@ponharu/pkgflare 1.0.0 → 1.1.1

package/dist/worker.js

@@ -7,6 +7,10 @@ var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -1021,9 +1025,9 @@ var require_range = __commonJS({
         range = range.replace(BUILDSTRIPRE, "");
         const memoOpts = (this.options.includePrerelease && FLAG_INCLUDE_PRERELEASE) | (this.options.loose && FLAG_LOOSE);
         const memoKey = memoOpts + ":" + range;
-        const cached = cache.get(memoKey);
-        if (cached) {
-          return cached;
+        const cached2 = cache2.get(memoKey);
+        if (cached2) {
+          return cached2;
         }
         const loose = this.options.loose;
         const hr = loose ? re[t.HYPHENRANGELOOSE] : re[t.HYPHENRANGE];
@@ -1055,7 +1059,7 @@ var require_range = __commonJS({
           rangeMap.delete("");
         }
         const result = [...rangeMap.values()];
-        cache.set(memoKey, result);
+        cache2.set(memoKey, result);
         return result;
       }
       intersects(range, options) {
@@ -1094,7 +1098,7 @@ var require_range = __commonJS({
     };
     module.exports = Range;
     var LRU = require_lrucache();
-    var cache = new LRU();
+    var cache2 = new LRU();
     var parseOptions = require_parse_options();
     var Comparator = require_comparator();
     var debug = require_debug();
@@ -2025,9 +2029,89 @@ var scopePattern = /^@[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?$/;
 var bindingPattern = /^[A-Z][A-Z0-9_]*$/;
 var hostnamePattern = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 var reservedBindings = /* @__PURE__ */ new Set(["PKGFLARE_DB", "PKGFLARE_BUCKET", "PKGFLARE_CONFIG"]);
+var githubIdPattern = /^[1-9][0-9]{0,19}$/;
+var audiencePattern = /^[\x21-\x7e]{1,256}$/;
+var refPattern = /^refs\/(?:heads|tags)\/[A-Za-z0-9._/-]+\*?$/;
+var workflowRefPattern = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml@refs\/(?:heads|tags)\/[A-Za-z0-9._/-]+\*?$/;
+var jobWorkflowRefPattern = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml@(?:refs\/(?:heads|tags)\/[A-Za-z0-9._/-]+\*?|[0-9a-f]{40})$/;
+var packageSegmentPattern = /^(?!\.)(?:[a-z0-9._-]+)$/;
+var maximumGithubSubjects = 128;
+var maximumPackagesPerSubject = 128;
+var maximumRuntimeConfigBytes = 5 * 1024;
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function normalizePermissions(value, label) {
+  if (!Array.isArray(value) || value.length === 0 || value.some((permission) => permission !== "read" && permission !== "publish")) {
+    throw new Error(`invalid permissions for ${label}`);
+  }
+  return [...new Set(value)];
+}
+function isSafePattern(value, pattern) {
+  if (!pattern.test(value)) return false;
+  const wildcard = value.indexOf("*");
+  return wildcard === -1 || wildcard === value.length - 1;
+}
+function normalizeGithubOidc(value, configuredScopes) {
+  if (!isObject(value) || typeof value.audience !== "string") {
+    throw new Error("githubOidc must define an audience and trusted subjects");
+  }
+  if (!audiencePattern.test(value.audience)) {
+    throw new Error("githubOidc audience must be 1-256 printable ASCII characters");
+  }
+  if (!Array.isArray(value.subjects) || value.subjects.length === 0 || value.subjects.length > maximumGithubSubjects) {
+    throw new Error(`githubOidc must define 1-${String(maximumGithubSubjects)} subjects`);
+  }
+  const subjects = value.subjects.map((subjectValue, index) => {
+    const label = `githubOidc subject ${String(index + 1)}`;
+    if (!isObject(subjectValue)) throw new Error(`${label} must be an object`);
+    const { repositoryId, repositoryOwnerId, ref, workflowRef, jobWorkflowRef } = subjectValue;
+    if (typeof repositoryId !== "string" || !githubIdPattern.test(repositoryId)) {
+      throw new Error(`${label} repositoryId must be a decimal GitHub repository ID`);
+    }
+    if (typeof repositoryOwnerId !== "string" || !githubIdPattern.test(repositoryOwnerId)) {
+      throw new Error(`${label} repositoryOwnerId must be a decimal GitHub owner ID`);
+    }
+    if (typeof ref !== "string" || !isSafePattern(ref, refPattern)) {
+      throw new Error(`${label} ref must be an exact branch/tag ref or trailing-wildcard pattern`);
+    }
+    if (typeof workflowRef !== "string" || !isSafePattern(workflowRef, workflowRefPattern)) {
+      throw new Error(
+        `${label} workflowRef must identify a workflow file at an exact or trailing-wildcard ref`
+      );
+    }
+    if (jobWorkflowRef !== void 0 && (typeof jobWorkflowRef !== "string" || !isSafePattern(jobWorkflowRef, jobWorkflowRefPattern))) {
+      throw new Error(
+        `${label} jobWorkflowRef must identify a reusable workflow at a full commit SHA or an exact/trailing-wildcard branch or tag ref`
+      );
+    }
+    const permissions = normalizePermissions(subjectValue.permissions, label);
+    if (!Array.isArray(subjectValue.packages) || subjectValue.packages.length === 0 || subjectValue.packages.length > maximumPackagesPerSubject || subjectValue.packages.some((packageName) => typeof packageName !== "string")) {
+      throw new Error(
+        `${label} must define 1-${String(maximumPackagesPerSubject)} package patterns`
+      );
+    }
+    const packages = [...new Set(subjectValue.packages)];
+    for (const packagePattern of packages) {
+      const slash = packagePattern.indexOf("/");
+      const scope = packagePattern.slice(0, slash);
+      const packageSegment = packagePattern.slice(slash + 1);
+      if (slash === -1 || packagePattern.length > 214 || !configuredScopes.includes(scope) || packageSegment !== "*" && !packageSegmentPattern.test(packageSegment)) {
+        throw new Error(`${label} contains an invalid or unconfigured package pattern`);
+      }
+    }
+    return {
+      repositoryId,
+      repositoryOwnerId,
+      ref,
+      workflowRef,
+      ...jobWorkflowRef === void 0 ? {} : { jobWorkflowRef },
+      permissions,
+      packages
+    };
+  });
+  return { audience: value.audience, subjects };
+}
 function normalizeConfig(value) {
