@uapkg/cli 1.1.10 → 1.2.0

package/dist/control-plane/AccountManager.js

@@ -0,0 +1,1014 @@
+import { createServer } from 'node:http';
+import { hostname } from 'node:os';
+import { createControlPlaneCommandFailedDiagnostic, } from '@uapkg/diagnostics';
+import isCI from 'is-ci';
+import * as oauth from 'oauth4webapi';
+import { AuthMetadataStore } from './AuthMetadataStore.js';
+import { resolveAuthStoragePaths } from './AuthStoragePaths.js';
+import { ControlPlaneClient } from './ControlPlaneClient.js';
+import { ControlPlaneError, isUAPKGCliScope, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, parseUAPKGCliScopeString, registryAudience, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, } from './ControlPlaneTypes.js';
+import { CredentialStore } from './CredentialStore.js';
+import { DPoPKeyStore } from './DPoPKeyStore.js';
+import { FileRegistryGrantLock } from './RegistryGrantLock.js';
+const INTERACTIVE_LOGIN_TIMEOUT_MS = 3 * 60 * 1000;
+const INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS = 60 * 1000;
+const CLI_LOGIN_RECONCILIATION_TIMEOUT_MS = 5 * 1000;
+const OAUTH_BACKCHANNEL_TIMEOUT_MS = 30 * 1000;
+const LOOPBACK_CALLBACK_PATH = '/callback';
+const ACCOUNT_COMPLETION_PATH = '/cli-login/complete';
+const CONTROL_PLANE_SERVER_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
+export class LoginError extends Error {
+    code;
+    oauthError;
+    constructor(code, message, oauthError) {
+        super(message);
+        this.code = code;
+        this.oauthError = oauthError;
+        this.name = 'LoginError';
+    }
+}
+export class AccountManager {
+    metadata;
+    credentials;
+    openBrowser;
+    isInteractiveLogin;
+    interactiveLoginTimeoutMs;
+    interactiveLoginFinalizationTimeoutMs;
+    keyStore;
+    accessTokenCache = new Map();
+    grantOperationTails = new Map();
+    grantLock;
+    constructor(metadata = new AuthMetadataStore(), credentials = new CredentialStore(), openBrowser = async (url) => {
+        const { default: open } = await import('open');
+        await open(url, { wait: false });
+    }, isInteractiveLogin = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI), grantLock, interactiveLoginTimeoutMs = INTERACTIVE_LOGIN_TIMEOUT_MS, interactiveLoginFinalizationTimeoutMs = INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS) {
+        this.metadata = metadata;
+        this.credentials = credentials;
+        this.openBrowser = openBrowser;
+        this.isInteractiveLogin = isInteractiveLogin;
+        this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
+        this.interactiveLoginFinalizationTimeoutMs = interactiveLoginFinalizationTimeoutMs;
+        this.keyStore = new DPoPKeyStore(credentials);
+        const metadataPath = typeof metadata.path === 'string' ? metadata.path : undefined;
+        this.grantLock = grantLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(metadataPath).locksDirectory);
+    }
+    async hasGrant(trust) {
+        return Boolean(await this.metadata.find(trust.issuer, trust.registryId));
+    }
+    invalidateAccessCredentials(trust) {
+        for (const key of this.accessTokenCache.keys()) {
+            if (key.startsWith(`${trust.issuer}|${trust.registryId}|`)) {
+                this.accessTokenCache.delete(key);
+            }
+        }
+    }
+    async login(trust, options = {}) {
+        this.assertPinnedTrust(trust);
+        this.assertInteractiveLogin();
+        await this.credentials.assertAvailable();
+        const previous = await this.metadata.find(trust.issuer, trust.registryId);
+        if (previous && !options.reauthorize) {
+            throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
+        }
+        emitLoginProgress(options.onProgress, { type: 'preparing', registryAlias: trust.alias });
+        const issuer = new URL(trust.issuer);
+        const as = await this.discover(issuer);
+        this.validateAuthorizationServer(as);
+        this.assertIssuerSupportsScopes(as, trust, UAPKG_CLI_SCOPES);
+        const client = this.client();
+        const keyPair = await this.keyStore.generate();
+        const dpop = oauth.DPoP(client, keyPair);
+        const publicKeyThumbprint = await dpop.calculateThumbprint();
+        const receiver = await LoopbackAuthorizationReceiver.listen(issuer);
+        let issuedRefreshToken;
+        let retainedIssuedGrant = false;
+        let preserveIssuedGrant = false;
+        let callbackReceipt;
+        let finalizationController;
+        let finalizationTimeout;
+        try {
+            const codeVerifier = oauth.generateRandomCodeVerifier();
+            const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
+            const state = oauth.generateRandomState();
+            const nonce = oauth.generateRandomNonce();
+            const requestedScopes = ['openid', 'offline_access', ...UAPKG_CLI_SCOPES];
+            const scope = requestedScopes.join(' ');
+            const deviceName = normalizeDeviceName(options.deviceName);
+            const parameters = new URLSearchParams({
+                client_id: client.client_id,
+                redirect_uri: receiver.redirectUri,
+                response_type: 'code',
+                code_challenge: codeChallenge,
+                code_challenge_method: 'S256',
+                state,
+                nonce,
+                scope,
+                resource: trust.resource,
+                dpop_jkt: publicKeyThumbprint,
+                registry_id: trust.registryId,
+                registry_source_fingerprint: trust.repositoryFingerprint,
+                device_name: deviceName,
+                max_age: '300',
+            });
+            if (requestedScopes.includes('offline_access')) {
+                parameters.set('prompt', 'consent');
+            }
+            const expectedPredecessorGrantId = options.reauthorize && previous ? previous.grantId : null;
+            if (expectedPredecessorGrantId) {
+                parameters.set('replace_grant_id', expectedPredecessorGrantId);
+            }
+            const pushed = await this.withDPoPNonceRetry(() => oauth.pushedAuthorizationRequest(as, client, oauth.None(), parameters, {
