@uapkg/cli 1.1.10 → 1.3.0

package/dist/control-plane/ControlPlaneClient.js

@@ -0,0 +1,280 @@
+import { randomUUID } from 'node:crypto';
+import * as oauth from 'oauth4webapi';
+import { z } from 'zod';
+import { ControlPlaneError, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, parseOAuthScopeTokens, UAPKG_CONTROL_PLANE_API, } from './ControlPlaneTypes.js';
+const errorSchema = z.object({
+    ok: z.literal(false),
+    error: z.object({
+        code: z.string(),
+        message: z.string(),
+        details: z.record(z.string(), z.unknown()).optional(),
+    }),
+});
+const insufficientScopeDetailsSchema = z.object({
+    requiredScopes: z.array(z.string()),
+    missingScopes: z.array(z.string()),
+});
+const accountSchema = z.object({
+    id: z.uuid(),
+    username: z.string().min(1),
+    displayName: z.string().min(1),
+});
+const accountGrantSchema = z.object({
+    id: z.uuid(),
+    deviceName: z.string().min(1),
+    idleExpiresAt: z.iso.datetime(),
+    absoluteExpiresAt: z.iso.datetime(),
+    scopes: z.array(z.string()),
+});
+const accountResponseSchema = z.object({
+    ok: z.literal(true),
+    account: accountSchema,
+    registry: z.object({
+        id: z.uuid(),
+    }),
+    grant: accountGrantSchema,
+});
+const cliLoginConfirmationResponseSchema = accountResponseSchema.extend({
+    grant: accountGrantSchema.extend({
+        status: z.enum(['pending', 'active']),
+        activationExpiresAt: z.iso.datetime(),
+        replacesGrantId: z.uuid().nullable(),
+    }),
+});
+const activatedCliLoginResponseSchema = z.object({
+    ok: z.literal(true),
+    grant: z.object({
+        id: z.uuid(),
+        status: z.literal('active'),
+        replacesGrantId: z.uuid().nullable(),
+    }),
+});
+const requestStatusSchema = z.enum([
+    'queued',
+    'checking',
+    'accepted',
+    'ready',
+    'ready_superseded',
+    'rejected',
+    'operationally_failed',
+]);
+const requestSummarySchema = z
+    .object({
+    id: z.string().min(1),
+    registryId: z.string().min(1),
+    kind: z.string().min(1),
+    status: requestStatusSchema,
+    currentStep: z.string().optional(),
+    createdAt: z.number().optional(),
+    updatedAt: z.number().optional(),
+    payload: z
+        .object({
+        packageName: z.string().optional(),
+        packageVersion: z.string().optional(),
+    })
+        .passthrough()
+        .optional(),
+})
+    .passthrough();
+export class ControlPlaneClient {
+    apiBaseUrl;
+    constructor(apiBaseUrl = UAPKG_CONTROL_PLANE_API) {
+        const normalized = new URL(apiBaseUrl).href.replace(/\/+$/, '');
+        if (normalized !== UAPKG_CONTROL_PLANE_API) {
+            throw new Error(`UAPKG v1 control-plane requests are pinned to ${UAPKG_CONTROL_PLANE_API}.`);
+        }
+        this.apiBaseUrl = normalized;
+    }
+    async getSelf(credential, signal) {
+        const value = await this.requestJson(credential, 'GET', '/v1/account/self', { signal });
+        const parsed = accountResponseSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new ControlPlaneError('ACCOUNT_SELF_RESPONSE_INVALID', 'The account identity response was invalid.');
+        }
+        return {
+            account: parsed.data.account,
+            registry: parsed.data.registry,
+            grant: parsed.data.grant,
+        };
+    }
+    async getCliLoginConfirmation(credential, signal) {
+        const value = await this.requestJson(credential, 'GET', '/v1/account/cli-login/confirmation', { signal });
+        const parsed = cliLoginConfirmationResponseSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new ControlPlaneError('CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID', 'The CLI login confirmation response was invalid.');
+        }
+        return {
+            account: parsed.data.account,
+            registry: parsed.data.registry,
+            grant: parsed.data.grant,
+        };
+    }
+    async confirmCliLogin(credential, signal) {
+        const value = await this.requestJson(credential, 'POST', '/v1/account/cli-login/confirmation', { signal });
+        const parsed = activatedCliLoginResponseSchema.safeParse(value);
+        if (!parsed.success) {
+            throw new ControlPlaneError('CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID', 'The CLI login confirmation response was invalid.');
+        }
+        return parsed.data.grant;
+    }
+    async submitRegistryRequest(credential, operation, submission, options = {}) {
+        const value = await this.requestJson(credential, 'POST', `/v1/registry-requests/${encodeURIComponent(operation)}`, {
+            body: JSON.stringify(submission),
+            headers: {
+                'content-type': 'application/json',
+                'x-uapkg-idempotency-key': options.idempotencyKey ?? randomUUID(),
+                ...(options.otp ? { 'x-uapkg-otp': options.otp } : {}),
+            },
+        });
+        const parsed = z
+            .object({
+            ok: z.literal(true),
+            requestId: z.string().min(1),
+            status: requestStatusSchema,
+            message: z.string(),
+        })
+            .safeParse(value);
+        if (!parsed.success) {
+            throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');
+        }
+        return parsed.data;
+    }
+    async getRegistryRequest(credential, requestId) {
+        const value = await this.requestJson(credential, 'GET', `/v1/registry-requests/${encodeURIComponent(requestId)}`);
+        const parsed = z.object({ ok: z.literal(true), request: requestSummarySchema }).safeParse(value);
+        if (!parsed.success) {
+            throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');
+        }
+        return parsed.data.request;
+    }
+    async listRegistryRequests(credential, registryId, status) {
+        const query = new URLSearchParams({ registryId });
+        if (status)
+            query.set('status', status);