   if (!isObject(value)) throw new Error("configuration must be an object");
   const { name, scopes: scopeValues, accountId, hostname, auth } = value;
@@ -2052,11 +2136,12 @@ function normalizeConfig(value) {
   if (!isObject(auth) || auth.provider !== "secrets") {
     throw new Error("unsupported authentication provider");
   }
-  if (!Array.isArray(auth.tokens) || auth.tokens.length === 0) {
-    throw new Error("at least one authentication token binding is required");
+  const tokenValues = auth.tokens ?? [];
+  if (!Array.isArray(tokenValues)) {
+    throw new Error("authentication token bindings must be an array");
   }
   const seenBindings = /* @__PURE__ */ new Set();
-  const tokens = auth.tokens.map((tokenValue) => {
+  const tokens = tokenValues.map((tokenValue) => {
     if (!isObject(tokenValue) || typeof tokenValue.binding !== "string") {
       throw new Error("authentication token binding must be an object with a binding name");
     }
@@ -2071,20 +2156,1079 @@ function normalizeConfig(value) {
       throw new Error(`duplicate secret binding: ${binding}`);
     }
     seenBindings.add(binding);
-    if (!Array.isArray(permissionValues) || permissionValues.length === 0 || permissionValues.some((permission) => permission !== "read" && permission !== "publish")) {
-      throw new Error(`invalid permissions for ${binding}`);
-    }
-    const permissions = [...new Set(permissionValues)];
+    const permissions = normalizePermissions(permissionValues, binding);
     return { binding, permissions };
   });
-  return {
+  const githubOidc = auth.githubOidc === void 0 ? void 0 : normalizeGithubOidc(auth.githubOidc, scopes);
+  if (tokens.length === 0 && githubOidc === void 0) {
+    throw new Error("at least one authentication method is required");
+  }
+  const normalized = {
     name,
     scopes,
     ...accountId === void 0 ? {} : { accountId },
     ...hostname === void 0 ? {} : { hostname },
-    auth: { provider: "secrets", tokens }
+    auth: {
+      provider: "secrets",
+      tokens,
+      ...githubOidc === void 0 ? {} : { githubOidc }
+    }
+  };
+  if (new TextEncoder().encode(JSON.stringify(normalized)).byteLength > maximumRuntimeConfigBytes) {
+    throw new Error("normalized configuration exceeds the 5 KiB Worker variable limit");
+  }
+  return normalized;
+}
+
+// src/runtime/diagnostics.ts
+function logRegistryError(requestId, operation, error) {
+  console.error(
+    JSON.stringify({
+      level: "error",
+      requestId,
+      operation,
+      errorType: error instanceof Error ? error.name : typeof error
+    })
+  );
+}
+
+// node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var strictDecoder = new TextDecoder("utf-8", { fatal: true });
+var MAX_INT32 = 2 ** 32;
+function concat(...buffers) {
+  const size = buffers.reduce((acc, { length }) => acc + length, 0);
+  const buf = new Uint8Array(size);
+  let i = 0;
+  for (const buffer of buffers) {
+    buf.set(buffer, i);
+    i += buffer.length;
+  }
+  return buf;
+}
+function encode(string) {
+  const bytes = new Uint8Array(string.length);
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    if (code > 127) {
+      throw new TypeError("non-ASCII string encountered in encode()");
+    }
+    bytes[i] = code;
+  }
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/lib/crypto_key.js
+var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage)) {
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+  }
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength !== "number" || modulusLength < 2048) {
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+  }
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name) {
+    throw unusable(expected.name);
+  }
+  if (expected.hash && algorithm.hash?.name !== expected.hash) {
+    throw unusable(expected.hash, "algorithm.hash");
+  }
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) {
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  }
+  if (expected.length !== void 0 && algorithm.length !== expected.length) {
+    throw unusable(expected.length, "algorithm.length");
+  }
+  checkUsage(key, usage);
+}
+
+// node_modules/jose/dist/webapi/lib/invalid_key_input.js
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else if (types.length === 2) {
+    msg += `one of type ${types[0]} or ${types[1]}.`;
+  } else {
+    msg += `of type ${types[0]}.`;
+  }
+  if (actual == null) {
+    msg += ` Received ${actual}`;
+  } else if (typeof actual === "function" && actual.name) {
+    msg += ` Received function ${actual.name}`;
+  } else if (typeof actual === "object" && actual != null) {
+    if (actual.constructor?.name) {
+      msg += ` Received an instance of ${actual.constructor.name}`;
+    }
+  }
+  return msg;
+}
+var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+
+// node_modules/jose/dist/webapi/util/errors.js
+var errors_exports = {};
+__export(errors_exports, {
+  JOSEAlgNotAllowed: () => JOSEAlgNotAllowed,
+  JOSEError: () => JOSEError,
+  JOSENotSupported: () => JOSENotSupported,
+  JWEDecryptionFailed: () => JWEDecryptionFailed,
+  JWEInvalid: () => JWEInvalid,
+  JWKInvalid: () => JWKInvalid,
+  JWKSInvalid: () => JWKSInvalid,
+  JWKSMultipleMatchingKeys: () => JWKSMultipleMatchingKeys,
+  JWKSNoMatchingKey: () => JWKSNoMatchingKey,
+  JWKSTimeout: () => JWKSTimeout,
+  JWSInvalid: () => JWSInvalid,
+  JWSSignatureVerificationFailed: () => JWSSignatureVerificationFailed,
+  JWTClaimValidationFailed: () => JWTClaimValidationFailed,
+  JWTExpired: () => JWTExpired,
+  JWTInvalid: () => JWTInvalid
+});
+var JOSEError = class extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(message2, options) {
+    super(message2, options);
+    this.name = this.constructor.name;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+};
+var JWTClaimValidationFailed = class extends JOSEError {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim: claim2, reason, payload } });
+    this.claim = claim2;
+    this.reason = reason;
