@uapkg/cli 1.2.0 → 1.3.1

package/dist/control-plane/DPoPKeyStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"DPoPKeyStore.js","sourceRoot":"","sources":["../../src/control-plane/DPoPKeyStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAUxC,MAAM,OAAO,YAAY;IACa;IAApC,YAAoC,WAA4B;QAA5B,gBAAW,GAAX,WAAW,CAAiB;IAAG,CAAC;IAE7D,KAAK,CAAC,QAAQ;QACnB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,IAAyB;QAC5D,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACjD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,UAAU,GAA0B;YACxC,SAAS,EAAE,OAAO;YAClB,SAAS;YACT,UAAU;SACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAiB;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,IAAI,KAA4B,CAAC;QACjC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,SAAS,GAAgC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACtF,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC/E,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAyB,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"DPoPKeyStore.js","names":[],"sources":["../../src/control-plane/DPoPKeyStore.ts"],"sourcesContent":["import { webcrypto } from 'node:crypto';\nimport type * as oauth from 'oauth4webapi';\nimport type { CredentialStore } from './CredentialStore.js';\n\ninterface SerializedDPoPKeyPair {\n  readonly algorithm: 'ES256';\n  readonly publicKey: webcrypto.JsonWebKey;\n  readonly privateKey: webcrypto.JsonWebKey;\n}\n\nexport class DPoPKeyStore {\n  public constructor(private readonly credentials: CredentialStore) {}\n\n  public async generate(): Promise<oauth.CryptoKeyPair> {\n    const { generateKeyPair } = await import('oauth4webapi');\n    return generateKeyPair('ES256', { extractable: true });\n  }\n\n  public async save(reference: string, pair: oauth.CryptoKeyPair): Promise<void> {\n    const [publicKey, privateKey] = await Promise.all([\n      webcrypto.subtle.exportKey('jwk', pair.publicKey),\n      webcrypto.subtle.exportKey('jwk', pair.privateKey),\n    ]);\n    const serialized: SerializedDPoPKeyPair = {\n      algorithm: 'ES256',\n      publicKey,\n      privateKey,\n    };\n    await this.credentials.set(reference, JSON.stringify(serialized));\n  }\n\n  public async load(reference: string): Promise<oauth.CryptoKeyPair | undefined> {\n    const raw = await this.credentials.get(reference);\n    if (!raw) return undefined;\n\n    let saved: SerializedDPoPKeyPair;\n    try {\n      saved = JSON.parse(raw) as SerializedDPoPKeyPair;\n    } catch (error) {\n      throw new Error('The saved UAPKG DPoP key is not valid JSON.', { cause: error });\n    }\n    if (saved.algorithm !== 'ES256' || !saved.publicKey || !saved.privateKey) {\n      throw new Error('The saved UAPKG DPoP key has an unsupported format.');\n    }\n\n    const algorithm: webcrypto.EcKeyImportParams = { name: 'ECDSA', namedCurve: 'P-256' };\n    const [publicKey, privateKey] = await Promise.all([\n      webcrypto.subtle.importKey('jwk', saved.publicKey, algorithm, true, ['verify']),\n      webcrypto.subtle.importKey('jwk', saved.privateKey, algorithm, true, ['sign']),\n    ]);\n    const challenge = webcrypto.getRandomValues(new Uint8Array(32));\n    const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, challenge);\n    const matches = await webcrypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signature, challenge);\n    if (!matches) {\n      throw new Error('The saved UAPKG DPoP public and private keys do not match.');\n    }\n    return { publicKey, privateKey } as oauth.CryptoKeyPair;\n  }\n\n  public async delete(reference: string): Promise<void> {\n    await this.credentials.delete(reference);\n  }\n}\n"],"mappings":";;;AAUA,IAAa,eAAb,MAA0B;CACY;CAApC,AAAO,YAAY,AAAiB,aAA8B;EAA9B;CAA+B;CAEnE,MAAa,WAAyC;EACpD,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,OAAO,gBAAgB,SAAS,EAAE,aAAa,KAAK,CAAC;CACvD;CAEA,MAAa,KAAK,WAAmB,MAA0C;EAC7E,MAAM,CAAC,WAAW,cAAc,MAAM,QAAQ,IAAI,CAChD,UAAU,OAAO,UAAU,OAAO,KAAK,SAAS,GAChD,UAAU,OAAO,UAAU,OAAO,KAAK,UAAU,CACnD,CAAC;EACD,MAAM,aAAoC;GACxC,WAAW;GACX;GACA;EACF;EACA,MAAM,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,UAAU,CAAC;CAClE;CAEA,MAAa,KAAK,WAA6D;EAC7E,MAAM,MAAM,MAAM,KAAK,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,KAAK,OAAO;EAEjB,IAAI;EACJ,IAAI;GACF,QAAQ,KAAK,MAAM,GAAG;EACxB,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,+CAA+C,EAAE,OAAO,MAAM,CAAC;EACjF;EACA,IAAI,MAAM,cAAc,WAAW,CAAC,MAAM,aAAa,CAAC,MAAM,YAC5D,MAAM,IAAI,MAAM,qDAAqD;EAGvE,MAAM,YAAyC;GAAE,MAAM;GAAS,YAAY;EAAQ;EACpF,MAAM,CAAC,WAAW,cAAc,MAAM,QAAQ,IAAI,CAChD,UAAU,OAAO,UAAU,OAAO,MAAM,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,GAC9E,UAAU,OAAO,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,CAAC,MAAM,CAAC,CAC/E,CAAC;EACD,MAAM,YAAY,UAAU,gCAAgB,IAAI,WAAW,EAAE,CAAC;EAC9D,MAAM,YAAY,MAAM,UAAU,OAAO,KAAK;GAAE,MAAM;GAAS,MAAM;EAAU,GAAG,YAAY,SAAS;EAEvG,IAAI,CAAC,MADiB,UAAU,OAAO,OAAO;GAAE,MAAM;GAAS,MAAM;EAAU,GAAG,WAAW,WAAW,SAAS,GAE/G,MAAM,IAAI,MAAM,4DAA4D;EAE9E,OAAO;GAAE;GAAW;EAAW;CACjC;CAEA,MAAa,OAAO,WAAkC;EACpD,MAAM,KAAK,YAAY,OAAO,SAAS;CACzC;AACF"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.d.ts

@@ -1,6 +1,39 @@
-import { type RegistryTrust } from './ControlPlaneTypes.js';
-export declare class GitHubActionsOidcCredentialProvider {
-    isAvailable(): boolean;
-    exchange(trust: RegistryTrust): Promise<string>;
+import { RegistryTrust } from "./ControlPlaneTypes.js";
+//#region src/control-plane/GitHubActionsOidcCredentialProvider.d.ts
+type GitHubActionsOidcErrorCode = 'OIDC_CONTROL_PLANE_UNTRUSTED' | 'OIDC_EXCHANGE_TARGET_INVALID' | 'OIDC_GITHUB_CONTEXT_UNAVAILABLE' | 'OIDC_GITHUB_ENDPOINT_INVALID' | 'OIDC_GITHUB_TOKEN_REQUEST_FAILED' | 'OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT' | 'OIDC_GITHUB_TOKEN_REJECTED' | 'OIDC_GITHUB_TOKEN_RESPONSE_INVALID' | 'OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE' | 'OIDC_EXCHANGE_REQUEST_FAILED' | 'OIDC_EXCHANGE_REQUEST_TIMEOUT' | 'OIDC_EXCHANGE_REJECTED' | 'OIDC_EXCHANGE_RESPONSE_INVALID' | 'OIDC_EXCHANGE_RESPONSE_TOO_LARGE';
+/** Stable local failures from the GitHub Actions OIDC credential flow. */
+declare class GitHubActionsOidcError extends Error {
+  readonly code: GitHubActionsOidcErrorCode;
+  readonly status?: number | undefined;
+  constructor(code: GitHubActionsOidcErrorCode, message: string, status?: number | undefined, options?: ErrorOptions);
 }
+interface GitHubActionsOidcCredentialProviderOptions {
+  readonly fetch?: typeof fetch;