+        const value = await this.requestJson(credential, 'GET', `/v1/registry-requests?${query}`);
+        const parsed = z
+            .object({
+            ok: z.literal(true),
+            recentRequests: z.array(requestSummarySchema).optional(),
+            requests: z.array(requestSummarySchema).optional(),
+        })
+            .safeParse(value);
+        if (!parsed.success || (!parsed.data.recentRequests && !parsed.data.requests)) {
+            throw new ControlPlaneError('REGISTRY_REQUEST_LIST_RESPONSE_INVALID', 'The publishing request list response was invalid.');
+        }
+        return parsed.data.recentRequests ?? parsed.data.requests ?? [];
+    }
+    async requestJson(credential, method, path, init = {}) {
+        const url = new URL(path, this.apiBaseUrl);
+        const headers = new Headers(init.headers);
+        let response;
+        if (credential.kind === 'dpop') {
+            try {
+                response = await this.withDPoPNonceRetry(() => oauth.protectedResourceRequest(credential.accessToken, method, url, headers, init.body, {
+                    DPoP: credential.dpop,
+                    signal: boundedRequestSignal(init.signal),
+                }));
+            }
+            catch (error) {
+                if (error instanceof oauth.WWWAuthenticateChallengeError) {
+                    throw await controlPlaneChallengeError(error, credential);
+                }
+                throw error;
+            }
+        }
+        else {
+            headers.set('authorization', `Bearer ${credential.accessToken}`);
+            response = await fetch(url, {
+                method,
+                headers,
+                body: init.body,
+                redirect: 'error',
+                signal: boundedRequestSignal(init.signal),
+            });
+        }
+        const value = await readJson(response);
+        if (!response.ok) {
+            const parsed = errorSchema.safeParse(value);
+            if (parsed.success) {
+                throw new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, response.status, parsed.data.error.details);
+            }
+            throw new ControlPlaneError(`HTTP_${response.status}`, `The UAPKG control plane returned HTTP ${response.status}.`, response.status);
+        }
+        return value;
+    }
+    async withDPoPNonceRetry(operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (!oauth.isDPoPNonceError(error))
+                throw error;
+            return operation();
+        }
+    }
+}
+function boundedRequestSignal(signal) {
+    const timeout = AbortSignal.timeout(30_000);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+async function readJson(response) {
+    const text = await response.text();
+    if (text.trim().length === 0)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw new ControlPlaneError('CONTROL_PLANE_RESPONSE_NOT_JSON', `The UAPKG control plane returned a non-JSON response (HTTP ${response.status}).`, response.status, undefined, { cause: error });
+    }
+}
+async function controlPlaneChallengeError(error, credential) {
+    const value = await tryReadJson(error.response);
+    const parsed = errorSchema.safeParse(value);
+    if (error.status === 403 && parsed.success && parsed.data.error.code === 'OAUTH_SCOPE_INSUFFICIENT') {
+        const details = insufficientScopeDetailsSchema.safeParse(parsed.data.error.details);
+        if (details.success) {
+            const headerRequiredScopeTokens = error.cause.flatMap((challenge) => challenge.scheme === 'dpop' && challenge.parameters.error === 'insufficient_scope'
+                ? parseOAuthScopeTokens(challenge.parameters.scope)
+                : []);
+            const bodyRequiredScopeTokens = validatedOAuthScopeTokens(details.data.requiredScopes);
+            const bodyMissingScopeTokens = validatedOAuthScopeTokens(details.data.missingScopes);
+            if (bodyRequiredScopeTokens && bodyMissingScopeTokens) {
+                const consistentRequiredScopeTokens = headerRequiredScopeTokens.filter((scope) => bodyRequiredScopeTokens.includes(scope));
+                const consistentMissingScopeTokens = consistentRequiredScopeTokens.filter((scope) => bodyMissingScopeTokens.includes(scope));
+                const requestedScopes = knownUAPKGCliScopes(credential.requestedScopes);
+                if (consistentMissingScopeTokens.some((scope) => !isUAPKGCliScope(scope))) {
+                    return new OAuthScopeUnsupportedError(credential.registryAlias, requestedScopes, [], {
+                        cause: error,
+                        reason: 'cli-update-required',
+                        status: error.status,
+                    });
+                }
+                const requiredScopes = knownUAPKGCliScopes(consistentRequiredScopeTokens);
+                const missingScopes = knownUAPKGCliScopes(consistentMissingScopeTokens).filter((scope) => requestedScopes.includes(scope));
+                if (requiredScopes.length > 0 && missingScopes.length > 0) {
+                    return new OAuthScopeInsufficientError(parsed.data.error.message, credential.registryAlias, requestedScopes, requiredScopes, missingScopes, error.status, { cause: error });
+                }
+            }
+        }
+    }
+    if (parsed.success) {
+        return new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, error.status, parsed.data.error.details, { cause: error });
+    }
+    return new ControlPlaneError('CONTROL_PLANE_AUTHENTICATION_REQUIRED', 'The UAPKG control plane rejected the saved login.', error.status, undefined, { cause: error });
+}
+function validatedOAuthScopeTokens(values) {
+    if (values.some((scope) => !isOAuthScopeToken(scope)))
+        return undefined;
+    return [...new Set(values)];
+}
+async function tryReadJson(response) {
+    try {
+        const text = await response.text();
+        return text.trim().length > 0 ? JSON.parse(text) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=ControlPlaneClient.js.map