+    this.payload = payload;
+  }
+};
+var JWTExpired = class extends JOSEError {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(message2, payload, claim2 = "unspecified", reason = "unspecified") {
+    super(message2, { cause: { claim: claim2, reason, payload } });
+    this.claim = claim2;
+    this.reason = reason;
+    this.payload = payload;
+  }
+};
+var JOSEAlgNotAllowed = class extends JOSEError {
+  static code = "ERR_JOSE_ALG_NOT_ALLOWED";
+  code = "ERR_JOSE_ALG_NOT_ALLOWED";
+};
+var JOSENotSupported = class extends JOSEError {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+};
+var JWEDecryptionFailed = class extends JOSEError {
+  static code = "ERR_JWE_DECRYPTION_FAILED";
+  code = "ERR_JWE_DECRYPTION_FAILED";
+  constructor(message2 = "decryption operation failed", options) {
+    super(message2, options);
+  }
+};
+var JWEInvalid = class extends JOSEError {
+  static code = "ERR_JWE_INVALID";
+  code = "ERR_JWE_INVALID";
+};
+var JWSInvalid = class extends JOSEError {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+};
+var JWTInvalid = class extends JOSEError {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+};
+var JWKInvalid = class extends JOSEError {
+  static code = "ERR_JWK_INVALID";
+  code = "ERR_JWK_INVALID";
+};
+var JWKSInvalid = class extends JOSEError {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+};
+var JWKSNoMatchingKey = class extends JOSEError {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(message2 = "no applicable key found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSMultipleMatchingKeys = class extends JOSEError {
+  [Symbol.asyncIterator] = async function* () {
+  };
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(message2 = "multiple matching keys found in the JSON Web Key Set", options) {
+    super(message2, options);
+  }
+};
+var JWKSTimeout = class extends JOSEError {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(message2 = "request timed out", options) {
+    super(message2, options);
+  }
+};
+var JWSSignatureVerificationFailed = class extends JOSEError {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(message2 = "signature verification failed", options) {
+    super(message2, options);
+  }
+};
+
+// node_modules/jose/dist/webapi/lib/is_key_like.js
+var isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return true;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return false;
+  }
+};
+var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+
+// node_modules/jose/dist/webapi/lib/base64.js
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
+  }
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+// node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    try {
+      return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+        alphabet: "base64url"
+      });
+    } catch (cause) {
+      throw new TypeError(invalid, { cause });
+    }
+  }
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  if (encoded.includes("+") || encoded.includes("/")) {
+    throw new TypeError(invalid);
+  }
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError(invalid);
+  }
+}
+
+// node_modules/jose/dist/webapi/lib/type_checks.js
+function isObject2(input) {
+  if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(input);
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject2(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject2);
+}
+
+// node_modules/jose/dist/webapi/lib/helpers.js
+function decodeBase64url(value, label, ErrorClass) {
+  try {
+    return decode(value);
+  } catch {
+    throw new ErrorClass(`Failed to base64url decode the ${label}`);
+  }
+}
+function encodeBase64url(value, label, ErrorClass) {
+  try {
+    return encode(value);
+  } catch {
+    throw new ErrorClass(`The ${label} is not a valid base64url string`);
+  }
+}
+function parseJoseHeader(b64, ErrorClass, message2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+  } catch {
+    throw new ErrorClass(message2);
+  }
+  if (!isObject2(parsed)) {
+    throw new ErrorClass(message2);
+  }
+  return parsed;
+}
+
+// node_modules/jose/dist/webapi/lib/jwk_to_key.js
+async function jwkToKey(entry, jwk) {
+  if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) {
+    throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+  }
+  if (!entry.kty.includes(jwk.kty)) {
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  }
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
+  const isPrivate = !!(jwk.d || jwk.priv);
+  const keyData = { ...jwk };
+  if (keyData.kty !== "AKP") {
+    delete keyData.alg;
+  }
+  delete keyData.use;
+  return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+
+// node_modules/jose/dist/webapi/lib/jwk_metadata.js
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  }
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops;
+    const keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    }
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+
+// node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag];
+var jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected) {
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+    }
+  }
+  if (key.alg !== void 0 && key.alg !== alg) {
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  }
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+    }
+  }
+};
+function checkKeyType(entry, key, usage) {
+  const { alg, secret } = entry;
+  const privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return [BYTES, key];
+  if (isObject2(key)) {
+    const normalized = normalizeJwk(key);
+    if (typeof normalized.kty !== "string") {
+      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
+    if (!valid) {
+      throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    }
+    jwkMatchesOp(entry, normalized, usage);
+    return [JWK, key, normalized];
+  }
+  if (!isKeyLike(key)) {
+    throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  }
+  if (secret) {
+    if (key.type !== "secret") {