+  readonly sleep?: (milliseconds: number) => Promise<void>;
+  readonly requestTimeoutMs?: number;
+  readonly maxResponseBytes?: number;
+  readonly maxAttempts?: number;
+  readonly maxRetryDelayMs?: number;
+}
+/** Package selector bound into every UAPKG OIDC exchange. */
+interface GitHubActionsOidcTarget {
+  readonly registryId: string;
+  readonly packageName: string;
+}
+declare class GitHubActionsOidcCredentialProvider {
+  private readonly fetch;
+  private readonly sleep;
+  private readonly requestTimeoutMs;
+  private readonly maxResponseBytes;
+  private readonly maxAttempts;
+  private readonly maxRetryDelayMs;
+  constructor(options?: GitHubActionsOidcCredentialProviderOptions);
+  isAvailable(): boolean;
+  exchange(trust: RegistryTrust, target: GitHubActionsOidcTarget): Promise<string>;
+  private fetchWithRetry;
+  private retryDelay;
+  private readJson;
+}
+//#endregion
+export { GitHubActionsOidcCredentialProvider, GitHubActionsOidcCredentialProviderOptions, GitHubActionsOidcError, GitHubActionsOidcErrorCode, GitHubActionsOidcTarget };
 //# sourceMappingURL=GitHubActionsOidcCredentialProvider.d.ts.map

package/dist/control-plane/GitHubActionsOidcCredentialProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubActionsOidcCredentialProvider.d.ts","sourceRoot":"","sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,wBAAwB,CAAC;AAShC,qBAAa,mCAAmC;IACvC,WAAW,IAAI,OAAO;IAQhB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;CAkD7D"}
+{"version":3,"file":"GitHubActionsOidcCredentialProvider.d.ts","names":[],"sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"mappings":";;KA8BY;;cAiBC,+BAA+B;WAExB,MAAM;WAEN;EAHlB,YACkB,MAAM,4BACtB,iBACgB,6BAChB,UAAU;;UAOG;WACN,eAAe;WACf,SAAS,yBAAyB;WAClC;WACA;WACA;WACA;;;UAIM;WACN;WACA;;cAKE;mBACM;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,YAAmB,UAAS;EASrB;EAQM,SAAS,OAAO,eAAe,QAAQ,0BAA0B;UA8FhE;UA2BN;UAMM"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js

@@ -1,67 +1,201 @@
-import { z } from 'zod';
-import { ControlPlaneError, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, } from './ControlPlaneTypes.js';
-const githubResponseSchema = z.object({ value: z.string().min(1) });
-const exchangeResponseSchema = z.object({
-    ok: z.literal(true),
-    token: z.string().min(1),
-    expiresAt: z.number().int().positive(),
+import { ControlPlaneError, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE } from "./ControlPlaneTypes.js";
+import { z } from "zod";
+
+//#region src/control-plane/GitHubActionsOidcCredentialProvider.ts
+const DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+const DEFAULT_MAX_RESPONSE_BYTES = 65536;
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_RETRY_DELAY_MS = 1e3;
+const DEFAULT_MAX_RETRY_DELAY_MS = 3e4;
+const RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+const githubResponseSchema = z.strictObject({ value: z.string().min(1) });
+const exchangeResponseSchema = z.strictObject({
+	ok: z.literal(true),
+	token: z.string().min(1),
+	expiresAt: z.number().int().positive()
 });
-export class GitHubActionsOidcCredentialProvider {
-    isAvailable() {
-        return Boolean(process.env.GITHUB_ACTIONS === 'true' ||
-            process.env.ACTIONS_ID_TOKEN_REQUEST_URL ||
-            process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
-    }
-    async exchange(trust) {
-        if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) {
-            throw new Error(`UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`);
-        }
-        const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
-        const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-        if (!this.isAvailable() || !requestUrl || !requestToken) {
-            throw new Error('GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.');
-        }
-        const url = new URL(requestUrl);
-        if (url.protocol !== 'https:' || !url.hostname.endsWith('.actions.githubusercontent.com')) {
-            throw new Error('GitHub Actions supplied an unexpected OIDC token endpoint.');
-        }
-        url.searchParams.set('audience', UAPKG_GITHUB_OIDC_AUDIENCE);
-        const githubResponse = await fetch(url, {
-            headers: { authorization: `Bearer ${requestToken}` },
-        });
-        const githubValue = githubResponseSchema.safeParse(await safeJson(githubResponse));
-        if (!githubResponse.ok || !githubValue.success) {
-            throw new Error(`GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`);
-        }
-        const exchangeResponse = await fetch(new URL('/v1/github-user-app/oidc/github-actions/exchange', trust.apiBaseUrl), {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-                provider: 'github_actions',
-                audience: UAPKG_GITHUB_OIDC_AUDIENCE,
-                idToken: githubValue.data.value,
-            }),
-        });
-        const exchangeValue = await safeJson(exchangeResponse);
-        if (!exchangeResponse.ok) {
-            const error = z.object({ error: z.object({ code: z.string(), message: z.string() }) }).safeParse(exchangeValue);
-            if (error.success) {
-                throw new ControlPlaneError(error.data.error.code, error.data.error.message, exchangeResponse.status);
-            }
-            throw new Error(`UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`);
-        }
-        const parsed = exchangeResponseSchema.safeParse(exchangeValue);
-        if (!parsed.success)
-            throw new Error('The UAPKG OIDC exchange response was invalid.');
-        return parsed.data.token;
-    }
+const exchangeErrorSchema = z.strictObject({
+	ok: z.literal(false),
+	error: z.strictObject({
+		code: z.string().min(1),
+		message: z.string().min(1),
+		details: z.record(z.string(), z.unknown()).optional()
+	})
+});
+/** Stable local failures from the GitHub Actions OIDC credential flow. */
+var GitHubActionsOidcError = class extends Error {
+	code;
+	status;
+	constructor(code, message, status, options) {
+		super(message, options);
+		this.code = code;
+		this.status = status;
+		this.name = "GitHubActionsOidcError";
+	}
+};
+var GitHubActionsOidcCredentialProvider = class {
+	fetch;
+	sleep;
+	requestTimeoutMs;
+	maxResponseBytes;
+	maxAttempts;
+	maxRetryDelayMs;
+	constructor(options = {}) {
+		this.fetch = options.fetch ?? globalThis.fetch;
+		this.sleep = options.sleep ?? delay;
