@uapkg/cli 1.2.0 → 1.3.1

package/dist/control-plane/ControlPlaneTypes.js

@@ -1,93 +1,100 @@
-import { UAPKG_CONTROL_PLANE_ENDPOINTS } from './ControlPlaneEndpoints.js';
-export const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;
-export const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;
-export const UAPKG_CLI_CLIENT_ID = 'uapkg-cli';
-export const UAPKG_GITHUB_OIDC_AUDIENCE = 'uapkg';
-export const UAPKG_CLI_SCOPES = [
-    'identity.self.read',
-    'publishing.request.create',
-    'publishing.request.read.self',
-    'registry_grant.revoke.self',
+import { UAPKG_CONTROL_PLANE_ENDPOINTS } from "./ControlPlaneEndpoints.js";
+
+//#region src/control-plane/ControlPlaneTypes.ts
+const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;
+const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;
+const UAPKG_CLI_CLIENT_ID = "uapkg-cli";
+const UAPKG_GITHUB_OIDC_AUDIENCE = "uapkg";
+const UAPKG_CLI_SCOPES = [
+	"identity.self.read",
+	"publishing.request.create",
+	"publishing.request.read.self",
+	"registry_grant.revoke.self"
 ];
 const UAPKG_CLI_SCOPE_SET = new Set(UAPKG_CLI_SCOPES);
 const OAUTH_SCOPE_TOKEN_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
-export function knownUAPKGCliScopes(value) {
-    if (!Array.isArray(value))
-        return [];
-    const candidates = new Set(value.filter((scope) => typeof scope === 'string'));
-    return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));
+function knownUAPKGCliScopes(value) {
+	if (!Array.isArray(value)) return [];
+	const candidates = new Set(value.filter((scope) => typeof scope === "string"));
+	return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));
 }
-export function parseUAPKGCliScopeString(value) {
-    return knownUAPKGCliScopes(parseOAuthScopeTokens(value));
+function parseUAPKGCliScopeString(value) {
+	return knownUAPKGCliScopes(parseOAuthScopeTokens(value));
 }
-export function parseOAuthScopeTokens(value) {
-    if (typeof value !== 'string' || value.length === 0 || value.trim() !== value)
-        return [];
-    const scopes = value.split(' ');
-    if (scopes.some((scope) => !isOAuthScopeToken(scope)))
-        return [];
-    return [...new Set(scopes)];
+function parseOAuthScopeTokens(value) {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) return [];
+	const scopes = value.split(" ");
+	if (scopes.some((scope) => !isOAuthScopeToken(scope))) return [];
+	return [...new Set(scopes)];
 }
-export function isOAuthScopeToken(value) {
-    return typeof value === 'string' && OAUTH_SCOPE_TOKEN_PATTERN.test(value);
+function isOAuthScopeToken(value) {
+	return typeof value === "string" && OAUTH_SCOPE_TOKEN_PATTERN.test(value);
 }
-export function isUAPKGCliScope(value) {
-    return typeof value === 'string' && UAPKG_CLI_SCOPE_SET.has(value);
-}
-export class ControlPlaneError extends Error {
-    code;
-    status;
-    details;
-    constructor(code, message, status, details, options) {
-        super(message, options);
-        this.code = code;
-        this.status = status;
-        this.details = details;
-        this.name = 'ControlPlaneError';
-    }
-}
-export class OAuthScopeInsufficientError extends ControlPlaneError {
-    registryAlias;
-    requestedScopes;
-    requiredScopes;
-    missingScopes;
-    constructor(message, registryAlias, requestedScopes, requiredScopes, missingScopes, status = 403, options) {
-        const requested = knownUAPKGCliScopes(requestedScopes);
-        const required = knownUAPKGCliScopes(requiredScopes);
-        const missing = knownUAPKGCliScopes(missingScopes).filter((scope) => requested.includes(scope) && required.includes(scope));
-        super('OAUTH_SCOPE_INSUFFICIENT', message, status, { requestedScopes: requested, requiredScopes: required, missingScopes: missing }, options);
-        this.registryAlias = registryAlias;
-        this.name = 'OAuthScopeInsufficientError';
-        this.requestedScopes = requested;
-        this.requiredScopes = required;
-        this.missingScopes = missing;
-    }
-}
-export class OAuthScopeUnsupportedError extends ControlPlaneError {
-    registryAlias;
-    requestedScopes;
-    unsupportedScopes;
-    reason;
-    constructor(registryAlias, requestedScopes, unsupportedScopes, options) {
-        const requested = knownUAPKGCliScopes(requestedScopes);
-        const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));
-        const reason = options?.reason ?? 'issuer-does-not-support-requested-scope';
-        const message = reason === 'cli-update-required'
-            ? `The authorization service for "${registryAlias}" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.`
-            : unsupportedIssuerScopeMessage(registryAlias, unsupported);
-        super('OAUTH_SCOPE_UNSUPPORTED', message, options?.status, { requestedScopes: requested, unsupportedScopes: unsupported, reason }, options);
-        this.registryAlias = registryAlias;
-        this.name = 'OAuthScopeUnsupportedError';
-        this.requestedScopes = requested;
-        this.unsupportedScopes = unsupported;
-        this.reason = reason;
-    }
+function isUAPKGCliScope(value) {
+	return typeof value === "string" && UAPKG_CLI_SCOPE_SET.has(value);
 }
+var ControlPlaneError = class extends Error {
+	code;
+	status;
+	details;
+	constructor(code, message, status, details, options) {
+		super(message, options);
+		this.code = code;
+		this.status = status;
+		this.details = details;