package/dist/control-plane/ControlPlaneClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlPlaneClient.js","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EAKrB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAehC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtD,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC/B,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;KACb,CAAC;IACF,KAAK,EAAE,kBAAkB;CAC1B,CAAC,CAAC;AAEH,MAAM,kCAAkC,GAAG,qBAAqB,CAAC,MAAM,CAAC;IACtE,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrC,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;QACrC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QACZ,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3B,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,QAAQ;IACR,UAAU;IACV,UAAU;IACV,OAAO;IACP,kBAAkB;IAClB,UAAU;IACV,sBAAsB;CACvB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,mBAAmB;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,OAAO,kBAAkB;IACZ,UAAU,CAAS;IAEpC,YAAmB,UAAU,GAAG,uBAAuB;QACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,KAAK,uBAAuB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,uBAAuB,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,UAAkC,EAAE,MAAoB;QAC3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,4CAA4C,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAClC,UAAkC,EAClC,MAAoB;QAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,eAAe,CAC1B,UAAkC,EAClC,MAAoB;QAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,oCAAoC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CACzB,yCAAyC,EACzC,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,qBAAqB,CAChC,UAAkC,EAClC,SAA4B,EAC5B,UAAqC,EACrC,UAAuE,EAAE;QAEzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;YACjH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YAChC,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,yBAAyB,EAAE,OAAO,CAAC,cAAc,IAAI,UAAU,EAAE;gBACjE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD;SACF,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC;aACb,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,CAAC;aACD,SAAS,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,EAAE,8CAA8C,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,UAAkC,EAClC,SAAiB;QAEjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,yBAAyB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,EAAE,8CAA8C,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;IAC7B,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAC/B,UAAkC,EAClC,UAAkB,EAClB,MAA8B;QAE9B,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QAClD,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,yBAAyB,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,CAAC;aACb,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;YACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;SACnD,CAAC;aACD,SAAS,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,iBAAiB,CACzB,wCAAwC,EACxC,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,UAAkC,EAClC,MAAc,EACd,IAAY,EACZ,OAII,EAAE;QAEN,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAkB,CAAC;QAEvB,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAC5C,KAAK,CAAC,wBAAwB,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;oBACtF,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;iBAC1C,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,CAAC,6BAA6B,EAAE,CAAC;oBACzD,MAAM,MAAM,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACjE,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC1B,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EACzB,QAAQ,CAAC,MAAM,EACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,QAAQ,QAAQ,CAAC,MAAM,EAAE,EACzB,yCAAyC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAI,SAA2B;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAChD,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,MAAoB;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,iCAAiC,EACjC,8DAA8D,QAAQ,CAAC,MAAM,IAAI,EACjF,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA0C,EAC1C,UAAsE;IAEtE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACpG,MAAM,OAAO,GAAG,8BAA8B,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,yBAAyB,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAClE,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,KAAK,oBAAoB;gBAChF,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;gBACnD,CAAC,CAAC,EAAE,CACP,CAAC;YACF,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvF,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACrF,IAAI,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;gBACtD,MAAM,6BAA6B,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/E,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxC,CAAC;gBACF,MAAM,4BAA4B,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAClF,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvC,CAAC;gBACF,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxE,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1E,OAAO,IAAI,0BAA0B,CAAC,UAAU,CAAC,aAAa,EAAE,eAAe,EAAE,EAAE,EAAE;wBACnF,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,qBAAqB;wBAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;gBAC1E,MAAM,aAAa,GAAG,mBAAmB,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACvF,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAChC,CAAC;gBACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1D,OAAO,IAAI,2BAA2B,CACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EACzB,UAAU,CAAC,aAAa,EACxB,eAAe,EACf,cAAc,EACd,aAAa,EACb,KAAK,CAAC,MAAM,EACZ,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,IAAI,iBAAiB,CAC1B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EACzB,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EACzB,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,iBAAiB,CAC1B,uCAAuC,EACvC,mDAAmD,EACnD,KAAK,CAAC,MAAM,EACZ,SAAS,EACT,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAyB;IAC1D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAkB;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/control-plane/ControlPlaneEndpoints.d.ts

