@dsh-enhanced/plugin-control-plane 0.1.31 → 0.1.34

package/lib/host-attestor.js

@@ -1,5 +1,5 @@
-import { spawn } from 'node:child_process';
 import { realpath } from 'node:fs/promises';
+import { ControlledProcessError, executeControlledProcess } from './adapter-process.js';
 import { parseHostAttestationReceipt } from './attestation.js';
 import { ControlPlaneStore, ControlPlaneStoreError } from './store.js';
 import { inheritedHostAttestorEnvironment, openTrustedExecutable, verifyOpenTrustedExecutable } from './trust.js';
@@ -29,20 +29,26 @@ export function hostRequirements(policy, phase, previousHostGeneration) {
     if (phase === 'soak')
         return { kind: phase, minimumWindowMs: policy.soakMinimumWindowMs,
             minimumSamples: policy.soakMinimumSamples, maximumFailureRate: policy.soakMaximumFailureRate };
-    return { kind: phase, minimumChecks: policy.healthMinimumChecks, maximumFailures: policy.healthMaximumFailures };
+    if (phase === 'health')
+        return { kind: phase, minimumChecks: policy.healthMinimumChecks, maximumFailures: policy.healthMaximumFailures };
+    throw new HostAttestorError('FAILED', 'rollback requirements must be bound to the durable recovery marker');
 }
 function expectedPhase(plan) {
     const status = plan.status.startsWith('awaiting-') ? plan.status.slice('awaiting-'.length) : '';
-    if (!['reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health'].includes(status)) {
+    if (!['reload', 'readiness', 'effect-blocked-replay', 'shadow', 'canary', 'soak', 'health', 'rollback'].includes(status)) {
         throw new HostAttestorError('FAILED', 'plan is not awaiting a Host phase');
     }
     return status;
 }
 function prepare(store, plan, trust, issuer) {
-    const phase = expectedPhase(plan);
+    const phase = plan.status === 'rollback-pending' && plan.activation?.hostRecoveryRequired ? 'rollback' : expectedPhase(plan);
+    const requirements = phase === 'rollback'
+        ? { kind: 'rollback', previousHostGeneration: store.latestHostGeneration(plan.installationId), action: plan.activation?.targetOriginallyExisted ? 'restore' : 'stop',
+            baselineFiles: plan.activation?.targetBaselineFiles ?? [], minimumChecks: trust.hostPolicy.healthMinimumChecks }
+        : hostRequirements(trust.hostPolicy, phase, store.latestHostGeneration(plan.installationId));
     return store.prepareHostAttestationOperation({ planId: plan.id, expectedRevision: plan.revision,
         expectedFence: plan.activation.fence, issuer,
-        requirements: hostRequirements(trust.hostPolicy, phase, store.latestHostGeneration(plan.installationId)),
+        requirements,
         receiptTtlMs: trust.hostPolicy.receiptTtlMs });
 }
 export function prepareManualHostAttestation(store, plan, trust) {
@@ -56,7 +62,9 @@ export function prepareConfiguredHostAttestation(store, plan, trust) {
         path: attestor.path, sha256: attestor.sha256, interpreter: attestor.interpreter,
         authority: attestor.authority, keyId: attestor.keyId });
 }
-async function execute(executable, interpreter, args, environment, timeoutMs, input, maximumOutput) {
+async function execute(executable, interpreter, args, environment, timeoutMs, input, maximumOutput, signal) {
+    if (signal?.aborted)
+        throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
     if (process.platform !== 'linux')
         throw new HostAttestorError('FAILED', 'descriptor-pinned Host attestors require Linux');
     try {
@@ -65,55 +73,27 @@ async function execute(executable, interpreter, args, environment, timeoutMs, in
     catch {
         throw new HostAttestorError('FAILED', 'descriptor-pinned Host attestors require /proc/self/fd');
     }
-    return new Promise((resolve, reject) => {
-        const command = interpreter === undefined ? '/proc/self/fd/3' : '/proc/self/fd/4';
-        const commandArguments = interpreter === undefined ? [...args] : ['/proc/self/fd/3', ...args];
-        const stdio = ['pipe', 'pipe', 'ignore', executable.handle.fd];
-        if (interpreter !== undefined)
-            stdio.push(interpreter.handle.fd);
-        const child = spawn(command, commandArguments, { env: environment, shell: false, stdio });
-        const chunks = [];
-        let bytes = 0;
-        let timedOut = false;
-        let outputLimit = false;
-        let settled = false;
-        const fail = (error) => { if (!settled) {
-            settled = true;
-            reject(error);
-        } };
-        child.stdout.on('data', (chunk) => {
-            bytes += chunk.length;
-            if (bytes > maximumOutput) {
-                outputLimit = true;
-                child.kill('SIGKILL');
-            }
-            else
-                chunks.push(chunk);
-        });
-        child.once('error', () => fail(new HostAttestorError('FAILED', 'registered Host attestor could not start')));
-        child.once('close', code => {
-            if (settled)
-                return;
-            settled = true;
-            if (timedOut)
-                reject(new HostAttestorError('TIMEOUT', 'registered Host attestor exceeded its deadline'));
-            else if (outputLimit)