+                DPoP: dpop,
+                signal: () => AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),
+            }), (response) => oauth.processPushedAuthorizationResponse(as, client, response));
+            if (!as.authorization_endpoint) {
+                throw new Error('The authorization server did not advertise an authorization endpoint.');
+            }
+            const authorizationUrl = new URL(as.authorization_endpoint);
+            authorizationUrl.searchParams.set('client_id', client.client_id);
+            authorizationUrl.searchParams.set('request_uri', pushed.request_uri);
+            emitLoginProgress(options.onProgress, { type: 'opening-browser' });
+            try {
+                await this.openBrowser(authorizationUrl.href);
+            }
+            catch {
+                emitLoginProgress(options.onProgress, {
+                    type: 'browser-open-failed',
+                    authorizationUrl: authorizationUrl.href,
+                });
+            }
+            emitLoginProgress(options.onProgress, { type: 'waiting-for-decision' });
+            callbackReceipt = await receiver.waitForCallback(this.interactiveLoginTimeoutMs, trust.alias);
+            finalizationController = new AbortController();
+            finalizationTimeout = setTimeout(() => {
+                finalizationController?.abort(loginFinalizationTimeoutError(trust.alias));
+            }, this.interactiveLoginFinalizationTimeoutMs);
+            const finalizationSignal = finalizationController.signal;
+            const callbackUrl = callbackReceipt.url;
+            if (callbackUrl.searchParams.get('iss') !== trust.issuer) {
+                throw new LoginError('LOGIN_AUTHORIZATION_RESPONSE_INVALID', 'The browser authorization response came from an unexpected issuer. Run `uapkg login` again.');
+            }
+            let callbackParameters;
+            try {
+                callbackParameters = oauth.validateAuthResponse(as, client, callbackUrl, state);
+            }
+            catch (error) {
+                throw authorizationResponseLoginError(error);
+            }
+            emitLoginProgress(options.onProgress, { type: 'approval-received' });
+            const tokens = await this.withDPoPNonceRetry(() => oauth.authorizationCodeGrantRequest(as, client, oauth.None(), callbackParameters, receiver.redirectUri, codeVerifier, { DPoP: dpop, signal: finalizationSignal }), (response) => oauth.processAuthorizationCodeResponse(as, client, response, {
+                expectedNonce: nonce,
+                maxAge: 300,
+                requireIdToken: true,
+            }));
+            finalizationSignal.throwIfAborted();
+            if (tokens.token_type !== 'dpop') {
+                throw new Error('The authorization server did not issue a DPoP-bound access token.');
+            }
+            if (!tokens.refresh_token) {
+                throw new Error('The authorization server did not issue a persistent registry grant.');
+            }
+            const refreshToken = tokens.refresh_token;
+            issuedRefreshToken = refreshToken;
+            const controlPlane = new ControlPlaneClient(trust.apiBaseUrl);
+            const issuedCredential = {
+                kind: 'dpop',
+                accessToken: tokens.access_token,
+                dpop,
+                registryAlias: trust.alias,
+                requestedScopes: UAPKG_CLI_SCOPES,
+            };
+            const self = await controlPlane.getCliLoginConfirmation(issuedCredential, finalizationSignal);
+            finalizationSignal.throwIfAborted();
+            if (self.grant.replacesGrantId !== expectedPredecessorGrantId) {
+                throw loginReplacementBindingError(trust.alias);
+            }
+            if (self.registry.id !== trust.registryId) {
+                throw new Error('The authorization server returned a registry grant for an unexpected registry.');
+            }
+            const missingScopes = UAPKG_CLI_SCOPES.filter((scope) => !self.grant.scopes.includes(scope));
+            if (missingScopes.length > 0) {
+                throw new Error(`The authorization server omitted required CLI capabilities: ${missingScopes.join(', ')}.`);
+            }
+            if (self.grant.status === 'pending' &&
+                timestampFromIso(self.grant.activationExpiresAt) <= Math.floor(Date.now() / 1000)) {
+                throw new LoginError('LOGIN_AUTHORIZATION_TIMEOUT', `Login approval expired before this device could confirm it. Run \`uapkg login --registry ${trust.alias}\` to try again.`);
+            }
+            const grantId = self.grant.id;
+            const keyReference = this.credentials.createReference('dpop-key', trust.issuer, trust.registryId, grantId);
+            const refreshTokenReference = this.credentials.createReference('grant', trust.issuer, trust.registryId, grantId);
+            const metadata = {
+                issuer: trust.issuer,
+                registryId: trust.registryId,
+                registryName: trust.registryName,
+                grantId,
+                clientId: client.client_id,
+                keyReference,
+                refreshTokenReference,
+                publicKeyThumbprint,
+                deviceName: self.grant.deviceName,
+                repositoryFingerprint: trust.repositoryFingerprint,
+                account: self.account,
+                createdAt: Math.floor(Date.now() / 1000),
+                idleExpiresAt: timestampFromIso(self.grant.idleExpiresAt),
+                expiresAt: timestampFromIso(self.grant.absoluteExpiresAt),
+            };
+            let previousForCleanup;
+            await this.serializeGrantOperation(trust, async () => {
+                const currentPrevious = await this.metadata.find(trust.issuer, trust.registryId);
+                if (!isSameRegistryGrant(previous, currentPrevious)) {
+                    if (options.reauthorize) {
+                        throw loginReauthorizationConflictError(trust.alias);
+                    }
