@uapkg/cli 1.1.10 → 1.3.0

package/dist/control-plane/CredentialStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/CredentialStore.ts"],"names":[],"mappings":"AAEA,UAAU,YAAY;IACpB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,IAAI,OAAO,CAAC;CAC7B;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,KAAK,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC;CAChE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AAEzD;;;GAGG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,MAAM,CAAC,CAAgB;gBAGZ,WAAW,GAAE,aAA+E,EAC5F,OAAO,SAAc;IAG3B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBhC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9C,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAO/G,OAAO,CAAC,KAAK;YAOC,YAAY;CAG3B"}

package/dist/control-plane/CredentialStore.js

@@ -0,0 +1,87 @@
+import { createHash, randomUUID } from 'node:crypto';
+/**
+ * Protected secret storage. The native module is imported only when a
+ * control-plane command needs it, so install/search/update remain portable.
+ */
+export class CredentialStore {
+    loadKeyring;
+    service;
+    module;
+    constructor(loadKeyring = async () => (await import('@napi-rs/keyring')), service = 'uapkg.cli') {
+        this.loadKeyring = loadKeyring;
+        this.service = service;
+    }
+    async assertAvailable() {
+        const reference = `availability:${randomUUID()}`;
+        try {
+            await this.set(reference, reference);
+            const roundTrip = await this.get(reference);
+            if (roundTrip !== reference) {
+                throw new Error('The operating-system credential store failed a round-trip check.');
+            }
+        }
+        catch (error) {
+            throw new Error('Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.', { cause: error });
+        }
+        finally {
+            await this.delete(reference).catch(() => undefined);
+        }
+    }
+    async get(reference) {
+        await this.ensureModule();
+        try {
+            return this.entry(reference).getPassword() ?? undefined;
+        }
+        catch (error) {
+            if (isMissingCredentialError(error))
+                return undefined;
+            throw new Error('Unable to read a UAPKG credential from protected operating-system storage.', {
+                cause: error,
+            });
+        }
+    }
+    async set(reference, value) {
+        await this.ensureModule();
+        try {
+            this.entry(reference).setPassword(value);
+        }
+        catch (error) {
+            throw new Error('Unable to save a UAPKG credential in protected operating-system storage.', {
+                cause: error,
+            });
+        }
+    }
+    async delete(reference) {
+        await this.ensureModule();
+        try {
+            this.entry(reference).deleteCredential();
+        }
+        catch (error) {
+            if (!isMissingCredentialError(error)) {
+                throw new Error('Unable to remove a UAPKG credential from protected operating-system storage.', {
+                    cause: error,
+                });
+            }
+        }
+    }
+    createReference(kind, issuer, registryId, grantId) {
+        const digest = createHash('sha256')
+            .update(`${kind}\0${issuer.replace(/\/+$/, '')}\0${registryId.toLowerCase()}\0${grantId}`)
+            .digest('hex');
+        return `${kind}:${digest}`;
+    }
+    entry(reference) {
+        if (!this.module) {
+            throw new Error('CredentialStore has not loaded the native keyring yet.');
+        }
+        return new this.module.Entry(this.service, reference);
+    }
+    async ensureModule() {
+        this.module ??= await this.loadKeyring();
+    }
+}
+function isMissingCredentialError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /no\s*entry|not\s*found|missing/i.test(message);
+}
+//# sourceMappingURL=CredentialStore.js.map

package/dist/control-plane/CredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialStore.js","sourceRoot":"","sources":["../../src/control-plane/CredentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAcrD;;;GAGG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IAJX,MAAM,CAAiB;IAE/B,YACmB,cAA6B,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAkB,EAC5F,UAAU,WAAW;QADrB,gBAAW,GAAX,WAAW,CAAiF;QAC5F,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEG,KAAK,CAAC,eAAe;QAC1B,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,4GAA4G,EAC5G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,SAAiB;QAChC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,wBAAwB,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,4EAA4E,EAAE;gBAC5F,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,KAAa;QAC/C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,EAAE;gBAC1F,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,8EAA8E,EAAE;oBAC9F,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,IAA0B,EAAE,MAAc,EAAE,UAAkB,EAAE,OAAe;QACpG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;aACzF,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,SAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC"}