-                reject(new HostAttestorError('OUTPUT_LIMIT', 'registered Host attestor exceeded its output bound'));
-            else if (code !== 0)
-                reject(new HostAttestorError('FAILED', 'registered Host attestor returned a non-zero status'));
-            else
-                resolve(Buffer.concat(chunks).toString('utf8'));
-        });
-        const timer = setTimeout(() => { timedOut = true; child.kill('SIGKILL'); }, timeoutMs);
-        child.once('close', () => clearTimeout(timer));
-        child.stdin.on('error', () => { });
-        if (input === undefined)
-            child.stdin.end();
-        else
-            child.stdin.end(input, 'utf8');
-    });
+    const command = interpreter === undefined ? '/proc/self/fd/3' : '/proc/self/fd/4';
+    const commandArguments = interpreter === undefined ? [...args] : ['/proc/self/fd/3', ...args];
+    const stdio = ['pipe', 'pipe', 'ignore', executable.handle.fd];
+    if (interpreter !== undefined)
+        stdio.push(interpreter.handle.fd);
+    try {
+        return await executeControlledProcess({ command, args: commandArguments, env: environment, stdio,
+            stdin: input, timeoutMs, maximumOutput, ...(signal === undefined ? {} : { signal }) });
+    }
+    catch (error) {
+        if (!(error instanceof ControlledProcessError))
+            throw error;
+        if (error.code === 'TIMEOUT')
+            throw new HostAttestorError('TIMEOUT', 'registered Host attestor exceeded its deadline');
+        if (error.code === 'OUTPUT_LIMIT')
+            throw new HostAttestorError('OUTPUT_LIMIT', 'registered Host attestor exceeded its output bound');
+        throw new HostAttestorError('FAILED', error.code === 'NON_ZERO'
+            ? 'registered Host attestor returned a non-zero status' : 'registered Host attestor could not be safely reclaimed');
+    }
 }
-export async function invokeConfiguredHostAttestor(trust, request) {
+export async function invokeConfiguredHostAttestor(trust, request, signal) {
     const attestor = trust.hostAttestor;
     if (attestor === undefined)
         throw new HostAttestorError('NOT_CONFIGURED', 'no owner-configured Host attestor is registered');
@@ -125,18 +105,27 @@ export async function invokeConfiguredHostAttestor(trust, request) {
         throw new HostAttestorError('FAILED', 'durable request is not bound to the configured Host attestor');
     let executable;
     let interpreter;
+    let receipt;
     try {
+        if (signal?.aborted)
+            throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
         executable = await openTrustedExecutable(attestor.path, attestor.sha256);
+        if (signal?.aborted)
+            throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
         interpreter = attestor.interpreter === null ? undefined
             : await openTrustedExecutable(attestor.interpreter.path, attestor.interpreter.sha256);
+        if (signal?.aborted)
+            throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
         const environment = inheritedHostAttestorEnvironment(trust);
-        const version = (await execute(executable, interpreter, ['--version'], environment, attestor.timeoutMs, undefined, 1_024)).trim();
+        const version = (await execute(executable, interpreter, ['--version'], environment, attestor.timeoutMs, undefined, 1_024, signal)).trim();
         if (version !== attestor.version)
             throw new HostAttestorError('VERSION_MISMATCH', 'registered Host attestor reported a different version');
-        const receiptSource = await execute(executable, interpreter, ['attest'], environment, attestor.timeoutMs, `${JSON.stringify(request)}\n`, 65_536);
+        const receiptSource = await execute(executable, interpreter, ['attest'], environment, attestor.timeoutMs, `${JSON.stringify(request)}\n`, 65_536, signal);
         await verifyOpenTrustedExecutable(executable);
         if (interpreter !== undefined)
             await verifyOpenTrustedExecutable(interpreter);
+        if (signal?.aborted)
+            throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
         let parsed;
         try {
             parsed = JSON.parse(receiptSource);
@@ -144,7 +133,7 @@ export async function invokeConfiguredHostAttestor(trust, request) {
         catch {
             throw new HostAttestorError('FAILED', 'registered Host attestor did not return one JSON receipt');
         }
-        return parseHostAttestationReceipt(parsed);
+        receipt = parseHostAttestationReceipt(parsed);
     }
     catch (error) {
         if (error instanceof HostAttestorError || error instanceof ControlPlaneStoreError)
@@ -159,5 +148,10 @@ export async function invokeConfiguredHostAttestor(trust, request) {
             await executable?.handle.close();
         }
     }
+    if (signal?.aborted)
+        throw new HostAttestorError('FAILED', 'registered Host attestor was cancelled');
+    if (receipt === undefined)
+        throw new HostAttestorError('FAILED', 'registered Host attestor did not return a receipt');
+    return receipt;
 }
 //# sourceMappingURL=host-attestor.js.map