+		this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);
+		this.maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
+		this.maxAttempts = positiveInteger(options.maxAttempts, DEFAULT_MAX_ATTEMPTS);
+		this.maxRetryDelayMs = positiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS);
+	}
+	isAvailable() {
+		return Boolean(process.env.GITHUB_ACTIONS === "true" || process.env.ACTIONS_ID_TOKEN_REQUEST_URL || process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
+	}
+	async exchange(trust, target) {
+		if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) throw new GitHubActionsOidcError("OIDC_CONTROL_PLANE_UNTRUSTED", `UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`);
+		const packageName = target.packageName.trim();
+		if (target.registryId !== trust.registryId || !packageName) throw new GitHubActionsOidcError("OIDC_EXCHANGE_TARGET_INVALID", "GitHub Actions OIDC requires the exact trusted registry and packaged package name.");
+		const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+		const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+		if (!this.isAvailable() || !requestUrl || !requestToken) throw new GitHubActionsOidcError("OIDC_GITHUB_CONTEXT_UNAVAILABLE", "GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.");
+		const url = parseGitHubOidcEndpoint(requestUrl);
+		url.searchParams.set("audience", UAPKG_GITHUB_OIDC_AUDIENCE);
+		const githubResponse = await this.fetchWithRetry(url, { headers: { authorization: `Bearer ${requestToken}` } }, "github");
+		const githubValue = githubResponseSchema.safeParse(await this.readJson(githubResponse, "github"));
+		if (!githubResponse.ok) throw new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_REJECTED", `GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`, githubResponse.status);
+		if (!githubValue.success) throw new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_INVALID", "GitHub Actions returned an invalid OIDC identity-token response.", githubResponse.status);
+		const exchangeResponse = await this.fetchWithRetry(new URL("/v1/oidc/github-actions/exchange", trust.apiBaseUrl), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				provider: "github_actions",
+				audience: UAPKG_GITHUB_OIDC_AUDIENCE,
+				idToken: githubValue.data.value,
+				target: {
+					registryId: target.registryId,
+					packageName
+				}
+			})
+		}, "exchange");
+		const exchangeValue = await this.readJson(exchangeResponse, "exchange");
+		if (!exchangeResponse.ok) {
+			const error = exchangeErrorSchema.safeParse(exchangeValue);
+			if (error.success) throw new ControlPlaneError(error.data.error.code, error.data.error.message, exchangeResponse.status, error.data.error.details);
+			throw new GitHubActionsOidcError("OIDC_EXCHANGE_REJECTED", `UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`, exchangeResponse.status);
+		}
+		const parsed = exchangeResponseSchema.safeParse(exchangeValue);
+		if (!parsed.success) throw new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_INVALID", "The UAPKG OIDC exchange response was invalid.", exchangeResponse.status);
+		return parsed.data.token;
+	}
+	async fetchWithRetry(url, init, endpoint) {
+		for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {
+			let response;
+			try {
+				response = await this.fetch(url, {
+					...init,
+					redirect: "error",
+					signal: AbortSignal.timeout(this.requestTimeoutMs)
+				});
+			} catch (error) {
+				if (attempt < this.maxAttempts) {
+					await this.sleep(this.retryDelay(void 0, attempt));
+					continue;
+				}
+				throw requestFailure(endpoint, error);
+			}
+			if (!RETRYABLE_STATUS_CODES.has(response.status) || attempt === this.maxAttempts) return response;
+			const retryAfter = response.headers.get("retry-after");
+			await response.body?.cancel().catch(() => void 0);
+			await this.sleep(this.retryDelay(retryAfter, attempt));
+		}
+		throw new Error("OIDC retry loop exhausted unexpectedly.");
+	}
+	retryDelay(retryAfter, attempt) {
+		const parsed = parseRetryAfter(retryAfter);
+		const fallback = DEFAULT_RETRY_DELAY_MS * 2 ** (attempt - 1);
+		return Math.min(parsed ?? fallback, this.maxRetryDelayMs);
+	}
+	async readJson(response, endpoint) {
+		const contentLength = parseContentLength(response.headers.get("content-length"));
+		if (contentLength !== void 0 && contentLength > this.maxResponseBytes) {
+			await response.body?.cancel().catch(() => void 0);
+			throw responseTooLarge(endpoint, response.status);
+		}
+		const chunks = [];
+		let byteLength = 0;
+		if (response.body) {
+			const reader = response.body.getReader();
+			try {
+				while (true) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					byteLength += value.byteLength;
+					if (byteLength > this.maxResponseBytes) {
+						await reader.cancel().catch(() => void 0);
+						throw responseTooLarge(endpoint, response.status);
+					}
+					chunks.push(value);
+				}
+			} finally {
+				reader.releaseLock();
+			}
+		}
+		if (byteLength === 0) return {};
+		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+		if (contentType !== "application/json" && !contentType?.endsWith("+json")) throw responseInvalid(endpoint, response.status);
+		const bytes = new Uint8Array(byteLength);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		try {
+			return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		} catch (error) {
+			throw responseInvalid(endpoint, response.status, error);
+		}
+	}
+};
+function parseGitHubOidcEndpoint(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch (error) {
+		throw new GitHubActionsOidcError("OIDC_GITHUB_ENDPOINT_INVALID", "GitHub Actions supplied an unexpected OIDC token endpoint.", void 0, { cause: error });
+	}
+	const hostname = url.hostname.toLowerCase();
+	if (url.protocol !== "https:" || url.username || url.password || url.port || hostname !== "actions.githubusercontent.com" && !hostname.endsWith(".actions.githubusercontent.com")) throw new GitHubActionsOidcError("OIDC_GITHUB_ENDPOINT_INVALID", "GitHub Actions supplied an unexpected OIDC token endpoint.");
+	return url;
+}
+function requestFailure(endpoint, error) {
+	const timedOut = error instanceof DOMException && error.name === "TimeoutError";
+	if (endpoint === "github") return new GitHubActionsOidcError(timedOut ? "OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT" : "OIDC_GITHUB_TOKEN_REQUEST_FAILED", timedOut ? "Timed out while requesting a GitHub Actions OIDC identity token." : "Unable to request a GitHub Actions OIDC identity token.", void 0, { cause: error });