package/dist/control-plane/DPoPKeyStore.d.ts

@@ -0,0 +1,11 @@
+import type * as oauth from 'oauth4webapi';
+import type { CredentialStore } from './CredentialStore.js';
+export declare class DPoPKeyStore {
+    private readonly credentials;
+    constructor(credentials: CredentialStore);
+    generate(): Promise<oauth.CryptoKeyPair>;
+    save(reference: string, pair: oauth.CryptoKeyPair): Promise<void>;
+    load(reference: string): Promise<oauth.CryptoKeyPair | undefined>;
+    delete(reference: string): Promise<void>;
+}
+//# sourceMappingURL=DPoPKeyStore.d.ts.map

package/dist/control-plane/DPoPKeyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DPoPKeyStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/DPoPKeyStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,qBAAa,YAAY;IACJ,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,eAAe;IAEnD,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;IAKxC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAajE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;IA4BjE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD"}

package/dist/control-plane/DPoPKeyStore.js

@@ -0,0 +1,54 @@
+import { webcrypto } from 'node:crypto';
+export class DPoPKeyStore {
+    credentials;
+    constructor(credentials) {
+        this.credentials = credentials;
+    }
+    async generate() {
+        const { generateKeyPair } = await import('oauth4webapi');
+        return generateKeyPair('ES256', { extractable: true });
+    }
+    async save(reference, pair) {
+        const [publicKey, privateKey] = await Promise.all([
+            webcrypto.subtle.exportKey('jwk', pair.publicKey),
+            webcrypto.subtle.exportKey('jwk', pair.privateKey),
+        ]);
+        const serialized = {
+            algorithm: 'ES256',
+            publicKey,
+            privateKey,
+        };
+        await this.credentials.set(reference, JSON.stringify(serialized));
+    }
+    async load(reference) {
+        const raw = await this.credentials.get(reference);
+        if (!raw)
+            return undefined;
+        let saved;
+        try {
+            saved = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new Error('The saved UAPKG DPoP key is not valid JSON.', { cause: error });
+        }
+        if (saved.algorithm !== 'ES256' || !saved.publicKey || !saved.privateKey) {
+            throw new Error('The saved UAPKG DPoP key has an unsupported format.');
+        }
+        const algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+        const [publicKey, privateKey] = await Promise.all([
+            webcrypto.subtle.importKey('jwk', saved.publicKey, algorithm, true, ['verify']),
+            webcrypto.subtle.importKey('jwk', saved.privateKey, algorithm, true, ['sign']),
+        ]);
+        const challenge = webcrypto.getRandomValues(new Uint8Array(32));
+        const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, challenge);
+        const matches = await webcrypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signature, challenge);
+        if (!matches) {
+            throw new Error('The saved UAPKG DPoP public and private keys do not match.');
+        }
+        return { publicKey, privateKey };
+    }
+    async delete(reference) {
+        await this.credentials.delete(reference);
+    }
+}
+//# sourceMappingURL=DPoPKeyStore.js.map

package/dist/control-plane/DPoPKeyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DPoPKeyStore.js","sourceRoot":"","sources":["../../src/control-plane/DPoPKeyStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAUxC,MAAM,OAAO,YAAY;IACa;IAApC,YAAoC,WAA4B;QAA5B,gBAAW,GAAX,WAAW,CAAiB;IAAG,CAAC;IAE7D,KAAK,CAAC,QAAQ;QACnB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,IAAyB;QAC5D,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACjD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,UAAU,GAA0B;YACxC,SAAS,EAAE,OAAO;YAClB,SAAS;YACT,UAAU;SACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAiB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,SAAS,GAAgC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC/E,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAyB,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.d.ts