package/lib/host-attestor.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-attestor.js","sourceRoot":"","sources":["../src/host-attestor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,2BAA2B,EAChC,MAAM,YAAY,CAAA;AAa/E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAA2B,EAAE,OAAe;QAC/D,KAAK,CAAC,sCAAsC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAA;QAD7C,SAAI,GAAJ,IAAI,CAAuB;QAE9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA6B,EAAE,KAA2B,EACzF,sBAA8B;IAC9B,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IACtE,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAA;IAC/F,IAAI,KAAK,KAAK,uBAAuB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK;YACzD,uBAAuB,EAAE,MAAM,CAAC,oCAAoC;YACpE,4BAA4B,EAAE,MAAM,CAAC,yCAAyC,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAA;IAC7G,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,oBAAoB;YACvF,iBAAiB,EAAE,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAA;IAChF,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC/D,cAAc,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAA;IAC9F,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,mBAAmB;YACrF,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAA;IAChG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAA;AAClH,CAAC;AAED,SAAS,aAAa,CAAC,IAA0B;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/F,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,MAA8B,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB,EAAE,IAA0B,EAAE,KAA+B,EACpG,MAAwC;IACxC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,OAAO,KAAK,CAAC,+BAA+B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;QAC7F,aAAa,EAAE,IAAI,CAAC,UAAW,CAAC,KAAK,EAAE,MAAM;QAC7C,YAAY,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxG,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAwB,EAAE,IAA0B,EAC/F,KAA+B;IAC/B,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAwB,EAAE,IAA0B,EACnG,KAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAA;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAA;IAC5H,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QAC5G,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;QAC/E,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAiC,EAAE,WAA8C,EACtG,IAAuB,EAAE,WAA8B,EACvD,SAAiB,EAAE,KAAyB,EAAE,aAAqB;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAA;IACzH,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wDAAwD,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAA;QACjF,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAA;QAC7F,MAAM,KAAK,GAAsC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjG,IAAI,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACzF,MAAM,MAAM,GAAa,EAAE,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,WAAW,GAAG,KAAK,CAAC;QAAC,IAAI,OAAO,GAAG,KAAK,CAAA;QAC9G,MAAM,IAAI,GAAG,CAAC,KAAY,EAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAAC,CAAC,CAAC,CAAC,CAAA;QACxF,KAAK,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAA;YACrB,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;gBAAC,WAAW,GAAG,IAAI,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAAC,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClG,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC,CAAC,CAAA;QAC5G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACzB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAC,CAAA;iBACnG,IAAI,WAAW;gBAAE,MAAM,CAAC,IAAI,iBAAiB,CAAC,cAAc,EAAE,oDAAoD,CAAC,CAAC,CAAA;iBACpH,IAAI,IAAI,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,qDAAqD,CAAC,CAAC,CAAA;;gBAC9G,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9C,KAAK,CAAC,KAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAiD,CAAC,CAAC,CAAA;QACjF,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAM,CAAC,GAAG,EAAE,CAAA;;YACtC,KAAK,CAAC,KAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAA+B,EAChF,OAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAA;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAA;IAC5H,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;WACnF,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACpF,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;WAC5F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;WACnF,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAA;IACnJ,IAAI,UAA6C,CAAA;IACjD,IAAI,WAA8C,CAAA;IAClD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxE,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvF,MAAM,WAAW,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACjI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAA;QAC1I,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjJ,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAA;QAC7E,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAY,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAA;QAAC,CAAC;QACjK,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QAC9F,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,oEAAoE,CAAC,CAAA;IACzH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;gBACjC,CAAC;YAAC,MAAM,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}