+	return new GitHubActionsOidcError(timedOut ? "OIDC_EXCHANGE_REQUEST_TIMEOUT" : "OIDC_EXCHANGE_REQUEST_FAILED", timedOut ? "Timed out while exchanging the GitHub Actions identity with UAPKG." : "Unable to exchange the GitHub Actions identity with UAPKG.", void 0, { cause: error });
+}
+function responseTooLarge(endpoint, status) {
+	return endpoint === "github" ? new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE", "GitHub Actions returned an oversized OIDC identity-token response.", status) : new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_TOO_LARGE", "The UAPKG OIDC exchange returned an oversized response.", status);
+}
+function responseInvalid(endpoint, status, cause) {
+	return endpoint === "github" ? new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_INVALID", "GitHub Actions returned an invalid OIDC identity-token response.", status, { cause }) : new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_INVALID", "The UAPKG OIDC exchange response was invalid.", status, { cause });
+}
+function parseContentLength(value) {
+	if (value === null || !/^\d+$/.test(value)) return void 0;
+	const parsed = Number(value);
+	return Number.isSafeInteger(parsed) ? parsed : void 0;
+}
+function parseRetryAfter(value, now = Date.now()) {
+	if (!value) return void 0;
+	if (/^\d+$/.test(value)) return Number(value) * 1e3;
+	const timestamp = Date.parse(value);
+	return Number.isFinite(timestamp) ? Math.max(0, timestamp - now) : void 0;
+}
+function positiveInteger(value, fallback) {
+	return value !== void 0 && Number.isSafeInteger(value) && value > 0 ? value : fallback;
 }
-async function safeJson(response) {
-    try {
-        return (await response.json());
-    }
-    catch {
-        return {};
-    }
+function delay(milliseconds) {
+	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+
+//#endregion
+export { GitHubActionsOidcCredentialProvider, GitHubActionsOidcError };
 //# sourceMappingURL=GitHubActionsOidcCredentialProvider.js.map

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"GitHubActionsOidcCredentialProvider.js","sourceRoot":"","sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EAEjB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,OAAO,mCAAmC;IACvC,WAAW;QAChB,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;YACnC,OAAO,CAAC,GAAG,CAAC,4BAA4B;YACxC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAC7C,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACxC,IAAI,KAAK,CAAC,UAAU,KAAK,uBAAuB,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,uBAAuB,GAAG,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,6HAA6H,CAC9H,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAE7D,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACtC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,6DAA6D,cAAc,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAClC,IAAI,GAAG,CAAC,kDAAkD,EAAE,KAAK,CAAC,UAAU,CAAC,EAC7E;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,0BAA0B;gBACpC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK;aAChC,CAAC;SACH,CACF,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAChH,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"GitHubActionsOidcCredentialProvider.js","names":[],"sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"sourcesContent":["import { z } from 'zod';\nimport {\n  ControlPlaneError,\n  type RegistryTrust,\n  UAPKG_CONTROL_PLANE_API,\n  UAPKG_GITHUB_OIDC_AUDIENCE,\n} from './ControlPlaneTypes.js';\n\nconst DEFAULT_REQUEST_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_RETRY_DELAY_MS = 1_000;\nconst DEFAULT_MAX_RETRY_DELAY_MS = 30_000;\nconst RETRYABLE_STATUS_CODES = new Set([429, 503]);\n\nconst githubResponseSchema = z.strictObject({ value: z.string().min(1) });\nconst exchangeResponseSchema = z.strictObject({\n  ok: z.literal(true),\n  token: z.string().min(1),\n  expiresAt: z.number().int().positive(),\n});\nconst exchangeErrorSchema = z.strictObject({\n  ok: z.literal(false),\n  error: z.strictObject({\n    code: z.string().min(1),\n    message: z.string().min(1),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\n\nexport type GitHubActionsOidcErrorCode =\n  | 'OIDC_CONTROL_PLANE_UNTRUSTED'\n  | 'OIDC_EXCHANGE_TARGET_INVALID'\n  | 'OIDC_GITHUB_CONTEXT_UNAVAILABLE'\n  | 'OIDC_GITHUB_ENDPOINT_INVALID'\n  | 'OIDC_GITHUB_TOKEN_REQUEST_FAILED'\n  | 'OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT'\n  | 'OIDC_GITHUB_TOKEN_REJECTED'\n  | 'OIDC_GITHUB_TOKEN_RESPONSE_INVALID'\n  | 'OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE'\n  | 'OIDC_EXCHANGE_REQUEST_FAILED'\n  | 'OIDC_EXCHANGE_REQUEST_TIMEOUT'\n  | 'OIDC_EXCHANGE_REJECTED'\n  | 'OIDC_EXCHANGE_RESPONSE_INVALID'\n  | 'OIDC_EXCHANGE_RESPONSE_TOO_LARGE';\n\n/** Stable local failures from the GitHub Actions OIDC credential flow. */\nexport class GitHubActionsOidcError extends Error {\n  public constructor(\n    public readonly code: GitHubActionsOidcErrorCode,\n    message: string,\n    public readonly status?: number,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'GitHubActionsOidcError';\n  }\n}\n\nexport interface GitHubActionsOidcCredentialProviderOptions {\n  readonly fetch?: typeof fetch;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly requestTimeoutMs?: number;\n  readonly maxResponseBytes?: number;\n  readonly maxAttempts?: number;\n  readonly maxRetryDelayMs?: number;\n}\n\n/** Package selector bound into every UAPKG OIDC exchange. */\nexport interface GitHubActionsOidcTarget {\n  readonly registryId: string;\n  readonly packageName: string;\n}\n\ntype OidcEndpoint = 'github' | 'exchange';\n\nexport class GitHubActionsOidcCredentialProvider {\n  private readonly fetch: typeof fetch;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly requestTimeoutMs: number;\n  private readonly maxResponseBytes: number;\n  private readonly maxAttempts: number;\n  private readonly maxRetryDelayMs: number;\n\n  public constructor(options: GitHubActionsOidcCredentialProviderOptions = {}) {\n    this.fetch = options.fetch ?? globalThis.fetch;\n    this.sleep = options.sleep ?? delay;\n    this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);\n    this.maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);\n    this.maxAttempts = positiveInteger(options.maxAttempts, DEFAULT_MAX_ATTEMPTS);\n    this.maxRetryDelayMs = positiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS);\n  }\n\n  public isAvailable(): boolean {\n    return Boolean(\n      process.env.GITHUB_ACTIONS === 'true' ||\n      process.env.ACTIONS_ID_TOKEN_REQUEST_URL ||\n      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,\n    );\n  }\n\n  public async exchange(trust: RegistryTrust, target: GitHubActionsOidcTarget): Promise<string> {\n    if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) {\n      throw new GitHubActionsOidcError(\n        'OIDC_CONTROL_PLANE_UNTRUSTED',\n        `UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`,\n      );\n    }\n    const packageName = target.packageName.trim();\n    if (target.registryId !