@@ -0,0 +1,6 @@
+import { type RegistryTrust } from './ControlPlaneTypes.js';
+export declare class GitHubActionsOidcCredentialProvider {
+    isAvailable(): boolean;
+    exchange(trust: RegistryTrust): Promise<string>;
+}
+//# sourceMappingURL=GitHubActionsOidcCredentialProvider.d.ts.map

package/dist/control-plane/GitHubActionsOidcCredentialProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubActionsOidcCredentialProvider.d.ts","sourceRoot":"","sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,wBAAwB,CAAC;AAShC,qBAAa,mCAAmC;IACvC,WAAW,IAAI,OAAO;IAQhB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;CAkD7D"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+import { ControlPlaneError, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, } from './ControlPlaneTypes.js';
+const githubResponseSchema = z.object({ value: z.string().min(1) });
+const exchangeResponseSchema = z.object({
+    ok: z.literal(true),
+    token: z.string().min(1),
+    expiresAt: z.number().int().positive(),
+});
+export class GitHubActionsOidcCredentialProvider {
+    isAvailable() {
+        return Boolean(process.env.GITHUB_ACTIONS === 'true' ||
+            process.env.ACTIONS_ID_TOKEN_REQUEST_URL ||
+            process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+    }
+    async exchange(trust) {
+        if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) {
+            throw new Error(`UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`);
+        }
+        const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+        const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+        if (!this.isAvailable() || !requestUrl || !requestToken) {
+            throw new Error('GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.');
+        }
+        const url = new URL(requestUrl);
+        if (url.protocol !== 'https:' || !url.hostname.endsWith('.actions.githubusercontent.com')) {
+            throw new Error('GitHub Actions supplied an unexpected OIDC token endpoint.');
+        }
+        url.searchParams.set('audience', UAPKG_GITHUB_OIDC_AUDIENCE);
+        const githubResponse = await fetch(url, {
+            headers: { authorization: `Bearer ${requestToken}` },
+        });
+        const githubValue = githubResponseSchema.safeParse(await safeJson(githubResponse));
+        if (!githubResponse.ok || !githubValue.success) {
+            throw new Error(`GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`);
+        }
+        const exchangeResponse = await fetch(new URL('/v1/github-user-app/oidc/github-actions/exchange', trust.apiBaseUrl), {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                provider: 'github_actions',
+                audience: UAPKG_GITHUB_OIDC_AUDIENCE,
+                idToken: githubValue.data.value,
+            }),
+        });
+        const exchangeValue = await safeJson(exchangeResponse);
+        if (!exchangeResponse.ok) {
+            const error = z.object({ error: z.object({ code: z.string(), message: z.string() }) }).safeParse(exchangeValue);
+            if (error.success) {
+                throw new ControlPlaneError(error.data.error.code, error.data.error.message, exchangeResponse.status);
+            }
+            throw new Error(`UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`);
+        }
+        const parsed = exchangeResponseSchema.safeParse(exchangeValue);
+        if (!parsed.success)
+            throw new Error('The UAPKG OIDC exchange response was invalid.');
+        return parsed.data.token;
+    }
+}
+async function safeJson(response) {
+    try {
+        return (await response.json());
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=GitHubActionsOidcCredentialProvider.js.map

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubActionsOidcCredentialProvider.js","sourceRoot":"","sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EAEjB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,mCAAmC;IACvC,WAAW;QAChB,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;YACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACxC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAC7C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACxC,IAAI,KAAK,CAAC,UAAU,KAAK,uBAAuB,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,uBAAuB,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,6HAA6H,CAC9H,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACtC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6DAA6D,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAClC,IAAI,GAAG,CAAC,kDAAkD,EAAE,KAAK,CAAC,UAAU,CAAC,EAC7E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,0BAA0B;gBACpC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK;aAChC,CAAC;SACH,CACF,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAChH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/control-plane/PublishIdempotencyStore.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Persisted idempotency keys for logical registry-operation submissions.
+ * One logical submission (operation + registry + payload) keeps one key
+ * across retries, so a re-run after a network fault or crash replays the
+ * original request instead of creating a duplicate. Keys are cleared once
+ * the request reaches a terminal state.
+ */
+export declare class PublishIdempotencyStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    /** Stable digest identifying one logical submission. */
+    static submissionDigest(operation: string, submission: unknown): string;
+    getOrCreate(digest: string, newKey: () => string, now?: number): string;
+    clear(digest: string, now?: number): void;
+    private read;
+    private write;
+}
+//# sourceMappingURL=PublishIdempotencyStore.d.ts.map