@@ -0,0 +1,13 @@
+import type { UAPKGBuildMode } from '@uapkg/common';
+export interface UAPKGControlPlaneEndpoints {
+    readonly issuer: string;
+    readonly apiBaseUrl: string;
+}
+/**
+ * Only an explicitly stamped development build can select development trust
+ * roots. Source execution and any unrecognized runtime value fail closed to
+ * the production control plane.
+ */
+export declare function controlPlaneEndpointsForBuildMode(mode: UAPKGBuildMode): UAPKGControlPlaneEndpoints;
+export declare const UAPKG_CONTROL_PLANE_ENDPOINTS: UAPKGControlPlaneEndpoints;
+//# sourceMappingURL=ControlPlaneEndpoints.d.ts.map

package/dist/control-plane/ControlPlaneEndpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlPlaneEndpoints.d.ts","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneEndpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAYD;;;;GAIG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,cAAc,GAAG,0BAA0B,CAElG;AAED,eAAO,MAAM,6BAA6B,4BAA+D,CAAC"}

package/dist/control-plane/ControlPlaneEndpoints.js

@@ -0,0 +1,19 @@
+import { UAPKG_BUILD_METADATA } from '../build/BuildMetadata.js';
+const DEVELOPMENT_ENDPOINTS = Object.freeze({
+    issuer: 'https://account-dev.uapkg.dev/oauth',
+    apiBaseUrl: 'https://api-dev.uapkg.dev',
+});
+const PRODUCTION_ENDPOINTS = Object.freeze({
+    issuer: 'https://account.uapkg.dev/oauth',
+    apiBaseUrl: 'https://api.uapkg.dev',
+});
+/**
+ * Only an explicitly stamped development build can select development trust
+ * roots. Source execution and any unrecognized runtime value fail closed to
+ * the production control plane.
+ */
+export function controlPlaneEndpointsForBuildMode(mode) {
+    return mode === 'development' ? DEVELOPMENT_ENDPOINTS : PRODUCTION_ENDPOINTS;
+}
+export const UAPKG_CONTROL_PLANE_ENDPOINTS = controlPlaneEndpointsForBuildMode(UAPKG_BUILD_METADATA.mode);
+//# sourceMappingURL=ControlPlaneEndpoints.js.map