+{"version":3,"file":"host-attestor.js","sourceRoot":"","sources":["../src/host-attestor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,2BAA2B,EAChC,MAAM,YAAY,CAAA;AAa/E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAA2B,EAAE,OAAe;QAC/D,KAAK,CAAC,sCAAsC,IAAI,MAAM,OAAO,EAAE,CAAC,CAAA;QAD7C,SAAI,GAAJ,IAAI,CAAuB;QAE9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,MAA6B,EAAE,KAA2B,EACzF,sBAA8B;IAC9B,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IACtE,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAA;IAC/F,IAAI,KAAK,KAAK,uBAAuB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK;YACzD,uBAAuB,EAAE,MAAM,CAAC,oCAAoC;YACpE,4BAA4B,EAAE,MAAM,CAAC,yCAAyC,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAA;IAC7G,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,oBAAoB;YACvF,iBAAiB,EAAE,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAA;IAChF,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC/D,cAAc,EAAE,MAAM,CAAC,oBAAoB,EAAE,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAA;IAC9F,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,mBAAmB;YACrF,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,CAAC,sBAAsB,EAAE,CAAA;IAChG,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,mBAAmB,EAAE,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAA;IACxI,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,oEAAoE,CAAC,CAAA;AAC7G,CAAC;AAED,SAAS,aAAa,CAAC,IAA0B;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/F,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,MAA8B,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,KAAwB,EAAE,IAA0B,EAAE,KAA+B,EACpG,MAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,kBAAkB,IAAI,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5H,MAAM,YAAY,GAAG,KAAK,KAAK,UAAU;QACvC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,MAAe;YAC7L,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,IAAI,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,UAAU,CAAC,mBAAmB,EAAE;QAClH,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;IAC9F,OAAO,KAAK,CAAC,+BAA+B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,QAAQ;QAC7F,aAAa,EAAE,IAAI,CAAC,UAAW,CAAC,KAAK,EAAE,MAAM;QAC7C,YAAY;QACZ,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAwB,EAAE,IAA0B,EAC/F,KAA+B;IAC/B,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAwB,EAAE,IAA0B,EACnG,KAA+B;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAA;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAA;IAC5H,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QAC5G,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW;QAC/E,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,UAAiC,EAAE,WAA8C,EACtG,IAAuB,EAAE,WAA8B,EACvD,SAAiB,EAAE,KAAyB,EAAE,aAAqB,EAAE,MAAoB;IACzF,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;IACpG,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAA;IACzH,IAAI,CAAC;QAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wDAAwD,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAA;IACjF,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAsC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACjG,IAAI,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,OAAO,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK;YAC9F,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAsB,CAAC;YAAE,MAAM,KAAK,CAAA;QAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,gDAAgD,CAAC,CAAA;QACtH,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,oDAAoD,CAAC,CAAA;QACpI,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,UAAU;YAC7D,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAA;IACvH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAA+B,EAChF,OAA+B,EAAE,MAAoB;IACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAA;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAA;IAC5H,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE;WACnF,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;WACpF,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;WAC5F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;WACnF,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,8DAA8D,CAAC,CAAA;IACnJ,IAAI,UAA6C,CAAA;IACjD,IAAI,WAA8C,CAAA;IAClD,IAAI,OAA2C,CAAA;IAC/C,IAAI,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;QACpG,UAAU,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;QACxE,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;QACpG,WAAW,GAAG,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,CAAC,CAAC,MAAM,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvF,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;QACpG,MAAM,WAAW,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACzI,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAA;QAC1I,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QACzJ,MAAM,2BAA2B,CAAC,UAAU,CAAC,CAAA;QAC7C,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAA;QAC7E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;QACpG,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAY,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,0DAA0D,CAAC,CAAA;QAAC,CAAC;QACjK,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QAC9F,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,oEAAoE,CAAC,CAAA;IACzH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;gBACjC,CAAC;YAAC,MAAM,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,wCAAwC,CAAC,CAAA;IACpG,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,mDAAmD,CAAC,CAAA;IACrH,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/index.d.ts