+		this.name = "ControlPlaneError";
+	}
+};
+var OAuthScopeInsufficientError = class extends ControlPlaneError {
+	registryAlias;
+	requestedScopes;
+	requiredScopes;
+	missingScopes;
+	constructor(message, registryAlias, requestedScopes, requiredScopes, missingScopes, status = 403, options) {
+		const requested = knownUAPKGCliScopes(requestedScopes);
+		const required = knownUAPKGCliScopes(requiredScopes);
+		const missing = knownUAPKGCliScopes(missingScopes).filter((scope) => requested.includes(scope) && required.includes(scope));
+		super("OAUTH_SCOPE_INSUFFICIENT", message, status, {
+			requestedScopes: requested,
+			requiredScopes: required,
+			missingScopes: missing
+		}, options);
+		this.registryAlias = registryAlias;
+		this.name = "OAuthScopeInsufficientError";
+		this.requestedScopes = requested;
+		this.requiredScopes = required;
+		this.missingScopes = missing;
+	}
+};
+var OAuthScopeUnsupportedError = class extends ControlPlaneError {
+	registryAlias;
+	requestedScopes;
+	unsupportedScopes;
+	reason;
+	constructor(registryAlias, requestedScopes, unsupportedScopes, options) {
+		const requested = knownUAPKGCliScopes(requestedScopes);
+		const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));
+		const reason = options?.reason ?? "issuer-does-not-support-requested-scope";
+		const message = reason === "cli-update-required" ? `The authorization service for "${registryAlias}" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.` : unsupportedIssuerScopeMessage(registryAlias, unsupported);
+		super("OAUTH_SCOPE_UNSUPPORTED", message, options?.status, {
+			requestedScopes: requested,
+			unsupportedScopes: unsupported,
+			reason
+		}, options);
+		this.registryAlias = registryAlias;
+		this.name = "OAuthScopeUnsupportedError";
+		this.requestedScopes = requested;
+		this.unsupportedScopes = unsupported;
+		this.reason = reason;
+	}
+};
 function unsupportedIssuerScopeMessage(registryAlias, unsupportedScopes) {
-    const noun = unsupportedScopes.length === 1 ? 'scope' : 'scopes';
-    return `The authorization service for "${registryAlias}" does not support the OAuth ${noun} required by this UAPKG CLI: ${unsupportedScopes.join(', ')}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;
+	return `The authorization service for "${registryAlias}" does not support the OAuth ${unsupportedScopes.length === 1 ? "scope" : "scopes"} required by this UAPKG CLI: ${unsupportedScopes.join(", ")}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;
 }
-export function registryAudience(registryId) {
-    return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;
+function registryAudience(registryId) {
+	return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;
 }
+
+//#endregion
+export { ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, parseOAuthScopeTokens, parseUAPKGCliScopeString, registryAudience };
 //# sourceMappingURL=ControlPlaneTypes.js.map

package/dist/control-plane/ControlPlaneTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"ControlPlaneTypes.js","sourceRoot":"","sources":["../../src/control-plane/ControlPlaneTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC,MAAM,CAAC;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC,UAAU,CAAC;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB;IACpB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;CACpB,CAAC;AAGX,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;AAC9D,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEhE,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;IAChG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAoJD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IAEA;IACA;IAJlB,YACkB,IAAY,EAC5B,OAAe,EACC,MAAe,EACf,OAA2C,EAC3D,OAAsB;QAEtB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QANR,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAS;QACf,YAAO,GAAP,OAAO,CAAoC;QAI3D,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,iBAAiB;IAO9C;IANF,eAAe,CAA2B;IAC1C,cAAc,CAA2B;IACzC,aAAa,CAA2B;IAExD,YACE,OAAe,EACC,aAAqB,EACrC,eAAyC,EACzC,cAAwC,EACxC,aAAuC,EACvC,MAAM,GAAG,GAAG,EACZ,OAAsB;QAEtB,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC,MAAM,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CACjE,CAAC;QACF,KAAK,CACH,0BAA0B,EAC1B,OAAO,EACP,MAAM,EACN,EAAE,eAAe,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,EAChF,OAAO,CACR,CAAC;QAlBc,kBAAa,GAAb,aAAa,CAAQ;QAmBrC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,iBAAiB;IAM7C;IALF,eAAe,CAA2B;IAC1C,iBAAiB,CAA2B;IAC5C,MAAM,CAAoE;IAE1F,YACkB,aAAqB,EACrC,eAAyC,EACzC,iBAA2C,EAC3C,OAGC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,yCAAyC,CAAC;QAC5E,MAAM,OAAO,GACX,MAAM,KAAK,qBAAqB;YAC9B,CAAC,CAAC,kCAAkC,aAAa,gHAAgH;YACjK,CAAC,CAAC,6BAA6B,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAChE,KAAK,CACH,yBAAyB,EACzB,OAAO,EACP,OAAO,EAAE,MAAM,EACf,EAAE,eAAe,EAAE,SAAS,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,EACtE,OAAO,CACR,CAAC;QArBc,kBAAa,GAAb,aAAa,CAAQ;QAsBrC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,6BAA6B,CAAC,aAAqB,EAAE,iBAA2C;IACvG,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjE,OAAO,kCAAkC,aAAa,gCAAgC,IAAI,gCAAgC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,wGAAwG,CAAC;AACjQ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,GAAG,uBAAuB,kBAAkB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"ControlPlaneTypes.js","names":[],"sources":["../../src/control-plane/ControlPlaneTypes.ts"],"sourcesContent":["import { UAPKG_CONTROL_PLANE_ENDPOINTS } from './ControlPlaneEndpoints.js';\n\nexport const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;\nexport const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;\nexport const UAPKG_CLI_CLIENT_ID = 'uapkg-cli';\nexport const UAPKG_GITHUB_OIDC_AUDIENCE = 'uapkg';\n\nexport const UAPKG_CLI_SCOPES = [\n  'identity.self.read',\n  'publishing.request.create',\n  'publishing.request.read.self',\n  'registry_grant.revoke.self',\n] as const;\n\nexport type UAPKGCliScope = (typeof UAPKG_CLI_SCOPES)[number];\nconst UAPKG_CLI_SCOPE_SET = new Set<string>(UAPKG_CLI_SCOPES);\nconst OAUTH_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/;\n\nexport function knownUAPKGCliScopes(value: unknown): UAPKGCliScope[] {\n  if (!Array.isArray(value)) return [];\n  const candidates = new Set(value.filter((scope): scope is string => typeof scope === 'string'));\n  return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));\n}\n\nexport function parseUAPKGCliScopeString(value: unknown): UAPKGCliScope[] {\n  return knownUAPKGCliScopes(parseOAuthScopeTokens(value));\n}\n\nexport function parseOAuthScopeTokens(value: unknown): string[] {\n  if (typeof value !== 'string' || value.length === 0 || value.trim() !== value) return [];\n  const scopes = value.split(' ');\n  if (scopes.some((scope) => !isOAuthScopeToken(scope))) return [];\n  return [...new Set(scopes)];\n}\n\nexport function isOAuthScopeToken(value: unknown): value is string {\n  return typeof value === 'string' && OAUTH_SCOPE_TOKEN_PATTERN.test(value);\n}\n\nexport function isUAPKGCliScope(value: unknown): value is UAPKGCliScope {\n  return typeof value === 'string' && UAPKG_CLI_SCOPE_SET.has(value);\n}\n\nexport type ControlPlaneAuthMode = 'auto' | 'login' | 'gat' | 'oidc';\n\nexport interface RegistryTrust {\n  readonly alias: string;\n  readonly registryId: string;\n  readonly registryName: string;\n  readonly repositoryUrl: string;\n  readonly repositoryFingerprint: string;\n  readonly issuer: string;\n  readonly apiBaseUrl: string;\n  readonly resource: string;\n  readonly cacheShortId: string;\n}\n\nexport interface AccountDisplayMetadata {\n  readonly id: string;\n  readonly username: string;\n  readonly displayName: string;\n}\n\nexport interface AccountSelf {\n  readonly account: AccountDisplayMetadata;\n  readonly registry: {\n    readonly id: string;\n  };\n  readonly grant: {\n    readonly id: string;\n    readonly deviceName: string;\n    readonly idleExpiresAt: string;\n    readonly absoluteExpiresAt: string;\n    readonly scopes: readonly string[];\n  };\n}\n\nexport interface CliLoginConfirmation extends AccountSelf {\n  readonly grant: AccountSelf['grant'] & {\n    readonly status: 'pending' | 'active';\n    readonly activationExpiresAt: string;\n    readonly replacesGrantId: string | null;\n  };\n}\n\nexport interface ActivatedCliLoginGrant {\n  readonly id: string;\n  readonly status: 'active';\n  readonly replacesGrantId: string | null;\n}\n\nexport interface RegistryGrantMetadata {\n  readonly issuer: string;\n  readonly registryId: string;\n  readonly registryName: string;\n  readonly grantId: string;\n  readonly clientId: string;\n  readonly keyReference: string;\n  readonly refreshTokenReference: string;\n  readonly publicKeyThumbprint: string;\n  readonly deviceName: string;\n  readonly repositoryFingerprint: string;\n  readonly account: AccountDisplayMetadata;\n  readonly createdAt: number;\n  readonly idleExpiresAt: number;\n  readonly expiresAt: number;\n}\n\nexport interface AuthMetadataFile {\n  readonly schemaVersion: 1;\n  readonly grants: Readonly<Record<string, RegistryGrantMetadata>>;\n}\n\nexport interface RegistryRequestSource {\n  readonly type: 'github_release';\n  readonly repository: string;\n  readonly releaseTag: string;\n  readonly assetName: string;\n}\n\n/** Artifact integrity observed by this client from the exact bytes it inspected. */\nexport interface ObservedArtifactIntegrity {\n  /** Exactly `sha256:` + 64 lowercase hex characters. */\n  readonly sha256: string;\n  readonly sizeBytes: number;\n}\n\n/** Normalized packaged-manifest claims submitted with a publish request. */\nexport interface SubmittedPackageClaims {\n  readonly name: string;\n  readonly version: string;\n  readonly private: boolean;\n  readonly dependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n  readonly devDependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n  readonly peerDependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n}\n\n/** The six route-derived registry operations (PS-REQ-001). */\nexport type RegistryOperation = 'publish' | 'unpublish' | 'yank' | 'unyank' | 'deprecate' | 'undeprecate';\n\n/**\n * Body for `POST /v1/registry-requests/{operation}`. The operation is\n * derived from the route; the body never carries a kind.