package/dist/control-plane/ControlPlaneEndpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlPlaneEndpoints.js","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneEndpoints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAOjE,MAAM,qBAAqB,GAA+B,MAAM,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,qCAAqC;IAC7C,UAAU,EAAE,2BAA2B;CACxC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAA+B,MAAM,CAAC,MAAM,CAAC;IACrE,MAAM,EAAE,iCAAiC;IACzC,UAAU,EAAE,uBAAuB;CACpC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAAoB;IACpE,OAAO,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC"}

package/dist/control-plane/ControlPlaneTypes.d.ts

@@ -0,0 +1,168 @@
+export declare const UAPKG_AUTHORIZATION_ISSUER: string;
+export declare const UAPKG_CONTROL_PLANE_API: string;
+export declare const UAPKG_CLI_CLIENT_ID = "uapkg-cli";
+export declare const UAPKG_GITHUB_OIDC_AUDIENCE = "uapkg";
+export declare const UAPKG_CLI_SCOPES: readonly ["identity.self.read", "publishing.request.create", "publishing.request.read.self", "registry_grant.revoke.self"];
+export type UAPKGCliScope = (typeof UAPKG_CLI_SCOPES)[number];
+export declare function knownUAPKGCliScopes(value: unknown): UAPKGCliScope[];
+export declare function parseUAPKGCliScopeString(value: unknown): UAPKGCliScope[];
+export declare function parseOAuthScopeTokens(value: unknown): string[];
+export declare function isOAuthScopeToken(value: unknown): value is string;
+export declare function isUAPKGCliScope(value: unknown): value is UAPKGCliScope;
+export type ControlPlaneAuthMode = 'auto' | 'login' | 'gat' | 'oidc';
+export interface RegistryTrust {
+    readonly alias: string;
+    readonly registryId: string;
+    readonly registryName: string;
+    readonly repositoryUrl: string;
+    readonly repositoryFingerprint: string;
+    readonly issuer: string;
+    readonly apiBaseUrl: string;
+    readonly resource: string;
+    readonly cacheShortId: string;
+}
+export interface AccountDisplayMetadata {
+    readonly id: string;
+    readonly username: string;
+    readonly displayName: string;
+}
+export interface AccountSelf {
+    readonly account: AccountDisplayMetadata;
+    readonly registry: {
+        readonly id: string;
+    };
+    readonly grant: {
+        readonly id: string;
+        readonly deviceName: string;
+        readonly idleExpiresAt: string;
+        readonly absoluteExpiresAt: string;
+        readonly scopes: readonly string[];
+    };
+}
+export interface CliLoginConfirmation extends AccountSelf {
+    readonly grant: AccountSelf['grant'] & {
+        readonly status: 'pending' | 'active';
+        readonly activationExpiresAt: string;
+        readonly replacesGrantId: string | null;
+    };
+}
+export interface ActivatedCliLoginGrant {
+    readonly id: string;
+    readonly status: 'active';
+    readonly replacesGrantId: string | null;
+}
+export interface RegistryGrantMetadata {
+    readonly issuer: string;
+    readonly registryId: string;
+    readonly registryName: string;
+    readonly grantId: string;
+    readonly clientId: string;
+    readonly keyReference: string;
+    readonly refreshTokenReference: string;
+    readonly publicKeyThumbprint: string;
+    readonly deviceName: string;
+    readonly repositoryFingerprint: string;
+    readonly account: AccountDisplayMetadata;
+    readonly createdAt: number;
+    readonly idleExpiresAt: number;
+    readonly expiresAt: number;
+}
+export interface AuthMetadataFile {
+    readonly schemaVersion: 1;
+    readonly grants: Readonly<Record<string, RegistryGrantMetadata>>;
+}
+export interface RegistryRequestSource {
+    readonly type: 'github_release';
+    readonly repository: string;
+    readonly releaseTag: string;
+    readonly assetName: string;
+}
+/** Artifact integrity observed by this client from the exact bytes it inspected. */
+export interface ObservedArtifactIntegrity {
+    /** Exactly `sha256:` + 64 lowercase hex characters. */
+    readonly sha256: string;
+    readonly sizeBytes: number;
+}
+/** Normalized packaged-manifest claims submitted with a publish request. */
+export interface SubmittedPackageClaims {
+    readonly name: string;
+    readonly version: string;
+    readonly private: boolean;
+    readonly dependencies: Readonly<Record<string, {
+        readonly version: string;
+        readonly registry?: string;
+    }>>;
+    readonly devDependencies: Readonly<Record<string, {
+        readonly version: string;
+        readonly registry?: string;
+    }>>;
+    readonly peerDependencies: Readonly<Record<string, {
+        readonly version: string;
+        readonly registry?: string;
+    }>>;
+}
+/** The six route-derived registry operations (PS-REQ-001). */
+export type RegistryOperation = 'publish' | 'unpublish' | 'yank' | 'unyank' | 'deprecate' | 'undeprecate';
+/**
+ * Body for `POST /v1/registry-requests/{operation}`. The operation is
+ * derived from the route; the body never carries a kind.
+ */
+export interface RegistryRequestSubmission {
+    readonly registryId: string;
+    readonly ownerOrganizationName?: string;
+    readonly payload: {
+        readonly packageName: string;
+        readonly packageVersion: string;
+        readonly source?: RegistryRequestSource;
+        readonly observedIntegrity?: ObservedArtifactIntegrity;
+        readonly claims?: SubmittedPackageClaims;
+        readonly reason?: string;
+    };
+}
+export type RegistryRequestStatus = 'queued' | 'checking' | 'accepted' | 'ready' | 'ready_superseded' | 'rejected' | 'operationally_failed';
+export interface RegistryRequestSummary {
+    readonly id: string;
+    readonly registryId: string;
+    readonly kind: string;
+    readonly status: RegistryRequestStatus;
+    readonly currentStep?: string;
+    readonly createdAt?: number;
+    readonly updatedAt?: number;
+    readonly payload?: {
+        readonly packageName?: string;
+        readonly packageVersion?: string;
+    };
+}
+export interface ControlPlaneApiErrorBody {
+    readonly ok: false;
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+        readonly details?: Readonly<Record<string, unknown>>;
+    };
+}
+export declare class ControlPlaneError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    readonly details?: Readonly<Record<string, unknown>> | undefined;
+    constructor(code: string, message: string, status?: number | undefined, details?: Readonly<Record<string, unknown>> | undefined, options?: ErrorOptions);
+}
+export declare class OAuthScopeInsufficientError extends ControlPlaneError {
+    readonly registryAlias: string;
+    readonly requestedScopes: readonly UAPKGCliScope[];
+    readonly requiredScopes: readonly UAPKGCliScope[];
+    readonly missingScopes: readonly UAPKGCliScope[];
+    constructor(message: string, registryAlias: string, requestedScopes: readonly UAPKGCliScope[], requiredScopes: readonly UAPKGCliScope[], missingScopes: readonly UAPKGCliScope[], status?: number, options?: ErrorOptions);
+}
+export declare class OAuthScopeUnsupportedError extends ControlPlaneError {
+    readonly registryAlias: string;
+    readonly requestedScopes: readonly UAPKGCliScope[];
+    readonly unsupportedScopes: readonly UAPKGCliScope[];
+    readonly reason: 'issuer-does-not-support-requested-scope' | 'cli-update-required';
+    constructor(registryAlias: string, requestedScopes: readonly UAPKGCliScope[], unsupportedScopes: readonly UAPKGCliScope[], options?: ErrorOptions & {
+        readonly reason?: 'issuer-does-not-support-requested-scope' | 'cli-update-required';
+        readonly status?: number;
+    });
+}
+export declare function registryAudience(registryId: string): string;
+//# sourceMappingURL=ControlPlaneTypes.d.ts.map

