@uapkg/cli 1.2.0 → 1.3.1

package/dist/control-plane/PublishRequestErrorMapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublishRequestErrorMapper.js","names":[],"sources":["../../src/control-plane/PublishRequestErrorMapper.ts"],"sourcesContent":["import {\n  createPublishRequestFailedDiagnostic,\n  type PublishDiagnosticFact,\n  type PublishDiagnosticResource,\n  type PublishRequestFailedDiagnostic,\n} from '@uapkg/diagnostics';\nimport { z } from 'zod';\nimport { ControlPlaneError } from './ControlPlaneTypes.js';\n\nconst SERVER_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/u;\n\nconst boundedText = (maximumLength: number) =>\n  z\n    .string()\n    .trim()\n    .min(1)\n    .max(maximumLength)\n    .refine((value) => !hasUnsafeDisplayCharacter(value));\nconst packageNameSchema = boundedText(214);\nconst packageVersionSchema = boundedText(256);\nconst ownerNameSchema = boundedText(100).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/u);\nconst repositorySchema = boundedText(255).regex(/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/u);\nconst requestIdSchema = boundedText(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u);\nconst accessModeSchema = z.enum(['none', 'selected', 'all']);\nconst missingCapabilitiesSchema = z\n  .array(z.enum(['package.publish', 'publishing.request.create']))\n  .max(10)\n  .transform((values) => [...new Set(values)]);\nconst missingOAuthScopesSchema = z\n  .array(z.enum(['publishing.request.create', 'publishing.request.read.self']))\n  .max(2)\n  .transform((values) => [...new Set(values)]);\nconst ownerNamesSchema = z\n  .array(ownerNameSchema)\n  .max(20)\n  .transform((values) => [...new Set(values)].sort());\n\nconst emptyDetailsSchema = z.object({});\nconst packageDetailsSchema = z.object({ packageName: packageNameSchema.optional() });\nconst ownerRequiredDetailsSchema = packageDetailsSchema;\nconst requestedOwnerDetailsSchema = packageDetailsSchema.extend({\n  requestedOwnerOrganizationName: ownerNameSchema.optional(),\n  ownerOrganizationName: ownerNameSchema.optional(),\n  allowedOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst gatOwnerMismatchDetailsSchema = packageDetailsSchema.extend({\n  requestedOwnerOrganizationName: ownerNameSchema.optional(),\n  tokenOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst scopeMismatchDetailsSchema = packageDetailsSchema.extend({\n  requestedScopeOwner: ownerNameSchema.optional(),\n  scopeOwner: ownerNameSchema.optional(),\n  allowedScopeOwners: ownerNamesSchema.optional(),\n  tokenOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst tokenAccessDetailsSchema = packageDetailsSchema.extend({\n  actualPackageAccessMode: accessModeSchema.optional(),\n  requiredPackageAccessMode: z.literal('all').optional(),\n  missingCapabilities: missingCapabilitiesSchema.optional(),\n  packageAccess: z.object({ mode: accessModeSchema }).optional(),\n  actualRegistryAccessMode: accessModeSchema.optional(),\n  requiredRegistryAccessModes: z\n    .array(z.enum(['selected', 'all']))\n    .max(2)\n    .optional(),\n  requiredPackageAccessModes: z\n    .array(z.enum(['selected', 'all']))\n    .max(2)\n    .optional(),\n  registryAccess: z.object({ mode: accessModeSchema }).optional(),\n});\nconst tokenPermissionDetailsSchema = z.object({\n  missingCapabilities: missingCapabilitiesSchema.optional(),\n});\nconst oauthScopeDetailsSchema = z.object({\n  missingScopes: missingOAuthScopesSchema.optional(),\n});\nconst oidcRepositoryDetailsSchema = packageDetailsSchema.extend({\n  submittedRepository: repositorySchema.optional(),\n  trustedRepository: repositorySchema.optional(),\n});\nconst versionDetailsSchema = z.object({\n  packageName: packageNameSchema.optional(),\n  packageVersion: packageVersionSchema.optional(),\n});\nconst activeRequestDetailsSchema = versionDetailsSchema.extend({\n  activeRequestId: requestIdSchema.optional(),\n});\nconst haltedPackageDetailsSchema = packageDetailsSchema.extend({\n  blockingRequestId: requestIdSchema.optional(),\n});\nconst retryDetailsSchema = z.object({\n  retryAfterSeconds: z.number().int().min(1).max(86_400).optional(),\n});\n\nexport interface PublishRequestErrorContext {\n  readonly packageName: string;\n  readonly packageVersion: string;\n  readonly registryAlias: string;\n  readonly registryName?: string;\n  readonly registryIssuer: string;\n  readonly credentialKind: 'login' | 'gat' | 'oidc';\n  readonly requestedOwner?: string;\n  readonly repository: string;\n}\n\ntype ResourceKind =\n  | 'access-tokens'\n  | 'help'\n  | 'login'\n  | 'owner-command'\n  | 'requests'\n  | 'security'\n  | 'registries'\n  | 'trusted-publishers';\n\ninterface PublishGuidance {\n  readonly message: string;\n  readonly hint: string;\n  readonly facts?: readonly PublishDiagnosticFact[];\n  readonly resources?: readonly ResourceKind[];\n  readonly requestId?: string;\n}\n\ninterface PublishErrorSpec {\n  build(details: unknown, context: PublishRequestErrorContext): PublishGuidance;\n}\n\nfunction defineSpec<Schema extends z.ZodObject>(\n  schema: Schema,\n  build: (details: z.output<Schema>, context: PublishRequestErrorContext) => PublishGuidance,\n): PublishErrorSpec {\n  const empty = schema.parse({});\n  return {\n    build(details, context) {\n      const parsed = schema.safeParse(details ?? {});\n      return build(parsed.success ? parsed.data : empty, context);\n    },\n  };\n}\n\nfunction fixedSpec(message: string, hint: string, resources: readonly ResourceKind[] = []): PublishErrorSpec {\n  return defineSpec(emptyDetailsSchema, () => ({ message, hint, resources }));\n}\n\nconst UPDATE_CLIENT_AND_RETRY =\n  'Update UAPKG CLI and try again. If the problem remains, report the server code to the registry operator.';\nconst RETRY_AND_REPORT =\n  'Try publishing again. If the failure continues, report the server code to the registry operator.';\nconst LOGIN_AGAIN = 'Sign in again for this registry, then retry the publication.';\nconst CHECK_TOKEN =\n  'Create or use an active granular access token with the correct owner, permissions, and package access, then try again.';\n\nconst clientRequestSpec = (message: string) => fixedSpec(message, UPDATE_CLIENT_AND_RETRY);\nconst internalServiceSpec = (message: string) => fixedSpec(message, RETRY_AND_REPORT);\nconst loginSpec = (message: string) => fixedSpec(message, LOGIN_AGAIN, ['login']);\nconst tokenSpec = (message: string) => fixedSpec(message, CHECK_TOKEN, ['access-tokens']);\n\nconst unscopedOwnerSpec = defineSpec(ownerRequiredDetailsSchema, (_details, context) => {\n  const packageName = safeDisplayValue(context.packageName, 214);\n  return {\n    message: packageName\n      ? `\"${packageName}\" needs an owner organization before it can be published for the first time.`\n      : 'This unscoped package needs an owner organization before it can be published for the first time.',\n    hint: 'Pass `--owner <organization>`, set `publish.owner` in uapkg.json, or publish the package under an `@organization/name` scope.',\n    resources: ['owner-command'],\n  };\n});\n\nconst gatOwnerMismatchSpec = defineSpec(gatOwnerMismatchDetailsSchema, (details, context) => {\n  const requestedOwner = details.requestedOwnerOrganizationName ?? safeOwner(context.requestedOwner);\n  const tokenOwners = details.tokenOwnerOrganizationNames ?? [];\n  const ownerDescription = tokenOwners.length > 0 ? quotedList(tokenOwners) : 'a different organization';\n  const requestedDescription = requestedOwner ? `\"${requestedOwner}\"` : 'the requested organization';\n  const scoped = scopedOwner(context.packageName);\n  return {\n    message: `The selected token was created for ${ownerDescription}, but this publication asks to use ${requestedDescription}.`,\n    hint: scoped\n      ? `Use a token created for \"${scoped}\", or rebuild the package under the organization scope this token acts for.`\n      : 'Correct or remove the explicit owner, or use a token created for the organization that should own this package.',\n    facts: compactFacts([\n      fact('requested-owner', requestedOwner),\n      ...tokenOwners.map((owner) => fact('token-owner', owner)),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst scopeMismatchSpec = defineSpec(scopeMismatchDetailsSchema, (details, context) => {\n  const requestedOwner = details.requestedScopeOwner ?? details.scopeOwner ?? scopedOwner(context.packageName);\n  const allowedOwners = details.allowedScopeOwners ?? details.tokenOwnerOrganizationNames ?? [];\n  const requestedDescription = requestedOwner ? `\"@${requestedOwner}\"` : 'The package scope';\n  const allowedDescription =\n    allowedOwners.length > 0\n      ? quotedList(allowedOwners.map((owner) => `@${owner}`))\n      : 'the organization this token acts for';\n  return {\n    message: `${requestedDescription} does not match ${allowedDescription}.`,\n    hint: 'Use a token created for the package scope, or rebuild the package under the organization scope this token acts for.',\n    facts: compactFacts([\n      fact('requested-owner', requestedOwner),\n      ...allowedOwners.map((owner) => fact('allowed-owner', owner)),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst initialTokenAccessSpec = defineSpec(tokenAccessDetailsSchema, (details) => {\n  const actualMode = details.actualPackageAccessMode ?? details.packageAccess?.mode;\n  const requiredMode = details.requiredPackageAccessMode ?? 