+                    throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
+                }
+                if (currentPrevious && !options.reauthorize) {
+                    throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
+                }
+                emitLoginProgress(options.onProgress, { type: 'saving-local-credentials' });
+                await this.persistPreparedGrant(metadata, keyPair, refreshToken, currentPrevious, finalizationSignal);
+                if (self.grant.status === 'pending') {
+                    emitLoginProgress(options.onProgress, { type: 'confirming-with-service' });
+                    const activation = await this.activatePreparedGrant(controlPlane, issuedCredential, metadata.grantId, expectedPredecessorGrantId, finalizationSignal, trust.alias);
+                    if (activation.kind === 'rejected') {
+                        await this.rollbackPreparedGrant(metadata, currentPrevious);
+                        throw activation.error;
+                    }
+                    if (activation.kind === 'ambiguous') {
+                        preserveIssuedGrant = true;
+                        throw activation.error;
+                    }
+                }
+                retainedIssuedGrant = true;
+                this.invalidateAccessCredentials(trust);
+                if (finalizationTimeout) {
+                    clearTimeout(finalizationTimeout);
+                    finalizationTimeout = undefined;
+                }
+                previousForCleanup = currentPrevious;
+            });
+            await callbackReceipt.complete('success');
+            let warnings = [];
+            if (previousForCleanup) {
+                try {
+                    warnings = await this.serializeGrantOperation(trust, () => this.cleanupPreviousLocalCredentials(metadata, previousForCleanup));
+                }
+                catch {
+                    warnings = [
+                        'The new login is active, but UAPKG could not remove one or more old protected credential entries. Remove the stale UAPKG entries from the operating-system credential store.',
+                    ];
+                }
+            }
+            return { grant: metadata, warnings };
+        }
+        catch (error) {
+            if (finalizationTimeout) {
+                clearTimeout(finalizationTimeout);
+                finalizationTimeout = undefined;
+            }
+            const failure = error instanceof LoginError
+                ? error
+                : finalizationController?.signal.aborted && finalizationController.signal.reason instanceof LoginError
+                    ? finalizationController.signal.reason
+                    : error;
+            if (issuedRefreshToken && !retainedIssuedGrant && !preserveIssuedGrant) {
+                await this.revokeToken(as, client, issuedRefreshToken, dpop).catch(() => undefined);
+            }
+            const loginError = normalizeLoginError(failure);
+            if (callbackReceipt) {
+                const outcome = loginError.code === 'LOGIN_ACCESS_DENIED' ? 'denied' : 'failed';
+                await callbackReceipt.complete(outcome).catch(() => undefined);
+            }
+            throw loginError;
+        }
+        finally {
+            if (finalizationTimeout)
+                clearTimeout(finalizationTimeout);
+            receiver.close();
+        }
+    }
+    async getAccessCredential(trust, scopes) {
+        this.assertPinnedTrust(trust);
+        const requestedScopes = [...new Set(scopes)].sort();
+        if (requestedScopes.length === 0 || requestedScopes.some((scope) => !isUAPKGCliScope(scope))) {
+            throw new Error('A control-plane operation requested an unsupported OAuth capability scope.');
+        }
+        const grant = await this.requireUsableGrant(trust);
+        const as = await this.discover(new URL(trust.issuer));
+        this.assertIssuerSupportsScopes(as, trust, requestedScopes);
+        const cacheKey = this.accessTokenCacheKey(grant, requestedScopes);
+        const cached = this.accessTokenCache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now() + 15_000) {
+            return {
+                grant,
+                credential: {
+                    kind: 'dpop',
+                    accessToken: cached.token,
+                    dpop: cached.dpop,
+                    registryAlias: trust.alias,
+                    requestedScopes,
+                },
+            };
+        }
+        return this.serializeGrantOperation(trust, async () => {
+            // Another process may have replaced the grant or rotated its refresh
+            // token while this process waited. Reload every persistent component
+            // only after the cross-process lock has been acquired.
+            const currentGrant = await this.requireUsableGrant(trust);
+            const currentCacheKey = this.accessTokenCacheKey(currentGrant, requestedScopes);
+            const refreshedCached = this.accessTokenCache.get(currentCacheKey);
+            if (refreshedCached && refreshedCached.expiresAt > Date.now() + 15_000) {
+                return {
+                    grant: currentGrant,
+                    credential: {
+                        kind: 'dpop',
+                        accessToken: refreshedCached.token,
+                        dpop: refreshedCached.dpop,
+                        registryAlias: trust.alias,
+                        requestedScopes,
+                    },
+                };
+            }
+            const pair = await this.keyStore.load(currentGrant.keyReference);
+            if (!pair)
+                throw missingKeyError(trust);
+            const client = this.client();
+            const dpop = oauth.DPoP(client, pair);
+            if ((await dpop.calculateThumbprint()) !== currentGrant.publicKeyThumbprint) {
+                throw missingKeyError(trust);
+            }
+            // Refresh tokens rotate on every successful use. Read the current value
+            // only after acquiring both the process-local and filesystem lock.