package/dist/control-plane/ControlPlaneTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlPlaneTypes.d.ts","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneTypes.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B,QAAuC,CAAC;AAC/E,eAAO,MAAM,uBAAuB,QAA2C,CAAC;AAChF,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD,eAAO,MAAM,gBAAgB,4HAKnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAI9D,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAInE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,CAExE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAK9D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEjE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAEtE;AAED,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;CACH;AAED,MAAM,WAAW,oBAAqB,SAAQ,WAAW;IACvD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG;QACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;KACzC,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,oFAAoF;AACpF,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC1G,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC7G,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC/G;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;AAE1G;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;QACxC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;QACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;QACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,MAAM,qBAAqB,GAC7B,QAAQ,GACR,UAAU,GACV,UAAU,GACV,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,sBAAsB,CAAC;AAE3B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACtD,CAAC;CACH;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAAE,MAAM;aAEZ,MAAM,CAAC,EAAE,MAAM;aACf,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAH3C,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,YAAA,EAC3D,OAAO,CAAC,EAAE,YAAY;CAKzB;AAED,qBAAa,2BAA4B,SAAQ,iBAAiB;aAO9C,aAAa,EAAE,MAAM;IANvC,SAAgB,eAAe,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1D,SAAgB,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IACzD,SAAgB,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;gBAGtD,OAAO,EAAE,MAAM,EACC,aAAa,EAAE,MAAM,EACrC,eAAe,EAAE,SAAS,aAAa,EAAE,EACzC,cAAc,EAAE,SAAS,aAAa,EAAE,EACxC,aAAa,EAAE,SAAS,aAAa,EAAE,EACvC,MAAM,SAAM,EACZ,OAAO,CAAC,EAAE,YAAY;CAmBzB;AAED,qBAAa,0BAA2B,SAAQ,iBAAiB;aAM7C,aAAa,EAAE,MAAM;IALvC,SAAgB,eAAe,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1D,SAAgB,iBAAiB,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5D,SAAgB,MAAM,EAAE,yCAAyC,GAAG,qBAAqB,CAAC;gBAGxE,aAAa,EAAE,MAAM,EACrC,eAAe,EAAE,SAAS,aAAa,EAAE,EACzC,iBAAiB,EAAE,SAAS,aAAa,EAAE,EAC3C,OAAO,CAAC,EAAE,YAAY,GAAG;QACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,yCAAyC,GAAG,qBAAqB,CAAC;QACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B;CAqBJ;AAOD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/control-plane/ControlPlaneTypes.js