\n */\nexport interface RegistryRequestSubmission {\n  readonly registryId: string;\n  readonly ownerOrganizationName?: string;\n  readonly payload: {\n    readonly packageName: string;\n    readonly packageVersion: string;\n    readonly source?: RegistryRequestSource;\n    readonly observedIntegrity?: ObservedArtifactIntegrity;\n    readonly claims?: SubmittedPackageClaims;\n    readonly reason?: string;\n  };\n}\n\nexport type RegistryRequestStatus =\n  | 'queued'\n  | 'checking'\n  | 'accepted'\n  | 'ready'\n  | 'ready_superseded'\n  | 'rejected'\n  | 'operationally_failed';\n\nexport interface RegistryRequestSummary {\n  readonly id: string;\n  readonly registryId: string;\n  readonly kind: string;\n  readonly status: RegistryRequestStatus;\n  readonly currentStep?: string;\n  readonly createdAt?: number;\n  readonly updatedAt?: number;\n  readonly payload?: {\n    readonly packageName?: string;\n    readonly packageVersion?: string;\n  };\n}\n\nexport type RegistryRequestCheckExecutionState =\n  | 'pending'\n  | 'running'\n  | 'retrying'\n  | 'blocked_by_dependency'\n  | 'completed';\n\nexport type RegistryRequestCheckConclusion = 'success' | 'failure' | 'skipped';\n\n/** One bounded, caller-visible result from the request's sealed check plan. */\nexport interface RegistryRequestCheck {\n  readonly checkId: string;\n  readonly executionState: RegistryRequestCheckExecutionState;\n  readonly conclusion?: RegistryRequestCheckConclusion;\n  readonly reasonCode?: string;\n}\n\n/** Sanitized durable retry-exhaustion details for an operational failure. */\nexport interface RegistryRequestTerminalFailure {\n  readonly reasonCode: string;\n  readonly attempts?: number;\n  readonly maxAttempts?: number;\n}\n\n/** Additive detail returned by the request-status endpoint. */\nexport interface RegistryRequestDetail {\n  readonly request: RegistryRequestSummary;\n  readonly checks?: readonly RegistryRequestCheck[];\n  readonly terminalFailure?: RegistryRequestTerminalFailure;\n}\n\nexport interface ControlPlaneApiErrorBody {\n  readonly ok: false;\n  readonly error: {\n    readonly code: string;\n    readonly message: string;\n    readonly details?: Readonly<Record<string, unknown>>;\n  };\n}\n\nexport class ControlPlaneError extends Error {\n  public constructor(\n    public readonly code: string,\n    message: string,\n    public readonly status?: number,\n    public readonly details?: Readonly<Record<string, unknown>>,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'ControlPlaneError';\n  }\n}\n\nexport class OAuthScopeInsufficientError extends ControlPlaneError {\n  public readonly requestedScopes: readonly UAPKGCliScope[];\n  public readonly requiredScopes: readonly UAPKGCliScope[];\n  public readonly missingScopes: readonly UAPKGCliScope[];\n\n  public constructor(\n    message: string,\n    public readonly registryAlias: string,\n    requestedScopes: readonly UAPKGCliScope[],\n    requiredScopes: readonly UAPKGCliScope[],\n    missingScopes: readonly UAPKGCliScope[],\n    status = 403,\n    options?: ErrorOptions,\n  ) {\n    const requested = knownUAPKGCliScopes(requestedScopes);\n    const required = knownUAPKGCliScopes(requiredScopes);\n    const missing = knownUAPKGCliScopes(missingScopes).filter(\n      (scope) => requested.includes(scope) && required.includes(scope),\n    );\n    super(\n      'OAUTH_SCOPE_INSUFFICIENT',\n      message,\n      status,\n      { requestedScopes: requested, requiredScopes: required, missingScopes: missing },\n      options,\n    );\n    this.name = 'OAuthScopeInsufficientError';\n    this.requestedScopes = requested;\n    this.requiredScopes = required;\n    this.missingScopes = missing;\n  }\n}\n\nexport class OAuthScopeUnsupportedError extends ControlPlaneError {\n  public readonly requestedScopes: readonly UAPKGCliScope[];\n  public readonly unsupportedScopes: readonly UAPKGCliScope[];\n  public readonly reason: 'issuer-does-not-support-requested-scope' | 'cli-update-required';\n\n  public constructor(\n    public readonly registryAlias: string,\n    requestedScopes: readonly UAPKGCliScope[],\n    unsupportedScopes: readonly UAPKGCliScope[],\n    options?: ErrorOptions & {\n      readonly reason?: 'issuer-does-not-support-requested-scope' | 'cli-update-required';\n      readonly status?: number;\n    },\n  ) {\n    const requested = knownUAPKGCliScopes(requestedScopes);\n    const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));\n    const reason = options?.reason ?? 'issuer-does-not-support-requested-scope';\n    const message =\n      reason === 'cli-update-required'\n        ? `The authorization service for \"${registryAlias}\" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.`\n        : unsupportedIssuerScopeMessage(registryAlias, unsupported);\n    super(\n      'OAUTH_SCOPE_UNSUPPORTED',\n      message,\n      options?.status,\n      { requestedScopes: requested, unsupportedScopes: unsupported, reason },\n      options,\n    );\n    this.name = 'OAuthScopeUnsupportedError';\n    this.requestedScopes = requested;\n    this.unsupportedScopes = unsupported;\n    this.reason = reason;\n  }\n}\n\nfunction unsupportedIssuerScopeMessage(registryAlias: string, unsupportedScopes: readonly UAPKGCliScope[]): string {\n  const noun = unsupportedScopes.length === 1 ? 