+            const refreshToken = await this.credentials.get(currentGrant.refreshTokenReference);
+            if (!refreshToken) {
+                throw new Error(`The saved login for "${trust.alias}" is missing its protected registry grant. Run \`uapkg login --registry ${trust.alias}\` again.`);
+            }
+            let tokenResponse;
+            try {
+                tokenResponse = await this.withDPoPNonceRetry(() => oauth.refreshTokenGrantRequest(as, client, oauth.None(), refreshToken, {
+                    DPoP: dpop,
+                    additionalParameters: {
+                        resource: trust.resource,
+                        scope: requestedScopes.join(' '),
+                    },
+                }), (response) => oauth.processRefreshTokenResponse(as, client, response));
+            }
+            catch (error) {
+                if (error instanceof oauth.ResponseBodyError && error.error === 'invalid_scope') {
+                    const hintedScopes = parseUAPKGCliScopeString(error.cause.scope).filter((scope) => requestedScopes.includes(scope));
+                    const missingScopes = hintedScopes.length > 0 ? hintedScopes : requestedScopes;
+                    throw new OAuthScopeInsufficientError('The saved registry grant does not include every OAuth scope required by this operation.', trust.alias, requestedScopes, requestedScopes, missingScopes, 403, { cause: error });
+                }
+                if (error instanceof oauth.ResponseBodyError &&
+                    (error.error === 'invalid_grant' || error.error === 'invalid_token')) {
+                    throw new Error(`Your saved login for "${trust.alias}" is no longer valid. Run \`uapkg login --registry ${trust.alias} --reauthorize\` to authenticate again.`, { cause: error });
+                }
+                throw error;
+            }
+            if (tokenResponse.token_type !== 'dpop') {
+                throw new Error('The authorization server returned an access token that is not DPoP-bound.');
+            }
+            if (tokenResponse.refresh_token && tokenResponse.refresh_token !== refreshToken) {
+                await this.credentials.set(currentGrant.refreshTokenReference, tokenResponse.refresh_token);
+            }
+            const expiresAt = Date.now() + Math.max(1, tokenResponse.expires_in ?? 300) * 1000;
+            this.accessTokenCache.set(currentCacheKey, { token: tokenResponse.access_token, expiresAt, dpop });
+            return {
+                grant: currentGrant,
+                credential: {
+                    kind: 'dpop',
+                    accessToken: tokenResponse.access_token,
+                    dpop,
+                    registryAlias: trust.alias,
+                    requestedScopes,
+                },
+            };
+        });
+    }
+    async logout(trust, localOnly = false) {
+        this.assertPinnedTrust(trust);
+        return this.serializeGrantOperation(trust, async () => {
+            const grant = await this.metadata.find(trust.issuer, trust.registryId);
+            if (!grant)
+                return 'not-logged-in';
+            if (!localOnly) {
+                try {
+                    await this.revokeSavedGrant(grant);
+                }
+                catch (error) {
+                    throw new Error(`Unable to revoke the registry grant for "${trust.alias}". The local login was kept so you can retry. Use --local-only only if you accept that account-site revocation may still be required.`, { cause: error });
+                }
+            }
+            await Promise.all([
+                this.keyStore.delete(grant.keyReference),
+                this.credentials.delete(grant.refreshTokenReference),
+            ]);
+            await this.metadata.remove(grant.issuer, grant.registryId);
+            this.invalidateAccessCredentials(trust);
+            return 'removed';
+        });
+    }
+    async requireUsableGrant(trust) {
+        const grant = await this.metadata.find(trust.issuer, trust.registryId);
+        if (!grant) {
+            throw new Error(`You are not logged in to "${trust.alias}". Run \`uapkg login --registry ${trust.alias}\`.`);
+        }
+        if (grant.repositoryFingerprint !== trust.repositoryFingerprint) {
+            throw new Error(`The configured Git source for "${trust.alias}" does not match the source authorized by the saved login. Run \`uapkg login --registry ${trust.alias} --reauthorize\`.`);
+        }
+        const now = Math.floor(Date.now() / 1000);
+        // The idle deadline advances whenever the grant is used. The saved value
+        // is display metadata from login time, so the server remains authoritative
+        // for idle expiry; the absolute deadline is stable and safe to reject
+        // locally.
+        if (grant.expiresAt && grant.expiresAt <= now) {
+            throw new Error(`Your saved login for "${trust.alias}" has expired. Run \`uapkg login --registry ${trust.alias}\` again.`);
+        }
+        return grant;
+    }
+    async revokeSavedGrant(grant) {
+        const refreshToken = await this.credentials.get(grant.refreshTokenReference);
+        if (!refreshToken) {
+            throw new Error('The registry grant cannot be revoked because its protected credential is missing.');
+        }
+        const pair = await this.keyStore.load(grant.keyReference);
+        if (!pair)
+            throw new Error('The registry grant cannot be revoked because its DPoP key is missing.');
+        const dpop = oauth.DPoP(this.client(), pair);
+        if ((await dpop.calculateThumbprint()) !== grant.publicKeyThumbprint) {
+            throw new Error('The registry grant cannot be revoked because its DPoP key has changed.');
+        }
+        const as = await this.discover(new URL(grant.issuer));
+        await this.revokeToken(as, this.client(), refreshToken, dpop);
+    }
+    async activatePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, signal, registryAlias) {
+        try {
+            const confirmed = await controlPlane.confirmCliLogin(credential, signal);
+            if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) {
+                return { kind: 'active' };
+            }
+            return this.reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias);
+        }
+        catch (error) {
+            if (isCliLoginReauthorizationConflict(error)) {
+                return { kind: 'rejected', error: reauthorizationConflictLoginError(error) };
+            }
+            if (isDefinitiveCliLoginConfirmationRejection(error))
+                return { kind: 'rejected', error };
+            return this.reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias);
+        }
+    }
+    async reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias) {
+        const signal = AbortSignal.timeout(CLI_LOGIN_RECONCILIATION_TIMEOUT_MS);
+        let retryActivation = true;
+        try {
+            const observed = await controlPlane.getCliLoginConfirmation(credential, signal);
+            if (observed.grant.id !== expectedGrantId || observed.grant.replacesGrantId !== expectedPredecessorGrantId) {
+                retryActivation = false;
+            }
+            else if (observed.grant.status === 'active') {
+                return { kind: 'active' };
+            }
+        }
+        catch {
+            // An idempotent activation retry can still resolve a failed status read.