'all';\n  const missing = details.missingCapabilities ?? (actualMode === undefined ? ['package.publish'] : []);\n  return {\n    message: 'This token cannot create a package during its first publication.',\n    hint: 'Create or use a token with Package Access set to All and permission to publish packages.',\n    facts: compactFacts([\n      fact('actual-access-mode', accessModeLabel(actualMode, 'package')),\n      fact('required-access-mode', accessModeLabel(requiredMode, 'package')),\n      ...missing.map((capability) => fact('missing-capability', capabilityLabel(capability))),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst tokenPermissionSpec = defineSpec(tokenPermissionDetailsSchema, (details) => ({\n  message: 'This token does not allow package publication.',\n  hint: 'Create or use a token with permission to publish packages, then try again.',\n  facts: (details.missingCapabilities ?? ['package.publish']).map((capability) => ({\n    kind: 'missing-capability' as const,\n    value: capabilityLabel(capability),\n  })),\n  resources: ['access-tokens'],\n}));\n\nconst oauthScopeSpec = defineSpec(oauthScopeDetailsSchema, (details) => ({\n  message: 'This CLI login does not include permission to submit publishing requests.',\n  hint: 'Reauthorize the login for this registry, then try publishing again.',\n  facts: (details.missingScopes ?? ['publishing.request.create']).map((scope) => ({\n    kind: 'missing-capability' as const,\n    value: oauthScopeLabel(scope),\n  })),\n  resources: ['login'],\n}));\n\nconst packageOwnerNotAuthorizedSpec = defineSpec(requestedOwnerDetailsSchema, (details, context) => {\n  const owner =\n    details.requestedOwnerOrganizationName ?? details.ownerOrganizationName ?? safeOwner(context.requestedOwner);\n  const allowedOwners = details.allowedOwnerOrganizationNames ?? [];\n  const scoped = scopedOwner(context.packageName);\n  const retryOwner = allowedOwners.length === 1 && !scoped ? allowedOwners[0] : undefined;\n  return {\n    message: owner\n      ? `Your account is not allowed to create this package for UAPKG organization \"${owner}\".`\n      : 'Your account is not allowed to create this package for the requested UAPKG organization.',\n    hint: scoped\n      ? allowedOwners.length > 0\n        ? 'This package’s `@owner` scope determines ownership. Rebuild it under one of the allowed UAPKG organization scopes shown above.'\n        : 'This package’s `@owner` scope determines ownership. Rebuild it under a UAPKG organization scope where you can publish, or ask an organization administrator to grant access.'\n      : retryOwner\n        ? `Retry with \\`--owner ${retryOwner}\\` to use the allowed UAPKG organization namespace.`\n        : allowedOwners.length > 0\n          ? 'Choose one of the allowed UAPKG organization namespaces with `--owner`, or ask a UAPKG organization administrator to grant access.'\n          : 'Choose a UAPKG organization namespace where you can publish, or ask a UAPKG organization administrator to grant access.',\n    facts: compactFacts([\n      fact('requested-owner', owner),\n      ...allowedOwners.map((allowedOwner) => fact('allowed-owner', allowedOwner)),\n    ]),\n  };\n});\n\nconst publishingAuthorityDeniedSpec = defineSpec(emptyDetailsSchema, (_details, context) => {\n  switch (context.credentialKind) {\n    case 'oidc':\n      return {\n        message: 'This GitHub Actions workflow does not currently have publishing authority for the package.',\n        hint: 'Check the package’s trusted-publisher repository, workflow, and optional GitHub Environment setting, then run the workflow again.',\n        resources: ['trusted-publishers'],\n      };\n    case 'gat':\n      return {\n        message: 'This granular access token does not currently have publishing authority for the package.',\n        hint: 'Create or use a token for the package owner with the required package access and publishing permission.',\n        resources: ['access-tokens'],\n      };\n    case 'login':\n      return {\n        message: 'Your account does not currently have publishing authority for the package.',\n        hint: 'Choose an owner organization where you can publish, or ask an organization administrator to grant access.',\n      };\n  }\n});\n\nconst tokenResourceAccessSpec = defineSpec(tokenAccessDetailsSchema, (details) => {\n  const actualPackageMode = details.actualPackageAccessMode ?? details.packageAccess?.mode;\n  const actualRegistryMode = details.actualRegistryAccessMode ?? details.registryAccess?.mode;\n  const requiredPackageModes = details.requiredPackageAccessModes;\n  const requiredRegistryModes = details.requiredRegistryAccessModes;\n  return {\n    message: 'This token does not cover the package or registry selected for publication.',\n    hint: 'Create or use a token whose package and registry access cover this publication.',\n    facts: compactFacts([\n      fact('actual-access-mode', accessModeLabel(actualPackageMode, 'package')),\n      fact('actual-access-mode', accessModeLabel(actualRegistryMode, 'registry')),\n      fact('required-access-mode', accessModesLabel(requiredPackageModes, 'package')),\n      fact('required-access-mode', accessModesLabel(requiredRegistryModes, 'registry')),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst oidcRepositorySpec = defineSpec(oidcRepositoryDetailsSchema, (details, context) => {\n  const submitted = details.submittedRepository ?? safeRepository(context.repository);\n  const trusted = details.trustedRepository;\n  if (!trusted) {\n    return {\n      message: 'The registry could not determine the trusted repository for this workflow session.',\n      hint: 'Start a new trusted-publishing workflow and try again. If the failure continues, review the trusted-publisher rule and report the server code.',\n      facts: compactFacts([fact('requested-repository', submitted)]),\n      resources: ['trusted-publishers'],\n    };\n  }\n  return {\n    message: submitted\n      ? `This workflow submitted \"${submitted}\", but its trusted-publisher rule is bound to \"${trusted}\".`\n      : 'The registry could not compare the package source with this workflow’s trusted-publisher rule.',\n    hint: submitted\n      ? 'Publish from the repository named by the trusted-publisher rule, or update the rule for the intended package source.'\n      : 'Start a new trusted-publishing workflow and try again. If the failure continues, report the server code.',\n    facts: compactFacts([fact('requested-repository', submitted), fact('trusted-repository', trusted)]),\n    resources: ['trusted-publishers'],\n  };\n});\n\nconst versionConflictSpec = (kind: 'exists' | 'tombstoned') =>\n  defineSpec(versionDetailsSchema, (_details, context) => {\n    const coordinate = packageCoordinate(context);\n    return kind === 'exists'\n      ? {\n          message: `${coordinate} is already published in this registry.`,\n          hint: 'Choose a new version in uapkg.json, rebuild the archive, and publish that version instead.',\n          resources: ['requests'],\n        }\n      : {\n          message: `${coordinate} was previously unpublished and cannot be reused.`,\n          hint: 'Choose a new version in uapkg.json, rebuild the archive, and publish that version instead.',\n          resources: ['requests'],\n        };\n  });\n\nconst activeRequestSpec = (ownershipConflict: boolean) =>\n  defineSpec(activeRequestDetailsSchema, (details, context) => {\n    const coordinate = packageCoordinate(context);\n    const readableRequestId = ownershipConflict ? undefined : details.activeRequestId;\n    return {\n      message: ownershipConflict\n        ? `Another organization already has an active first-publication request for ${safePackageLabel(context.packageName)}.`\n        : `An active publishing request already covers ${coordinate}.`,\n      hint: ownershipConflict\n        ? 'Wait for that request to finish before trying to claim this package name, or review your own request when a request ID is shown.'\n        : 'Wait for the active request to finish instead of submitting the same publication again.',\n      facts: compactFacts([fact('request-id', readableRequestId)]),\n      resources: ['requests'],\n      requestId: readableRequestId,\n    };\n  });\n\nconst haltedPackageSpec = defineSpec(haltedPackageDetailsSchema, (details, context) => ({\n  message: `Publishing for ${safePackageLabel(context.packageName)} is paused because an earlier request could not be completed.`,\n  hint: 'Review the earlier request and ask the registry operator to resolve its failure before publishing again.',\n  facts: compactFacts([fact('request-id', details.blockingRequestId)]),\n  resources: ['requests'],\n  requestId: details.blockingRequestId,\n}));\n\nconst rateLimitSpec = defineSpec(retryDetailsSchema, (details) => ({\n  message: 'Too many publishing requests were submitted in a short time.',\n  hint: details.retryAfterSeconds\n    ? `Wait ${formatDuration(details.retryAfterSeconds)}, then try publishing again.`\n    : 'Wait a moment, then try publishing again.',\n  facts: compactFacts([\n    fact('retry-after', details.retryAfterSeconds ? formatDuration(details.retryAfterSeconds) : undefined),\n  ]),\n}));\n\n/**\n * Explicit inventory of errors that can be returned synchronously while the\n * CLI submits POST /v1/registry-requests/publish. Unknown future codes use the\n * non-leaking fallback in {@link publishRequestDiagnosticForError}.\n */\nexport const PUBLISH_SUBMISSION_ERROR_CATALOG = {\n  // Authentication and request-bound authorization.\n  AUTH_REQUIRED: loginSpec('Authentication is required to publish this package.'),\n  CONTROL_PLANE_AUTHENTICATION_REQUIRED: loginSpec('The saved registry login was rejected.'),\n  DPOP_AUTH_UNAVAILABLE: internalServiceSpec('The registry cannot validate CLI logins right now.'),\n  DPOP_AUTH_REQUIRED: loginSpec('The publishing request did not include a valid CLI login.'),\n  DPOP_PROOF_INVALID: loginSpec('The saved CLI login proof was rejected.'),\n  DPOP_PROOF_REPLAYED: fixedSpec(\n    'The security proof for this CLI login was already used.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  DPOP_ACCESS_TOKEN_INVALID: loginSpec('The saved CLI login is invalid or no longer usable.'),\n  DPOP_PROOF_STALE: fixedSpec(\n    'The security proof for this CLI login expired before the request arrived.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  DPOP_NONCE_REQUIRED: fixedSpec(\n    'The registry could not complete the security challenge for this CLI login.