+      throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+    }
+  } else {
+    if (key.type === "secret") {
+      throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+    }
+    const expectedType = privateKey ? "private" : "public";
+    if ((key.type === "public" || key.type === "private") && key.type !== expectedType) {
+      const operation = usage === "sign" ? "signing" : usage === "verify" ? "verifying" : `${usage.slice(0, -1)}tion`;
+      throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
+    }
+  }
+  return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+}
+var BYTES = 0;
+var CRYPTO = 1;
+var KEYOBJECT = 2;
+var JWK = 3;
+var cache;
+var nist = {
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
+};
+function cached(key, alg, value) {
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const entry = cache.get(key);
+  if (value) {
+    if (entry) {
+      entry[alg] = value;
+    } else {
+      cache.set(key, { [alg]: value });
+    }
+  }
+  return value ?? entry?.[alg];
+}
+var handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ?? cached(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
+var handleKeyObject = (keyObject, entry) => {
+  const hit = cached(keyObject, entry.alg);
+  if (hit)
+    return hit;
+  const isPublic = keyObject.type === "public";
+  const usages = entry.usages[isPublic ? 0 : 1];
+  const { asymmetricKeyType } = keyObject;
+  const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
+  const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
+  return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+};
+async function prepareKey(entry, key, usage) {
+  const tagged = checkKeyType(entry, key, usage);
+  switch (tagged[0]) {
+    case BYTES:
+    case CRYPTO:
+      return tagged[1];
+    case JWK: {
+      const key2 = tagged[1];
+      const normalized = tagged[2];
+      if (normalized.kty === "oct") {
+        return decode(normalized.k);
+      }
+      if (!Object.isFrozen(key2)) {
+        const { key_ops } = key2;
+        if (Array.isArray(key_ops))
+          Object.freeze(key_ops);
+        Object.freeze(key2);
+      }
+      return handleJWK(key2, normalized, entry);
+    }
+    case KEYOBJECT: {
+      const keyObject = tagged[1];
+      if (keyObject.type === "secret") {
+        return keyObject.export();
+      }
+      if ("toCryptoKey" in keyObject && typeof keyObject.toCryptoKey === "function") {
+        return handleKeyObject(keyObject, entry);
+      }
+      return handleJWK(keyObject, keyObject.export({ format: "jwk" }), entry);
+    }
+  }
+}
+
+// node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+  const out = { __proto__: null };
+  for (const alg in entries) {
+    out[alg] = { ...entries[alg], alg };
+  }
+  return out;
+}
+
+// node_modules/jose/dist/webapi/lib/options.js
+var JWS_RECOGNIZED = { __proto__: null, b64: true };
+function validateAlgorithms(option, algorithms) {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  }
+  if (!algorithms) {
+    return void 0;
+  }
+  return new Set(algorithms);
+}
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  }
+  if (!protectedHeader || protectedHeader.crit === void 0) {
+    return [];
+  }
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  }
+  const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+  for (const parameter of protectedHeader.crit) {
+    if (!(parameter in recognized)) {
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    }
+    if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) {
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    }
+    if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) {
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+    }
+  }
+  return protectedHeader.crit;
+}
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 !== "boolean") {
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    }
+    return b64;
+  }
+  return true;
+}
+
+// node_modules/jose/dist/webapi/lib/signing.js
+async function getSigKey(entry, key, usage) {
+  if (key instanceof Uint8Array) {
+    return crypto.subtle.importKey("raw", key, entry.subtle, false, [
+      usage
+    ]);
+  }
+  checkCryptoKey(key, entry.subtle, usage);
+  if (entry.minRsaBits)
+    checkModulusLength(entry.alg, key);
+  return key;
+}
+async function verify(entry, key, signature, data) {
+  const cryptoKey = await getSigKey(entry, key, "verify");
+  try {
+    return await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+  } catch {
+    return false;
+  }
+}
+
+// node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
+}
+function rsa(bits, saltLength) {
+  const name = saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5";
+  const subtle = { name, hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
   };
 }
+function ecdsa(crv, bits) {
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
+}
+function eddsa() {
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+function mldsa(bits) {
+  const name = `ML-DSA-${bits}`;
+  const subtle = { name };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
+}
+var JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+  const entry = typeof alg === "string" ? JWS[alg] : void 0;
+  if (!entry) {
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  }
+  return entry;
+}
+
+// node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
+  return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+  const alg = joseHeader.alg;
+  if (typeof alg !== "string" || !alg) {
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  }
+  if (shared[0] && !shared[0].has(alg)) {
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  }
+  return [b64, alg];
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
+  let resolvedKey = false;
+  if (typeof key === "function") {
+    key = await key(parsedProt, jws);
+    resolvedKey = true;
+  }
+  const b64 = typeof signingPayload === "string";
+  const entry = jwsAlgorithm(alg);