+        }
+        if (retryActivation) {
+            try {
+                const confirmed = await controlPlane.confirmCliLogin(credential, signal);
+                if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) {
+                    return { kind: 'active' };
+                }
+            }
+            catch {
+                // Once the first activation outcome is ambiguous, even a later 4xx
+                // cannot prove that the original request did not commit.
+            }
+        }
+        try {
+            const observed = await controlPlane.getCliLoginConfirmation(credential, signal);
+            if (observed.grant.id === expectedGrantId &&
+                observed.grant.replacesGrantId === expectedPredecessorGrantId &&
+                observed.grant.status === 'active') {
+                return { kind: 'active' };
+            }
+        }
+        catch {
+            // Fall through to the explicit ambiguous outcome below.
+        }
+        return { kind: 'ambiguous', error: loginConfirmationAmbiguousError(registryAlias) };
+    }
+    async persistPreparedGrant(metadata, keyPair, refreshToken, previous, signal) {
+        let metadataWriteAttempted = false;
+        try {
+            signal?.throwIfAborted();
+            await this.keyStore.save(metadata.keyReference, keyPair);
+            signal?.throwIfAborted();
+            await this.credentials.set(metadata.refreshTokenReference, refreshToken);
+            signal?.throwIfAborted();
+            metadataWriteAttempted = true;
+            await this.metadata.upsert(metadata);
+            signal?.throwIfAborted();
+        }
+        catch (error) {
+            const cleanup = [
+                this.keyStore.delete(metadata.keyReference),
+                this.credentials.delete(metadata.refreshTokenReference),
+            ];
+            let metadataRollbackIndex;
+            if (metadataWriteAttempted) {
+                metadataRollbackIndex = cleanup.length;
+                cleanup.push(previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId));
+            }
+            const cleanupResults = await Promise.allSettled(cleanup);
+            if (metadataRollbackIndex !== undefined && cleanupResults[metadataRollbackIndex]?.status === 'rejected') {
+                throw new LoginError('LOGIN_FAILED', 'Login failed, and UAPKG could not roll back the local login metadata safely. Check `uapkg whoami --json` before retrying.');
+            }
+            throw error;
+        }
+    }
+    async rollbackPreparedGrant(metadata, previous) {
+        const cleanupResults = await Promise.allSettled([
+            this.keyStore.delete(metadata.keyReference),
+            this.credentials.delete(metadata.refreshTokenReference),
+            previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId),
+        ]);
+        if (cleanupResults.some(({ status }) => status === 'rejected')) {
+            throw new LoginError('LOGIN_FAILED', 'Login confirmation failed, and UAPKG could not roll back the local login safely. Check `uapkg whoami --json` before retrying.');
+        }
+    }
+    async cleanupPreviousLocalCredentials(metadata, previous) {
+        if (!previous)
+            return [];
+        if (previous.grantId === metadata.grantId ||
+            (previous.keyReference === metadata.keyReference &&
+                previous.refreshTokenReference === metadata.refreshTokenReference)) {
+            return [];
+        }
+        const cleanupResults = await Promise.allSettled([
+            this.keyStore.delete(previous.keyReference),
+            this.credentials.delete(previous.refreshTokenReference),
+        ]);
+        const warnings = [];
+        if (cleanupResults.some(({ status }) => status === 'rejected')) {
+            warnings.push('The previous registry grant was replaced, but one or more old protected credential entries could not be removed. Remove the stale UAPKG entries from the operating-system credential store.');
+        }
+        return warnings;
+    }
+    async revokeToken(as, client, refreshToken, dpop) {
+        const signer = signingDPoPHandle(dpop);
+        await this.withDPoPNonceRetry(() => oauth.revocationRequest(as, client, oauth.None(), refreshToken, {
+            additionalParameters: { token_type_hint: 'refresh_token' },
+            signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),
+            [oauth.customFetch]: async (url, options) => {
+                const endpoint = new URL(url);
+                const headers = new Headers(options.headers);
+                await signer.addProof(endpoint, headers, 'POST');
+                const response = await fetch(url, { ...options, headers });
+                signer.cacheNonce(response, endpoint);
+                return response;
+            },
+        }), (response) => oauth.processRevocationResponse(response));
+    }
+    async discover(issuer) {
+        const discoveryUrl = oidcDiscoveryUrl(issuer);
+        let response;
+        try {
+            response = await oauth.discoveryRequest(issuer, {
+                algorithm: 'oidc',
+                signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new Error(`Unable to retrieve OAuth metadata for build-pinned issuer "${issuer.href}" from discovery URL "${discoveryUrl.href}".`);
+        }
+        try {
+            return await oauth.processDiscoveryResponse(issuer, response);
+        }
+        catch {
+            throw new Error(`Invalid OAuth metadata for build-pinned issuer "${issuer.href}" from discovery URL "${discoveryUrl.href}" (HTTP ${response.status}).`);
+        }
+    }
+    validateAuthorizationServer(as) {
+        if (!as.authorization_endpoint || !as.token_endpoint || !as.pushed_authorization_request_endpoint) {
+            throw new Error('The UAPKG authorization server is missing required authorization, token, or PAR endpoints.');
+        }
+        if (!as.revocation_endpoint) {
+            throw new Error('The UAPKG authorization server is missing its grant revocation endpoint.');
+        }
+        if (as.code_challenge_methods_supported && !as.code_challenge_methods_supported.includes('S256')) {
+            throw new Error('The UAPKG authorization server does not support PKCE S256.');
+        }
+        if (as.dpop_signing_alg_values_supported && !as.dpop_signing_alg_values_supported.includes('ES256')) {