'scope' : 'scopes';\n  return `The authorization service for \"${registryAlias}\" does not support the OAuth ${noun} required by this UAPKG CLI: ${unsupportedScopes.join(', ')}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;\n}\n\nexport function registryAudience(registryId: string): string {\n  return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;\n}\n"],"mappings":";;;AAEA,MAAa,6BAA6B,8BAA8B;AACxE,MAAa,0BAA0B,8BAA8B;AACrE,MAAa,sBAAsB;AACnC,MAAa,6BAA6B;AAE1C,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;AACF;AAGA,MAAM,sBAAsB,IAAI,IAAY,gBAAgB;AAC5D,MAAM,4BAA4B;AAElC,SAAgB,oBAAoB,OAAiC;CACnE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,aAAa,IAAI,IAAI,MAAM,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC;CAC9F,OAAO,iBAAiB,QAAQ,UAAU,WAAW,IAAI,KAAK,CAAC;AACjE;AAEA,SAAgB,yBAAyB,OAAiC;CACxE,OAAO,oBAAoB,sBAAsB,KAAK,CAAC;AACzD;AAEA,SAAgB,sBAAsB,OAA0B;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,KAAK,MAAM,OAAO,OAAO,CAAC;CACvF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IAAI,OAAO,MAAM,UAAU,CAAC,kBAAkB,KAAK,CAAC,GAAG,OAAO,CAAC;CAC/D,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAEA,SAAgB,kBAAkB,OAAiC;CACjE,OAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAEA,SAAgB,gBAAgB,OAAwC;CACtE,OAAO,OAAO,UAAU,YAAY,oBAAoB,IAAI,KAAK;AACnE;AAmLA,IAAa,oBAAb,cAAuC,MAAM;CAEzB;CAEA;CACA;CAJlB,AAAO,YACL,AAAgB,MAChB,SACA,AAAgB,QAChB,AAAgB,SAChB,SACA;EACA,MAAM,SAAS,OAAO;EANN;EAEA;EACA;EAIhB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,kBAAkB;CAO/C;CANlB,AAAgB;CAChB,AAAgB;CAChB,AAAgB;CAEhB,AAAO,YACL,SACA,AAAgB,eAChB,iBACA,gBACA,eACA,SAAS,KACT,SACA;EACA,MAAM,YAAY,oBAAoB,eAAe;EACrD,MAAM,WAAW,oBAAoB,cAAc;EACnD,MAAM,UAAU,oBAAoB,aAAa,CAAC,CAAC,QAChD,UAAU,UAAU,SAAS,KAAK,KAAK,SAAS,SAAS,KAAK,CACjE;EACA,MACE,4BACA,SACA,QACA;GAAE,iBAAiB;GAAW,gBAAgB;GAAU,eAAe;EAAQ,GAC/E,OACF;EAlBgB;EAmBhB,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;EACtB,KAAK,gBAAgB;CACvB;AACF;AAEA,IAAa,6BAAb,cAAgD,kBAAkB;CAM9C;CALlB,AAAgB;CAChB,AAAgB;CAChB,AAAgB;CAEhB,AAAO,YACL,AAAgB,eAChB,iBACA,mBACA,SAIA;EACA,MAAM,YAAY,oBAAoB,eAAe;EACrD,MAAM,cAAc,oBAAoB,iBAAiB,CAAC,CAAC,QAAQ,UAAU,UAAU,SAAS,KAAK,CAAC;EACtG,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,UACJ,WAAW,wBACP,kCAAkC,cAAc,kHAChD,8BAA8B,eAAe,WAAW;EAC9D,MACE,2BACA,SACA,SAAS,QACT;GAAE,iBAAiB;GAAW,mBAAmB;GAAa;EAAO,GACrE,OACF;EArBgB;EAsBhB,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,oBAAoB;EACzB,KAAK,SAAS;CAChB;AACF;AAEA,SAAS,8BAA8B,eAAuB,mBAAqD;CAEjH,OAAO,kCAAkC,cAAc,+BAD1C,kBAAkB,WAAW,IAAI,UAAU,SACmC,+BAA+B,kBAAkB,KAAK,IAAI,EAAE;AACzJ;AAEA,SAAgB,iBAAiB,YAA4B;CAC3D,OAAO,GAAG,wBAAwB,iBAAiB,mBAAmB,UAAU;AAClF"}

package/dist/control-plane/CredentialStore.d.ts

@@ -1,28 +1,30 @@
+//#region src/control-plane/CredentialStore.d.ts
 interface KeyringEntry {
-    setPassword(password: string): void;
-    getPassword(): string | null;
-    deleteCredential(): boolean;
+  setPassword(password: string): void;
+  getPassword(): string | null;
+  deleteCredential(): boolean;
 }
 interface KeyringModule {
-    Entry: new (service: string, username: string) => KeyringEntry;
+  Entry: new (service: string, username: string) => KeyringEntry;
 }
-export type KeyringLoader = () => Promise<KeyringModule>;
+type KeyringLoader = () => Promise<KeyringModule>;
 /**
  * Protected secret storage. The native module is imported only when a
  * control-plane command needs it, so install/search/update remain portable.
  */
-export declare class CredentialStore {
-    private readonly loadKeyring;
-    private readonly service;
-    private module?;
-    constructor(loadKeyring?: KeyringLoader, service?: string);
-    assertAvailable(): Promise<void>;
-    get(reference: string): Promise<string | undefined>;
-    set(reference: string, value: string): Promise<void>;
-    delete(reference: string): Promise<void>;
-    createReference(kind: 'grant' | 'dpop-key', issuer: string, registryId: string, grantId: string): string;
-    private entry;
-    private ensureModule;
+declare class CredentialStore {
+  private readonly loadKeyring;
+  private readonly service;
+  private module?;
+  constructor(loadKeyring?: KeyringLoader, service?: string);
+  assertAvailable(): Promise<void>;
+  get(reference: string): Promise<string | undefined>;
+  set(reference: string, value: string): Promise<void>;
+  delete(reference: string): Promise<void>;
+  createReference(kind: 'grant' | 'dpop-key', issuer: string, registryId: string, grantId: string): string;
+  private entry;
+  private ensureModule;
 }
-export {};
+//#endregion
+export { CredentialStore, KeyringLoader };
 //# sourceMappingURL=CredentialStore.d.ts.map

package/dist/control-plane/CredentialStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CredentialStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/CredentialStore.ts"],"names":[],"mappings":"AAEA,UAAU,YAAY;IACpB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,IAAI,OAAO,CAAC;CAC7B;AAED,UAAU,aAAa;IACrB,KAAK,EAAE,KAAK,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC;CAChE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AAEzD;;;GAGG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,MAAM,CAAC,CAAgB;gBAGZ,WAAW,GAAE,aAA+E,EAC5F,OAAO,SAAc;IAG3B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBhC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYnD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa9C,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAO/G,OAAO,CAAC,KAAK;YAOC,YAAY;CAG3B"}
+{"version":3,"file":"CredentialStore.d.ts","names":[],"sources":["../../src/control-plane/CredentialStore.ts"],"mappings":";UAEU;EACR,YAAY;EACZ;EACA;;UAGQ;EACR,YAAY,iBAAiB,qBAAqB;;KAGxC,sBAAsB,QAAQ;;;;;cAM7B;mBAIQ;mBACA;UAJX;EAER,YACmB,cAAa,eACb;EAGN,mBAAmB;EAkBnB,IAAI,oBAAoB;EAYxB,IAAI,mBAAmB,gBAAgB;EAWvC,OAAO,oBAAoB;EAajC,gBAAgB,4BAA4B,gBAAgB,oBAAoB;UAO/E;UAOM"}

package/dist/control-plane/CredentialStore.js

@@ -1,87 +1,70 @@
-import { createHash, randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from "node:crypto";
+
+//#region src/control-plane/CredentialStore.ts
 /**
- * Protected secret storage. The native module is imported only when a
- * control-plane command needs it, so install/search/update remain portable.