== trust.registryId || !packageName) {\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_TARGET_INVALID',\n        'GitHub Actions OIDC requires the exact trusted registry and packaged package name.',\n      );\n    }\n    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;\n    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;\n    if (!this.isAvailable() || !requestUrl || !requestToken) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_CONTEXT_UNAVAILABLE',\n        'GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.',\n      );\n    }\n\n    const url = parseGitHubOidcEndpoint(requestUrl);\n    url.searchParams.set('audience', UAPKG_GITHUB_OIDC_AUDIENCE);\n\n    const githubResponse = await this.fetchWithRetry(\n      url,\n      {\n        headers: { authorization: `Bearer ${requestToken}` },\n      },\n      'github',\n    );\n    const githubValue = githubResponseSchema.safeParse(await this.readJson(githubResponse, 'github'));\n    if (!githubResponse.ok) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_REJECTED',\n        `GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`,\n        githubResponse.status,\n      );\n    }\n    if (!githubValue.success) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_INVALID',\n        'GitHub Actions returned an invalid OIDC identity-token response.',\n        githubResponse.status,\n      );\n    }\n\n    const exchangeResponse = await this.fetchWithRetry(\n      new URL('/v1/oidc/github-actions/exchange', trust.apiBaseUrl),\n      {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          provider: 'github_actions',\n          audience: UAPKG_GITHUB_OIDC_AUDIENCE,\n          idToken: githubValue.data.value,\n          target: {\n            registryId: target.registryId,\n            packageName,\n          },\n        }),\n      },\n      'exchange',\n    );\n    const exchangeValue = await this.readJson(exchangeResponse, 'exchange');\n    if (!exchangeResponse.ok) {\n      const error = exchangeErrorSchema.safeParse(exchangeValue);\n      if (error.success) {\n        throw new ControlPlaneError(\n          error.data.error.code,\n          error.data.error.message,\n          exchangeResponse.status,\n          error.data.error.details,\n        );\n      }\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_REJECTED',\n        `UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`,\n        exchangeResponse.status,\n      );\n    }\n    const parsed = exchangeResponseSchema.safeParse(exchangeValue);\n    if (!parsed.success) {\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_INVALID',\n        'The UAPKG OIDC exchange response was invalid.',\n        exchangeResponse.status,\n      );\n    }\n    return parsed.data.token;\n  }\n\n  private async fetchWithRetry(url: URL, init: RequestInit, endpoint: OidcEndpoint): Promise<Response> {\n    for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {\n      let response: Response;\n      try {\n        response = await this.fetch(url, {\n          ...init,\n          redirect: 'error',\n          signal: AbortSignal.timeout(this.requestTimeoutMs),\n        });\n      } catch (error) {\n        if (attempt < this.maxAttempts) {\n          await this.sleep(this.retryDelay(undefined, attempt));\n          continue;\n        }\n        throw requestFailure(endpoint, error);\n      }\n\n      if (!RETRYABLE_STATUS_CODES.has(response.status) || attempt === this.maxAttempts) return response;\n\n      const retryAfter = response.headers.get('retry-after');\n      await response.body?.cancel().catch(() => undefined);\n      await this.sleep(this.retryDelay(retryAfter, attempt));\n    }\n\n    throw new Error('OIDC retry loop exhausted unexpectedly.');\n  }\n\n  private retryDelay(retryAfter: string | null | undefined, attempt: number): number {\n    const parsed = parseRetryAfter(retryAfter);\n    const fallback = DEFAULT_RETRY_DELAY_MS * 2 ** (attempt - 1);\n    return Math.min(parsed ?? fallback, this.maxRetryDelayMs);\n  }\n\n  private async readJson(response: Response, endpoint: OidcEndpoint): Promise<unknown> {\n    const contentLength = parseContentLength(response.headers.get('content-length'));\n    if (contentLength !== undefined && contentLength > this.maxResponseBytes) {\n      await response.body?.cancel().catch(() => undefined);\n      throw responseTooLarge(endpoint, response.status);\n    }\n\n    const chunks: Uint8Array[] = [];\n    let byteLength = 0;\n    if (response.body) {\n      const reader = response.body.getReader();\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          byteLength += value.byteLength;\n          if (byteLength > this.maxResponseBytes) {\n            await reader.cancel().catch(() => undefined);\n            throw responseTooLarge(endpoint, response.status);\n          }\n          chunks.push(value);\n        }\n      } finally {\n        reader.releaseLock();\n      }\n    }\n\n    if (byteLength === 0) return {};\n    const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase();\n    if (contentType !== 'application/json' && !contentType?.endsWith('+json')) {\n      throw responseInvalid(endpoint, response.status);\n    }\n\n    const bytes = new Uint8Array(byteLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      bytes.set(chunk, offset);\n      offset += chunk.byteLength;\n    }\n    try {\n      return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)) as unknown;\n    } catch (error) {\n      throw responseInvalid(endpoint, response.status, error);\n    }\n  }\n}\n\nfunction parseGitHubOidcEndpoint(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch (error) {\n    throw new GitHubActionsOidcError(\n      'OIDC_GITHUB_ENDPOINT_INVALID',\n      'GitHub Actions supplied an unexpected OIDC token endpoint.',\n      undefined,\n      { cause: error },\n    );\n  }\n  const hostname = url.hostname.toLowerCase();\n  if (\n    url.protocol !