package/dist/control-plane/PublishIdempotencyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublishIdempotencyStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"names":[],"mappings":"AAkBA;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEf,QAAQ,CAAC,EAAE,MAAM;IAIpC,wDAAwD;WAC1C,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM;IAIvE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM;IAY3E,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IAQpD,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,KAAK;CAId"}

package/dist/control-plane/PublishIdempotencyStore.js

@@ -0,0 +1,71 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { resolveActiveUapkgProfileRoot } from '@uapkg/common';
+import { sha256OfCanonicalJson } from '@uapkg/package-claims';
+const STORE_FILE_NAME = 'publish-idempotency.json';
+const MAX_ENTRY_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Persisted idempotency keys for logical registry-operation submissions.
+ * One logical submission (operation + registry + payload) keeps one key
+ * across retries, so a re-run after a network fault or crash replays the
+ * original request instead of creating a duplicate. Keys are cleared once
+ * the request reaches a terminal state.
+ */
+export class PublishIdempotencyStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath ?? join(resolveActiveUapkgProfileRoot(), STORE_FILE_NAME);
+    }
+    /** Stable digest identifying one logical submission. */
+    static submissionDigest(operation, submission) {
+        return sha256OfCanonicalJson({ operation, submission });
+    }
+    getOrCreate(digest, newKey, now = Date.now()) {
+        const store = this.read(now);
+        const existing = store.entries[digest];
+        if (existing)
+            return existing.key;
+        const key = newKey();
+        this.write({
+            schemaVersion: 1,
+            entries: { ...store.entries, [digest]: { key, createdAt: now } },
+        });
+        return key;
+    }
+    clear(digest, now = Date.now()) {
+        const store = this.read(now);
+        if (!(digest in store.entries))
+            return;
+        const entries = { ...store.entries };
+        delete entries[digest];
+        this.write({ schemaVersion: 1, entries });
+    }
+    read(now) {
+        let parsed;
+        try {
+            const raw = readFileSync(this.filePath, 'utf8');
+            const candidate = JSON.parse(raw);
+            if (candidate.schemaVersion === 1 && candidate.entries && typeof candidate.entries === 'object') {
+                parsed = { schemaVersion: 1, entries: candidate.entries };
+            }
+        }
+        catch {
+            // Missing or corrupt store starts fresh; keys are best-effort retry aids.
+        }
+        const entries = {};
+        for (const [digest, entry] of Object.entries(parsed?.entries ?? {})) {
+            if (entry &&
+                typeof entry.key === 'string' &&
+                typeof entry.createdAt === 'number' &&
+                now - entry.createdAt <= MAX_ENTRY_AGE_MS) {
+                entries[digest] = entry;
+            }
+        }
+        return { schemaVersion: 1, entries };
+    }
+    write(store) {
+        mkdirSync(dirname(this.filePath), { recursive: true });
+        writeFileSync(this.filePath, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+    }
+}
+//# sourceMappingURL=PublishIdempotencyStore.js.map