+  const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload);
+  const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
+  const k = await prepareKey(entry, key, "verify");
+  if (!await verify(entry, k, signature, data)) {
+    throw new JWSSignatureVerificationFailed();
+  }
+  const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
+  return [payload, parsedProt, b64, k, resolvedKey];
+}
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array) {
+    jws = decoder.decode(jws);
+  }
+  if (typeof jws !== "string") {
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  }
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3) {
+    throw new JWSInvalid("Invalid Compact JWS");
+  }
+  const compactJws = { payload, protected: protectedHeader, signature };
+  const parsedProt = parseProtectedHeader(protectedHeader);
+  const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+  const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+}
+
+// node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3);
+var multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+};
+var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  if (typeof str !== "string") {
+    invalidDuration();
+  }
+  const matched = REGEX.exec(str);
+  if (!matched || matched[4] && matched[1]) {
+    invalidDuration();
+  }
+  const value = parseFloat(matched[2]);
+  const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  if (!Number.isFinite(numericDate)) {
+    invalidDuration();
+  }
+  if (matched[1] === "-" || matched[4] === "ago") {
+    return -numericDate;
+  }
+  return numericDate;
+}
+function validateInput(label, input) {
+  if (!Number.isFinite(input)) {
+    throw new TypeError(`Invalid ${label} input`);
+  }
+  return input;
+}
+var normalizeTyp = (value) => {
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+};
+var checkAudiencePresence = (audPayload, audOption) => {
+  if (typeof audPayload === "string") {
+    return audOption.includes(audPayload);
+  }
+  if (Array.isArray(audPayload)) {
+    return audOption.some((aud) => audPayload.includes(aud));
+  }
+  return false;
+};
+function validateNumericDate(payload, claim2, required = false) {
+  const value = payload[claim2];
+  if (value === void 0 && !required)
+    return void 0;
+  if (typeof value !== "number") {
+    throw new JWTClaimValidationFailed(`"${claim2}" claim must be a number`, payload, claim2, "invalid");
+  }
+  return value;
+}
+function unexpectedClaim(payload, claim2) {
+  throw new JWTClaimValidationFailed(`unexpected "${claim2}" claim value`, payload, claim2, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject2(payload)) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  }
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  }
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+  const presenceCheck = [...requiredClaims];
+  if (maxTokenAge !== void 0)
+    presenceCheck.push("iat");
+  if (audience !== void 0)
+    presenceCheck.push("aud");
+  if (subject !== void 0)
+    presenceCheck.push("sub");
+  if (issuer !== void 0)
+    presenceCheck.push("iss");
+  for (const claim2 of new Set(presenceCheck.reverse())) {
+    if (!Object.hasOwn(payload, claim2)) {
+      throw new JWTClaimValidationFailed(`missing required "${claim2}" claim`, payload, claim2, "missing");
+    }
+  }
+  if (issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+    unexpectedClaim(payload, "iss");
+  }
+  if (subject !== void 0 && payload.sub !== subject) {
+    unexpectedClaim(payload, "sub");
+  }
+  if (audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
+    unexpectedClaim(payload, "aud");
+  }
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance === "string") {
+    tolerance = secs(clockTolerance);
+  } else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance !== "number") {
+      throw new TypeError("Invalid clockTolerance option type");
+    }
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options;
+  const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
+  const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
+  const nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0) {
+    if (nbf > now + tolerance) {
+      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+    }
+  }
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0) {
+    if (exp <= now - tolerance) {
+      throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+    }
+  }
+  if (maxTokenAge !== void 0) {
+    const age = now - iat;
+    const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max) {
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    }
+    if (age < -tolerance) {
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+    }
+  }
+  return payload;
+}
+
+// node_modules/jose/dist/webapi/jwt/verify.js
+async function jwtVerify(jwt, key, options) {
+  const verified = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!verified[2]) {
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  }
+  const payload = validateClaimsSet(verified[1], verified[0], options);
+  const result = { payload, protectedHeader: verified[1] };
+  if (typeof key === "function") {
+    return { ...result, key: verified[3] };
+  }
+  return result;
+}
+
+// node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+  const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+}
+async function importWithAlgCache(cache2, jwk, entry) {
+  const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
+  const { alg } = entry;
+  if (cached2[alg] === void 0) {
+    const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+    if (key.type !== "public") {
+      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+    }
+    cached2[alg] = key;
+  }
+  return cached2[alg];
+}
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot)) {
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  }
+  const cached2 = /* @__PURE__ */ new WeakMap();
+  const localJWKSet = async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header };