== 'https:' ||\n    url.username ||\n    url.password ||\n    url.port ||\n    (hostname !== 'actions.githubusercontent.com' && !hostname.endsWith('.actions.githubusercontent.com'))\n  ) {\n    throw new GitHubActionsOidcError(\n      'OIDC_GITHUB_ENDPOINT_INVALID',\n      'GitHub Actions supplied an unexpected OIDC token endpoint.',\n    );\n  }\n  return url;\n}\n\nfunction requestFailure(endpoint: OidcEndpoint, error: unknown): GitHubActionsOidcError {\n  const timedOut = error instanceof DOMException && error.name === 'TimeoutError';\n  if (endpoint === 'github') {\n    return new GitHubActionsOidcError(\n      timedOut ? 'OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT' : 'OIDC_GITHUB_TOKEN_REQUEST_FAILED',\n      timedOut\n        ? 'Timed out while requesting a GitHub Actions OIDC identity token.'\n        : 'Unable to request a GitHub Actions OIDC identity token.',\n      undefined,\n      { cause: error },\n    );\n  }\n  return new GitHubActionsOidcError(\n    timedOut ? 'OIDC_EXCHANGE_REQUEST_TIMEOUT' : 'OIDC_EXCHANGE_REQUEST_FAILED',\n    timedOut\n      ? 'Timed out while exchanging the GitHub Actions identity with UAPKG.'\n      : 'Unable to exchange the GitHub Actions identity with UAPKG.',\n    undefined,\n    { cause: error },\n  );\n}\n\nfunction responseTooLarge(endpoint: OidcEndpoint, status: number): GitHubActionsOidcError {\n  return endpoint === 'github'\n    ? new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE',\n        'GitHub Actions returned an oversized OIDC identity-token response.',\n        status,\n      )\n    : new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_TOO_LARGE',\n        'The UAPKG OIDC exchange returned an oversized response.',\n        status,\n      );\n}\n\nfunction responseInvalid(endpoint: OidcEndpoint, status: number, cause?: unknown): GitHubActionsOidcError {\n  return endpoint === 'github'\n    ? new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_INVALID',\n        'GitHub Actions returned an invalid OIDC identity-token response.',\n        status,\n        { cause },\n      )\n    : new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_INVALID',\n        'The UAPKG OIDC exchange response was invalid.',\n        status,\n        { cause },\n      );\n}\n\nfunction parseContentLength(value: string | null): number | undefined {\n  if (value === null || !/^\\d+$/.test(value)) return undefined;\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) ? parsed : undefined;\n}\n\nfunction parseRetryAfter(value: string | null | undefined, now = Date.now()): number | undefined {\n  if (!value) return undefined;\n  if (/^\\d+$/.test(value)) return Number(value) * 1_000;\n  const timestamp = Date.parse(value);\n  return Number.isFinite(timestamp) ? Math.max(0, timestamp - now) : undefined;\n}\n\nfunction positiveInteger(value: number | undefined, fallback: number): number {\n  return value !== undefined && Number.isSafeInteger(value) && value > 0 ? value : fallback;\n}\n\nfunction delay(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n"],"mappings":";;;;AAQA,MAAM,6BAA6B;AACnC,MAAM,6BAA6B;AACnC,MAAM,uBAAuB;AAC7B,MAAM,yBAAyB;AAC/B,MAAM,6BAA6B;AACnC,MAAM,yCAAyB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAEjD,MAAM,uBAAuB,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,MAAM,yBAAyB,EAAE,aAAa;CAC5C,IAAI,EAAE,QAAQ,IAAI;CAClB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AACvC,CAAC;AACD,MAAM,sBAAsB,EAAE,aAAa;CACzC,IAAI,EAAE,QAAQ,KAAK;CACnB,OAAO,EAAE,aAAa;EACpB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACzB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACtD,CAAC;AACH,CAAC;;AAmBD,IAAa,yBAAb,cAA4C,MAAM;CAE9B;CAEA;CAHlB,AAAO,YACL,AAAgB,MAChB,SACA,AAAgB,QAChB,SACA;EACA,MAAM,SAAS,OAAO;EALN;EAEA;EAIhB,KAAK,OAAO;CACd;AACF;AAmBA,IAAa,sCAAb,MAAiD;CAC/C,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,AAAO,YAAY,UAAsD,CAAC,GAAG;EAC3E,KAAK,QAAQ,QAAQ,SAAS,WAAW;EACzC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,mBAAmB,gBAAgB,QAAQ,kBAAkB,0BAA0B;EAC5F,KAAK,mBAAmB,gBAAgB,QAAQ,kBAAkB,0BAA0B;EAC5F,KAAK,cAAc,gBAAgB,QAAQ,aAAa,oBAAoB;EAC5E,KAAK,kBAAkB,gBAAgB,QAAQ,iBAAiB,0BAA0B;CAC5F;CAEA,AAAO,cAAuB;EAC5B,OAAO,QACL,QAAQ,IAAI,mBAAmB,UAC/B,QAAQ,IAAI,gCACZ,QAAQ,IAAI,8BACd;CACF;CAEA,MAAa,SAAS,OAAsB,QAAkD;EAC5F,IAAI,MAAM,eAAe,yBACvB,MAAM,IAAI,uBACR,gCACA,uCAAuC,wBAAwB,EACjE;EAEF,MAAM,cAAc,OAAO,YAAY,KAAK;EAC5C,IAAI,OAAO,eAAe,MAAM,cAAc,CAAC,aAC7C,MAAM,IAAI,uBACR,gCACA,oFACF;EAEF,MAAM,aAAa,QAAQ,IAAI;EAC/B,MAAM,eAAe,QAAQ,IAAI;EACjC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,cAAc,CAAC,cACzC,MAAM,IAAI,uBACR,mCACA,6HACF;EAGF,MAAM,MAAM,wBAAwB,UAAU;EAC9C,IAAI,aAAa,IAAI,YAAY,0BAA0B;EAE3D,MAAM,iBAAiB,MAAM,KAAK,eAChC,KACA,EACE,SAAS,EAAE,eAAe,UAAU,eAAe,EACrD,GACA,QACF;EACA,MAAM,cAAc,qBAAqB,UAAU,MAAM,KAAK,SAAS,gBAAgB,QAAQ,CAAC;EAChG,IAAI,CAAC,eAAe,IAClB,MAAM,IAAI,uBACR,8BACA,6DAA6D,eAAe,OAAO,KACnF,eAAe,MACjB;EAEF,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,uBACR,sCACA,oEACA,eAAe,MACjB;EAGF,MAAM,mBAAmB,MAAM,KAAK,eAClC,IAAI,IAAI,oCAAoC,MAAM,UAAU,GAC5D;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,UAAU;IACV,UAAU;IACV,SAAS,YAAY,KAAK;IAC1B,QAAQ;KACN,YAAY,OAAO;KACnB;IACF;GACF,CAAC;EACH,GACA,UACF;EACA,MAAM,gBAAgB,MAAM,KAAK,SAAS,kBAAkB,UAAU;EACtE,IAAI,CAAC,iBAAiB,IAAI;GACxB,MAAM,QAAQ,oBAAoB,UAAU,aAAa;GACzD,IAAI,MAAM,SACR,MAAM,IAAI,kBACR,MAAM,KAAK,MAAM,MACjB,MAAM,KAAK,MAAM,SACjB,iBAAiB,QACjB,MAAM,KAAK,MAAM,OACnB;GAEF,MAAM,IAAI,uBACR,0BACA,oDAAoD,iBAAiB,OAAO,KAC5E,iBAAiB,MACnB;EACF;EACA,MAAM,SAAS,uBAAuB,UAAU,aAAa;EAC7D,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,uBACR,kCACA,iDACA,iBAAiB,MACnB;EAEF,OAAO,OAAO,KAAK;CACrB;CAEA,MAAc,eAAe,KAAU,MAAmB,UAA2C;EACnG,KAAK,IAAI,UAAU,GAAG,WAAW,KAAK,aAAa,WAAW,GAAG;GAC/D,IAAI;GACJ,IAAI;IACF,WAAW,MAAM,KAAK,MAAM,KAAK;KAC/B,GAAG;KACH,UAAU;KACV,QAAQ,YAAY,QAAQ,KAAK,gBAAgB;IACnD,CAAC;GACH,SAAS,OAAO;IACd,IAAI,UAAU,KAAK,aAAa;KAC9B,MAAM,KAAK,MAAM,KAAK,WAAW,QAAW,OAAO,CAAC;KACpD;IACF;IACA,MAAM,eAAe,UAAU,KAAK;GACtC;GAEA,IAAI,CAAC,uBAAuB,IAAI,SAAS,MAAM,KAAK,YAAY,KAAK,aAAa,OAAO;GAEzF,MAAM,aAAa,SAAS,QAAQ,IAAI,aAAa;GACrD,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,MAAS;GACnD,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