package/dist/control-plane/PublishIdempotencyStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublishIdempotencyStore.js","sourceRoot":"","sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAYjD;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IACjB,QAAQ,CAAS;IAElC,YAAmB,QAAiB;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,6BAA6B,EAAE,EAAE,eAAe,CAAC,CAAC;IACrF,CAAC;IAED,wDAAwD;IACjD,MAAM,CAAC,gBAAgB,CAAC,SAAiB,EAAE,UAAmB;QACnE,OAAO,qBAAqB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1D,CAAC;IAEM,WAAW,CAAC,MAAc,EAAE,MAAoB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,GAAG,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC;YACT,aAAa,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;SACjE,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO;QACvC,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,IAAI,CAAC,GAAW;QACtB,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YACxD,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChG,MAAM,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QACD,MAAM,OAAO,GAAgC,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,IACE,KAAK;gBACL,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;gBACnC,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,gBAAgB,EACzC,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,KAAgB;QAC5B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/control-plane/RegistryGrantLock.d.ts

@@ -0,0 +1,35 @@
+export interface RegistryGrantLock {
+    withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
+}
+export interface FileRegistryGrantLockOptions {
+    readonly waitTimeoutMs?: number;
+    readonly staleAfterMs?: number;
+    readonly pollIntervalMs?: number;
+    readonly heartbeatIntervalMs?: number;
+    readonly now?: () => number;
+    readonly sleep?: (milliseconds: number) => Promise<void>;
+    readonly isProcessAlive?: (pid: number) => boolean;
+}
+/**
+ * Cross-process serialization for a registry grant's rotating refresh-token
+ * family. Lock file names contain only a SHA-256 digest of the issuer and
+ * registry ID; lock contents contain only an opaque owner ID, PID, and time.
+ */
+export declare class FileRegistryGrantLock implements RegistryGrantLock {
+    private readonly directory;
+    private readonly waitTimeoutMs;
+    private readonly staleAfterMs;
+    private readonly pollIntervalMs;
+    private readonly heartbeatIntervalMs;
+    private readonly now;
+    private readonly sleep;
+    private readonly isProcessAlive;
+    constructor(directory: string, options?: FileRegistryGrantLockOptions);
+    pathFor(issuer: string, registryId: string): string;
+    withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
+    private tryAcquire;
+    private reclaimIfStale;
+    private touchIfOwned;
+    private releaseIfOwned;
+}
+//# sourceMappingURL=RegistryGrantLock.d.ts.map

package/dist/control-plane/RegistryGrantLock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryGrantLock.d.ts","sourceRoot":"","sources":["../../src/control-plane/RegistryGrantLock.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACpD;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAU3D,OAAO,CAAC,QAAQ,CAAC,SAAS;IAT5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;gBAGvC,SAAS,EAAE,MAAM,EAClC,OAAO,GAAE,4BAAiC;IAcrC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAO7C,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAmCvF,UAAU;YAoBV,cAAc;YA2Cd,YAAY;YAOZ,cAAc;CAa7B"}