@@ -1,20 +1,43 @@
 import type { Context } from '@deepseek-ai/cordis';
-import { PluginControlPlaneService, type Config } from './service.js';
+import { PluginControlPlaneService, normalizeControlPlaneConfig, type Config } from './service.js';
 import { version } from './version.js';
 export declare const name = "dsh-enhanced-plugin-control-plane";
-export { PluginControlPlaneService, version };
+export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
+export type { NormalizedControlPlaneConfig } from './service.js';
 export * from './catalog.js';
+export * from './errors.js';
+export * from './source-workspace.js';
 export * from './approval.js';
+export type { SourceApprovalClientConfig } from './source-approval-client.js';
+export { validateSourceApprovalAuthorityConfig } from './source-approval-authority.js';
+export type { SourceApprovalAuthorityConfig, SourceApprovalRequest } from './source-approval-authority.js';
+export type { SourceAdoptionConfig } from './source-adoption-runner.js';
+export { validateSourceAdoptionAuthorityConfig } from './source-adoption-authority.js';
+export type { SourceAdoptionAuthorityConfig } from './source-adoption-authority.js';
 export * from './attestation.js';
 export * from './host-attestor.js';
+export * from './runtime-observer.js';
+export type { ForegroundDeploymentConfig } from './foreground-deployment-runtime.js';
+export type * from './task-observation-types.js';
+export { validateTaskObservationAuthorityConfig } from './task-observation-authority.js';
+export type { TaskObservationAuthorityConfig } from './task-observation-authority.js';
+export type { ForegroundDeploymentRecord } from './foreground-deployment.js';
+export * from './effect-blocked-replay.js';
+export * from './replay-endpoint.js';
 export * from './lockfile.js';
 export * from './release.js';
+export { validateSourceReleaseAuthorityConfig } from './source-release-authority.js';
+export type { SourceReleaseAuthorityConfig } from './source-release-authority.js';
 export * from './service.js';
 export * from './sqlite.js';
 export * from './store.js';
 export * from './types.js';
 export * from './trust.js';
+export type * from './source-job-types.js';
+export type { EnqueueSourceJobInput, SourceJobCaller } from './source-jobs.js';
 export declare function apply(ctx: Context, config: Config): void;
 export default PluginControlPlaneService;
+export type { AdoptionHandoffTerms, AdoptionHandoffRecord } from './adoption-handoff.js';
+export type { AdoptionCoordinatorConfig } from './adoption-coordinator.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAE1B,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,KAAK,MAAM,EAAE,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,YAAY,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAChE,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAC7B,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AAC1G,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AACtF,YAAY,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AACnF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AACpF,mBAAmB,6BAA6B,CAAA;AAChD,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AACxF,YAAY,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAA;AACrF,YAAY,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAC5E,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AACpF,YAAY,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAA;AACjF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,uBAAuB,CAAA;AAC1C,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAE9E,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,eAAe,yBAAyB,CAAA;AAExC,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA"}

package/lib/index.js

@@ -1,14 +1,23 @@
-import { PluginControlPlaneService } from './service.js';
+import { PluginControlPlaneService, normalizeControlPlaneConfig } from './service.js';
 import { version } from './version.js';
 export const name = 'dsh-enhanced-plugin-control-plane';
-export { PluginControlPlaneService, version };
+export { PluginControlPlaneService, normalizeControlPlaneConfig, version };
 export { Config } from './service.js';
 export * from './catalog.js';
+export * from './errors.js';
+export * from './source-workspace.js';
 export * from './approval.js';
+export { validateSourceApprovalAuthorityConfig } from './source-approval-authority.js';
+export { validateSourceAdoptionAuthorityConfig } from './source-adoption-authority.js';
 export * from './attestation.js';
 export * from './host-attestor.js';
+export * from './runtime-observer.js';
+export { validateTaskObservationAuthorityConfig } from './task-observation-authority.js';
+export * from './effect-blocked-replay.js';
+export * from './replay-endpoint.js';
 export * from './lockfile.js';
 export * from './release.js';
+export { validateSourceReleaseAuthorityConfig } from './source-release-authority.js';
 export * from './service.js';
 export * from './sqlite.js';
 export * from './store.js';