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  REGISTRY_GRANT_INVALID: loginSpec('The registry login was revoked, expired, or belongs to another registry.'),\n  CLI_LOGIN_ACTIVATION_EXPIRED: loginSpec('This CLI login expired before the device finished confirming it.'),\n  ACCOUNT_NOT_ACTIVE: loginSpec('The account for this registry login is not active.'),\n  CLI_ACCESS_TOKEN_INVALID: loginSpec('The saved CLI login is invalid.'),\n  CLI_ACCESS_TOKEN_EXPIRED: loginSpec('The saved CLI login has expired.'),\n  OAUTH_SCOPE_INSUFFICIENT: oauthScopeSpec,\n  OAUTH_SCOPE_UNSUPPORTED: fixedSpec(\n    'This CLI version does not understand a capability required by the registry.',\n    'Update UAPKG CLI, sign in again, and retry the publication.',\n    ['login'],\n  ),\n  TOKEN_INVALID: tokenSpec('The selected granular access token is invalid.'),\n  TOKEN_REVOKED: tokenSpec('The selected granular access token has been revoked.'),\n  TOKEN_EXPIRED: tokenSpec('The selected granular access token has expired.'),\n  UAPKG_TOKEN_APPROVAL_PENDING: fixedSpec(\n    'The selected token is still waiting for organization approval.',\n    'Ask an organization administrator to approve the token, or select a different active token.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_APPROVAL_DENIED: fixedSpec(\n    'The organization denied the selected token request.',\n    'Use an approved token, or request a new token from the organization.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_ORGANIZATION_POLICY_DENIED: fixedSpec(\n    'The organization’s token policy blocks this publication.',\n    'Ask an organization administrator to review the token policy, or publish with an allowed credential.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_TEMPORARILY_BLOCKED_OWNER_MFA_REQUIRED: fixedSpec(\n    'This token is temporarily blocked because its owner must enable two-factor authentication.',\n    'Enable two-factor authentication for the token owner, then try again.',\n    ['access-tokens', 'security'],\n  ),\n  UAPKG_TOKEN_LIFECYCLE_DISABLED: tokenSpec('The selected token is not currently usable.'),\n  UAPKG_TOKEN_PERMISSION_DENIED: tokenPermissionSpec,\n  UAPKG_TOKEN_RESOURCE_ACCESS_DENIED: tokenResourceAccessSpec,\n  SECOND_FACTOR_REQUIRED: fixedSpec(\n    'A current two-factor authentication code is required for this publication.',\n    'Run the publish command again and enter the current code when prompted.',\n    ['security'],\n  ),\n  OTP_INVALID: fixedSpec(\n    'The two-factor authentication code was incorrect or expired.',\n    'Run the publish command again and enter a new code when prompted.',\n    ['security'],\n  ),\n  OTP_NOT_ENROLLED: fixedSpec(\n    'This account must enroll in two-factor authentication before publishing.',\n    'Enable two-factor authentication in account settings, then try publishing again.',\n    ['security'],\n  ),\n  OTP_RATE_LIMITED: rateLimitSpec,\n  OTP_ERROR: internalServiceSpec('The registry could not verify the two-factor authentication code.'),\n  OTP_UNSUPPORTED_PRINCIPAL: fixedSpec(\n    'This credential cannot use an interactive two-factor authentication code.',\n    'Select a CLI login or granular access token that supports attended publication.',\n  ),\n  SECURED_ACCOUNT_REQUIRED: fixedSpec(\n    'Publishing requires an active account with two-factor authentication enabled.',\n    'Activate the account and enable two-factor authentication, then try again.',\n    ['security'],\n  ),\n  ACTOR_WRITE_FORBIDDEN: fixedSpec(\n    'This account is not allowed to submit registry changes.',\n    'Use an account with publishing access, or ask an organization administrator for access.',\n  ),\n  UAPKG_PRINCIPAL_NOT_ALLOWED: fixedSpec(\n    'This kind of credential cannot submit a publishing request.',\n    'Use a CLI login, granular access token, or configured GitHub Actions trusted publisher.',\n  ),\n\n  // Ownership, package naming, and token access.\n  UNSCOPED_PACKAGE_OWNER_REQUIRED: unscopedOwnerSpec,\n  GAT_OWNER_ORGANIZATION_MISMATCH: gatOwnerMismatchSpec,\n  UAPKG_PACKAGE_SCOPE_OWNER_MISMATCH: scopeMismatchSpec,\n  UAPKG_REGISTRY_REQUIRES_SCOPED_PACKAGE: defineSpec(packageDetailsSchema, (_details, context) => ({\n    message: `This registry requires a scoped name for the first publication of ${safePackageLabel(context.packageName)}.`,\n    hint: 'Rename the package to `@organization/name`, rebuild the archive, and publish it again.',\n  })),\n  INITIAL_PUBLICATION_PACKAGE_ACCESS_ALL_REQUIRED: initialTokenAccessSpec,\n  PACKAGE_OWNER_NOT_AUTHORIZED: packageOwnerNotAuthorizedSpec,\n  INITIAL_PUBLICATION_CREDENTIAL_UNSUPPORTED: fixedSpec(\n    'This credential cannot create a package during its first publication.',\n    'Publish the package once with an interactive CLI login or an attended granular access token.',\n    ['login', 'access-tokens'],\n  ),\n  CLI_REGISTRY_GRANT_NOT_AUTHORIZED: fixedSpec(\n    'The saved CLI login cannot publish to this registry.',\n    'Reauthorize the login for the selected registry, then try again.',\n    ['login'],\n  ),\n  REGISTRY_WRITE_DENIED_REBAC: publishingAuthorityDeniedSpec,\n  GAT_CREDENTIAL_CONTEXT_REQUIRED: internalServiceSpec('The registry could not validate the selected token.'),\n  PACKAGE_OWNER_NOT_RESOLVED: internalServiceSpec('The registry could not determine this package’s owner.'),\n\n  // GitHub Actions trusted publishing.\n  OIDC_SESSION_INVALID: fixedSpec(\n    'The GitHub Actions publishing session expired or is no longer trusted.',\n    'Run the workflow again. If it still fails, verify that the package still has an active trusted-publisher rule for this repository and workflow.',\n    ['trusted-publishers'],\n  ),\n  OIDC_PROVIDER_UNAVAILABLE: fixedSpec(\n    'The registry cannot validate GitHub trusted publishing right now.',\n    'Run the workflow again later. If the failure continues, report the server code to the registry operator.',\n    ['trusted-publishers'],\n  ),\n  OIDC_INITIAL_PUBLICATION_NOT_SUPPORTED: fixedSpec(\n    'GitHub Actions cannot create this package during its first publication.',\n    'Publish the package once with an interactive CLI login, then configure its trusted-publisher rule and rerun the workflow.',\n    ['login', 'trusted-publishers'],\n  ),\n  OIDC_SOURCE_REPOSITORY_MISMATCH: oidcRepositorySpec,\n  TRUSTED_PUBLISHER_NOT_AUTHORIZED: fixedSpec(\n    'This GitHub Actions workflow is not authorized to publish the package.',\n    'Check the package’s trusted-publisher repository, workflow, and optional GitHub Environment setting, then rerun the workflow.',\n    ['trusted-publishers'],\n  ),\n\n  // Archive, source, claims, and request-contract validation.\n  INVALID_PACKAGE_NAME: fixedSpec(\n    'The packaged manifest contains an invalid package name.',\n    'Set `name` in uapkg.json to a name such as `my-package` or `@organization/my-package`, rebuild the archive, and publish it again.',\n  ),\n  SCOPED_PACKAGES_DISABLED: fixedSpec(\n    'The selected registry does not accept organization-scoped package names.',\n    'Select a registry that supports scoped packages, or intentionally rename and rebuild the package as an unscoped package with an explicit owner.',\n    ['registries', 'owner-command'],\n  ),\n  INVALID_VERSION: fixedSpec(\n    'The packaged manifest contains an invalid semantic version.',\n    'Set `version` in uapkg.json to a semantic version such as `1.2.3`, rebuild the archive, and publish it again.',\n  ),\n  INVALID_OWNER_ORGANIZATION_NAME: fixedSpec(\n    'The selected owner is not a valid organization name.',\n    'Correct `--owner <organization>` or `publish.owner` in uapkg.json, then try publishing again.',\n    ['owner-command'],\n  ),\n  SOURCE_REQUIRED: fixedSpec(\n    'The publishing request did not identify its GitHub Release source.',\n    'Set `publish.repository` or pass `--repository owner/repository`, and make sure the release tag and asset exist before retrying.',\n  ),\n  GITHUB_RELEASE_SOURCE_REQUIRED: fixedSpec(\n    'The publishing request did not identify its GitHub Release source.',\n    'Set `publish.repository` or pass `--repository owner/repository`, and make sure the release tag and asset exist before retrying.',\n  ),\n  SOURCE_TYPE_UNSUPPORTED: fixedSpec(\n    'The registry does not support this kind of package source.',\n    'Publish from an uploaded GitHub Release asset. If this CLI produced another source type, update it and try again.',\n  ),\n  GITHUB_REPOSITORY_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub repository coordinate.',\n    'Pass `--repository owner/repository` or correct `publish.repository` in uapkg.json, then try again.',\n  ),\n  RELEASE_TAG_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub Release tag.',\n    'Pass a non-empty GitHub Release tag with `--tag <tag>`, or correct the package version used by the default tag.',\n  ),\n  RELEASE_ASSET_NAME_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub Release asset name.',\n    'Pass the uploaded file name—not a path—with `--asset <file-name>`, then try again.',\n  ),\n  OBSERVED_INTEGRITY_REQUIRED: fixedSpec(\n    'The publishing request is missing the archive’s integrity information.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  OBSERVED_DIGEST_INVALID: fixedSpec(\n    'The publishing request contains an invalid archive digest.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  OBSERVED_SIZE_INVALID: fixedSpec(\n    'The publishing request contains an invalid archive size.