+    const entry = typeof alg === "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret) {
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
+    const { 0: jwk, length } = candidates;
+    if (!length) {
+      throw new JWKSNoMatchingKey();
+    }
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates) {
+          try {
+            yield await importWithAlgCache(cached2, jwk2, entry);
+          } catch {
+          }
+        }
+      };
+      throw error;
+    }
+    return importWithAlgCache(cached2, jwk, entry);
+  };
+  return Object.defineProperty(localJWKSet, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
+}
+
+// src/runtime/github-oidc.ts
+var githubIssuer = "https://token.actions.githubusercontent.com";
+var githubJwksUrl = new URL(`${githubIssuer}/.well-known/jwks`);
+var maximumJwksBytes = 64 * 1024;
+var maximumJwksKeys = 16;
+var jwksCacheMilliseconds = 5 * 60 * 1e3;
+var jwksCooldownMilliseconds = 30 * 1e3;
+var jwksTimeoutMilliseconds = 5e3;
+var maximumClaimLength = 512;
+var cachedJwks;
+var pendingJwks;
+var GitHubOidcUnavailableError = class extends Error {
+  name = "GitHubOidcUnavailableError";
+};
+function isObject3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function readBoundedBody(response) {
+  if (response.body === null) throw new GitHubOidcUnavailableError("GitHub JWKS response is empty");
+  const reader = response.body.getReader();
+  const decoder2 = new TextDecoder("utf-8", { fatal: true });
+  let size = 0;
+  let contents = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > maximumJwksBytes) {
+        await reader.cancel();
+        throw new GitHubOidcUnavailableError("GitHub JWKS response is too large");
+      }
+      contents += decoder2.decode(value, { stream: true });
+    }
+    contents += decoder2.decode();
+    return contents;
+  } catch (error) {
+    if (error instanceof GitHubOidcUnavailableError) throw error;
+    throw new GitHubOidcUnavailableError("GitHub JWKS response could not be read");
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function fetchJwks() {
+  let response;
+  try {
+    response = await fetch(githubJwksUrl, {
+      headers: { accept: "application/json" },
+      redirect: "error",
+      signal: AbortSignal.timeout(jwksTimeoutMilliseconds)
+    });
+  } catch {
+    throw new GitHubOidcUnavailableError("GitHub JWKS endpoint is unavailable");
+  }
+  if (!response.ok)
+    throw new GitHubOidcUnavailableError("GitHub JWKS endpoint rejected the request");
+  let value;
+  try {
+    value = JSON.parse(await readBoundedBody(response));
+  } catch (error) {
+    if (error instanceof GitHubOidcUnavailableError) throw error;
+    throw new GitHubOidcUnavailableError("GitHub JWKS response is invalid");
+  }
+  if (!isObject3(value) || !Array.isArray(value.keys) || value.keys.length === 0 || value.keys.length > maximumJwksKeys || value.keys.some(
+    (key) => !isObject3(key) || key.kty !== "RSA" || typeof key.kid !== "string" || key.kid.length === 0 || key.kid.length > 256 || key.alg !== void 0 && key.alg !== "RS256" || key.use !== void 0 && key.use !== "sig" || typeof key.n !== "string" || typeof key.e !== "string"
+  )) {
+    throw new GitHubOidcUnavailableError("GitHub JWKS response is invalid");
+  }
+  let resolver;
+  try {
+    resolver = createLocalJWKSet(value);
+  } catch {
+    throw new GitHubOidcUnavailableError("GitHub JWKS response is invalid");
+  }
+  const fetchedAt = Date.now();
+  return { resolver, fetchedAt, expiresAt: fetchedAt + jwksCacheMilliseconds };
+}
+async function loadJwks(force) {
+  const now = Date.now();
+  if (!force && cachedJwks !== void 0 && cachedJwks.expiresAt > now) return cachedJwks;
+  if (pendingJwks !== void 0) return pendingJwks;
+  pendingJwks = fetchJwks();
+  try {
+    cachedJwks = await pendingJwks;
+    return cachedJwks;
+  } finally {
+    pendingJwks = void 0;
+  }
+}
+async function resolveGithubKey(protectedHeader, token) {
+  const jwks = await loadJwks(false);
+  try {
+    return await jwks.resolver(protectedHeader, token);
+  } catch (error) {
+    if (!(error instanceof errors_exports.JWKSNoMatchingKey) || Date.now() - jwks.fetchedAt < jwksCooldownMilliseconds) {
+      throw error;
+    }
+    return (await loadJwks(true)).resolver(protectedHeader, token);
+  }
+}
+function claim(payload, name) {
+  const value = payload[name];
+  return typeof value === "string" && value.length > 0 && value.length <= maximumClaimLength ? value : null;
+}
+function matchesPattern(value, pattern) {
+  return pattern.endsWith("*") ? value.startsWith(pattern.slice(0, -1)) : value === pattern;
+}
+function grants(permissions, required) {
+  return permissions.includes("publish") || permissions.includes(required);
+}
+function grantsPackage(patterns, packageName) {
+  if (packageName === void 0) return true;
+  return patterns.some((pattern) => {
+    if (pattern.endsWith("/*")) return packageName.startsWith(pattern.slice(0, -1));
+    return packageName === pattern;
+  });
+}
+async function authorizeGitHubOidc(token, context, required, packageName) {
+  const configuration = context.config.auth.githubOidc;
+  if (configuration === void 0) return false;
+  let payload;
+  try {
+    const verified = await jwtVerify(token, resolveGithubKey, {
+      algorithms: ["RS256"],
+      audience: configuration.audience,
+      clockTolerance: 5,
+      issuer: githubIssuer,
+      maxTokenAge: "10m",
+      requiredClaims: [
+        "sub",
+        "exp",
+        "iat",
+        "nbf",
+        "jti",
+        "repository_id",
+        "repository_owner_id",
+        "ref",
+        "workflow_ref",
+        "event_name"
+      ],
+      typ: "JWT"
+    });
+    payload = verified.payload;
+  } catch (error) {
+    if (error instanceof GitHubOidcUnavailableError) throw error;
+    return false;
+  }
+  const repositoryId = claim(payload, "repository_id");
+  const repositoryOwnerId = claim(payload, "repository_owner_id");
+  const ref = claim(payload, "ref");