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAe,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAE1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAe,MAAM,cAAc,CAAA;AAClG,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,eAAe,CAAA;AAE7B,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAGtF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gCAAgC,CAAA;AAEtF,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAAE,sCAAsC,EAAE,MAAM,iCAAiC,CAAA;AAGxF,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,OAAO,EAAE,oCAAoC,EAAE,MAAM,+BAA+B,CAAA;AAEpF,cAAc,cAAc,CAAA;AAC5B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAI1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAc;IAChD,IAAI,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,eAAe,yBAAyB,CAAA"}

package/lib/npm-publish.d.ts

@@ -0,0 +1,25 @@
+export interface NpmPublishInput {
+    locator: string;
+    packageName: string;
+    version: string;
+    tarball: Buffer;
+    tag: string;
+    expectedRegistryReference: string;
+}
+export interface PreparedNpmPublish {
+    url: string;
+    body: Buffer;
+}
+export interface NpmPublishSendInput {
+    url: string;
+    body: Buffer;
+    token: string;
+    caPins: readonly string[];
+    timeoutMs: number;
+}
+export declare function prepareNpmPublish(input: NpmPublishInput): PreparedNpmPublish;
+export declare function sendNpmPublish(input: NpmPublishSendInput): Promise<{
+    outcome: 'accepted' | 'ambiguous';
+    detailDigest: string;
+}>;
+//# sourceMappingURL=npm-publish.d.ts.map

package/lib/npm-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-publish.d.ts","sourceRoot":"","sources":["../src/npm-publish.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,yBAAyB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACjE,MAAM,WAAW,mBAAmB;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAsH/H,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAmB5E;AAGD,wBAAsB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,UAAU,GAAG,WAAW,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CAgCrI"}

package/lib/npm-publish.js

@@ -0,0 +1,280 @@
+import { createHash } from 'node:crypto';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+import { gunzipSync } from 'node:zlib';
+const MAX_TGZ = 256 * 1024 * 1024;
+const MAX_INFLATED = 256 * 1024 * 1024;
+const MAX_MANIFEST = 1024 * 1024;
+const MAX_RESPONSE = 2 * 1024 * 1024;
+const PACKAGE = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u;
+const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/u;
+const TAG = /^[a-z][a-z0-9-]{0,63}$/u;
+function fail(message) { throw new Error(`npm publish: ${message}`); }
+function boundedText(value, label, maximum = 8_192) {
+    if (typeof value !== 'string' || value.length === 0 || Buffer.byteLength(value) > maximum
+        || [...value].some(character => character.charCodeAt(0) <= 0x20 || character.charCodeAt(0) === 0x7f))
+        fail(`${label} is invalid`);
+    return value;
+}
+function bareHttps(value, label, allowNpmEscapedSlash = false) {
+    boundedText(value, label);
+    if (/[\\?#]/u.test(value) || /%(?!2f)/u.test(value))
+        fail(`${label} is not a canonical HTTPS URL`);
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        fail(`${label} is invalid`);
+    }
+    const rootWithoutSlash = url.pathname === '/' && url.href === `${value}/`;
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname.includes('//')
+        || (!allowNpmEscapedSlash && value.includes('%2f')) || (url.href !== value && !rootWithoutSlash))
+        fail(`${label} is not a canonical HTTPS URL`);
+    return url;
+}
+function basePath(base) { return base.pathname.endsWith('/') ? base.pathname : `${base.pathname}/`; }
+function atBase(base, suffix) {
+    const target = new URL(base);
+    target.pathname = `${basePath(base)}${suffix}`;
+    return target;
+}
+function verifyReference(value, base) {
+    const reference = bareHttps(value, 'expected registry reference');
+    if (reference.origin !== base.origin || !reference.pathname.startsWith(basePath(base)))
+        fail('expected registry reference is outside the configured registry base');
+    return reference.href;
+}
+function readString(bytes, offset, length) {
+    const field = bytes.subarray(offset, offset + length);
+    const end = field.indexOf(0);
+    return field.subarray(0, end < 0 ? field.length : end).toString('utf8');
+}
+function octal(bytes, offset, length, label) {
+    const raw = readString(bytes, offset, length).trim();
+    if (raw === '')
+        return 0;
+    if (!/^[0-7]+$/u.test(raw))
+        fail(`tar ${label} is invalid`);
+    const value = Number.parseInt(raw, 8);
+    if (!Number.isSafeInteger(value) || value < 0)
+        fail(`tar ${label} is invalid`);
+    return value;
+}
+function checksum(header) {
+    const stored = octal(header, 148, 8, 'checksum');
+    let sum = 0;
+    for (let index = 0; index < 512; index++)
+        sum += index >= 148 && index < 156 ? 32 : header[index];
+    if (sum !== stored)
+        fail('tar header checksum is invalid');
+}
+function safePath(value, permitTerminalSlash = false) {
+    const path = permitTerminalSlash && value.endsWith('/') ? value.slice(0, -1) : value;
+    if (!path || value.includes('\0') || value.includes('\\') || value.startsWith('/') || path.split('/').some(part => part === '' || part === '.' || part === '..'))