@@ -0,0 +1,93 @@
+import { UAPKG_CONTROL_PLANE_ENDPOINTS } from './ControlPlaneEndpoints.js';
+export const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;
+export const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;
+export const UAPKG_CLI_CLIENT_ID = 'uapkg-cli';
+export const UAPKG_GITHUB_OIDC_AUDIENCE = 'uapkg';
+export const UAPKG_CLI_SCOPES = [
+    'identity.self.read',
+    'publishing.request.create',
+    'publishing.request.read.self',
+    'registry_grant.revoke.self',
+];
+const UAPKG_CLI_SCOPE_SET = new Set(UAPKG_CLI_SCOPES);
+const OAUTH_SCOPE_TOKEN_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
+export function knownUAPKGCliScopes(value) {
+    if (!Array.isArray(value))
+        return [];
+    const candidates = new Set(value.filter((scope) => typeof scope === 'string'));
+    return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));
+}
+export function parseUAPKGCliScopeString(value) {
+    return knownUAPKGCliScopes(parseOAuthScopeTokens(value));
+}
+export function parseOAuthScopeTokens(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.trim() !== value)
+        return [];
+    const scopes = value.split(' ');
+    if (scopes.some((scope) => !isOAuthScopeToken(scope)))
+        return [];
+    return [...new Set(scopes)];
+}
+export function isOAuthScopeToken(value) {
+    return typeof value === 'string' && OAUTH_SCOPE_TOKEN_PATTERN.test(value);
+}
+export function isUAPKGCliScope(value) {
+    return typeof value === 'string' && UAPKG_CLI_SCOPE_SET.has(value);
+}
+export class ControlPlaneError extends Error {
+    code;
+    status;
+    details;
+    constructor(code, message, status, details, options) {
+        super(message, options);
+        this.code = code;
+        this.status = status;
+        this.details = details;
+        this.name = 'ControlPlaneError';
+    }
+}
+export class OAuthScopeInsufficientError extends ControlPlaneError {
+    registryAlias;
+    requestedScopes;
+    requiredScopes;
+    missingScopes;
+    constructor(message, registryAlias, requestedScopes, requiredScopes, missingScopes, status = 403, options) {
+        const requested = knownUAPKGCliScopes(requestedScopes);
+        const required = knownUAPKGCliScopes(requiredScopes);
+        const missing = knownUAPKGCliScopes(missingScopes).filter((scope) => requested.includes(scope) && required.includes(scope));
+        super('OAUTH_SCOPE_INSUFFICIENT', message, status, { requestedScopes: requested, requiredScopes: required, missingScopes: missing }, options);
+        this.registryAlias = registryAlias;
+        this.name = 'OAuthScopeInsufficientError';
+        this.requestedScopes = requested;
+        this.requiredScopes = required;
+        this.missingScopes = missing;
+    }
+}
+export class OAuthScopeUnsupportedError extends ControlPlaneError {
+    registryAlias;
+    requestedScopes;
+    unsupportedScopes;
+    reason;
+    constructor(registryAlias, requestedScopes, unsupportedScopes, options) {
+        const requested = knownUAPKGCliScopes(requestedScopes);
+        const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));
+        const reason = options?.reason ?? 'issuer-does-not-support-requested-scope';
+        const message = reason === 'cli-update-required'
+            ? `The authorization service for "${registryAlias}" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.`
+            : unsupportedIssuerScopeMessage(registryAlias, unsupported);
+        super('OAUTH_SCOPE_UNSUPPORTED', message, options?.status, { requestedScopes: requested, unsupportedScopes: unsupported, reason }, options);
+        this.registryAlias = registryAlias;
+        this.name = 'OAuthScopeUnsupportedError';
+        this.requestedScopes = requested;
+        this.unsupportedScopes = unsupported;
+        this.reason = reason;
+    }
+}
+function unsupportedIssuerScopeMessage(registryAlias, unsupportedScopes) {
+    const noun = unsupportedScopes.length === 1 ? 'scope' : 'scopes';
+    return `The authorization service for "${registryAlias}" does not support the OAuth ${noun} required by this UAPKG CLI: ${unsupportedScopes.join(', ')}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;
+}
+export function registryAudience(registryId) {
+    return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;
+}
+//# sourceMappingURL=ControlPlaneTypes.js.map

