime) {
-          return fs$readdir(path29, options2, fs$readdirCallback(
-            path29,
+        } : function go$readdir2(path30, options2, cb2, startTime) {
+          return fs$readdir(path30, options2, fs$readdirCallback(
+            path30,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path28, options, cb);
-        function fs$readdirCallback(path29, options2, cb2, startTime) {
+        return go$readdir(path29, options, cb);
+        function fs$readdirCallback(path30, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path29, options2, cb2],
+                [path30, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -192167,21 +192129,21 @@ var require_graceful_fs = __commonJS2({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs22);
+        var legStreams = legacy(fs23);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs22.ReadStream;
+      var fs$ReadStream = fs23.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs22.WriteStream;
+      var fs$WriteStream = fs23.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs22, "ReadStream", {
+      Object.defineProperty(fs23, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -192191,7 +192153,7 @@ var require_graceful_fs = __commonJS2({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs22, "WriteStream", {
+      Object.defineProperty(fs23, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -192202,7 +192164,7 @@ var require_graceful_fs = __commonJS2({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs22, "FileReadStream", {
+      Object.defineProperty(fs23, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -192213,7 +192175,7 @@ var require_graceful_fs = __commonJS2({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs22, "FileWriteStream", {
+      Object.defineProperty(fs23, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -192223,7 +192185,7 @@ var require_graceful_fs = __commonJS2({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path28, options) {
+      function ReadStream(path29, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -192243,7 +192205,7 @@ var require_graceful_fs = __commonJS2({
           }
         });
       }
-      function WriteStream(path28, options) {
+      function WriteStream(path29, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -192261,22 +192223,22 @@ var require_graceful_fs = __commonJS2({
           }
         });
       }
-      function createReadStream(path28, options) {
-        return new fs22.ReadStream(path28, options);
+      function createReadStream(path29, options) {
+        return new fs23.ReadStream(path29, options);
       }
-      function createWriteStream(path28, options) {
-        return new fs22.WriteStream(path28, options);
+      function createWriteStream(path29, options) {
+        return new fs23.WriteStream(path29, options);
       }
-      var fs$open = fs22.open;
-      fs22.open = open2;
-      function open2(path28, flags, mode, cb) {
+      var fs$open = fs23.open;
+      fs23.open = open2;
+      function open2(path29, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path28, flags, mode, cb);
-        function go$open(path29, flags2, mode2, cb2, startTime) {
-          return fs$open(path29, flags2, mode2, function(err, fd) {
+        return go$open(path29, flags, mode, cb);
+        function go$open(path30, flags2, mode2, cb2, startTime) {
+          return fs$open(path30, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path29, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path30, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -192284,20 +192246,20 @@ var require_graceful_fs = __commonJS2({
           });
         }
       }
-      return fs22;
+      return fs23;
     }
     function enqueue(elem) {
       debug("ENQUEUE", elem[0].name, elem[1]);
-      fs21[gracefulQueue].push(elem);
+      fs22[gracefulQueue].push(elem);
       retry();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i5 = 0; i5 < fs21[gracefulQueue].length; ++i5) {
-        if (fs21[gracefulQueue][i5].length > 2) {
-          fs21[gracefulQueue][i5][3] = now;
-          fs21[gracefulQueue][i5][4] = now;
+      for (var i5 = 0; i5 < fs22[gracefulQueue].length; ++i5) {
+        if (fs22[gracefulQueue][i5].length > 2) {
+          fs22[gracefulQueue][i5][3] = now;
+          fs22[gracefulQueue][i5][4] = now;
         }
       }
       retry();
@@ -192305,9 +192267,9 @@ var require_graceful_fs = __commonJS2({
     function retry() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs21[gracefulQueue].length === 0)
+      if (fs22[gracefulQueue].length === 0)
         return;
-      var elem = fs21[gracefulQueue].shift();
+      var elem = fs22[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -192329,7 +192291,7 @@ var require_graceful_fs = __commonJS2({
           debug("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs21[gracefulQueue].push(elem);
+          fs22[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -192752,10 +192714,10 @@ var require_mtime_precision = __commonJS2({
   "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports2, module2) {
     "use strict";
     var cacheSymbol = /* @__PURE__ */ Symbol();
-    function probe(file, fs21, callback) {
-      const cachedPrecision = fs21[cacheSymbol];
+    function probe(file, fs22, callback) {
+      const cachedPrecision = fs22[cacheSymbol];
       if (cachedPrecision) {
-        return fs21.stat(file, (err, stat) => {
+        return fs22.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -192763,16 +192725,16 @@ var require_mtime_precision = __commonJS2({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs21.utimes(file, mtime, mtime, (err) => {
+      fs22.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs21.stat(file, (err2, stat) => {
+        fs22.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs21, cacheSymbol, { value: precision });
+          Object.defineProperty(fs22, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -192791,8 +192753,8 @@ var require_mtime_precision = __commonJS2({
 var require_lockfile = __commonJS2({
   "../../node_modules/proper-lockfile/lib/lockfile.js"(exports2, module2) {