,OAAO,CAAC;EACvD;EAEA,MAAM,IAAI,MAAM,yCAAyC;CAC3D;CAEA,AAAQ,WAAW,YAAuC,SAAyB;EACjF,MAAM,SAAS,gBAAgB,UAAU;EACzC,MAAM,WAAW,yBAAyB,MAAM,UAAU;EAC1D,OAAO,KAAK,IAAI,UAAU,UAAU,KAAK,eAAe;CAC1D;CAEA,MAAc,SAAS,UAAoB,UAA0C;EACnF,MAAM,gBAAgB,mBAAmB,SAAS,QAAQ,IAAI,gBAAgB,CAAC;EAC/E,IAAI,kBAAkB,UAAa,gBAAgB,KAAK,kBAAkB;GACxE,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,MAAS;GACnD,MAAM,iBAAiB,UAAU,SAAS,MAAM;EAClD;EAEA,MAAM,SAAuB,CAAC;EAC9B,IAAI,aAAa;EACjB,IAAI,SAAS,MAAM;GACjB,MAAM,SAAS,SAAS,KAAK,UAAU;GACvC,IAAI;IACF,OAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;KAC1C,IAAI,MAAM;KACV,cAAc,MAAM;KACpB,IAAI,aAAa,KAAK,kBAAkB;MACtC,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,MAAS;MAC3C,MAAM,iBAAiB,UAAU,SAAS,MAAM;KAClD;KACA,OAAO,KAAK,KAAK;IACnB;GACF,UAAU;IACR,OAAO,YAAY;GACrB;EACF;EAEA,IAAI,eAAe,GAAG,OAAO,CAAC;EAC9B,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY;EAC/F,IAAI,gBAAgB,sBAAsB,CAAC,aAAa,SAAS,OAAO,GACtE,MAAM,gBAAgB,UAAU,SAAS,MAAM;EAGjD,MAAM,QAAQ,IAAI,WAAW,UAAU;EACvC,IAAI,SAAS;EACb,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,IAAI,OAAO,MAAM;GACvB,UAAU,MAAM;EAClB;EACA,IAAI;GACF,OAAO,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;EAC3E,SAAS,OAAO;GACd,MAAM,gBAAgB,UAAU,SAAS,QAAQ,KAAK;EACxD;CACF;AACF;AAEA,SAAS,wBAAwB,OAAoB;CACnD,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAI,uBACR,gCACA,8DACA,QACA,EAAE,OAAO,MAAM,CACjB;CACF;CACA,MAAM,WAAW,IAAI,SAAS,YAAY;CAC1C,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,QACH,aAAa,mCAAmC,CAAC,SAAS,SAAS,gCAAgC,GAEpG,MAAM,IAAI,uBACR,gCACA,4DACF;CAEF,OAAO;AACT;AAEA,SAAS,eAAe,UAAwB,OAAwC;CACtF,MAAM,WAAW,iBAAiB,gBAAgB,MAAM,SAAS;CACjE,IAAI,aAAa,UACf,OAAO,IAAI,uBACT,WAAW,sCAAsC,oCACjD,WACI,qEACA,2DACJ,QACA,EAAE,OAAO,MAAM,CACjB;CAEF,OAAO,IAAI,uBACT,WAAW,kCAAkC,gCAC7C,WACI,uEACA,8DACJ,QACA,EAAE,OAAO,MAAM,CACjB;AACF;AAEA,SAAS,iBAAiB,UAAwB,QAAwC;CACxF,OAAO,aAAa,WAChB,IAAI,uBACF,wCACA,sEACA,MACF,IACA,IAAI,uBACF,oCACA,2DACA,MACF;AACN;AAEA,SAAS,gBAAgB,UAAwB,QAAgB,OAAyC;CACxG,OAAO,aAAa,WAChB,IAAI,uBACF,sCACA,oEACA,QACA,EAAE,MAAM,CACV,IACA,IAAI,uBACF,kCACA,iDACA,QACA,EAAE,MAAM,CACV;AACN;AAEA,SAAS,mBAAmB,OAA0C;CACpE,IAAI,UAAU,QAAQ,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACnD,MAAM,SAAS,OAAO,KAAK;CAC3B,OAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,SAAS,gBAAgB,OAAkC,MAAM,KAAK,IAAI,GAAuB;CAC/F,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,QAAQ,KAAK,KAAK,GAAG,OAAO,OAAO,KAAK,IAAI;CAChD,MAAM,YAAY,KAAK,MAAM,KAAK;CAClC,OAAO,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG,IAAI;AACrE;AAEA,SAAS,gBAAgB,OAA2B,UAA0B;CAC5E,OAAO,UAAU,UAAa,OAAO,cAAc,KAAK,KAAK,QAAQ,IAAI,QAAQ;AACnF;AAEA,SAAS,MAAM,cAAqC;CAClD,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,YAAY,CAAC;AACnE"}

package/dist/control-plane/PublishIdempotencyStore.d.ts

@@ -1,3 +1,17 @@
+//#region src/control-plane/PublishIdempotencyStore.d.ts
+interface GitHubActionsPublishCoordinates {
+  readonly registryId: string;
+  readonly packageName: string;
+  readonly packageVersion: string;
+  readonly artifactSha256: string;
+}
+/**
+ * Stable, non-secret key for one GitHub Actions publish job. A rerun keeps the
+ * same run ID and job name but changes GITHUB_RUN_ATTEMPT, so the attempt is
+ * deliberately excluded. Renewing an OIDC session therefore cannot change
+ * the request identity.
+ */
+declare function createGitHubActionsPublishIdempotencyKey(coordinates: GitHubActionsPublishCoordinates, environment?: NodeJS.ProcessEnv): string;
 /**
  * Persisted idempotency keys for logical registry-operation submissions.
  * One logical submission (operation + registry + payload) keeps one key
@@ -5,14 +19,16 @@
  * original request instead of creating a duplicate. Keys are cleared once
  * the request reaches a terminal state.
  */
-export declare class PublishIdempotencyStore {
-    private readonly filePath;
-    constructor(filePath?: string);
-    /** Stable digest identifying one logical submission. */
-    static submissionDigest(operation: string, submission: unknown): string;
-    getOrCreate(digest: string, newKey: () => string, now?: number): string;
-    clear(digest: string, now?: number): void;
-    private read;
-    private write;
+declare class PublishIdempotencyStore {
+  private readonly filePath;
+  constructor(filePath?: string);
+  /** Stable digest identifying one logical submission. */
+  static submissionDigest(operation: string, submission: unknown): string;
+  getOrCreate(digest: string, newKey: () => string, now?: number): string;
+  clear(digest: string, now?: number): void;
+  private read;
+  private write;
 }
+//#endregion
+export { GitHubActionsPublishCoordinates, PublishIdempotencyStore, createGitHubActionsPublishIdempotencyKey };
 //# sourceMappingURL=PublishIdempotencyStore.d.ts.map

package/dist/control-plane/PublishIdempotencyStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublishIdempotencyStore.d.ts","sourceRoot":"","sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"names":[],"mappings":"AAkBA;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEf,QAAQ,CAAC,EAAE,MAAM;IAIpC,wDAAwD;WAC1C,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM;IAIvE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM;IAY3E,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,IAAI;IAQpD,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,KAAK;CAId"}
+{"version":3,"file":"PublishIdempotencyStore.d.ts","names":[],"sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"mappings":";UAkBiB;WACN;WACA;WACA;WACA;;;;;;;;iBASK,yCACd,aAAa,iCACb,cAAa,OAAO;;;;;;;;cA2BT;mBACM;EAEjB,YAAmB;;SAKL,iBAAiB,mBAAmB;EAI3C,YAAY,gBAAgB,sBAAsB;EAYlD,MAAM,gBAAgB;UAQrB;UAyBA"}

package/dist/control-plane/PublishIdempotencyStore.js

@@ -1,71 +1,100 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { resolveActiveUapkgProfileRoot } from '@uapkg/common';
-import { sha256OfCanonicalJson } from '@uapkg/package-claims';
-const STORE_FILE_NAME = 'publish-idempotency.json';
-const MAX_ENTRY_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+import { resolveActiveUapkgProfileRoot } from "@uapkg/common";
+import { dirname, join } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { sha256OfCanonicalJson } from "@uapkg/package-claims";
+
+//#region src/control-plane/PublishIdempotencyStore.ts
+const STORE_FILE_NAME = "publish-idempotency.json";
+const MAX_ENTRY_AGE_MS = 6048e5;
 /**
- * Persisted idempotency keys for logical registry-operation submissions.