+            throw new Error('The UAPKG authorization server does not support ES256 DPoP proofs.');
+        }
+    }
+    assertIssuerSupportsScopes(as, trust, requestedScopes) {
+        const advertisedScopes = new Set(Array.isArray(as.scopes_supported) ? as.scopes_supported : []);
+        const unsupportedScopes = requestedScopes.filter((scope) => !advertisedScopes.has(scope));
+        if (unsupportedScopes.length > 0) {
+            throw new OAuthScopeUnsupportedError(trust.alias, requestedScopes, unsupportedScopes);
+        }
+    }
+    client() {
+        return {
+            client_id: UAPKG_CLI_CLIENT_ID,
+            token_endpoint_auth_method: 'none',
+        };
+    }
+    assertPinnedTrust(trust) {
+        if (trust.issuer !== UAPKG_AUTHORIZATION_ISSUER ||
+            trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API ||
+            trust.resource !== registryAudience(trust.registryId)) {
+            throw new Error('UAPKG v1 does not accept project-configured authorization issuers or API URLs.');
+        }
+    }
+    assertInteractiveLogin() {
+        if (this.isInteractiveLogin())
+            return;
+        throw new Error([
+            'Unable to complete interactive login on this machine.',
+            '',
+            'Persistent login is not supported in headless environments.',
+            '',
+            'For automated publishing, configure a GitHub Actions OIDC trusted publisher.',
+            'For interactive publishing, run `uapkg login` from a trusted, browser-capable workstation.',
+        ].join('\n'));
+    }
+    async withDPoPNonceRetry(request, processResponse) {
+        try {
+            return await processResponse(await request());
+        }
+        catch (error) {
+            if (!oauth.isDPoPNonceError(error))
+                throw error;
+            return processResponse(await request());
+        }
+    }
+    accessTokenCacheKey(grant, scopes) {
+        return `${grant.issuer}|${grant.registryId}|${grant.grantId}|${scopes.join(' ')}`;
+    }
+    async serializeGrantOperation(trust, operation) {
+        const key = `${trust.issuer}|${trust.registryId}`;
+        const previous = this.grantOperationTails.get(key) ?? Promise.resolve();
+        const result = previous.then(() => this.grantLock.withLock(trust.issuer, trust.registryId, operation));
+        const tail = result.then(() => undefined, () => undefined);
+        this.grantOperationTails.set(key, tail);
+        try {
+            return await result;
+        }
+        finally {
+            if (this.grantOperationTails.get(key) === tail) {
+                this.grantOperationTails.delete(key);
+            }
+        }
+    }
+}
+function signingDPoPHandle(handle) {
+    const signer = handle;
+    if (typeof signer.addProof !== 'function' || typeof signer.cacheNonce !== 'function') {
+        throw new Error('The installed OAuth implementation cannot sender-constrain grant revocation.');
+    }
+    return signer;
+}
+export class LoopbackAuthorizationReceiver {
+    server;
+    callbackPath;
+    expectedHost;
+    completionUrl;
+    redirectUri;
+    callbackPromise;
+    callbackResolve;
+    callbackReject;
+    receivedReceipt;
+    timeout;
+    state = 'listening';
+    terminalError;
+    pendingResponse;
+    completion;
+    constructor(server, callbackPath, expectedHost, completionUrl, redirectUri) {
+        this.server = server;
+        this.callbackPath = callbackPath;
+        this.expectedHost = expectedHost;
+        this.completionUrl = completionUrl;
+        this.redirectUri = redirectUri;
+    }
+    static async listen(issuer) {
+        const callbackPath = LOOPBACK_CALLBACK_PATH;
+        let receiver;
+        const server = createServer((request, response) => {
+            if (!receiver) {
+                response.writeHead(503).end();
+                return;
+            }
+            receiver.receive(request, response);
+        });
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', () => resolve());
+        });
+        const address = server.address();
+        if (!address || typeof address === 'string') {
+            server.close();
+            throw new Error('Unable to determine the interactive login callback address.');
+        }
+        const expectedHost = `127.0.0.1:${address.port}`;
+        receiver = new LoopbackAuthorizationReceiver(server, callbackPath, expectedHost, new URL(ACCOUNT_COMPLETION_PATH, issuer.origin), `http://${expectedHost}${callbackPath}`);
+        return receiver;
+    }
+    async waitForCallback(timeoutMs, registryAlias) {
+        if (this.receivedReceipt)
+            return this.receivedReceipt;
+        if (this.state === 'closed') {
+            throw this.terminalError ?? new LoginError('LOGIN_FAILED', 'The browser authorization listener was closed.');
+        }
+        if (this.callbackPromise)
+            return this.callbackPromise;
+        this.callbackPromise = new Promise((resolve, reject) => {
+            this.callbackResolve = resolve;
+            this.callbackReject = reject;
+            this.timeout = setTimeout(() => {
+                if (this.state !== 'listening')
+                    return;
+                this.terminate(new LoginError('LOGIN_AUTHORIZATION_TIMEOUT', registryAlias
+                    ? `Login timed out while waiting for browser authorization. Run \`uapkg login --registry ${registryAlias}\` to try again.`
+                    : 'Login timed out while waiting for browser authorization. Run `uapkg login` to try again.'));
+            }, timeoutMs);
+        });
+        return this.callbackPromise;
+    }
+    close() {
+        this.terminate(new LoginError('LOGIN_FAILED', 'The browser authorization listener was closed.'));
+    }
+    receive(request, response) {
+        if (this.state !== 'listening' ||
+            request.method !== 'GET' ||
+            request.headers.host !== this.expectedHost ||
+            (request.url !== this.callbackPath && !request.url?.startsWith(`${this.callbackPath}?`))) {
+            rejectLoopbackRequest(response);
+            return;
+        }
+        let url;
+        try {
+            url = new URL(request.url, this.redirectUri);
+        }
+        catch {
+            rejectLoopbackRequest(response);
+            return;
+        }
+        if (url.origin !== new URL(this.redirectUri).origin || url.pathname !== this.callbackPath) {