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  CLAIMS_REQUIRED: fixedSpec(\n    'The publishing request is missing package information from the packaged manifest.',\n    'Rebuild the archive so it contains a valid uapkg.json, then publish the rebuilt file.',\n  ),\n  CLAIMS_IDENTITY_MISMATCH: fixedSpec(\n    'The package name or version inside the archive does not match the publication being submitted.',\n    'Rebuild the archive from the intended uapkg.json and publish the rebuilt file.',\n  ),\n  CLAIMS_PRIVATE_INVALID: fixedSpec(\n    'The packaged manifest has an invalid private-package setting.',\n    'Set `private` in uapkg.json to `true` or `false`, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_BUCKET_INVALID: fixedSpec(\n    'The packaged manifest has an invalid dependency section.',\n    'Make each dependency section in uapkg.json an object, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCIES_TOO_MANY: fixedSpec(\n    'A dependency section in the packaged manifest is too large.',\n    'Reduce the dependency entries in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_NAME_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency name.',\n    'Correct the dependency name in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_RANGE_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency version range.',\n    'Set a non-empty bounded version range for the dependency, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_REGISTRY_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency registry.',\n    'Correct the dependency registry alias in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_FIELDS_INVALID: fixedSpec(\n    'A packaged dependency contains unsupported fields.',\n    'Remove unsupported dependency fields from uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  OFFICIAL_REGISTRY_PRIVATE_PACKAGE_FORBIDDEN: fixedSpec(\n    'This package is marked private, but the selected registry accepts only public packages.',\n    'Publish to a private registry, or intentionally remove the private setting, rebuild the archive, and try again.',\n    ['registries'],\n  ),\n  SERVER_RESOLVED_METADATA_NOT_ALLOWED: clientRequestSpec('The publishing request contains server-owned metadata.'),\n  UNRECOGNIZED_REQUEST_FIELDS: clientRequestSpec(\n    'The publishing request contains fields this registry does not recognize.',\n  ),\n  INVALID_REGISTRY_ID: clientRequestSpec('The CLI resolved an invalid registry identity.'),\n  PAYLOAD_TOO_LARGE: fixedSpec(\n    'The packaged publication information is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  REQUEST_BODY_TOO_LARGE: fixedSpec(\n    'The publishing request is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  UAPKG_OPERATION_INPUT_TOO_LARGE: fixedSpec(\n    'The publishing request is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  INVALID_CONTENT_LENGTH: clientRequestSpec('The registry received an incomplete publishing request.'),\n  INVALID_JSON: clientRequestSpec('The registry could not read the publishing request.'),\n  INVALID_REQUEST_BODY: clientRequestSpec('The registry could not understand the publishing request.'),\n  UAPKG_OPERATION_INPUT_INVALID: clientRequestSpec('The registry could not understand the publishing request.'),\n  IDEMPOTENCY_KEY_REQUIRED: clientRequestSpec('The publishing request was missing its retry-safety key.'),\n  REQUEST_KIND_NOT_PUBLIC: internalServiceSpec('The CLI reached the wrong registry operation.'),\n  SOURCE_NOT_ALLOWED: internalServiceSpec('The CLI reached the wrong registry operation for an artifact publication.'),\n  REASON_REQUIRED: internalServiceSpec('The CLI reached an operation that requires a reason.'),\n  DEPRECATION_MESSAGE_REQUIRED: internalServiceSpec(\n    'The CLI reached an operation that requires a deprecation message.',\n  ),\n\n  // Registry readiness, versions, and concurrent requests.\n  REGISTRY_NOT_FOUND: fixedSpec(\n    'The selected registry is no longer available to the publishing service.',\n    'Refresh or reconfigure the registry, then try publishing again.',\n    ['registries'],\n  ),\n  REGISTRY_LINK_MISSING: fixedSpec(\n    'The selected registry is not connected to an initialized repository.',\n    'Finish the registry repository connection in account settings, then try publishing again.',\n    ['registries'],\n  ),\n  REGISTRY_LINK_NOT_READY: fixedSpec(\n    'The selected registry repository connection is incomplete.',\n    'Finish reconnecting the registry repository in account settings, then try publishing again.',\n    ['registries'],\n  ),\n  PACKAGE_POLICY_NOT_CONFIGURED: internalServiceSpec(\n    'The registry is not ready to assign ownership for a new package.',\n  ),\n  PACKAGE_NOT_FOUND: fixedSpec(\n    'The package does not exist in the selected registry.',\n    'Check the package and registry, then try again.',\n    ['registries'],\n  ),\n  PACKAGE_HALTED: haltedPackageSpec,\n  VERSION_ALREADY_EXISTS: versionConflictSpec('exists'),\n  VERSION_TOMBSTONED: versionConflictSpec('tombstoned'),\n  DUPLICATE_ACTIVE_REQUEST: activeRequestSpec(false),\n  PACKAGE_OWNERSHIP_PENDING_CONFLICT: activeRequestSpec(true),\n  IDEMPOTENCY_KEY_CONFLICT: fixedSpec(\n    'The retry-safety key for this publication is already attached to a different request.',\n    'Run the publication again. If the conflict continues, report the server code to the registry operator.',\n    ['requests'],\n  ),\n  RATE_LIMIT_EXCEEDED: rateLimitSpec,\n\n  // Defensive catalog entries for invalid route state and server failures.\n  REQUEST_ATTRIBUTION_INVALID: internalServiceSpec('The registry could not safely attribute this publishing request.'),\n  AUTHORIZATION_RECEIPT_REQUIRED: internalServiceSpec(\n    'The registry could not preserve authorization for this request.',\n  ),\n  REQUEST_CREATE_FAILED: internalServiceSpec('The registry could not save the publishing request.'),\n  OPERATION_AUTHORIZATION_ACTION_MISMATCH: internalServiceSpec('The publishing endpoint is misconfigured.'),\n  OPERATION_BODY_LIMIT_UNREGISTERED: internalServiceSpec('The publishing endpoint is missing its request-size policy.'),\n  UAPKG_OPERATION_BINDING_MISMATCH: internalServiceSpec('The publishing endpoint is bound incorrectly.'),\n  UAPKG_OPERATION_BINDER_MISMATCH: internalServiceSpec(\n    'The publishing endpoint uses the wrong authentication boundary.',\n  ),\n  UAPKG_OPERATION_BODY_LIMIT_UNREGISTERED: internalServiceSpec(\n    'The publishing endpoint is missing its request-size policy.',\n  ),\n  UAPKG_SERVICE_AUTHENTICATION_REQUIRED: internalServiceSpec(\n    'The publishing endpoint rejected an unsupported credential.',\n  ),\n  REGISTRY_REQUEST_RESPONSE_INVALID: internalServiceSpec('The registry returned an invalid publishing response.'),\n  CONTROL_PLANE_RESPONSE_NOT_JSON: internalServiceSpec('The registry returned an unreadable publishing response.'),\n\n  // These normally belong to lifecycle routes, but cataloging them keeps a\n  // misrouted publish response helpful and non-leaking.\n  DESTRUCTIVE_POLICY_NOT_CONFIGURED: internalServiceSpec('The registry’s version policy is not configured.'),\n  PACKAGE_VERSION_TARGET_NOT_FOUND: fixedSpec(\n    'The selected package version does not exist in the registry.',\n    'Check the package version and selected registry.',\n    ['requests'],\n  ),\n  VERSION_ALREADY_UNPUBLISHED: fixedSpec(\n    'This package version is already unpublished.',\n    'No further action is needed.',\n  ),\n  VERSION_ALREADY_YANKED: fixedSpec('This package version is already yanked.', 'No further action is needed.'),\n  VERSION_NOT_YANKED: fixedSpec(\n    'This package version is not yanked.',\n    'Check the current request state before trying again.',\n  ),\n  VERSION_ALREADY_DEPRECATED: fixedSpec('This package version is already deprecated.', 'No further action is needed.'),\n  VERSION_NOT_DEPRECATED: fixedSpec(\n    'This package version is not deprecated.',\n    'Check the current request state before trying again.',\n  ),\n  UNPUBLISH_WINDOW_EXPIRED: fixedSpec(\n    'The allowed time window for unpublishing this version has closed.',\n    'Contact the registry operator if the version presents a security or legal issue.',\n  ),\n} as const satisfies Record<string, PublishErrorSpec>;\n\nexport type PublishSubmissionErrorCode = keyof typeof PUBLISH_SUBMISSION_ERROR_CATALOG;\n\nexport function publishRequestDiagnosticForError(\n  error: unknown,\n  context: PublishRequestErrorContext,\n): PublishRequestFailedDiagnostic {\n  const serverCode = validatedServerCode(error);\n  const status = validatedStatus(error);\n  const spec = serverCode\n    ? (PUBLISH_SUBMISSION_ERROR_CATALOG as Record<string, PublishErrorSpec>)[serverCode]\n    : undefined;\n  const guidance = spec\n    ? spec.build(error instanceof ControlPlaneError ? error.details : undefined, context)\n    : fallback(error, status);\n  const facts = dedupeFacts([...baseFacts(context), ...(guidance.facts ?? [])]);\n  const resources = resourcesFor(guidance.resources ?? [], context, guidance.requestId);\n\n  return createPublishRequestFailedDiagnostic(\n    guidance.message,\n    {\n      ...(serverCode ? { serverCode } : {}),\n      ...(status !== undefined ? { status } : {}),\n      facts,\n      resources,\n    },\n    guidance.hint,\n  );\n}\n\nfunction fallback(error: unknown, status: number | undefined): PublishGuidance {\n  if (isNetworkFailure(error)) {\n    return {\n      message: 'UAPKG could not reach the publishing service.',\n      hint: 'Check the network connection and registry availability, then try publishing again.',\n    };\n  }\n  if (status !== undefined && status >= 500) {\n    return {\n      message: 'The publishing service could not complete the request.',\n      hint: RETRY_AND_REPORT,\n    };\n  }\n  return {\n    message: 'The registry did not accept the publishing request.',\n    hint: 'Review the publication details and try again. If the failure continues, report this diagnostic to the registry operator.',\n  };\n}\n\nfunction baseFacts(context: PublishRequestErrorContext): PublishDiagnosticFact[] {\n  const registryName = safeDisplayValue(context.registryName ?? '', 100);\n  const registryAlias = safeDisplayValue(context.registryAlias, 100);\n  const registry =\n    registryName && registryAlias && registryName !