+        fail('tar path is unsafe');
+    return value;
+}
+function paxPath(payload) {
+    let offset = 0;
+    let path;
+    while (offset < payload.length) {
+        const space = payload.indexOf(0x20, offset);
+        if (space < 0)
+            fail('PAX record is invalid');
+        const lengthText = payload.subarray(offset, space).toString('ascii');
+        if (!/^[1-9]\d*$/u.test(lengthText))
+            fail('PAX record is invalid');
+        const length = Number(lengthText);
+        if (!Number.isSafeInteger(length) || length <= space - offset + 1 || offset + length > payload.length)
+            fail('PAX record is invalid');
+        const record = payload.subarray(space + 1, offset + length);
+        if (record[record.length - 1] !== 0x0a)
+            fail('PAX record is invalid');
+        const equal = record.indexOf(0x3d);
+        if (equal < 1)
+            fail('PAX record is invalid');
+        const key = record.subarray(0, equal).toString('utf8');
+        const value = record.subarray(equal + 1, -1).toString('utf8');
+        if (key === 'path')
+            path = safePath(value, true);
+        else if (key === 'size' || key === 'linkpath')
+            fail(`PAX ${key} is unsupported`);
+        else if (!['atime', 'ctime', 'gid', 'gname', 'mtime', 'uid', 'uname'].includes(key))
+            fail(`PAX ${key} is unsupported`);
+        offset += length;
+    }
+    return path;
+}
+function packageManifest(tgz) {
+    if (!Buffer.isBuffer(tgz) || tgz.length < 1 || tgz.length > MAX_TGZ)
+        fail('tarball exceeds the bounded size');
+    let tar;
+    try {
+        tar = Buffer.from(gunzipSync(tgz, { maxOutputLength: MAX_INFLATED }));
+    }
+    catch {
+        fail('tarball is not a bounded gzip stream');
+    }
+    let offset = 0;
+    let zeroBlocks = 0;
+    let pendingPath;
+    let pendingPax;
+    let manifest;
+    while (offset < tar.length) {
+        if (offset + 512 > tar.length)
+            fail('tarball is truncated');
+        const header = tar.subarray(offset, offset + 512);
+        offset += 512;
+        if (header.every(byte => byte === 0)) {
+            if (pendingPath !== undefined || pendingPax !== undefined)
+                fail('tarball has a dangling extension header');
+            zeroBlocks++;
+            continue;
+        }
+        if (zeroBlocks)
+            fail('tarball contains data after its terminator');
+        checksum(header);
+        const size = octal(header, 124, 12, 'size');
+        const type = String.fromCharCode(header[156] || 0);
+        const padded = Math.ceil(size / 512) * 512;
+        if (offset + padded > tar.length)
+            fail('tarball is truncated');
+        const payload = tar.subarray(offset, offset + size);
+        offset += padded;
+        if (type === 'x') {
+            if (pendingPath !== undefined || pendingPax !== undefined)
+                fail('tarball has stacked extension headers');
+            pendingPax = { path: paxPath(payload) };
+            continue;
+        }
+        if (type === 'L') {
+            if (pendingPath !== undefined || pendingPax !== undefined)
+                fail('tarball has stacked extension headers');
+            pendingPath = safePath(payload.subarray(0, payload.length && payload[payload.length - 1] === 0 ? -1 : payload.length).toString('utf8').replace(/\n$/u, ''), true);
+            continue;
+        }
+        if (type !== '\0' && type !== '0' && type !== '5')
+            fail('tarball contains an unsupported entry type');
+        const prefix = readString(header, 345, 155);
+        const path = pendingPax?.path ?? pendingPath ?? safePath(`${prefix}${prefix ? '/' : ''}${readString(header, 0, 100)}`, type === '5');
+        pendingPax = undefined;
+        pendingPath = undefined;
+        if (type === '5') {
+            if (size !== 0 || !path.endsWith('/'))
+                fail('tar directory entry is invalid');
+            continue;
+        }
+        if (path.endsWith('/'))
+            fail('tar file path is unsafe');
+        if (path === 'package/package.json') {
+            if (manifest !== undefined)
+                fail('tarball contains duplicate package manifests');
+            if (payload.length > MAX_MANIFEST)
+                fail('package manifest exceeds the bounded size');
+            try {
+                const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(payload));
+                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                    fail('package manifest is invalid');
+                manifest = parsed;
+            }
+            catch (error) {
+                if (error instanceof Error && error.message.startsWith('npm publish:'))
+                    throw error;
+                fail('package manifest is invalid');
+            }
+        }
+    }
+    if (zeroBlocks < 2 || manifest === undefined)
+        fail('tarball has no unique package/package.json');
+    return manifest;
+}
+export function prepareNpmPublish(input) {
+    if (!PACKAGE.test(input.packageName))
+        fail('package name is invalid');
+    if (!VERSION.test(input.version))