+            rejectLoopbackRequest(response);
+            return;
+        }
+        this.state = 'callback-accepted';
+        if (this.timeout)
+            clearTimeout(this.timeout);
+        this.timeout = undefined;
+        this.pendingResponse = response;
+        const receipt = {
+            url,
+            complete: (outcome) => this.complete(response, outcome),
+        };
+        this.receivedReceipt = receipt;
+        this.callbackResolve?.(receipt);
+        this.callbackResolve = undefined;
+        this.callbackReject = undefined;
+    }
+    complete(response, outcome) {
+        if (this.completion)
+            return this.completion;
+        this.completion = new Promise((resolve) => {
+            let settled = false;
+            const finish = () => {
+                if (settled)
+                    return;
+                settled = true;
+                this.pendingResponse = undefined;
+                this.close();
+                resolve();
+            };
+            response.once('finish', finish);
+            response.once('close', finish);
+            response.once('error', finish);
+            if (response.destroyed || response.writableEnded) {
+                finish();
+                return;
+            }
+            const location = new URL(this.completionUrl);
+            location.hash = new URLSearchParams({ result: outcome }).toString();
+            try {
+                response
+                    .writeHead(303, {
+                    location: location.href,
+                    'cache-control': 'no-store',
+                    'referrer-policy': 'no-referrer',
+                    'content-length': '0',
+                    'x-content-type-options': 'nosniff',
+                    connection: 'close',
+                })
+                    .end();
+            }
+            catch {
+                finish();
+            }
+        });
+        return this.completion;
+    }
+    terminate(error) {
+        if (this.state === 'closed')
+            return;
+        this.state = 'closed';
+        this.terminalError = error;
+        if (this.timeout)
+            clearTimeout(this.timeout);
+        this.timeout = undefined;
+        this.callbackReject?.(error);
+        this.callbackResolve = undefined;
+        this.callbackReject = undefined;
+        if (this.pendingResponse && !this.pendingResponse.writableEnded) {
+            this.pendingResponse.destroy();
+        }
+        this.pendingResponse = undefined;
+        this.server.close();
+    }
+}
+function rejectLoopbackRequest(response) {
+    response
+        .writeHead(404, {
+        'cache-control': 'no-store',
+        'content-type': 'text/plain; charset=utf-8',
+        'x-content-type-options': 'nosniff',
+    })
+        .end('Not found.');
+}
+function normalizeDeviceName(value) {
+    const candidate = value?.trim() || hostname().trim() || 'UAPKG CLI';
+    return candidate.slice(0, 80);
+}
+function oidcDiscoveryUrl(issuer) {
+    const discoveryUrl = new URL(issuer);
+    discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\/+$/, '')}/.well-known/openid-configuration`;
+    return discoveryUrl;
+}
+function timestampFromIso(value) {
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        throw new Error('The authorization server returned an invalid registry-grant expiration.');
+    }
+    return Math.floor(parsed / 1000);
+}
+function missingKeyError(trust) {
+    return new Error([
+        `The saved login for "${trust.alias}" cannot be used because its device-bound signing key is missing or has changed.`,
+        '',
+        'This can happen after copying configuration to another computer, resetting secure storage,',
+        'restoring an incomplete backup, or reinstalling the operating system.',
+        '',
+        `Run \`uapkg login --registry ${trust.alias} --reauthorize\` to authorize this device again.`,
+    ].join('\n'));
+}
+function loginFinalizationTimeoutError(registryAlias) {
+    return new LoginError('LOGIN_AUTHORIZATION_TIMEOUT', `Login timed out while verifying and saving browser authorization. No new login was saved. Run \`uapkg login --registry ${registryAlias}\` to try again.`);
+}
+function loginConfirmationAmbiguousError(registryAlias) {
+    return new LoginError('LOGIN_FAILED', [
+        'UAPKG could not determine whether the service activated this login.',
+        'The locally saved credentials were kept to avoid orphaning a possibly active grant.',
+        `Run \`uapkg whoami --registry ${registryAlias}\` to check the login before retrying.`,
+    ].join(' '));
+}
+function loginReauthorizationConflictError(registryAlias) {
+    return new LoginError('LOGIN_REAUTHORIZATION_CONFLICT', `The saved login for "${registryAlias}" changed while reauthorization was in progress. The newer local login was preserved. Run \`uapkg login --registry ${registryAlias} --reauthorize\` again if you still want to replace it.`);
+}
+function loginReplacementBindingError(registryAlias) {
+    return new LoginError('LOGIN_REAUTHORIZATION_CONFLICT', `The authorization service did not bind this login to the expected saved grant for "${registryAlias}". No new local login was saved. Run \`uapkg login --registry ${registryAlias} --reauthorize\` to try again.`);
+}
+function reauthorizationConflictLoginError(error) {
+    return new LoginError('LOGIN_REAUTHORIZATION_CONFLICT', error.message);
+}
+function isCliLoginReauthorizationConflict(error) {
+    return error instanceof ControlPlaneError && error.code === 'CLI_LOGIN_REAUTHORIZATION_CONFLICT';
+}
+function isSameRegistryGrant(expected, current) {
+    if (!expected || !current)
+        return expected === current;
+    return (expected.grantId === current.grantId &&
+        expected.keyReference === current.keyReference &&
+        expected.refreshTokenReference === current.refreshTokenReference);
+}
+function isDefinitiveCliLoginConfirmationRejection(error) {
+    if (!(error instanceof ControlPlaneError) || error.status === undefined)
+        return false;
+    if (error.status < 400 || error.status >= 500)
+        return false;
+    return ![408, 409, 425, 429].includes(error.status);
+}
+function emitLoginProgress(onProgress, event) {
+    try {
+        onProgress?.(event);
+    }
+    catch {
+        // Reporting must never change the authorization outcome.