package/dist/control-plane/ControlPlaneTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlPlaneTypes.js","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC,MAAM,CAAC;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC,UAAU,CAAC;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB;IACpB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;CACpB,CAAC;AAGX,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;AAC9D,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;IAChG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAoJD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IAEA;IACA;IAJlB,YACkB,IAAY,EAC5B,OAAe,EACC,MAAe,EACf,OAA2C,EAC3D,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAS;QACf,YAAO,GAAP,OAAO,CAAoC;QAI3D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,iBAAiB;IAO9C;IANF,eAAe,CAA2B;IAC1C,cAAc,CAA2B;IACzC,aAAa,CAA2B;IAExD,YACE,OAAe,EACC,aAAqB,EACrC,eAAyC,EACzC,cAAwC,EACxC,aAAuC,EACvC,MAAM,GAAG,GAAG,EACZ,OAAsB;QAEtB,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjE,CAAC;QACF,KAAK,CACH,0BAA0B,EAC1B,OAAO,EACP,MAAM,EACN,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,EAChF,OAAO,CACR,CAAC;QAlBc,kBAAa,GAAb,aAAa,CAAQ;QAmBrC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IAM7C;IALF,eAAe,CAA2B;IAC1C,iBAAiB,CAA2B;IAC5C,MAAM,CAAoE;IAE1F,YACkB,aAAqB,EACrC,eAAyC,EACzC,iBAA2C,EAC3C,OAGC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,yCAAyC,CAAC;QAC5E,MAAM,OAAO,GACX,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,kCAAkC,aAAa,gHAAgH;YACjK,CAAC,CAAC,6BAA6B,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAChE,KAAK,CACH,yBAAyB,EACzB,OAAO,EACP,OAAO,EAAE,MAAM,EACf,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,EACtE,OAAO,CACR,CAAC;QArBc,kBAAa,GAAb,aAAa,CAAQ;QAsBrC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,6BAA6B,CAAC,aAAqB,EAAE,iBAA2C;IACvG,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,kCAAkC,aAAa,gCAAgC,IAAI,gCAAgC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,wGAAwG,CAAC;AACjQ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,GAAG,uBAAuB,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AACtF,CAAC"}

package/dist/control-plane/CredentialStore.d.ts

@@ -0,0 +1,28 @@
+interface KeyringEntry {
+    setPassword(password: string): void;
+    getPassword(): string | null;
+    deleteCredential(): boolean;
+}
+interface KeyringModule {
+    Entry: new (service: string, username: string) => KeyringEntry;
+}
+export type KeyringLoader = () => Promise<KeyringModule>;
+/**
+ * Protected secret storage. The native module is imported only when a
+ * control-plane command needs it, so install/search/update remain portable.
+ */
+export declare class CredentialStore {
+    private readonly loadKeyring;
+    private readonly service;
+    private module?;
+    constructor(loadKeyring?: KeyringLoader, service?: string);
+    assertAvailable(): Promise<void>;
+    get(reference: string): Promise<string | undefined>;
+    set(reference: string, value: string): Promise<void>;
+    delete(reference: string): Promise<void>;
+    createReference(kind: 'grant' | 'dpop-key', issuer: string, registryId: string, grantId: string): string;
+    private entry;
+    private ensureModule;
+}
+export {};
+//# sourceMappingURL=CredentialStore.d.ts.map