+        fail('package version is invalid');
+    if (!TAG.test(input.tag))
+        fail('dist-tag is invalid');
+    const base = bareHttps(input.locator, 'registry locator');
+    const expected = verifyReference(input.expectedRegistryReference, base);
+    const manifest = packageManifest(input.tarball);
+    if (manifest.name !== input.packageName || manifest.version !== input.version || manifest.private)
+        fail('package manifest does not match the authorized public package');
+    if (Object.hasOwn(manifest, 'packageExtensions'))
+        fail('package manifest contains packageExtensions');
+    const tarballName = `${input.packageName}-${input.version}.tgz`;
+    const sha512 = createHash('sha512').update(input.tarball).digest('base64');
+    const sha1 = createHash('sha1').update(input.tarball).digest('hex');
+    const version = { ...manifest, _id: `${input.packageName}@${input.version}`, dist: { integrity: `sha512-${sha512}`, shasum: sha1, tarball: expected } };
+    delete version.patchedDependencies;
+    const body = Buffer.from(JSON.stringify({ _id: input.packageName, name: input.packageName,
+        description: typeof manifest.description === 'string' ? manifest.description : '', access: 'public', versions: { [input.version]: version },
+        'dist-tags': { [input.tag]: input.version }, _attachments: { [tarballName]: { content_type: 'application/octet-stream', data: input.tarball.toString('base64'), length: input.tarball.length } } }));
+    if (body.length > 402_653_184)
+        fail('publish body exceeds the bounded size');
+    return { url: atBase(base, input.packageName.replace('/', '%2f')).href, body };
+}
+function detail(code) { return createHash('sha256').update(code).digest('hex'); }
+export async function sendNpmPublish(input) {
+    const url = bareHttps(input.url, 'publish URL', true);
+    if (!Buffer.isBuffer(input.body) || input.body.length < 1 || input.body.length > 402_653_184)
+        fail('publish body is invalid');
+    if (typeof input.token !== 'string' || input.token.length < 1 || /[^\x21-\x7e]/u.test(input.token))
+        fail('publish token is invalid');
+    if (!Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 120_000)
+        fail('publish timeout is invalid');
+    if (!Array.isArray(input.caPins) || input.caPins.some(pin => typeof pin !== 'string' || pin.length < 1))
+        fail('owner CA pins are invalid');
+    const deadline = performance.now() + input.timeoutMs;
+    return await new Promise(resolve => {
+        let req;
+        let response;
+        let settled = false;
+        const finish = (outcome, code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            response?.destroy();
+            req?.destroy();
+            resolve({ outcome, detailDigest: detail(code) });
+        };
+        const timer = setTimeout(() => finish('ambiguous', 'timeout'), Math.max(1, deadline - performance.now()));
+        try {
+            req = httpsRequest(url, { method: 'PUT', agent: false, rejectUnauthorized: true, ...(input.caPins.length ? { ca: [...input.caPins] } : {}), ...(isIP(url.hostname) === 0 ? { servername: url.hostname } : {}), headers: { authorization: `Bearer ${input.token}`, 'content-type': 'application/json', 'content-length': String(input.body.length), accept: 'application/json', 'accept-encoding': 'identity' } }, incoming => {
+                response = incoming;
+                const status = incoming.statusCode ?? 0;
+                const encoding = incoming.headers['content-encoding'];
+                const length = incoming.headers['content-length'];
+                if (encoding !== undefined && encoding !== 'identity') {
+                    finish('ambiguous', `encoding:${status}`);
+                    return;
+                }
+                if (length !== undefined && (!/^\d{1,10}$/u.test(length) || Number(length) > MAX_RESPONSE)) {
+                    finish('ambiguous', `length:${status}`);
+                    return;
+                }
+                let size = 0;
+                incoming.on('data', (chunk) => { size += chunk.length; if (size > MAX_RESPONSE)
+                    finish('ambiguous', `body:${status}`); });
+                incoming.on('aborted', () => finish('ambiguous', `aborted:${status}`));
+                incoming.on('error', () => finish('ambiguous', `response-error:${status}`));
+                incoming.on('end', () => {
+                    if (performance.now() >= deadline)
+                        finish('ambiguous', 'timeout');
+                    else if (length !== undefined && size !== Number(length))
+                        finish('ambiguous', `truncated:${status}`);
+                    else
+                        finish(status === 200 || status === 201 ? 'accepted' : 'ambiguous', `status:${status}`);
+                });
+            });
+            req.on('error', () => finish('ambiguous', 'request-error'));
+            req.end(input.body);
+        }
+        catch {
+            finish('ambiguous', 'request-start-error');
+        }
+    });
+}
+//# sourceMappingURL=npm-publish.js.map