     "use strict";
-    var path28 = __require("path");
-    var fs21 = require_graceful_fs();
+    var path29 = __require("path");
+    var fs22 = require_graceful_fs();
     var retry = require_retry22();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -192802,7 +192764,7 @@ var require_lockfile = __commonJS2({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path28.resolve(file));
+        return callback(null, path29.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -192923,7 +192885,7 @@ var require_lockfile = __commonJS2({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs21,
+        fs: fs22,
         onCompromised: (err) => {
           throw err;
         },
@@ -192967,7 +192929,7 @@ var require_lockfile = __commonJS2({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs21,
+        fs: fs22,
         realpath: true,
         ...options
       };
@@ -192989,7 +192951,7 @@ var require_lockfile = __commonJS2({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs21,
+        fs: fs22,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -193026,16 +192988,16 @@ var require_lockfile = __commonJS2({
 var require_adapter = __commonJS2({
   "../../node_modules/proper-lockfile/lib/adapter.js"(exports2, module2) {
     "use strict";
-    var fs21 = require_graceful_fs();
-    function createSyncFs(fs22) {
+    var fs22 = require_graceful_fs();
+    function createSyncFs(fs23) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs22 };
+      const newFs = { ...fs23 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs22[`${method}Sync`](...args);
+            ret = fs23[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -193045,12 +193007,12 @@ var require_adapter = __commonJS2({
       return newFs;
     }
     function toPromise(method) {
-      return (...args) => new Promise((resolve, reject) => {
+      return (...args) => new Promise((resolve2, reject) => {
         args.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve(result);
+            resolve2(result);
           }
         });
         method(...args);
@@ -193073,7 +193035,7 @@ var require_adapter = __commonJS2({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs21);
+      options.fs = createSyncFs(options.fs || fs22);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -193130,8 +193092,47 @@ var ClefError = class extends Error {
 };
 var import_write_file_atomic = __toESM2(require_lib3());
 var MAX_FILE_SIZE = 1024 * 1024;
-var lockfile = __toESM2(require_proper_lockfile());
 var import_write_file_atomic2 = __toESM2(require_lib3());
+var lockfile = __toESM2(require_proper_lockfile());
+var import_write_file_atomic3 = __toESM2(require_lib3());
+function buildSigningPayload(artifact) {
+  const fields = [
+    "clef-sig-v3",
+    String(artifact.version),
+    artifact.identity,
+    artifact.environment,
+    artifact.revision,
+    artifact.packedAt,
+    artifact.ciphertextHash,
+    artifact.expiresAt ?? "",
+    artifact.envelope?.provider ?? "",
+    artifact.envelope?.keyId ?? "",
+    artifact.envelope?.wrappedKey ?? "",
+    artifact.envelope?.algorithm ?? "",
+    artifact.envelope?.iv ?? "",
+    artifact.envelope?.authTag ?? ""
+  ];
+  return Buffer.from(fields.join("\n"), "utf-8");
+}
+function verifySignature(payload2, signatureBase64, publicKeyBase64) {
+  const keyObj = crypto22.createPublicKey({
+    key: Buffer.from(publicKeyBase64, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  const signature = Buffer.from(signatureBase64, "base64");
+  const keyType = keyObj.asymmetricKeyType;
+  if (keyType === "ed25519") {
+    return crypto22.verify(null, payload2, keyObj, signature);
+  }
+  if (keyType === "ec") {
+    return crypto22.verify("sha256", payload2, keyObj, signature);
+  }
+  throw new Error(`Unsupported key type for signature verification: ${keyType}`);
+}
+function computeCiphertextHash(ciphertext) {
+  return crypto32.createHash("sha256").update(ciphertext).digest("hex");
+}
 var InvalidArtifactError = class extends ClefError {
   constructor(message) {
     super(
@@ -193200,6 +193201,8 @@ function assertPackedArtifact(x, context3) {
     throw new InvalidArtifactError(`${prefix}${result.reason}`);
   }
 }
+var WARNING_TAIL = "Shell history, terminal scrollback, and any attached logging (tmux capture-pane, CI log collectors, screen-recording) may retain it. Proceed only if this terminal and its upstream captures are trusted.";
+var REVEAL_WARNING = `WARNING: plaintext will be printed to stdout. ${WARNING_TAIL}`;
 var BACKEND_KEY_FIELDS = {
   age: void 0,
   awskms: "aws_kms_arn",
@@ -193388,7 +193391,7 @@ var ArtifactPoller = class {
       throw new Error(`Artifact expired at ${artifact.expiresAt}`);
     }
     if (artifact.revision === this.lastRevision) return artifact;
-    const hash = crypto16.createHash("sha256").update(artifact.ciphertext).digest("hex");
+    const hash = computeCiphertextHash(artifact.ciphertext);
     if (hash !== artifact.ciphertextHash) {
       const err = new Error(
         `Artifact integrity check failed: expected hash ${artifact.ciphertextHash}, got ${hash}`
@@ -193921,7 +193924,7 @@ var VcsArtifactSource = class {
 };
 // ../runtime/src/sources/s3.ts
-var crypto17 = __toESM(require("crypto"));
+var crypto15 = __toESM(require("crypto"));
 function isS3Url(url) {
   let u;
   try {
@@ -194064,10 +194067,10 @@ var S3ArtifactSource = class {
   }
 };
 function hmacSha256(key, data2) {
-  return crypto17.createHmac("sha256", key).update(data2, "utf-8").digest();
+  return crypto15.createHmac("sha256", key).update(data2, "utf-8").digest();
 }
 function sha256Hex(data2) {
-  return crypto17.createHash("sha256").update(data2, "utf-8").digest("hex");
+  return crypto15.createHash("sha256").update(data2, "utf-8").digest("hex");
 }
 function toAmzDate(date2) {
   return date2.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
@@ -194501,7 +194504,7 @@ async function initialFetch(poller, jitMode, encryptedStore, cache5, sourceDesc)
 }
 // package.json
-var version5 = "0.1.20";
+var version5 = "0.1.21";
 // src/main.ts
 var isLambda = !!process.env.AWS_LAMBDA_RUNTIME_API;