+  const workflowRef = claim(payload, "workflow_ref");
+  const eventName = claim(payload, "event_name");
+  const jobWorkflowRef = claim(payload, "job_workflow_ref");
+  if (repositoryId === null || repositoryOwnerId === null || ref === null || workflowRef === null || eventName === null) {
+    return false;
+  }
+  if (eventName.includes("pull_request") || eventName === "merge_group") return false;
+  return configuration.subjects.some(
+    (subject) => subject.repositoryId === repositoryId && subject.repositoryOwnerId === repositoryOwnerId && matchesPattern(ref, subject.ref) && matchesPattern(workflowRef, subject.workflowRef) && (subject.jobWorkflowRef === void 0 ? jobWorkflowRef === null : jobWorkflowRef !== null && matchesPattern(jobWorkflowRef, subject.jobWorkflowRef)) && grants(subject.permissions, required) && grantsPackage(subject.packages, packageName)
+  );
+}
 
 // src/runtime/response.ts
 function json(value, init = {}) {
@@ -2123,35 +3267,37 @@ function equalDigest(left, right) {
   }
   return difference === 0;
 }
-function grants(permissions, required) {
+function grants2(permissions, required) {
   return permissions.includes("publish") || permissions.includes(required);
 }
-async function authorize(request, context, required) {
+var maximumBearerTokenBytes = 16 * 1024;
+async function authorize(request, context, required, packageName) {
   const candidate = bearerToken(request);
   if (candidate === null) {
     return npmError(401, "unauthorized", "authentication required");
   }
+  if (candidate.length > maximumBearerTokenBytes) {
+    return npmError(403, "forbidden", `token does not grant ${required} access`);
+  }
   const candidateDigest = await digest(candidate);
   let authorized = false;
   for (const token of context.config.auth.tokens) {
     const secret = context.env[token.binding];
     if (typeof secret !== "string" || secret.length === 0) continue;
     const matches = equalDigest(candidateDigest, await digest(secret));
-    authorized ||= matches && grants(token.permissions, required);
+    authorized ||= matches && grants2(token.permissions, required);
   }
-  return authorized ? null : npmError(403, "forbidden", `token does not grant ${required} access`);
-}
-
-// src/runtime/diagnostics.ts
-function logRegistryError(requestId, operation, error) {
-  console.error(
-    JSON.stringify({
-      level: "error",
-      requestId,
-      operation,
-      errorType: error instanceof Error ? error.name : typeof error
-    })
-  );
+  if (authorized) return null;
+  try {
+    if (await authorizeGitHubOidc(candidate, context, required, packageName)) return null;
+  } catch (error) {
+    if (error instanceof GitHubOidcUnavailableError) {
+      logRegistryError(context.requestId, "github_oidc_jwks", error);
+      return npmError(503, "authentication_unavailable", "OIDC authentication is unavailable");
+    }
+    throw error;
+  }
+  return npmError(403, "forbidden", `token does not grant ${required} access`);
 }
 
 // src/runtime/dist-tags.ts
@@ -2193,15 +3339,15 @@ function parseDistTagRoute(pathname) {
   if (scope === void 0 || name === void 0) return null;
   const packageName = `${scope}/${name}`;
   if (packageName.length > 214 || !packageNamePattern.test(packageName)) return null;
-  const tag = segments[5];
-  return tag === void 0 ? { packageName } : { packageName, tag };
+  const tag2 = segments[5];
+  return tag2 === void 0 ? { packageName } : { packageName, tag: tag2 };
 }
 function isAllowedPackage(packageName, scopes) {
   const separator = packageName.indexOf("/");
   return separator > 0 && scopes.includes(packageName.slice(0, separator));
 }
-function isValidDistTag(tag) {
-  return /^[a-z0-9][a-z0-9._-]*$/i.test(tag) && (0, import_semver.validRange)(tag, { loose: false }) === null;
+function isValidDistTag(tag2) {
+  return /^[a-z0-9][a-z0-9._-]*$/i.test(tag2) && (0, import_semver.validRange)(tag2, { loose: false }) === null;
 }
 
 // src/runtime/dist-tags.ts
@@ -2209,7 +3355,7 @@ var maximumDistTagBodyBytes = 256;
 async function readVersion(request) {
   if (request.body === null) throw new Error("missing body");
   const reader = request.body.getReader();
-  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const decoder2 = new TextDecoder("utf-8", { fatal: true });
   let bytesRead = 0;
   let contents = "";
   try {
@@ -2221,17 +3367,17 @@ async function readVersion(request) {
         await reader.cancel();
         throw new PublishTagBodyError(413, "dist-tag request body exceeds 256 bytes");
       }
-      contents += decoder.decode(value, { stream: true });
+      contents += decoder2.decode(value, { stream: true });
     }
-    contents += decoder.decode();
+    contents += decoder2.decode();
     return JSON.parse(contents);
   } finally {
     reader.releaseLock();
   }
 }
 var PublishTagBodyError = class extends Error {
-  constructor(status, message) {
-    super(message);
+  constructor(status, message2) {
+    super(message2);
     this.status = status;
   }
   status;
@@ -2253,11 +3399,11 @@ async function readDistTags(context, packageName) {
     headers: { "cache-control": "private, no-store" }
   });
 }
-async function setDistTag(request, context, packageName, tag) {
+async function setDistTag(request, context, packageName, tag2) {
   if (!isAllowedPackage(packageName, context.config.scopes)) {
     return npmError(404, "not_found", "package not found");
   }
-  if (!isValidDistTag(tag)) return npmError(400, "bad_request", "dist-tag is invalid");
+  if (!isValidDistTag(tag2)) return npmError(400, "bad_request", "dist-tag is invalid");
   let version;
   try {
     version = await readVersion(request);
@@ -2272,20 +3418,20 @@ async function setDistTag(request, context, packageName, tag) {
   }
   const result = await context.env.PKGFLARE_DB.prepare(
     "INSERT INTO dist_tags (package_name, tag, version) SELECT package_name, ?3, version FROM versions WHERE package_name = ?1 AND version = ?2 ON CONFLICT(package_name, tag) DO UPDATE SET version = excluded.version"