- */
-export class CredentialStore {
-    loadKeyring;
-    service;
-    module;
-    constructor(loadKeyring = async () => (await import('@napi-rs/keyring')), service = 'uapkg.cli') {
-        this.loadKeyring = loadKeyring;
-        this.service = service;
-    }
-    async assertAvailable() {
-        const reference = `availability:${randomUUID()}`;
-        try {
-            await this.set(reference, reference);
-            const roundTrip = await this.get(reference);
-            if (roundTrip !== reference) {
-                throw new Error('The operating-system credential store failed a round-trip check.');
-            }
-        }
-        catch (error) {
-            throw new Error('Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.', { cause: error });
-        }
-        finally {
-            await this.delete(reference).catch(() => undefined);
-        }
-    }
-    async get(reference) {
-        await this.ensureModule();
-        try {
-            return this.entry(reference).getPassword() ?? undefined;
-        }
-        catch (error) {
-            if (isMissingCredentialError(error))
-                return undefined;
-            throw new Error('Unable to read a UAPKG credential from protected operating-system storage.', {
-                cause: error,
-            });
-        }
-    }
-    async set(reference, value) {
-        await this.ensureModule();
-        try {
-            this.entry(reference).setPassword(value);
-        }
-        catch (error) {
-            throw new Error('Unable to save a UAPKG credential in protected operating-system storage.', {
-                cause: error,
-            });
-        }
-    }
-    async delete(reference) {
-        await this.ensureModule();
-        try {
-            this.entry(reference).deleteCredential();
-        }
-        catch (error) {
-            if (!isMissingCredentialError(error)) {
-                throw new Error('Unable to remove a UAPKG credential from protected operating-system storage.', {
-                    cause: error,
-                });
-            }
-        }
-    }
-    createReference(kind, issuer, registryId, grantId) {
-        const digest = createHash('sha256')
-            .update(`${kind}\0${issuer.replace(/\/+$/, '')}\0${registryId.toLowerCase()}\0${grantId}`)
-            .digest('hex');
-        return `${kind}:${digest}`;
-    }
-    entry(reference) {
-        if (!this.module) {
-            throw new Error('CredentialStore has not loaded the native keyring yet.');
-        }
-        return new this.module.Entry(this.service, reference);
-    }
-    async ensureModule() {
-        this.module ??= await this.loadKeyring();
-    }
-}
+* Protected secret storage. The native module is imported only when a
+* control-plane command needs it, so install/search/update remain portable.
+*/
+var CredentialStore = class {
+	loadKeyring;
+	service;
+	module;
+	constructor(loadKeyring = async () => await import("@napi-rs/keyring"), service = "uapkg.cli") {
+		this.loadKeyring = loadKeyring;
+		this.service = service;
+	}
+	async assertAvailable() {
+		const reference = `availability:${randomUUID()}`;
+		try {
+			await this.set(reference, reference);
+			if (await this.get(reference) !== reference) throw new Error("The operating-system credential store failed a round-trip check.");
+		} catch (error) {
+			throw new Error("Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.", { cause: error });
+		} finally {
+			await this.delete(reference).catch(() => void 0);
+		}
+	}
+	async get(reference) {
+		await this.ensureModule();
+		try {
+			return this.entry(reference).getPassword() ?? void 0;
+		} catch (error) {
+			if (isMissingCredentialError(error)) return void 0;
+			throw new Error("Unable to read a UAPKG credential from protected operating-system storage.", { cause: error });
+		}
+	}
+	async set(reference, value) {
+		await this.ensureModule();
+		try {
+			this.entry(reference).setPassword(value);
+		} catch (error) {
+			throw new Error("Unable to save a UAPKG credential in protected operating-system storage.", { cause: error });
+		}
+	}
+	async delete(reference) {
+		await this.ensureModule();
+		try {
+			this.entry(reference).deleteCredential();
+		} catch (error) {
+			if (!isMissingCredentialError(error)) throw new Error("Unable to remove a UAPKG credential from protected operating-system storage.", { cause: error });
+		}
+	}
+	createReference(kind, issuer, registryId, grantId) {
+		return `${kind}:${createHash("sha256").update(`${kind}\0${issuer.replace(/\/+$/, "")}\0${registryId.toLowerCase()}\0${grantId}`).digest("hex")}`;
+	}
+	entry(reference) {
+		if (!this.module) throw new Error("CredentialStore has not loaded the native keyring yet.");
+		return new this.module.Entry(this.service, reference);
+	}
+	async ensureModule() {
+		this.module ??= await this.loadKeyring();
+	}
+};
 function isMissingCredentialError(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return /no\s*entry|not\s*found|missing/i.test(message);
+	const message = error instanceof Error ? error.message : String(error);
+	return /no\s*entry|not\s*found|missing/i.test(message);
 }
+
+//#endregion
+export { CredentialStore };
 //# sourceMappingURL=CredentialStore.js.map