== registryAlias\n      ? `${registryName} (${registryAlias})`\n      : (registryName ?? registryAlias);\n  return compactFacts([\n    fact('package', safeDisplayValue(context.packageName, 214)),\n    fact('version', safeDisplayValue(context.packageVersion, 256)),\n    fact('registry', registry),\n    fact('credential-kind', credentialKindLabel(context.credentialKind)),\n    fact('requested-owner', safeOwner(context.requestedOwner)),\n    fact('repository', safeRepository(context.repository)),\n  ]);\n}\n\nfunction resourcesFor(\n  requested: readonly ResourceKind[],\n  context: PublishRequestErrorContext,\n  requestId?: string,\n): PublishDiagnosticResource[] {\n  const kinds = [...new Set([...requested, 'help' as const])];\n  const accountOrigin = accountOriginForIssuer(context.registryIssuer);\n  const resources: PublishDiagnosticResource[] = [];\n  for (const kind of kinds) {\n    switch (kind) {\n      case 'help':\n        resources.push({ kind: 'command', command: 'uapkg publish --help', label: 'Publish command help' });\n        break;\n      case 'login':\n        resources.push({\n          kind: 'command',\n          command: `uapkg login --registry ${shellDisplayArgument(context.registryAlias)} --reauthorize`,\n          label: 'Reauthorize this registry login',\n        });\n        break;\n      case 'owner-command':\n        resources.push({\n          kind: 'command',\n          command: 'uapkg publish --owner <organization>',\n          label: 'Publish with an explicit owner',\n        });\n        break;\n      case 'requests':\n        if (requestId) {\n          resources.push({\n            kind: 'command',\n            command: `uapkg requests status ${requestId}`,\n            label: 'Inspect the related request',\n          });\n        }\n        addAccountUrl(resources, accountOrigin, '/requests', 'Publishing requests');\n        break;\n      case 'access-tokens':\n        addAccountUrl(resources, accountOrigin, '/settings/access-tokens', 'Access token settings');\n        break;\n      case 'trusted-publishers':\n        addAccountUrl(resources, accountOrigin, '/trusted-publishers', 'Trusted publishers');\n        break;\n      case 'registries':\n        addAccountUrl(resources, accountOrigin, '/settings/registries', 'Registry settings');\n        break;\n      case 'security':\n        addAccountUrl(\n          resources,\n          accountOrigin,\n          '/settings/two-factor-authentication',\n          'Two-factor authentication settings',\n        );\n        break;\n    }\n  }\n  return dedupeResources(resources);\n}\n\nfunction addAccountUrl(\n  resources: PublishDiagnosticResource[],\n  origin: string | undefined,\n  path: string,\n  label: string,\n): void {\n  if (!origin) return;\n  resources.push({ kind: 'url', url: new URL(path, origin).href, label });\n}\n\nfunction accountOriginForIssuer(issuer: string): string | undefined {\n  try {\n    const url = new URL(issuer);\n    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction validatedServerCode(error: unknown): string | undefined {\n  return error instanceof ControlPlaneError && SERVER_CODE_PATTERN.test(error.code) ? error.code : undefined;\n}\n\nfunction validatedStatus(error: unknown): number | undefined {\n  if (!(error instanceof ControlPlaneError) || error.status === undefined) return undefined;\n  return Number.isInteger(error.status) && error.status >= 100 && error.status <= 599 ? error.status : undefined;\n}\n\nfunction isNetworkFailure(error: unknown): boolean {\n  return (\n    error instanceof TypeError ||\n    (error instanceof Error && (error.name === 'AbortError' || error.name === 'TimeoutError'))\n  );\n}\n\nfunction safeDisplayValue(value: unknown, maximumLength: number): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= maximumLength && !hasUnsafeDisplayCharacter(normalized)\n    ? normalized\n    : undefined;\n}\n\nfunction hasUnsafeDisplayCharacter(value: string): boolean {\n  for (const character of value) {\n    const codePoint = character.codePointAt(0);\n    if (\n      codePoint !== undefined &&\n      (codePoint <= 0x1f ||\n        (codePoint >= 0x7f && codePoint <= 0x9f) ||\n        codePoint === 0x061c ||\n        codePoint === 0x200e ||\n        codePoint === 0x200f ||\n        (codePoint >= 0x2028 && codePoint <= 0x202e) ||\n        (codePoint >= 0x2066 && codePoint <= 0x2069))\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction safeOwner(value: unknown): string | undefined {\n  const parsed = ownerNameSchema.safeParse(value);\n  return parsed.success ? parsed.data : undefined;\n}\n\nfunction safeRepository(value: unknown): string | undefined {\n  const parsed = repositorySchema.safeParse(value);\n  return parsed.success ? parsed.data : undefined;\n}\n\nfunction safePackageLabel(packageName: string): string {\n  const safe = safeDisplayValue(packageName, 214);\n  return safe ? `\"${safe}\"` : 'this package';\n}\n\nfunction packageCoordinate(context: PublishRequestErrorContext): string {\n  const packageName = safeDisplayValue(context.packageName, 214);\n  const version = safeDisplayValue(context.packageVersion, 256);\n  return packageName && version ? `\"${packageName}@${version}\"` : 'This package version';\n}\n\nfunction scopedOwner(packageName: string): string | undefined {\n  const match = safeDisplayValue(packageName, 214)?.match(/^@([^/]+)\\//u);\n  return safeOwner(match?.[1]);\n}\n\nfunction credentialKindLabel(kind: PublishRequestErrorContext['credentialKind']): string {\n  switch (kind) {\n    case 'login':\n      return 'CLI login';\n    case 'gat':\n      return 'Granular access token';\n    case 'oidc':\n      return 'GitHub Actions trusted publishing';\n  }\n}\n\nfunction capabilityLabel(capability: z.output<typeof missingCapabilitiesSchema>[number]): string {\n  return capability === 'package.publish' ? 'Publish packages' : 'Submit publishing requests';\n}\n\nfunction oauthScopeLabel(scope: z.output<typeof missingOAuthScopesSchema>[number]): string {\n  return scope === 'publishing.request.create' ? 'Submit publishing requests' : 'Read your publishing requests';\n}\n\nfunction accessModeLabel(\n  mode: z.output<typeof accessModeSchema> | undefined,\n  category: 'package' | 'registry',\n): string | undefined {\n  if (!mode) return undefined;\n  const noun = category === 'package' ? 'packages' : 'registries';\n  switch (mode) {\n    case 'none':\n      return `No ${noun}`;\n    case 'selected':\n      return `Selected ${noun}`;\n    case 'all':\n      return `All ${noun}`;\n  }\n}\n\nfunction accessModesLabel(\n  modes: readonly ('selected' | 'all')[] | undefined,\n  category: 'package' | 'registry',\n): string | undefined {\n  if (!modes || modes.length === 0) return undefined;\n  const labels = [...new Set(modes)].map((mode) => accessModeLabel(mode, category)).filter(Boolean);\n  return labels.join(' or ');\n}\n\nfunction formatDuration(seconds: number): string {\n  if (seconds === 1) return '1 second';\n  if (seconds < 60) return `${seconds} seconds`;\n  if (seconds % 60 === 0) {\n    const minutes = seconds / 60;\n    return `${minutes} ${minutes === 1 ? 'minute' : 'minutes'}`;\n  }\n  return `${seconds} seconds`;\n}\n\nfunction quotedList(values: readonly string[]): string {\n  const quoted = values.map((value) => `\"${value}\"`);\n  if (quoted.length === 1) return quoted[0] as string;\n  if (quoted.length === 2) return `${quoted[0]} or ${quoted[1]}`;\n  return `${quoted.slice(0, -1).join(', ')}, or ${quoted.at(-1)}`;\n}\n\nfunction fact(kind: PublishDiagnosticFact['kind'], value: string | undefined): PublishDiagnosticFact | undefined {\n  return value ? { kind, value } : undefined;\n}\n\nfunction compactFacts(facts: readonly (PublishDiagnosticFact | undefined)[]): PublishDiagnosticFact[] {\n  return facts.filter((value): value is PublishDiagnosticFact => value !== undefined);\n}\n\nfunction dedupeFacts(facts: readonly PublishDiagnosticFact[]): PublishDiagnosticFact[] {\n  const seen = new Set<string>();\n  return facts.filter((factValue) => {\n    const key = `${factValue.kind}\\0${factValue.value}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction dedupeResources(resources: readonly PublishDiagnosticResource[]): PublishDiagnosticResource[] {\n  const seen = new Set<string>();\n  return resources.filter((resource) => {\n    const key = resource.kind === 'command' ? `command\\0${resource.command}` : `url\\0${resource.url}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction shellDisplayArgument(value: string): string {\n  const safe = safeDisplayValue(value, 100);\n  return safe && /^[A-Za-z0-9._-]+$/u.test(safe) ? safe : '<registry>';\n}\n"],"mappings":";;;;;AASA,MAAM,sBAAsB;AAE5B,MAAM,eAAe,kBACnB,EACG,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,CAAC,CAAC,CACN,IAAI,aAAa,CAAC,CAClB,QAAQ,UAAU,CAAC,0BAA0B,KAAK,CAAC;AACxD,MAAM,oBAAoB,YAAY,GAAG;AACzC,MAAM,uBAAuB,YAAY,GAAG;AAC5C,MAAM,kBAAkB,YAAY,GAAG,CAAC,CAAC,MAAM,8BAA8B;AAC7E,MAAM,mBAAmB,YAAY,GAAG,CAAC,CAAC,MAAM,qCAAqC;AACrF,MAAM,kBAAkB,YAAY,GAAG,CAAC,CAAC,MAAM,gCAAgC;AAC/E,MAAM,mBAAmB,EAAE,KAAK;CAAC;CAAQ;CAAY;AAAK,CAAC;AAC3D,MAAM,4BAA4B,EAC/B,MAAM,EAAE,KAAK,CAAC,mBAAmB,2BAA2B,CAAC,CAAC,CAAC,CAC/D,IAAI,EAAE,CAAC,CACP,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC;AAC7C,MAAM,2BAA2B,EAC9B,MAAM,EAAE,KAAK,CAAC,6BAA6B,8BAA8B,CAAC,CAAC,CAAC,CAC5E,IAAI,CAAC,CAAC,CACN,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC;AAC7C,MAAM,mBAAmB,EACtB,MAAM,eAAe,CAAC,CACtB,IAAI,EAAE,CAAC,CACP,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAEpD,MAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC;AACtC,MAAM,uBAAuB,EAAE,OAAO,EAAE,aAAa,kBAAkB,SAAS,EAAE,CAAC;AACnF,MAAM,6BAA6B;AACnC,MAAM,8BAA8B,qBAAqB,OAAO;CAC9D,gCAAgC,gBAAgB,SAAS;CACzD,uBAAuB,gBAAgB,SAAS;CAChD,+BAA+B,iBAAiB,SAAS;AAC3D,CAAC;AACD,MAAM,gCAAgC,qBAAqB,OAAO;CAChE,gCAAgC,gBAAgB,SAAS;CACzD,6BAA6B,iBAAiB,SAAS;AACzD,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO;CAC7D,qBAAqB,gBAAgB,SAAS;CAC9C,YAAY,gBAAgB,SAAS;CACrC,oBAAoB,iBAAiB,SAAS;CAC9C,6BAA6B,iBAAiB,SAAS;AACzD,CAAC;AACD,MAAM,2BAA2B,qBAAqB,OAAO;CAC3D,yBAAyB,iBAAiB,SAAS;CACnD,2BAA2B,EAAE,QAAQ,KAAK,CAAC,CAAC,SAAS;CACrD,qBAAqB,0BAA0B,SAAS;CACxD,eAAe,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,SAAS;CAC7D,0BAA0B,iBAAiB,SAAS;CACpD,6BAA6B,EAC1B,MAAM,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAClC,IAAI,CAAC,CAAC,CACN,SAAS;CACZ,4BAA4B,EACzB,MAAM,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAClC,IAAI,CAAC,CAAC,CACN,SAAS;CACZ,gBAAgB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,SAAS;AAChE,CAAC;AACD,MAAM,+BAA+B,EAAE,OAAO,EAC5C,qBAAqB,0BAA0B,SAAS,EAC1D,CAAC;AACD,MAAM,0BAA0B,EAAE,OAAO,EACvC,eAAe,yBAAyB,SAAS,EACnD,CAAC;AACD,MAAM,8BAA8B,qBAAqB,OAAO;CAC9D,qBAAqB,iBAAiB,SAAS;CAC/C,mBAAmB,iBAAiB,SAAS;AAC/C,CAAC;AACD,MAAM,uBAAuB,EAAE,OAAO;CACpC,aAAa,kBAAkB,SAAS;CACxC,gBAAgB,qBAAqB,SAAS;AAChD,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO,EAC7D,iBAAiB,gBAAgB,SAAS,EAC5C,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO,EAC7D,mBAAmB,gBAAgB,SAAS,EAC9C,CAAC;AACD,MAAM,qBAAqB,EAAE,OAAO,EAClC,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAM,CAAC,CAAC,SAAS,EAClE,CAAC;AAmCD,SAAS,WACP,QACA,OACkB;CAClB,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;CAC7B,OAAO,EACL,MAAM,SAAS,SAAS;EACtB,MAAM,SAAS,OAAO,UAAU,WAAW,CAAC,CAAC;EAC7C,OAAO,MAAM,OAAO,UAAU,OAAO,OAAO,OAAO,OAAO;CAC5D,EACF;AACF;AAEA,SAAS,UAAU,SAAiB,MAAc,YAAqC,CAAC,GAAqB;CAC3G,OAAO,WAAW,2BAA2B;EAAE;EAAS;EAAM;CAAU,EAAE;AAC5E;AAEA,MAAM,0BACJ;AACF,MAAM,mBACJ;AACF,MAAM,cAAc;AACpB,MAAM,cACJ;AAEF,MAAM,qBAAqB,YAAoB,UAAU,SAAS,uBAAuB;AACzF,MAAM,uBAAuB,YAAoB,UAAU,SAAS,gBAAgB;AACpF,MAAM,aAAa,YAAoB,UAAU,SAAS,aAAa,CAAC,OAAO,CAAC;AAChF,MAAM,aAAa,YAAoB,UAAU,SAAS,aAAa,CAAC,eAAe,CAAC;AAExF,MAAM,oBAAoB,WAAW,6BAA6B,UAAU,YAAY;CACtF,MAAM,cAAc,iBAAiB,QAAQ,aAAa,GAAG;CAC7D,OAAO;EACL,SAAS,cACL,IAAI,YAAY,gFAChB;EACJ,MAAM;EACN,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,uBAAuB,WAAW,gCAAgC,SAAS,YAAY;CAC3F,MAAM,iBAAiB,QAAQ,kCAAkC,UAAU,QAAQ,cAAc;CACjG,MAAM,cAAc,QAAQ,+BAA+B,CAAC;CAC5D,MAAM,mBAAmB,YAAY,SAAS,IAAI,WAAW,WAAW,IAAI;CAC5E,MAAM,uBAAuB,iBAAiB,IAAI,eAAe,KAAK;CACtE,MAAM,SAAS,YAAY,QAAQ,WAAW;CAC9C,OAAO;EACL,SAAS,sCAAsC,iBAAiB,qCAAqC,qBAAqB;EAC1H,MAAM,SACF,4BAA4B,OAAO,+EACnC;EACJ,OAAO,aAAa,CAClB,KAAK,mBAAmB,cAAc,GACtC,GAAG,YAAY,KAAK,UAAU,KAAK,eAAe,KAAK,CAAC,CAC1D,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,oBAAoB,WAAW,6BAA6B,SAAS,YAAY;CACrF,MAAM,iBAAiB,QAAQ,uBAAuB,QAAQ,cAAc,YAAY,QAAQ,WAAW;CAC3G,MAAM,gBAAgB,QAAQ,sBAAsB,QAAQ,+BAA+B,CAAC;CAM5F,OAAO;EACL,SAAS,GANkB,iBAAiB,KAAK,eAAe,KAAK,oBAMpC,kBAJjC,cAAc,SAAS,IACnB,WAAW,cAAc,KAAK,UAAU,IAAI,OAAO,CAAC,IACpD,uCAEkE;EACtE,MAAM;EACN,OAAO,aAAa,CAClB,KAAK,mBAAmB,cAAc,GACtC,GAAG,cAAc,KAAK,UAAU,KAAK,iBAAiB,KAAK,CAAC,CAC9D,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,yBAAyB,WAAW,2BAA2B,YAAY;CAC/E,MAAM,aAAa,QAAQ,2BAA2B,QAAQ,eAAe;CAC7E,MAAM,eAAe,QAAQ,6BAA6B;CAC1D,MAAM,UAAU,QAAQ,wBAAwB,eAAe,SAAY,CAAC,iBAAiB,IAAI,CAAC;CAClG,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa;GAClB,KAAK,sBAAsB,gBAAgB,YAAY,SAAS,CAAC;GACjE,KAAK,wBAAwB,gBAAgB,cAAc,SAAS,CAAC;GACrE,GAAG,QAAQ,KAAK,eAAe,KAAK,sBAAsB,gBAAgB,UAAU,CAAC,CAAC;EACxF,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,sBAAsB,WAAW,+BAA+B,aAAa;CACjF,SAAS;CACT,MAAM;CACN,QAAQ,QAAQ,uBAAuB,CAAC,iBAAiB,EAAC,CAAE,KAAK,gBAAgB;EAC/E,MAAM;EACN,OAAO,gBAAgB,UAAU;CACnC,EAAE;CACF,WAAW,CAAC,eAAe;AAC7B,EAAE;AAEF,MAAM,iBAAiB,WAAW,0BAA0B,aAAa;CACvE,SAAS;CACT,MAAM;CACN,QAAQ,QAAQ,iBAAiB,CAAC,2BAA2B,EAAC,CAAE,KAAK,WAAW;EAC9E,MAAM;EACN,OAAO,gBAAgB,KAAK;CAC9B,EAAE;CACF,WAAW,CAAC,OAAO;AACrB,EAAE;AAEF,MAAM,gCAAgC,WAAW,8BAA8B,SAAS,YAAY;CAClG,MAAM,QACJ,QAAQ,kCAAkC,QAAQ,yBAAyB,UAAU,QAAQ,cAAc;CAC7G,MAAM,gBAAgB,QAAQ,iCAAiC,CAAC;CAChE,MAAM,SAAS,YAAY,QAAQ,WAAW;CAC9C,MAAM,aAAa,cAAc,WAAW,KAAK,CAAC,SAAS,cAAc,KAAK;CAC9E,OAAO;EACL,SAAS,QACL,8EAA8E,MAAM,MACpF;EACJ,MAAM,SACF,cAAc,SAAS,IACrB,mIACA,iLACF,aACE,wBAAwB,WAAW,uDACnC,cAAc,SAAS,IACrB,uIACA;EACR,OAAO,aAAa,CAClB,KAAK,mBAAmB,KAAK,GAC7B,GAAG,cAAc,KAAK,iBAAiB,KAAK,iBAAiB,YAAY,CAAC,CAC5E,CAAC;CACH;AACF,CAAC;AAED,MAAM,gCAAgC,WAAW,qBAAqB,UAAU,YAAY;CAC1F,QAAQ,QAAQ,gBAAhB;EACE,KAAK,QACH,OAAO;GACL,SAAS;GACT,MAAM;GACN,WAAW,CAAC,oBAAoB;EAClC;EACF,KAAK,OACH,OAAO;GACL,SAAS;GACT,MAAM;GACN,WAAW,CAAC,eAAe;EAC7B;EACF,KAAK,SACH,OAAO;GACL,SAAS;GACT,MAAM;EACR;CACJ;AACF,CAAC;AAED,MAAM,0BAA0B,WAAW,2BAA2B,YAAY;CAChF,MAAM,oBAAoB,QAAQ,2BAA2B,QAAQ,eAAe;CACpF,MAAM,qBAAqB,QAAQ,4BAA4B,QAAQ,gBAAgB;CACvF,MAAM,uBAAuB,QAAQ;CACrC,MAAM,wBAAwB,QAAQ;CACtC,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa;GAClB,KAAK,sBAAsB,gBAAgB,mBAAmB,SAAS,CAAC;GACxE,KAAK,sBAAsB,gBAAgB,oBAAoB,UAAU,CAAC;GAC1E,KAAK,wBAAwB,iBAAiB,sBAAsB,SAAS,CAAC;GAC9E,KAAK,wBAAwB,iBAAiB,uBAAuB,UAAU,CAAC;EAClF,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,qBAAqB,WAAW,8BAA8B,SAAS,YAAY;CACvF,MAAM,YAAY,QAAQ,uBAAuB,eAAe,QAAQ,UAAU;CAClF,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,SACH,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa,CAAC,KAAK,wBAAwB,SAAS,CAAC,CAAC;EAC7D,WAAW,CAAC,oBAAoB;CAClC;CAEF,OAAO;EACL,SAAS,YACL,4BAA4B,UAAU,iDAAiD,QAAQ,MAC/F;EACJ,MAAM,YACF,yHACA;EACJ,OAAO,aAAa,CAAC,KAAK,wBAAwB,SAAS,GAAG,KAAK,sBAAsB,OAAO,CAAC,CAAC;EAClG,WAAW,CAAC,oBAAoB;CAClC;AACF,CAAC;AAED,MAAM,uBAAuB,SAC3B,WAAW,uBAAuB,UAAU,YAAY;CACtD,MAAM,aAAa,kBAAkB,OAAO;CAC5C,OAAO,SAAS,WACZ;EACE,SAAS,GAAG,WAAW;EACvB,MAAM;EACN,WAAW,CAAC,UAAU;CACxB,IACA;EACE,SAAS,GAAG,WAAW;EACvB,MAAM;EACN,WAAW,CAAC,UAAU;CACxB;AACN,CAAC;AAEH,MAAM,qBAAqB,sBACzB,WAAW,6BAA6B,SAAS,YAAY;CAC3D,MAAM,aAAa,kBAAkB,OAAO;CAC5C,MAAM,oBAAoB,oBAAoB,SAAY,QAAQ;CAClE,OAAO;EACL,SAAS,oBACL,4EAA4E,iBAAiB,QAAQ,WAAW,EAAE,KAClH,+CAA+C,WAAW;EAC9D,MAAM,oBACF,qIACA;EACJ,OAAO,aAAa,CAAC,KAAK,cAAc,iBAAiB,CAAC,CAAC;EAC3D,WAAW,CAAC,UAAU;EACtB,WAAW;CACb;AACF,CAAC;AAEH,MAAM,oBAAoB,WAAW,6BAA6B,SAAS,aAAa;CACtF,SAAS,kBAAkB,iBAAiB,QAAQ,WAAW,EAAE;CACjE,MAAM;CACN,OAAO,aAAa,CAAC,KAAK,cAAc,QAAQ,iBAAiB,CAAC,CAAC;CACnE,WAAW,CAAC,UAAU;CACtB,WAAW,QAAQ;AACrB,EAAE;AAEF,MAAM,gBAAgB,WAAW,qBAAqB,aAAa;CACjE,SAAS;CACT,MAAM,QAAQ,oBACV,QAAQ,eAAe,QAAQ,iBAAiB,EAAE,gCAClD;CACJ,OAAO,aAAa,CAClB,KAAK,eAAe,QAAQ,oBAAoB,eAAe,QAAQ,iBAAiB,IAAI,MAAS,CACvG,CAAC;AACH,EAAE;;;;;;AAOF,MAAa,mCAAmC;CAE9C,eAAe,UAAU,qDAAqD;CAC9E,uCAAuC,UAAU,wCAAwC;CACzF,uBAAuB,oBAAoB,oDAAoD;CAC/F,oBAAoB,UAAU,2DAA2D;CACzF,oBAAoB,UAAU,yCAAyC;CACvE,qBAAqB,UACnB,2DACA,oGACA,CAAC,OAAO,CACV;CACA,2BAA2B,UAAU,qDAAqD;CAC1F,kBAAkB,UAChB,6EACA,oGACA,CAAC,OAAO,CACV;CACA,qBAAqB,UACnB,8EACA,oGACA,CAAC,OAAO,CACV;CACA,wBAAwB,UAAU,0EAA0E;CAC5G,8BAA8B,UAAU,kEAAkE;CAC1G,oBAAoB,UAAU,oDAAoD;CAClF,0BAA0B,UAAU,iCAAiC;CACrE,0BAA0B,UAAU,kCAAkC;CACtE,0BAA0B;CAC1B,yBAAyB,UACvB,+EACA,+DACA,CAAC,OAAO,CACV;CACA,eAAe,UAAU,gDAAgD;CACzE,eAAe,UAAU,sDAAsD;CAC/E,eAAe,UAAU,iDAAiD;CAC1E,8BAA8B,UAC5B,kEACA,+FACA,CAAC,eAAe,CAClB;CACA,6BAA6B,UAC3B,uDACA,wEACA,CAAC,eAAe,CAClB;CACA,wCAAwC,UACtC,4DACA,wGACA,CAAC,eAAe,CAClB;CACA,oDAAoD,UAClD,8FACA,yEACA,CAAC,iBAAiB,UAAU,CAC9B;CACA,gCAAgC,UAAU,6CAA6C;CACvF,+BAA+B;CAC/B,oCAAoC;CACpC,wBAAwB,UACtB,8EACA,2EACA,CAAC,UAAU,CACb;CACA,aAAa,UACX,gEACA,qEACA,CAAC,UAAU,CACb;CACA,kBAAkB,UAChB,4EACA,oFACA,CAAC,UAAU,CACb;CACA,kBAAkB;CAClB,WAAW,oBAAoB,mEAAmE;CAClG,2BAA2B,UACzB,6EACA,iFACF;CACA,0BAA0B,UACxB,iFACA,8EACA,CAAC,UAAU,CACb;CACA,uBAAuB,UACrB,2DACA,yFACF;CACA,6BAA6B,UAC3B,+DACA,yFACF;CAGA,iCAAiC;CACjC,iCAAiC;CACjC,oCAAoC;CACpC,wCAAwC,WAAW,uBAAuB,UAAU,aAAa;EAC/F,SAAS,qEAAqE,iBAAiB,QAAQ,WAAW,EAAE;EACpH,MAAM;CACR,EAAE;CACF,iDAAiD;CACjD,8BAA8B;CAC9B,4CAA4C,UAC1C,yEACA,gGACA,CAAC,SAAS,eAAe,CAC3B;CACA,mCAAmC,UACjC,wDACA,oEACA,CAAC,OAAO,CACV;CACA,6BAA6B;CAC7B,iCAAiC,oBAAoB,qDAAqD;CAC1G,4BAA4B,oBAAoB,wDAAwD;CAGxG,sBAAsB,UACpB,0EACA,mJACA,CAAC,oBAAoB,CACvB;CACA,2BAA2B,UACzB,qEACA,4GACA,CAAC,oBAAoB,CACvB;CACA,wCAAwC,UACtC,2EACA,6HACA,CAAC,SAAS,oBAAoB,CAChC;CACA,iCAAiC;CACjC,kCAAkC,UAChC,0EACA,iIACA,CAAC,oBAAoB,CACvB;CAGA,sBAAsB,UACpB,2DACA,mIACF;CACA,0BAA0B,UACxB,4EACA,mJACA,CAAC,cAAc,eAAe,CAChC;CACA,iBAAiB,UACf,+DACA,+GACF;CACA,iCAAiC,UAC/B,wDACA,iGACA,CAAC,eAAe,CAClB;CACA,iBAAiB,UACf,sEACA,kIACF;CACA,gCAAgC,UAC9B,sEACA,kIACF;CACA,yBAAyB,UACvB,8DACA,mHACF;CACA,2BAA2B,UACzB,4EACA,qGACF;CACA,qBAAqB,UACnB,kEACA,iHACF;CACA,4BAA4B,UAC1B,yEACA,oFACF;CACA,6BAA6B,UAC3B,0EACA,oHACF;CACA,yBAAyB,UACvB,8DACA,oHACF;CACA,uBAAuB,UACrB,4DACA,oHACF;CACA,iBAAiB,UACf,qFACA,uFACF;CACA,0BAA0B,UACxB,kGACA,gFACF;CACA,wBAAwB,UACtB,iEACA,8FACF;CACA,uBAAuB,UACrB,4DACA,kGACF;CACA,8BAA8B,UAC5B,+DACA,yFACF;CACA,gCAAgC,UAC9B,8DACA,uFACF;CACA,iCAAiC,UAC/B,uEACA,sGACF;CACA,oCAAoC,UAClC,kEACA,iGACF;CACA,kCAAkC,UAChC,sDACA,kGACF;CACA,6CAA6C,UAC3C,2FACA,mHACA,CAAC,YAAY,CACf;CACA,sCAAsC,kBAAkB,wDAAwD;CAChH,6BAA6B,kBAC3B,0EACF;CACA,qBAAqB,kBAAkB,gDAAgD;CACvF,mBAAmB,UACjB,wEACA,+FACF;CACA,wBAAwB,UACtB,0DACA,+FACF;CACA,iCAAiC,UAC/B,0DACA,+FACF;CACA,wBAAwB,kBAAkB,yDAAyD;CACnG,cAAc,kBAAkB,qDAAqD;CACrF,sBAAsB,kBAAkB,2DAA2D;CACnG,+BAA+B,kBAAkB,2DAA2D;CAC5G,0BAA0B,kBAAkB,0DAA0D;CACtG,yBAAyB,oBAAoB,+CAA+C;CAC5F,oBAAoB,oBAAoB,2EAA2E;CACnH,iBAAiB,oBAAoB,sDAAsD;CAC3F,8BAA8B,oBAC5B,mEACF;CAGA,oBAAoB,UAClB,2EACA,mEACA,CAAC,YAAY,CACf;CACA,uBAAuB,UACrB,wEACA,6FACA,CAAC,YAAY,CACf;CACA,yBAAyB,UACvB,8DACA,+FACA,CAAC,YAAY,CACf;CACA,+BAA+B,oBAC7B,kEACF;CACA,mBAAmB,UACjB,wDACA,mDACA,CAAC,YAAY,CACf;CACA,gBAAgB;CAChB,wBAAwB,oBAAoB,QAAQ;CACpD,oBAAoB,oBAAoB,YAAY;CACpD,0BAA0B,kBAAkB,KAAK;CACjD,oCAAoC,kBAAkB,IAAI;CAC1D,0BAA0B,UACxB,yFACA,0GACA,CAAC,UAAU,CACb;CACA,qBAAqB;CAGrB,6BAA6B,oBAAoB,kEAAkE;CACnH,gCAAgC,oBAC9B,iEACF;CACA,uBAAuB,oBAAoB,qDAAqD;CAChG,yCAAyC,oBAAoB,2CAA2C;CACxG,mCAAmC,oBAAoB,6DAA6D;CACpH,kCAAkC,oBAAoB,+CAA+C;CACrG,iCAAiC,oBAC/B,iEACF;CACA,yCAAyC,oBACvC,6DACF;CACA,uCAAuC,oBACrC,6DACF;CACA,mCAAmC,oBAAoB,uDAAuD;CAC9G,iCAAiC,oBAAoB,0DAA0D;CAI/G,mCAAmC,oBAAoB,kDAAkD;CACzG,kCAAkC,UAChC,gEACA,oDACA,CAAC,UAAU,CACb;CACA,6BAA6B,UAC3B,gDACA,8BACF;CACA,wBAAwB,UAAU,2CAA2C,8BAA8B;CAC3G,oBAAoB,UAClB,uCACA,sDACF;CACA,4BAA4B,UAAU,+CAA+C,8BAA8B;CACnH,wBAAwB,UACtB,2CACA,sDACF;CACA,0BAA0B,UACxB,qEACA,kFACF;AACF;AAIA,SAAgB,iCACd,OACA,SACgC;CAChC,MAAM,aAAa,oBAAoB,KAAK;CAC5C,MAAM,SAAS,gBAAgB,KAAK;CACpC,MAAM,OAAO,aACR,iCAAsE,cACvE;CACJ,MAAM,WAAW,OACb,KAAK,MAAM,iBAAiB,oBAAoB,MAAM,UAAU,QAAW,OAAO,IAClF,SAAS,OAAO,MAAM;CAC1B,MAAM,QAAQ,YAAY,CAAC,GAAG,UAAU,OAAO,GAAG,GAAI,SAAS,SAAS,CAAC,CAAE,CAAC;CAC5E,MAAM,YAAY,aAAa,SAAS,aAAa,CAAC,GAAG,SAAS,SAAS,SAAS;CAEpF,OAAO,qCACL,SAAS,SACT;EACE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EACzC;EACA;CACF,GACA,SAAS,IACX;AACF;AAEA,SAAS,SAAS,OAAgB,QAA6C;CAC7E,IAAI,iBAAiB,KAAK,GACxB,OAAO;EACL,SAAS;EACT,MAAM;CACR;CAEF,IAAI,WAAW,UAAa,UAAU,KACpC,OAAO;EACL,SAAS;EACT,MAAM;CACR;CAEF,OAAO;EACL,SAAS;EACT,MAAM;CACR;AACF;AAEA,SAAS,UAAU,SAA8D;CAC/E,MAAM,eAAe,iBAAiB,QAAQ,gBAAgB,IAAI,GAAG;CACrE,MAAM,gBAAgB,iBAAiB,QAAQ,eAAe,GAAG;CACjE,MAAM,WACJ,gBAAgB,iBAAiB,iBAAiB,gBAC9C,GAAG,aAAa,IAAI,cAAc,KACjC,gBAAgB;CACvB,OAAO,aAAa;EAClB,KAAK,WAAW,iBAAiB,QAAQ,aAAa,GAAG,CAAC;EAC1D,KAAK,WAAW,iBAAiB,QAAQ,gBAAgB,GAAG,CAAC;EAC7D,KAAK,YAAY,QAAQ;EACzB,KAAK,mBAAmB,oBAAoB,QAAQ,cAAc,CAAC;EACnE,KAAK,mBAAmB,UAAU,QAAQ,cAAc,CAAC;EACzD,KAAK,cAAc,eAAe,QAAQ,UAAU,CAAC;CACvD,CAAC;AACH;AAEA,SAAS,aACP,WACA,SACA,WAC6B;CAC7B,MAAM,QAAQ,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,WAAW,MAAe,CAAC,CAAC;CAC1D,MAAM,gBAAgB,uBAAuB,QAAQ,cAAc;CACnE,MAAM,YAAyC,CAAC;CAChD,KAAK,MAAM,QAAQ,OACjB,QAAQ,MAAR;EACE,KAAK;GACH,UAAU,KAAK;IAAE,MAAM;IAAW,SAAS;IAAwB,OAAO;GAAuB,CAAC;GAClG;EACF,KAAK;GACH,UAAU,KAAK;IACb,MAAM;IACN,SAAS,0BAA0B,qBAAqB,QAAQ,aAAa,EAAE;IAC/E,OAAO;GACT,CAAC;GACD;EACF,KAAK;GACH,UAAU,KAAK;IACb,MAAM;IACN,SAAS;IACT,OAAO;GACT,CAAC;GACD;EACF,KAAK;GACH,IAAI,WACF,UAAU,KAAK;IACb,MAAM;IACN,SAAS,yBAAyB;IAClC,OAAO;GACT,CAAC;GAEH,cAAc,WAAW,eAAe,aAAa,qBAAqB;GAC1E;EACF,KAAK;GACH,cAAc,WAAW,eAAe,2BAA2B,uBAAuB;GAC1F;EACF,KAAK;GACH,cAAc,WAAW,eAAe,uBAAuB,oBAAoB;GACnF;EACF,KAAK;GACH,cAAc,WAAW,eAAe,wBAAwB,mBAAmB;GACnF;EACF,KAAK,YACH,cACE,WACA,eACA,uCACA,oCACF;CAEJ;CAEF,OAAO,gBAAgB,SAAS;AAClC;AAEA,SAAS,cACP,WACA,QACA,MACA,OACM;CACN,IAAI,CAAC,QAAQ;CACb,UAAU,KAAK;EAAE,MAAM;EAAO,KAAK,IAAI,IAAI,MAAM,MAAM,CAAC,CAAC;EAAM;CAAM,CAAC;AACxE;AAEA,SAAS,uBAAuB,QAAoC;CAClE,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,UAAU,IAAI,SAAS;CAC9E,QAAQ;EACN;CACF;AACF;AAEA,SAAS,oBAAoB,OAAoC;CAC/D,OAAO,iBAAiB,qBAAqB,oBAAoB,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO;AACnG;AAEA,SAAS,gBAAgB,OAAoC;CAC3D,IAAI,EAAE,iBAAiB,sBAAsB,MAAM,WAAW,QAAW,OAAO;CAChF,OAAO,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS;AACvG;AAEA,SAAS,iBAAiB,OAAyB;CACjD,OACE,iBAAiB,aAChB,iBAAiB,UAAU,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE9E;AAEA,SAAS,iBAAiB,OAAgB,eAA2C;CACnF,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,KAAK,WAAW,UAAU,iBAAiB,CAAC,0BAA0B,UAAU,IACvG,aACA;AACN;AAEA,SAAS,0BAA0B,OAAwB;CACzD,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,YAAY,UAAU,YAAY,CAAC;EACzC,IACE,cAAc,WACb,aAAa,MACX,aAAa,OAAQ,aAAa,OACnC,cAAc,QACd,cAAc,QACd,cAAc,QACb,aAAa,QAAU,aAAa,QACpC,aAAa,QAAU,aAAa,OAEvC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,gBAAgB,UAAU,KAAK;CAC9C,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,eAAe,OAAoC;CAC1D,MAAM,SAAS,iBAAiB,UAAU,KAAK;CAC/C,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,iBAAiB,aAA6B;CACrD,MAAM,OAAO,iBAAiB,aAAa,GAAG;CAC9C,OAAO,OAAO,IAAI,KAAK,KAAK;AAC9B;AAEA,SAAS,kBAAkB,SAA6C;CACtE,MAAM,cAAc,iBAAiB,QAAQ,aAAa,GAAG;CAC7D,MAAM,UAAU,iBAAiB,QAAQ,gBAAgB,GAAG;CAC5D,OAAO,eAAe,UAAU,IAAI,YAAY,GAAG,QAAQ,KAAK;AAClE;AAEA,SAAS,YAAY,aAAyC;CAC5D,MAAM,QAAQ,iBAAiB,aAAa,GAAG,CAAC,EAAE,MAAM,cAAc;CACtE,OAAO,UAAU,QAAQ,EAAE;AAC7B;AAEA,SAAS,oBAAoB,MAA4D;CACvF,QAAQ,MAAR;EACE,KAAK,SACH,OAAO;EACT,KAAK,OACH,OAAO;EACT,KAAK,QACH,OAAO;CACX;AACF;AAEA,SAAS,gBAAgB,YAAwE;CAC/F,OAAO,eAAe,oBAAoB,qBAAqB;AACjE;AAEA,SAAS,gBAAgB,OAAkE;CACzF,OAAO,UAAU,8BAA8B,+BAA+B;AAChF;AAEA,SAAS,gBACP,MACA,UACoB;CACpB,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,OAAO,aAAa,YAAY,aAAa;CACnD,QAAQ,MAAR;EACE,KAAK,QACH,OAAO,MAAM;EACf,KAAK,YACH,OAAO,YAAY;EACrB,KAAK,OACH,OAAO,OAAO;CAClB;AACF;AAEA,SAAS,iBACP,OACA,UACoB;CACpB,IAAI,CAAC,SAAS,MAAM,WAAW,GAAG,OAAO;CAEzC,OADe,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,gBAAgB,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,OAC7E,CAAC,CAAC,KAAK,MAAM;AAC3B;AAEA,SAAS,eAAe,SAAyB;CAC/C,IAAI,YAAY,GAAG,OAAO;CAC1B,IAAI,UAAU,IAAI,OAAO,GAAG,QAAQ;CACpC,IAAI,UAAU,OAAO,GAAG;EACtB,MAAM,UAAU,UAAU;EAC1B,OAAO,GAAG,QAAQ,GAAG,YAAY,IAAI,WAAW;CAClD;CACA,OAAO,GAAG,QAAQ;AACpB;AAEA,SAAS,WAAW,QAAmC;CACrD,MAAM,SAAS,OAAO,KAAK,UAAU,IAAI,MAAM,EAAE;CACjD,IAAI,OAAO,WAAW,GAAG,OAAO,OAAO;CACvC,IAAI,OAAO,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,OAAO;CAC1D,OAAO,GAAG,OAAO,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,OAAO,GAAG,EAAE;AAC9D;AAEA,SAAS,KAAK,MAAqC,OAA8D;CAC/G,OAAO,QAAQ;EAAE;EAAM;CAAM,IAAI;AACnC;AAEA,SAAS,aAAa,OAAgF;CACpG,OAAO,MAAM,QAAQ,UAA0C,UAAU,MAAS;AACpF;AAEA,SAAS,YAAY,OAAkE;CACrF,MAAM,uBAAO,IAAI,IAAY;CAC7B,OAAO,MAAM,QAAQ,cAAc;EACjC,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,UAAU;EAC5C,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,KAAK,IAAI,GAAG;EACZ,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBAAgB,WAA8E;CACrG,MAAM,uBAAO,IAAI,IAAY;CAC7B,OAAO,UAAU,QAAQ,aAAa;EACpC,MAAM,MAAM,SAAS,SAAS,YAAY,YAAY,SAAS,YAAY,QAAQ,SAAS;EAC5F,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,KAAK,IAAI,GAAG;EACZ,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAuB;CACnD,MAAM,OAAO,iBAAiB,OAAO,GAAG;CACxC,OAAO,QAAQ,qBAAqB,KAAK,IAAI,IAAI,OAAO;AAC1D"}

package/dist/control-plane/RegistryGrantLock.d.ts

@@ -1,35 +1,38 @@
-export interface RegistryGrantLock {
-    withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
+//#region src/control-plane/RegistryGrantLock.d.ts
+interface RegistryGrantLock {
+  withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
 }
-export interface FileRegistryGrantLockOptions {
-    readonly waitTimeoutMs?: number;
-    readonly staleAfterMs?: number;
-    readonly pollIntervalMs?: number;
-    readonly heartbeatIntervalMs?: number;
-    readonly now?: () => number;
-    readonly sleep?: (milliseconds: number) => Promise<void>;
-    readonly isProcessAlive?: (pid: number) => boolean;
+interface FileRegistryGrantLockOptions {
+  readonly waitTimeoutMs?: number;
+  readonly staleAfterMs?: number;
+  readonly pollIntervalMs?: number;
+  readonly heartbeatIntervalMs?: number;
+  readonly now?: () => number;
+  readonly sleep?: (milliseconds: number) => Promise<void>;
+  readonly isProcessAlive?: (pid: number) => boolean;
 }
 /**
  * Cross-process serialization for a registry grant's rotating refresh-token
  * family. Lock file names contain only a SHA-256 digest of the issuer and
  * registry ID; lock contents contain only an opaque owner ID, PID, and time.
  */
-export declare class FileRegistryGrantLock implements RegistryGrantLock {
-    private readonly directory;
-    private readonly waitTimeoutMs;
-    private readonly staleAfterMs;
-    private readonly pollIntervalMs;
-    private readonly heartbeatIntervalMs;
-    private readonly now;
-    private readonly sleep;
-    private readonly isProcessAlive;
-    constructor(directory: string, options?: FileRegistryGrantLockOptions);
-    pathFor(issuer: string, registryId: string): string;
-    withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
-    private tryAcquire;
-    private reclaimIfStale;
-    private touchIfOwned;
-    private releaseIfOwned;
+declare class FileRegistryGrantLock implements RegistryGrantLock {
+  private readonly directory;
+  private readonly waitTimeoutMs;
+  private readonly staleAfterMs;
+  private readonly pollIntervalMs;
+  private readonly heartbeatIntervalMs;
+  private readonly now;
+  private readonly sleep;
+  private readonly isProcessAlive;
+  constructor(directory: string, options?: FileRegistryGrantLockOptions);
+  pathFor(issuer: string, registryId: string): string;
+  withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;
+  private tryAcquire;
+  private reclaimIfStale;
+  private touchIfOwned;
+  private releaseIfOwned;
 }
+//#endregion
+export { FileRegistryGrantLock, FileRegistryGrantLockOptions, RegistryGrantLock };
 //# sourceMappingURL=RegistryGrantLock.d.ts.map

package/dist/control-plane/RegistryGrantLock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegistryGrantLock.d.ts","sourceRoot":"","sources":["../../src/control-plane/RegistryGrantLock.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;CACpD;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAU3D,OAAO,CAAC,QAAQ,CAAC,SAAS;IAT5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;gBAGvC,SAAS,EAAE,MAAM,EAClC,OAAO,GAAE,4BAAiC;IAcrC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAO7C,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAmCvF,UAAU;YAoBV,cAAc;YA2Cd,YAAY;YAOZ,cAAc;CAa7B"}
+{"version":3,"file":"RegistryGrantLock.d.ts","names":[],"sources":["../../src/control-plane/RegistryGrantLock.ts"],"mappings":";UAiBiB;EACf,SAAS,GAAG,gBAAgB,oBAAoB,iBAAiB,QAAQ,KAAK,QAAQ;;UAGvE;WACN;WACA;WACA;WACA;WACA;WACA,SAAS,yBAAyB;WAClC,kBAAkB;;;;;;;cAQhB,iCAAiC;mBAUzB;mBATF;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,YACmB,mBACjB,UAAS;EAcJ,QAAQ,gBAAgB;EAOlB,SAAS,GAAG,gBAAgB,oBAAoB,iBAAiB,QAAQ,KAAK,QAAQ;UAmCrF;UAoBA;UA2CA;UAOA"}

package/dist/control-plane/RegistryGrantLock.js

@@ -1,199 +1,163 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, open, readFile, rename, stat, unlink, utimes } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join } from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, stat, unlink, utimes } from "node:fs/promises";
+
+//#region src/control-plane/RegistryGrantLock.ts
 const LOCK_FILE_VERSION = 1;
-const DEFAULT_WAIT_TIMEOUT_MS = 30_000;
-const DEFAULT_STALE_AFTER_MS = 120_000;
+const DEFAULT_WAIT_TIMEOUT_MS = 3e4;
+const DEFAULT_STALE_AFTER_MS = 12e4;
 const DEFAULT_POLL_INTERVAL_MS = 50;
-const DEFAULT_HEARTBEAT_INTERVAL_MS = 5_000;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
 /**
- * Cross-process serialization for a registry grant's rotating refresh-token
- * family. Lock file names contain only a SHA-256 digest of the issuer and
- * registry ID; lock contents contain only an opaque owner ID, PID, and time.