-  ).bind(packageName, version, tag).run();
+  ).bind(packageName, version, tag2).run();
   if (result.meta.changes === 0) {
     return npmError(404, "not_found", "package version not found");
   }
   return json({ ok: true });
 }
-async function deleteDistTag(context, packageName, tag) {
+async function deleteDistTag(context, packageName, tag2) {
   if (!isAllowedPackage(packageName, context.config.scopes)) {
     return npmError(404, "not_found", "package not found");
   }
-  if (!isValidDistTag(tag)) return npmError(400, "bad_request", "dist-tag is invalid");
+  if (!isValidDistTag(tag2)) return npmError(400, "bad_request", "dist-tag is invalid");
   const result = await context.env.PKGFLARE_DB.prepare(
     "DELETE FROM dist_tags WHERE package_name = ?1 AND tag = ?2"
-  ).bind(packageName, tag).run();
+  ).bind(packageName, tag2).run();
   return result.meta.changes === 0 ? npmError(404, "not_found", "dist-tag not found") : json({ ok: true });
 }
 
@@ -2302,16 +3448,16 @@ for (let index = 0; index < base64Alphabet.length; index += 1) {
   base64Values[base64Alphabet.charCodeAt(index)] = index;
 }
 var PublishStreamError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
+  constructor(status, code, message2) {
+    super(message2);
     this.status = status;
     this.code = code;
   }
   status;
   code;
 };
-function badJson(message = "request body must be valid JSON") {
-  return new PublishStreamError(400, "bad_request", message);
+function badJson(message2 = "request body must be valid JSON") {
+  return new PublishStreamError(400, "bad_request", message2);
 }
 function hex(bytes) {
   return [...new Uint8Array(bytes)].map((value) => value.toString(16).padStart(2, "0")).join("");
@@ -2837,8 +3983,8 @@ async function parsePublishRequest(request, bucket, packageName) {
 
 // src/runtime/publish.ts
 var PublishError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
+  constructor(status, code, message2) {
+    super(message2);
     this.status = status;
     this.code = code;
   }
@@ -2878,11 +4024,11 @@ function validateDocument(value, pathPackageName, scopes, tarball) {
     throw new PublishError(400, "bad_request", "at least one dist-tag is required");
   }
   const tags = {};
-  for (const [tag, target] of Object.entries(document["dist-tags"])) {
-    if (!/^[a-z0-9][a-z0-9._-]*$/i.test(tag) || target !== version) {
+  for (const [tag2, target] of Object.entries(document["dist-tags"])) {
+    if (!/^[a-z0-9][a-z0-9._-]*$/i.test(tag2) || target !== version) {
       throw new PublishError(400, "bad_request", "dist-tags must reference the published version");
     }
-    tags[tag] = version;
+    tags[tag2] = version;
   }
   if (!object(document._attachments) || Object.keys(document._attachments).length !== 1) {
     throw new PublishError(
@@ -3016,9 +4162,9 @@ async function publishPackage(request, context, packageName) {
         now
       ),
       ...Object.entries(publish.tags).map(
-        ([tag, version]) => context.env.PKGFLARE_DB.prepare(
+        ([tag2, version]) => context.env.PKGFLARE_DB.prepare(
           "INSERT INTO dist_tags (package_name, tag, version) VALUES (?1, ?2, ?3) ON CONFLICT(package_name, tag) DO UPDATE SET version = excluded.version"
-        ).bind(publish.packageName, tag, version)
+        ).bind(publish.packageName, tag2, version)
       )
     ];
     try {
@@ -3188,7 +4334,7 @@ async function handle(request, env, requestId) {
       if (request.method !== "GET" && request.method !== "HEAD") {
         return methodNotAllowed(["GET", "HEAD"]);
       }
-      const denied2 = await authorize(request, context, "read");
+      const denied2 = await authorize(request, context, "read", distTagRoute.packageName);
       if (denied2 !== null) return denied2;
       const response = await readDistTags(context, distTagRoute.packageName);
       return request.method === "HEAD" ? new Response(null, { status: response.status, headers: response.headers }) : response;
@@ -3196,7 +4342,7 @@ async function handle(request, env, requestId) {
     if (request.method !== "PUT" && request.method !== "DELETE") {
       return methodNotAllowed(["PUT", "DELETE"]);
     }
-    const denied = await authorize(request, context, "publish");
+    const denied = await authorize(request, context, "publish", distTagRoute.packageName);
     if (denied !== null) return denied;
     return request.method === "PUT" ? setDistTag(request, context, distTagRoute.packageName, distTagRoute.tag) : deleteDistTag(context, distTagRoute.packageName, distTagRoute.tag);
   }
@@ -3206,18 +4352,18 @@ async function handle(request, env, requestId) {
     if (request.method !== "GET" && request.method !== "HEAD") {
       return methodNotAllowed(["GET", "HEAD"]);
     }
-    const denied = await authorize(request, context, "read");
+    const denied = await authorize(request, context, "read", route.packageName);
     if (denied !== null) return denied;
     return readTarball(request, context, route.packageName, route.remainder[1] ?? "");
   }
   if (route.remainder.length > 1) return npmError(404, "not_found", "endpoint not found");
   if (request.method === "PUT" && route.remainder.length === 0) {
-    const denied = await authorize(request, context, "publish");
+    const denied = await authorize(request, context, "publish", route.packageName);
     if (denied !== null) return denied;
     return publishPackage(request, context, route.packageName);
   }
   if ((request.method === "GET" || request.method === "HEAD") && route.remainder.length <= 1) {
-    const denied = await authorize(request, context, "read");
+    const denied = await authorize(request, context, "read", route.packageName);
     if (denied !== null) return denied;
     const response = await readPackage(request, context, route.packageName, route.remainder[0]);
     return request.method === "HEAD" ? new Response(null, { status: response.status, headers: response.headers }) : response;