package/dist/control-plane/CredentialStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"CredentialStore.js","sourceRoot":"","sources":["../../src/control-plane/CredentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAcrD;;;GAGG;AACH,MAAM,OAAO,eAAe;IAIP;IACA;IAJX,MAAM,CAAiB;IAE/B,YACmB,cAA6B,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAkB,EAC5F,UAAU,WAAW;QADrB,gBAAW,GAAX,WAAW,CAAiF;QAC5F,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEG,KAAK,CAAC,eAAe;QAC1B,MAAM,SAAS,GAAG,gBAAgB,UAAU,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,4GAA4G,EAC5G,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,SAAiB;QAChC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,wBAAwB,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,4EAA4E,EAAE;gBAC5F,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,KAAa;QAC/C,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0EAA0E,EAAE;gBAC1F,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,8EAA8E,EAAE;oBAC9F,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEM,eAAe,CAAC,IAA0B,EAAE,MAAc,EAAE,UAAkB,EAAE,OAAe;QACpG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;aACzF,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,SAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"CredentialStore.js","names":[],"sources":["../../src/control-plane/CredentialStore.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\n\ninterface KeyringEntry {\n  setPassword(password: string): void;\n  getPassword(): string | null;\n  deleteCredential(): boolean;\n}\n\ninterface KeyringModule {\n  Entry: new (service: string, username: string) => KeyringEntry;\n}\n\nexport type KeyringLoader = () => Promise<KeyringModule>;\n\n/**\n * Protected secret storage. The native module is imported only when a\n * control-plane command needs it, so install/search/update remain portable.\n */\nexport class CredentialStore {\n  private module?: KeyringModule;\n\n  public constructor(\n    private readonly loadKeyring: KeyringLoader = async () => (await import('@napi-rs/keyring')) as KeyringModule,\n    private readonly service = 'uapkg.cli',\n  ) {}\n\n  public async assertAvailable(): Promise<void> {\n    const reference = `availability:${randomUUID()}`;\n    try {\n      await this.set(reference, reference);\n      const roundTrip = await this.get(reference);\n      if (roundTrip !== reference) {\n        throw new Error('The operating-system credential store failed a round-trip check.');\n      }\n    } catch (error) {\n      throw new Error(\n        'Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.',\n        { cause: error },\n      );\n    } finally {\n      await this.delete(reference).catch(() => undefined);\n    }\n  }\n\n  public async get(reference: string): Promise<string | undefined> {\n    await this.ensureModule();\n    try {\n      return this.entry(reference).getPassword() ?? undefined;\n    } catch (error) {\n      if (isMissingCredentialError(error)) return undefined;\n      throw new Error('Unable to read a UAPKG credential from protected operating-system storage.', {\n        cause: error,\n      });\n    }\n  }\n\n  public async set(reference: string, value: string): Promise<void> {\n    await this.ensureModule();\n    try {\n      this.entry(reference).setPassword(value);\n    } catch (error) {\n      throw new Error('Unable to save a UAPKG credential in protected operating-system storage.', {\n        cause: error,\n      });\n    }\n  }\n\n  public async delete(reference: string): Promise<void> {\n    await this.ensureModule();\n    try {\n      this.entry(reference).deleteCredential();\n    } catch (error) {\n      if (!isMissingCredentialError(error)) {\n        throw new Error('Unable to remove a UAPKG credential from protected operating-system storage.', {\n          cause: error,\n        });\n      }\n    }\n  }\n\n  public createReference(kind: 'grant' | 'dpop-key', issuer: string, registryId: string, grantId: string): string {\n    const digest = createHash('sha256')\n      .update(`${kind}\\0${issuer.replace(/\\/+$/, '')}\\0${registryId.toLowerCase()}\\0${grantId}`)\n      .digest('hex');\n    return `${kind}:${digest}`;\n  }\n\n  private entry(reference: string): KeyringEntry {\n    if (!this.module) {\n      throw new Error('CredentialStore has not loaded the native keyring yet.');\n    }\n    return new this.module.Entry(this.service, reference);\n  }\n\n  private async ensureModule(): Promise<void> {\n    this.module ??= await this.loadKeyring();\n  }\n}\n\nfunction isMissingCredentialError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return /no\\s*entry|not\\s*found|missing/i.test(message);\n}\n"],"mappings":";;;;;;;AAkBA,IAAa,kBAAb,MAA6B;CAIR;CACA;CAJnB,AAAQ;CAER,AAAO,YACL,AAAiB,cAA6B,YAAa,MAAM,OAAO,qBACxE,AAAiB,UAAU,aAC3B;EAFiB;EACA;CAChB;CAEH,MAAa,kBAAiC;EAC5C,MAAM,YAAY,gBAAgB,WAAW;EAC7C,IAAI;GACF,MAAM,KAAK,IAAI,WAAW,SAAS;GAEnC,IAAI,MADoB,KAAK,IAAI,SAAS,MACxB,WAChB,MAAM,IAAI,MAAM,kEAAkE;EAEtF,SAAS,OAAO;GACd,MAAM,IAAI,MACR,8GACA,EAAE,OAAO,MAAM,CACjB;EACF,UAAU;GACR,MAAM,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY,MAAS;EACpD;CACF;CAEA,MAAa,IAAI,WAAgD;EAC/D,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,YAAY,KAAK;EAChD,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM,IAAI,MAAM,8EAA8E,EAC5F,OAAO,MACT,CAAC;EACH;CACF;CAEA,MAAa,IAAI,WAAmB,OAA8B;EAChE,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,KAAK,MAAM,SAAS,CAAC,CAAC,YAAY,KAAK;EACzC,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,4EAA4E,EAC1F,OAAO,MACT,CAAC;EACH;CACF;CAEA,MAAa,OAAO,WAAkC;EACpD,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,KAAK,MAAM,SAAS,CAAC,CAAC,iBAAiB;EACzC,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GACjC,MAAM,IAAI,MAAM,gFAAgF,EAC9F,OAAO,MACT,CAAC;EAEL;CACF;CAEA,AAAO,gBAAgB,MAA4B,QAAgB,YAAoB,SAAyB;EAI9G,OAAO,GAAG,KAAK,GAHA,WAAW,QAAQ,CAAC,CAChC,OAAO,GAAG,KAAK,IAAI,OAAO,QAAQ,QAAQ,EAAE,EAAE,IAAI,WAAW,YAAY,EAAE,IAAI,SAAS,CAAC,CACzF,OAAO,KACa;CACzB;CAEA,AAAQ,MAAM,WAAiC;EAC7C,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,MAAM,wDAAwD;EAE1E,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,SAAS,SAAS;CACtD;CAEA,MAAc,eAA8B;EAC1C,KAAK,WAAW,MAAM,KAAK,YAAY;CACzC;AACF;AAEA,SAAS,yBAAyB,OAAyB;CACzD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,OAAO,kCAAkC,KAAK,OAAO;AACvD"}

package/dist/control-plane/DPoPKeyStore.d.ts

@@ -1,11 +1,14 @@
-import type * as oauth from 'oauth4webapi';
-import type { CredentialStore } from './CredentialStore.js';
-export declare class DPoPKeyStore {
-    private readonly credentials;