+    }
+}
+function authorizationResponseLoginError(error) {
+    if (error instanceof oauth.AuthorizationResponseError) {
+        const oauthError = sanitizeOAuthErrorIdentifier(error.error);
+        const description = sanitizeOAuthErrorDescription(error.error_description);
+        if (oauthError === 'access_denied') {
+            return new LoginError('LOGIN_ACCESS_DENIED', `Login denied: ${description ?? 'The user denied the registry grant.'} (access_denied)`, oauthError);
+        }
+        return new LoginError('LOGIN_OAUTH_ERROR', `Login failed: ${description ?? 'The authorization server rejected the request.'}${oauthError ? ` (${oauthError})` : ''}`, oauthError);
+    }
+    return new LoginError('LOGIN_AUTHORIZATION_RESPONSE_INVALID', 'The browser authorization response was invalid. Run `uapkg login` again.');
+}
+function normalizeLoginError(error) {
+    if (error instanceof LoginError)
+        return error;
+    if (isCliLoginReauthorizationConflict(error))
+        return reauthorizationConflictLoginError(error);
+    if (error instanceof oauth.AuthorizationResponseError)
+        return authorizationResponseLoginError(error);
+    if (error instanceof oauth.ResponseBodyError) {
+        const oauthError = sanitizeOAuthErrorIdentifier(error.error);
+        const description = sanitizeOAuthErrorDescription(error.error_description);
+        return new LoginError('LOGIN_OAUTH_ERROR', `Login failed: ${description ?? 'The authorization server rejected the request.'}${oauthError ? ` (${oauthError})` : ''}`, oauthError);
+    }
+    return new LoginError('LOGIN_FAILED', describeControlPlaneError(error));
+}
+function sanitizeOAuthErrorIdentifier(value) {
+    return value && /^[a-z][a-z0-9._~-]{0,63}$/i.test(value) ? value : undefined;
+}
+function sanitizeOAuthErrorDescription(value) {
+    if (!value)
+        return undefined;
+    const sanitized = Array.from(value, (character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return isUnsafeOAuthDescriptionCodePoint(codePoint) ? ' ' : character;
+    })
+        .join('')
+        .replace(/\s+/g, ' ')
+        .trim();
+    return sanitized ? Array.from(sanitized).slice(0, 300).join('') : undefined;
+}
+function isUnsafeOAuthDescriptionCodePoint(codePoint) {
+    return (codePoint <= 0x1f ||
+        (codePoint >= 0x7f && codePoint <= 0x9f) ||
+        codePoint === 0x061c ||
+        codePoint === 0x200e ||
+        codePoint === 0x200f ||
+        (codePoint >= 0x202a && codePoint <= 0x202e) ||
+        codePoint === 0x2028 ||
+        codePoint === 0x2029 ||
+        (codePoint >= 0x2066 && codePoint <= 0x2069));
+}
+export function loginDiagnosticForError(error) {
+    const loginError = normalizeLoginError(error);
+    return {
+        level: 'error',
+        code: loginError.code,
+        message: loginError.message,
+        data: loginError.oauthError ? { oauthError: loginError.oauthError } : {},
+    };
+}
+export function controlPlaneDiagnosticForError(error, operation) {
+    const serverCode = error instanceof ControlPlaneError && CONTROL_PLANE_SERVER_CODE_PATTERN.test(error.code) ? error.code : undefined;
+    const status = error instanceof ControlPlaneError &&
+        error.status !== undefined &&
+        Number.isInteger(error.status) &&
+        error.status >= 100 &&
+        error.status <= 599
+        ? error.status
+        : undefined;
+    const data = {
+        operation,
+        ...(serverCode === undefined ? {} : { serverCode }),
+        ...(status === undefined ? {} : { status }),
+    };
+    return createControlPlaneCommandFailedDiagnostic(describeControlPlaneError(error), data);
+}
+export function describeControlPlaneError(error) {
+    if (error instanceof LoginError)
+        return error.message;
+    if (error instanceof OAuthScopeInsufficientError && error.missingScopes.length > 0) {
+        const scopes = error.missingScopes.map((scope) => `\`${scope}\``).join(', ');
+        const noun = error.missingScopes.length === 1 ? 'scope' : 'scopes';
+        return `Missing authorization ${noun} ${scopes} for this action.\nRun \`uapkg login --registry ${error.registryAlias} --reauthorize\` to authorize the capabilities required by this CLI version.`;
+    }
+    if (error instanceof ControlPlaneError) {
+        if (error.status === 401 && requiresSavedLoginRenewal(error.code)) {
+            return `${error.message}\n\nRun \`uapkg login\` to authenticate again.`;
+        }
+        return `${error.message} (${error.code})`;
+    }
+    return error instanceof Error ? error.message : String(error);
+}
+function requiresSavedLoginRenewal(code) {
+    const normalized = code.toUpperCase();
+    return (normalized.startsWith('DPOP_') ||
+        normalized.startsWith('REGISTRY_GRANT_') ||
+        normalized === 'CONTROL_PLANE_AUTHENTICATION_REQUIRED' ||
+        normalized === 'CLI_ACCESS_TOKEN_INVALID' ||
+        normalized === 'CLI_ACCESS_TOKEN_EXPIRED');
+}
+//# sourceMappingURL=AccountManager.js.map