- */
-export class FileRegistryGrantLock {
-    directory;
-    waitTimeoutMs;
-    staleAfterMs;
-    pollIntervalMs;
-    heartbeatIntervalMs;
-    now;
-    sleep;
-    isProcessAlive;
-    constructor(directory, options = {}) {
-        this.directory = directory;
-        this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);
-        this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);
-        this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
-        this.heartbeatIntervalMs = positiveMilliseconds(options.heartbeatIntervalMs, Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))));
-        this.now = options.now ?? Date.now;
-        this.sleep = options.sleep ?? delay;
-        this.isProcessAlive = options.isProcessAlive ?? processIsAlive;
-    }
-    pathFor(issuer, registryId) {
-        const digest = createHash('sha256')
-            .update(`${issuer.replace(/\/+$/, '')}\0${registryId.toLowerCase()}`)
-            .digest('hex');
-        return join(this.directory, `${digest}.lock`);
-    }
-    async withLock(issuer, registryId, operation) {
-        await mkdir(this.directory, { recursive: true, mode: 0o700 });
-        const lockPath = this.pathFor(issuer, registryId);
-        const owner = {
-            version: LOCK_FILE_VERSION,
-            ownerId: randomUUID(),
-            pid: process.pid,
-            acquiredAt: this.now(),
-        };
-        const deadline = this.now() + this.waitTimeoutMs;
-        while (!(await this.tryAcquire(lockPath, owner))) {
-            if (await this.reclaimIfStale(lockPath))
-                continue;
-            const remaining = deadline - this.now();
-            if (remaining <= 0) {
-                throw new Error('Timed out waiting for another UAPKG process to finish using the saved login for this registry.');
-            }
-            await this.sleep(Math.min(this.pollIntervalMs, remaining));
-        }
-        const heartbeat = setInterval(() => {
-            void this.touchIfOwned(lockPath, owner.ownerId);
-        }, this.heartbeatIntervalMs);
-        heartbeat.unref?.();
-        try {
-            return await operation();
-        }
-        finally {
-            clearInterval(heartbeat);
-            await this.releaseIfOwned(lockPath, owner.ownerId);
-        }
-    }
-    async tryAcquire(lockPath, owner) {
-        let handle;
-        try {
-            handle = await open(lockPath, 'wx', 0o600);
-        }
-        catch (error) {
-            if (errorCode(error) === 'EEXIST')
-                return false;
-            throw new Error('Unable to create the UAPKG registry-grant lock.', { cause: error });
-        }
-        try {
-            await handle.writeFile(JSON.stringify(owner), { encoding: 'utf8' });
-            return true;
-        }
-        catch (error) {
-            await unlink(lockPath).catch(() => undefined);
-            throw new Error('Unable to initialize the UAPKG registry-grant lock.', { cause: error });
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async reclaimIfStale(lockPath) {
-        let lockStat;
-        try {
-            lockStat = await stat(lockPath);
-        }
-        catch (error) {
-            if (errorCode(error) === 'ENOENT')
-                return true;
-            throw new Error('Unable to inspect the UAPKG registry-grant lock.', { cause: error });
-        }
-        const observedOwner = await readOwner(lockPath);
-        if (observedOwner) {
-            // A valid owner record with a definitely dead PID is safe to reclaim
-            // immediately. Waiting for the general stale threshold would make a
-            // refresh retry miss the authorization server's bounded predecessor
-            // grace after a process dies between rotation and local persistence.
-            if (this.isProcessAlive(observedOwner.pid))
-                return false;
-        }
-        else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) {
-            // A just-created lock can briefly be empty while its owner record is
-            // written. Malformed or unreadable ownership therefore remains subject
-            // to the conservative stale threshold.
-            return false;
-        }
-        const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
-        try {
-            await rename(lockPath, quarantinePath);
-        }
-        catch (error) {
-            if (errorCode(error) === 'ENOENT')
-                return true;
-            throw new Error('Unable to quarantine a stale UAPKG registry-grant lock.', { cause: error });
-        }
-        const movedOwner = await readOwner(quarantinePath);
-        if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {
-            await rename(quarantinePath, lockPath).catch(() => undefined);
-            return false;
-        }
-        await unlink(quarantinePath).catch((error) => {
-            throw new Error('Unable to remove a stale UAPKG registry-grant lock.', { cause: error });
-        });
-        return true;
-    }
-    async touchIfOwned(lockPath, ownerId) {
-        const owner = await readOwner(lockPath);
-        if (owner?.ownerId !== ownerId)
-            return;
-        const now = new Date(this.now());
-        await utimes(lockPath, now, now).catch(() => undefined);
-    }
-    async releaseIfOwned(lockPath, ownerId) {
-        const owner = await readOwner(lockPath);
-        if (!owner)
-            return;
-        if (owner.ownerId !== ownerId) {
-            throw new Error('The UAPKG registry-grant lock changed ownership before it could be released.');
-        }
-        try {
-            await unlink(lockPath);
-        }
-        catch (error) {
-            if (errorCode(error) === 'ENOENT')
-                return;
-            throw new Error('Unable to release the UAPKG registry-grant lock.', { cause: error });
-        }
-    }
-}
+* Cross-process serialization for a registry grant's rotating refresh-token
+* family. Lock file names contain only a SHA-256 digest of the issuer and
+* registry ID; lock contents contain only an opaque owner ID, PID, and time.
+*/
+var FileRegistryGrantLock = class {
+	directory;
+	waitTimeoutMs;
+	staleAfterMs;
+	pollIntervalMs;
+	heartbeatIntervalMs;
+	now;
+	sleep;
+	isProcessAlive;
+	constructor(directory, options = {}) {
+		this.directory = directory;
+		this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);
+		this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);
+		this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
+		this.heartbeatIntervalMs = positiveMilliseconds(options.heartbeatIntervalMs, Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))));
+		this.now = options.now ?? Date.now;
+		this.sleep = options.sleep ?? delay;
+		this.isProcessAlive = options.isProcessAlive ?? processIsAlive;
+	}
+	pathFor(issuer, registryId) {
+		const digest = createHash("sha256").update(`${issuer.replace(/\/+$/, "")}\0${registryId.toLowerCase()}`).digest("hex");
+		return join(this.directory, `${digest}.lock`);
+	}
+	async withLock(issuer, registryId, operation) {
+		await mkdir(this.directory, {
+			recursive: true,
+			mode: 448
+		});
+		const lockPath = this.pathFor(issuer, registryId);
+		const owner = {
+			version: LOCK_FILE_VERSION,
+			ownerId: randomUUID(),
+			pid: process.pid,
+			acquiredAt: this.now()
+		};
+		const deadline = this.now() + this.waitTimeoutMs;
+		while (!await this.tryAcquire(lockPath, owner)) {
+			if (await this.reclaimIfStale(lockPath)) continue;
+			const remaining = deadline - this.now();
+			if (remaining <= 0) throw new Error("Timed out waiting for another UAPKG process to finish using the saved login for this registry.");
+			await this.sleep(Math.min(this.pollIntervalMs, remaining));
+		}
+		const heartbeat = setInterval(() => {
+			this.touchIfOwned(lockPath, owner.ownerId);
+		}, this.heartbeatIntervalMs);
+		heartbeat.unref?.();
+		try {
+			return await operation();
+		} finally {
+			clearInterval(heartbeat);
+			await this.releaseIfOwned(lockPath, owner.ownerId);
+		}
+	}
+	async tryAcquire(lockPath, owner) {
+		let handle;
+		try {
+			handle = await open(lockPath, "wx", 384);
+		} catch (error) {
+			if (errorCode(error) === "EEXIST") return false;
+			throw new Error("Unable to create the UAPKG registry-grant lock.", { cause: error });
+		}
+		try {
+			await handle.writeFile(JSON.stringify(owner), { encoding: "utf8" });
+			return true;
+		} catch (error) {
+			await unlink(lockPath).catch(() => void 0);
+			throw new Error("Unable to initialize the UAPKG registry-grant lock.", { cause: error });
+		} finally {
+			await handle.close();
+		}
+	}
+	async reclaimIfStale(lockPath) {
+		let lockStat;
+		try {
+			lockStat = await stat(lockPath);
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return true;
+			throw new Error("Unable to inspect the UAPKG registry-grant lock.", { cause: error });
+		}
+		const observedOwner = await readOwner(lockPath);
+		if (observedOwner) {
+			if (this.isProcessAlive(observedOwner.pid)) return false;
+		} else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) return false;
+		const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
+		try {
+			await rename(lockPath, quarantinePath);
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return true;
+			throw new Error("Unable to quarantine a stale UAPKG registry-grant lock.", { cause: error });
+		}
+		const movedOwner = await readOwner(quarantinePath);
+		if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {
+			await rename(quarantinePath, lockPath).catch(() => void 0);
+			return false;
+		}
+		await unlink(quarantinePath).catch((error) => {
+			throw new Error("Unable to remove a stale UAPKG registry-grant lock.", { cause: error });
+		});
+		return true;
+	}
+	async touchIfOwned(lockPath, ownerId) {
+		if ((await readOwner(lockPath))?.ownerId !== ownerId) return;
+		const now = new Date(this.now());
+		await utimes(lockPath, now, now).catch(() => void 0);
+	}
+	async releaseIfOwned(lockPath, ownerId) {
+		const owner = await readOwner(lockPath);
+		if (!owner) return;
+		if (owner.ownerId !== ownerId) throw new Error("The UAPKG registry-grant lock changed ownership before it could be released.");
+		try {
+			await unlink(lockPath);
+		} catch (error) {
+			if (errorCode(error) === "ENOENT") return;
+			throw new Error("Unable to release the UAPKG registry-grant lock.", { cause: error });
+		}
+	}
+};
 async function readOwner(lockPath) {
-    try {
-        const value = JSON.parse(await readFile(lockPath, 'utf8'));
-        if (typeof value !== 'object' ||
-            value === null ||
-            value.version !== LOCK_FILE_VERSION ||
-            typeof value.ownerId !== 'string' ||
-            !Number.isInteger(value.pid) ||
-            typeof value.acquiredAt !== 'number') {
-            return undefined;
-        }
-        return value;
-    }
-    catch {
-        return undefined;
-    }
+	try {
+		const value = JSON.parse(await readFile(lockPath, "utf8"));
+		if (typeof value !== "object" || value === null || value.version !== LOCK_FILE_VERSION || typeof value.ownerId !== "string" || !Number.isInteger(value.pid) || typeof value.acquiredAt !== "number") return;
+		return value;
+	} catch {
+		return;
+	}
 }
 function processIsAlive(pid) {
-    if (pid === process.pid)
-        return true;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return errorCode(error) !== 'ESRCH';
-    }
+	if (pid === process.pid) return true;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return errorCode(error) !== "ESRCH";
+	}
 }
 function positiveMilliseconds(value, fallback) {
-    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
 }
 function errorCode(error) {
-    return typeof error === 'object' && error !== null && 'code' in error
-        ? String(error.code)
-        : undefined;
+	return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
 }
 function delay(milliseconds) {
-    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
+
+//#endregion
+export { FileRegistryGrantLock };
 //# sourceMappingURL=RegistryGrantLock.js.map