-    constructor(credentials: CredentialStore);
-    generate(): Promise<oauth.CryptoKeyPair>;
-    save(reference: string, pair: oauth.CryptoKeyPair): Promise<void>;
-    load(reference: string): Promise<oauth.CryptoKeyPair | undefined>;
-    delete(reference: string): Promise<void>;
+import { CredentialStore } from "./CredentialStore.js";
+import * as oauth from "oauth4webapi";
+//#region src/control-plane/DPoPKeyStore.d.ts
+declare class DPoPKeyStore {
+  private readonly credentials;
+  constructor(credentials: CredentialStore);
+  generate(): Promise<oauth.CryptoKeyPair>;
+  save(reference: string, pair: oauth.CryptoKeyPair): Promise<void>;
+  load(reference: string): Promise<oauth.CryptoKeyPair | undefined>;
+  delete(reference: string): Promise<void>;
 }
+//#endregion
+export { DPoPKeyStore };
 //# sourceMappingURL=DPoPKeyStore.d.ts.map

package/dist/control-plane/DPoPKeyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DPoPKeyStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/DPoPKeyStore.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,qBAAa,YAAY;IACJ,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,eAAe;IAEnD,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;IAKxC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAajE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC;IA4BjE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGtD"}
+{"version":3,"file":"DPoPKeyStore.d.ts","names":[],"sources":["../../src/control-plane/DPoPKeyStore.ts"],"mappings":";;;cAUa;mBACyB;EAApC,YAAoC,aAAa;EAEpC,YAAY,QAAQ,MAAM;EAK1B,KAAK,mBAAmB,MAAM,MAAM,gBAAgB;EAapD,KAAK,oBAAoB,QAAQ,MAAM;EA4BvC,OAAO,oBAAoB"}

package/dist/control-plane/DPoPKeyStore.js

@@ -1,54 +1,58 @@
-import { webcrypto } from 'node:crypto';
-export class DPoPKeyStore {
-    credentials;
-    constructor(credentials) {
-        this.credentials = credentials;
-    }
-    async generate() {
-        const { generateKeyPair } = await import('oauth4webapi');
-        return generateKeyPair('ES256', { extractable: true });
-    }
-    async save(reference, pair) {
-        const [publicKey, privateKey] = await Promise.all([
-            webcrypto.subtle.exportKey('jwk', pair.publicKey),
-            webcrypto.subtle.exportKey('jwk', pair.privateKey),
-        ]);
-        const serialized = {
-            algorithm: 'ES256',
-            publicKey,
-            privateKey,
-        };
-        await this.credentials.set(reference, JSON.stringify(serialized));
-    }
-    async load(reference) {
-        const raw = await this.credentials.get(reference);
-        if (!raw)
-            return undefined;
-        let saved;
-        try {
-            saved = JSON.parse(raw);
-        }
-        catch (error) {
-            throw new Error('The saved UAPKG DPoP key is not valid JSON.', { cause: error });
-        }
-        if (saved.algorithm !== 'ES256' || !saved.publicKey || !saved.privateKey) {
-            throw new Error('The saved UAPKG DPoP key has an unsupported format.');
-        }
-        const algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
-        const [publicKey, privateKey] = await Promise.all([
-            webcrypto.subtle.importKey('jwk', saved.publicKey, algorithm, true, ['verify']),
-            webcrypto.subtle.importKey('jwk', saved.privateKey, algorithm, true, ['sign']),
-        ]);
-        const challenge = webcrypto.getRandomValues(new Uint8Array(32));
-        const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, challenge);
-        const matches = await webcrypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signature, challenge);
-        if (!matches) {
-            throw new Error('The saved UAPKG DPoP public and private keys do not match.');
-        }
-        return { publicKey, privateKey };
-    }
-    async delete(reference) {
-        await this.credentials.delete(reference);
-    }
-}
+import { webcrypto } from "node:crypto";
+
+//#region src/control-plane/DPoPKeyStore.ts
+var DPoPKeyStore = class {
+	credentials;
+	constructor(credentials) {
+		this.credentials = credentials;
+	}
+	async generate() {
+		const { generateKeyPair } = await import("oauth4webapi");
+		return generateKeyPair("ES256", { extractable: true });
+	}
+	async save(reference, pair) {
+		const [publicKey, privateKey] = await Promise.all([webcrypto.subtle.exportKey("jwk", pair.publicKey), webcrypto.subtle.exportKey("jwk", pair.privateKey)]);
+		const serialized = {
+			algorithm: "ES256",
+			publicKey,
+			privateKey
+		};
+		await this.credentials.set(reference, JSON.stringify(serialized));
+	}
+	async load(reference) {
+		const raw = await this.credentials.get(reference);
+		if (!raw) return void 0;
+		let saved;
+		try {
+			saved = JSON.parse(raw);
+		} catch (error) {
+			throw new Error("The saved UAPKG DPoP key is not valid JSON.", { cause: error });
+		}
+		if (saved.algorithm !== "ES256" || !saved.publicKey || !saved.privateKey) throw new Error("The saved UAPKG DPoP key has an unsupported format.");
+		const algorithm = {
+			name: "ECDSA",
+			namedCurve: "P-256"
+		};
+		const [publicKey, privateKey] = await Promise.all([webcrypto.subtle.importKey("jwk", saved.publicKey, algorithm, true, ["verify"]), webcrypto.subtle.importKey("jwk", saved.privateKey, algorithm, true, ["sign"])]);
+		const challenge = webcrypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		const signature = await webcrypto.subtle.sign({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, privateKey, challenge);
+		if (!await webcrypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, publicKey, signature, challenge)) throw new Error("The saved UAPKG DPoP public and private keys do not match.");
+		return {
+			publicKey,
+			privateKey
+		};
+	}
+	async delete(reference) {
+		await this.credentials.delete(reference);
+	}
+};
+
+//#endregion
+export { DPoPKeyStore };
 //# sourceMappingURL=DPoPKeyStore.js.map