- * One logical submission (operation + registry + payload) keeps one key
- * across retries, so a re-run after a network fault or crash replays the
- * original request instead of creating a duplicate. Keys are cleared once
- * the request reaches a terminal state.
- */
-export class PublishIdempotencyStore {
-    filePath;
-    constructor(filePath) {
-        this.filePath = filePath ?? join(resolveActiveUapkgProfileRoot(), STORE_FILE_NAME);
-    }
-    /** Stable digest identifying one logical submission. */
-    static submissionDigest(operation, submission) {
-        return sha256OfCanonicalJson({ operation, submission });
-    }
-    getOrCreate(digest, newKey, now = Date.now()) {
-        const store = this.read(now);
-        const existing = store.entries[digest];
-        if (existing)
-            return existing.key;
-        const key = newKey();
-        this.write({
-            schemaVersion: 1,
-            entries: { ...store.entries, [digest]: { key, createdAt: now } },
-        });
-        return key;
-    }
-    clear(digest, now = Date.now()) {
-        const store = this.read(now);
-        if (!(digest in store.entries))
-            return;
-        const entries = { ...store.entries };
-        delete entries[digest];
-        this.write({ schemaVersion: 1, entries });
-    }
-    read(now) {
-        let parsed;
-        try {
-            const raw = readFileSync(this.filePath, 'utf8');
-            const candidate = JSON.parse(raw);
-            if (candidate.schemaVersion === 1 && candidate.entries && typeof candidate.entries === 'object') {
-                parsed = { schemaVersion: 1, entries: candidate.entries };
-            }
-        }
-        catch {
-            // Missing or corrupt store starts fresh; keys are best-effort retry aids.
-        }
-        const entries = {};
-        for (const [digest, entry] of Object.entries(parsed?.entries ?? {})) {
-            if (entry &&
-                typeof entry.key === 'string' &&
-                typeof entry.createdAt === 'number' &&
-                now - entry.createdAt <= MAX_ENTRY_AGE_MS) {
-                entries[digest] = entry;
-            }
-        }
-        return { schemaVersion: 1, entries };
-    }
-    write(store) {
-        mkdirSync(dirname(this.filePath), { recursive: true });
-        writeFileSync(this.filePath, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
-    }
+* Stable, non-secret key for one GitHub Actions publish job. A rerun keeps the
+* same run ID and job name but changes GITHUB_RUN_ATTEMPT, so the attempt is
+* deliberately excluded. Renewing an OIDC session therefore cannot change
+* the request identity.
+*/
+function createGitHubActionsPublishIdempotencyKey(coordinates, environment = process.env) {
+	const githubRunId = environment.GITHUB_RUN_ID?.trim();
+	const githubJob = environment.GITHUB_JOB?.trim();
+	if (!githubRunId || !githubJob) throw new Error("GitHub Actions OIDC publishing requires GITHUB_RUN_ID and GITHUB_JOB to derive a stable idempotency key.");
+	return `gha-${sha256OfCanonicalJson({
+		schemaVersion: 1,
+		registryId: coordinates.registryId,
+		packageName: coordinates.packageName,
+		packageVersion: coordinates.packageVersion,
+		artifactSha256: coordinates.artifactSha256,
+		githubRunId,
+		githubJob
+	})}`;
 }
+/**
+* Persisted idempotency keys for logical registry-operation submissions.
+* One logical submission (operation + registry + payload) keeps one key
+* across retries, so a re-run after a network fault or crash replays the
+* original request instead of creating a duplicate. Keys are cleared once
+* the request reaches a terminal state.
+*/
+var PublishIdempotencyStore = class {
+	filePath;
+	constructor(filePath) {
+		this.filePath = filePath ?? join(resolveActiveUapkgProfileRoot(), STORE_FILE_NAME);
+	}
+	/** Stable digest identifying one logical submission. */
+	static submissionDigest(operation, submission) {
+		return sha256OfCanonicalJson({
+			operation,
+			submission
+		});
+	}
+	getOrCreate(digest, newKey, now = Date.now()) {
+		const store = this.read(now);
+		const existing = store.entries[digest];
+		if (existing) return existing.key;
+		const key = newKey();
+		this.write({
+			schemaVersion: 1,
+			entries: {
+				...store.entries,
+				[digest]: {
+					key,
+					createdAt: now
+				}
+			}
+		});
+		return key;
+	}
+	clear(digest, now = Date.now()) {
+		const store = this.read(now);
+		if (!(digest in store.entries)) return;
+		const entries = { ...store.entries };
+		delete entries[digest];
+		this.write({
+			schemaVersion: 1,
+			entries
+		});
+	}
+	read(now) {
+		let parsed;
+		try {
+			const raw = readFileSync(this.filePath, "utf8");
+			const candidate = JSON.parse(raw);
+			if (candidate.schemaVersion === 1 && candidate.entries && typeof candidate.entries === "object") parsed = {
+				schemaVersion: 1,
+				entries: candidate.entries
+			};
+		} catch {}
+		const entries = {};
+		for (const [digest, entry] of Object.entries(parsed?.entries ?? {})) if (entry && typeof entry.key === "string" && typeof entry.createdAt === "number" && now - entry.createdAt <= MAX_ENTRY_AGE_MS) entries[digest] = entry;
+		return {
+			schemaVersion: 1,
+			entries
+		};
+	}
+	write(store) {
+		mkdirSync(dirname(this.filePath), { recursive: true });
+		writeFileSync(this.filePath, `${JSON.stringify(store, null, 2)}\n`, "utf8");
+	}
+};
+
+//#endregion
+export { PublishIdempotencyStore, createGitHubActionsPublishIdempotencyKey };
 //# sourceMappingURL=PublishIdempotencyStore.js.map