package/dist/control-plane/RegistryGrantLock.js

@@ -0,0 +1,199 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, open, readFile, rename, stat, unlink, utimes } from 'node:fs/promises';
+import { join } from 'node:path';
+const LOCK_FILE_VERSION = 1;
+const DEFAULT_WAIT_TIMEOUT_MS = 30_000;
+const DEFAULT_STALE_AFTER_MS = 120_000;
+const DEFAULT_POLL_INTERVAL_MS = 50;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 5_000;
+/**
+ * Cross-process serialization for a registry grant's rotating refresh-token
+ * family. Lock file names contain only a SHA-256 digest of the issuer and
+ * registry ID; lock contents contain only an opaque owner ID, PID, and time.
+ */
+export class FileRegistryGrantLock {
+    directory;
+    waitTimeoutMs;
+    staleAfterMs;
+    pollIntervalMs;
+    heartbeatIntervalMs;
+    now;
+    sleep;
+    isProcessAlive;
+    constructor(directory, options = {}) {
+        this.directory = directory;
+        this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);
+        this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);
+        this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
+        this.heartbeatIntervalMs = positiveMilliseconds(options.heartbeatIntervalMs, Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))));
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? delay;
+        this.isProcessAlive = options.isProcessAlive ?? processIsAlive;
+    }
+    pathFor(issuer, registryId) {
+        const digest = createHash('sha256')
+            .update(`${issuer.replace(/\/+$/, '')}\0${registryId.toLowerCase()}`)
+            .digest('hex');
+        return join(this.directory, `${digest}.lock`);
+    }
+    async withLock(issuer, registryId, operation) {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const lockPath = this.pathFor(issuer, registryId);
+        const owner = {
+            version: LOCK_FILE_VERSION,
+            ownerId: randomUUID(),
+            pid: process.pid,
+            acquiredAt: this.now(),
+        };
+        const deadline = this.now() + this.waitTimeoutMs;
+        while (!(await this.tryAcquire(lockPath, owner))) {
+            if (await this.reclaimIfStale(lockPath))
+                continue;
+            const remaining = deadline - this.now();
+            if (remaining <= 0) {
+                throw new Error('Timed out waiting for another UAPKG process to finish using the saved login for this registry.');
+            }
+            await this.sleep(Math.min(this.pollIntervalMs, remaining));
+        }
+        const heartbeat = setInterval(() => {
+            void this.touchIfOwned(lockPath, owner.ownerId);
+        }, this.heartbeatIntervalMs);
+        heartbeat.unref?.();
+        try {
+            return await operation();
+        }
+        finally {
+            clearInterval(heartbeat);
+            await this.releaseIfOwned(lockPath, owner.ownerId);
+        }
+    }
+    async tryAcquire(lockPath, owner) {
+        let handle;
+        try {
+            handle = await open(lockPath, 'wx', 0o600);
+        }
+        catch (error) {
+            if (errorCode(error) === 'EEXIST')
+                return false;
+            throw new Error('Unable to create the UAPKG registry-grant lock.', { cause: error });
+        }
+        try {
+            await handle.writeFile(JSON.stringify(owner), { encoding: 'utf8' });
+            return true;
+        }
+        catch (error) {
+            await unlink(lockPath).catch(() => undefined);
+            throw new Error('Unable to initialize the UAPKG registry-grant lock.', { cause: error });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async reclaimIfStale(lockPath) {
+        let lockStat;
+        try {
+            lockStat = await stat(lockPath);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT')
+                return true;
+            throw new Error('Unable to inspect the UAPKG registry-grant lock.', { cause: error });
+        }
+        const observedOwner = await readOwner(lockPath);
+        if (observedOwner) {
+            // A valid owner record with a definitely dead PID is safe to reclaim
+            // immediately. Waiting for the general stale threshold would make a
+            // refresh retry miss the authorization server's bounded predecessor
+            // grace after a process dies between rotation and local persistence.
+            if (this.isProcessAlive(observedOwner.pid))
+                return false;
+        }
+        else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) {
+            // A just-created lock can briefly be empty while its owner record is
+            // written. Malformed or unreadable ownership therefore remains subject
+            // to the conservative stale threshold.
+            return false;
+        }
+        const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
+        try {
+            await rename(lockPath, quarantinePath);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT')
+                return true;
+            throw new Error('Unable to quarantine a stale UAPKG registry-grant lock.', { cause: error });
+        }
+        const movedOwner = await readOwner(quarantinePath);
+        if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {
+            await rename(quarantinePath, lockPath).catch(() => undefined);
+            return false;
+        }
+        await unlink(quarantinePath).catch((error) => {
+            throw new Error('Unable to remove a stale UAPKG registry-grant lock.', { cause: error });
+        });
+        return true;
+    }
+    async touchIfOwned(lockPath, ownerId) {
+        const owner = await readOwner(lockPath);
+        if (owner?.ownerId !== ownerId)
+            return;
+        const now = new Date(this.now());
+        await utimes(lockPath, now, now).catch(() => undefined);
+    }
+    async releaseIfOwned(lockPath, ownerId) {
+        const owner = await readOwner(lockPath);
+        if (!owner)
+            return;
+        if (owner.ownerId !== ownerId) {
+            throw new Error('The UAPKG registry-grant lock changed ownership before it could be released.');
+        }
+        try {
+            await unlink(lockPath);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT')
+                return;
+            throw new Error('Unable to release the UAPKG registry-grant lock.', { cause: error });
+        }
+    }
+}
+async function readOwner(lockPath) {
+    try {
+        const value = JSON.parse(await readFile(lockPath, 'utf8'));
+        if (typeof value !== 'object' ||
+            value === null ||
+            value.version !== LOCK_FILE_VERSION ||
+            typeof value.ownerId !== 'string' ||
+            !Number.isInteger(value.pid) ||
+            typeof value.acquiredAt !== 'number') {
+            return undefined;
+        }
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processIsAlive(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errorCode(error) !== 'ESRCH';
+    }
+}
+function positiveMilliseconds(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//# sourceMappingURL=RegistryGrantLock.js.map

package/dist/control-plane/RegistryGrantLock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryGrantLock.js","sourceRoot":"","sources":["../../src/control-plane/RegistryGrantLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAuB5C;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAUb;IATF,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,mBAAmB,CAAS;IAC5B,GAAG,CAAe;IAClB,KAAK,CAA0C;IAC/C,cAAc,CAA2B;IAE1D,YACmB,SAAiB,EAClC,UAAwC,EAAE;QADzB,cAAS,GAAT,SAAS,CAAQ;QAGlC,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;QACvF,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QAC7F,IAAI,CAAC,mBAAmB,GAAG,oBAAoB,CAC7C,OAAO,CAAC,mBAAmB,EAC3B,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC;IACjE,CAAC;IAEM,OAAO,CAAC,MAAc,EAAE,UAAkB;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;aACpE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAI,MAAc,EAAE,UAAkB,EAAE,SAA2B;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,UAAU,EAAE;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAAgB;QACzD,IAAI,MAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC3C,IAAI,QAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,qEAAqE;YACrE,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,QAAQ,UAAU,UAAU,EAAE,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,aAAa,IAAI,UAAU,EAAE,OAAO,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,OAAe;QAC1D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO;YAAE,OAAO;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,OAAe;QAC5D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAC;QACtE,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,OAAO,KAAK,iBAAiB;YAC3D,OAAQ,KAA4B,CAAC,OAAO,KAAK,QAAQ;YACzD,CAAC,MAAM,CAAC,SAAS,CAAE,KAA4B,CAAC,GAAG,CAAC;YACpD,OAAQ,KAA4B,CAAC,UAAU,KAAK,QAAQ,EAC5D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB;IACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAE,KAAqC,CAAC,IAAI,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/control-plane/RegistryTrustResolver.d.ts

@@ -0,0 +1,17 @@
+import type { CompositionRoot } from '../app/CompositionRoot.js';
+import { type RegistryTrust } from './ControlPlaneTypes.js';
+export declare class RegistryTrustResolver {
+    private readonly root;
+    constructor(root: CompositionRoot);
+    resolve(requestedAlias?: string): Promise<RegistryTrust>;
+    forceRefresh(trust: RegistryTrust): Promise<void>;
+    private selectedAlias;
+}
+/**
+ * GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same
+ * repository. Control-plane authorization must bind all three spellings to one
+ * stable source identity.
+ */
+export declare function canonicalizeRegistryGitOrigin(origin: string): string;
+export declare function fingerprintRegistryGitOrigin(origin: string): string;
+//# sourceMappingURL=RegistryTrustResolver.d.ts.map

package/dist/control-plane/RegistryTrustResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RegistryTrustResolver.d.ts","sourceRoot":"","sources":["../../src/control-plane/RegistryTrustResolver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,wBAAwB,CAAC;AAiBhC,qBAAa,qBAAqB;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAE5C,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDxD,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9D,OAAO,CAAC,aAAa;CAOtB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAuBpE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnE"}