@uapkg/cli 1.3.0 → 1.3.1

package/dist/control-plane/ControlPlaneClient.js

@@ -1,280 +1,291 @@
-import { randomUUID } from 'node:crypto';
-import * as oauth from 'oauth4webapi';
-import { z } from 'zod';
-import { ControlPlaneError, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, parseOAuthScopeTokens, UAPKG_CONTROL_PLANE_API, } from './ControlPlaneTypes.js';
+import { ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, UAPKG_CONTROL_PLANE_API, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, parseOAuthScopeTokens } from "./ControlPlaneTypes.js";
+import * as oauth from "oauth4webapi";
+import { randomUUID } from "node:crypto";
+import { z } from "zod";
+
+//#region src/control-plane/ControlPlaneClient.ts
 const errorSchema = z.object({
-    ok: z.literal(false),
-    error: z.object({
-        code: z.string(),
-        message: z.string(),
-        details: z.record(z.string(), z.unknown()).optional(),
-    }),
+	ok: z.literal(false),
+	error: z.object({
+		code: z.string(),
+		message: z.string(),
+		details: z.record(z.string(), z.unknown()).optional()
+	})
 });
 const insufficientScopeDetailsSchema = z.object({
-    requiredScopes: z.array(z.string()),
-    missingScopes: z.array(z.string()),
+	requiredScopes: z.array(z.string()),
+	missingScopes: z.array(z.string())
 });
 const accountSchema = z.object({
-    id: z.uuid(),
-    username: z.string().min(1),
-    displayName: z.string().min(1),
+	id: z.uuid(),
+	username: z.string().min(1),
+	displayName: z.string().min(1)
 });
 const accountGrantSchema = z.object({
-    id: z.uuid(),
-    deviceName: z.string().min(1),
-    idleExpiresAt: z.iso.datetime(),
-    absoluteExpiresAt: z.iso.datetime(),
-    scopes: z.array(z.string()),
+	id: z.uuid(),
+	deviceName: z.string().min(1),
+	idleExpiresAt: z.iso.datetime(),
+	absoluteExpiresAt: z.iso.datetime(),
+	scopes: z.array(z.string())
 });
 const accountResponseSchema = z.object({
-    ok: z.literal(true),
-    account: accountSchema,
-    registry: z.object({
-        id: z.uuid(),
-    }),
-    grant: accountGrantSchema,
-});
-const cliLoginConfirmationResponseSchema = accountResponseSchema.extend({
-    grant: accountGrantSchema.extend({
-        status: z.enum(['pending', 'active']),
-        activationExpiresAt: z.iso.datetime(),
-        replacesGrantId: z.uuid().nullable(),
-    }),
+	ok: z.literal(true),
+	account: accountSchema,
+	registry: z.object({ id: z.uuid() }),
+	grant: accountGrantSchema
 });
+const cliLoginConfirmationResponseSchema = accountResponseSchema.extend({ grant: accountGrantSchema.extend({
+	status: z.enum(["pending", "active"]),
+	activationExpiresAt: z.iso.datetime(),
+	replacesGrantId: z.uuid().nullable()
+}) });
 const activatedCliLoginResponseSchema = z.object({
-    ok: z.literal(true),
-    grant: z.object({
-        id: z.uuid(),
-        status: z.literal('active'),
-        replacesGrantId: z.uuid().nullable(),
-    }),
+	ok: z.literal(true),
+	grant: z.object({
+		id: z.uuid(),
+		status: z.literal("active"),
+		replacesGrantId: z.uuid().nullable()
+	})
 });
 const requestStatusSchema = z.enum([
-    'queued',
-    'checking',
-    'accepted',
-    'ready',
-    'ready_superseded',
-    'rejected',
-    'operationally_failed',
+	"queued",
+	"checking",
+	"accepted",
+	"ready",
+	"ready_superseded",
+	"rejected",
+	"operationally_failed"
 ]);
-const requestSummarySchema = z
-    .object({
-    id: z.string().min(1),
-    registryId: z.string().min(1),
-    kind: z.string().min(1),
-    status: requestStatusSchema,
-    currentStep: z.string().optional(),
-    createdAt: z.number().optional(),
-    updatedAt: z.number().optional(),
-    payload: z
-        .object({
-        packageName: z.string().optional(),
-        packageVersion: z.string().optional(),
-    })
-        .passthrough()
-        .optional(),
-})
-    .passthrough();
-export class ControlPlaneClient {
-    apiBaseUrl;
-    constructor(apiBaseUrl = UAPKG_CONTROL_PLANE_API) {
-        const normalized = new URL(apiBaseUrl).href.replace(/\/+$/, '');
-        if (normalized !== UAPKG_CONTROL_PLANE_API) {
-            throw new Error(`UAPKG v1 control-plane requests are pinned to ${UAPKG_CONTROL_PLANE_API}.`);
-        }
-        this.apiBaseUrl = normalized;
-    }
-    async getSelf(credential, signal) {
-        const value = await this.requestJson(credential, 'GET', '/v1/account/self', { signal });
-        const parsed = accountResponseSchema.safeParse(value);
-        if (!parsed.success) {
-            throw new ControlPlaneError('ACCOUNT_SELF_RESPONSE_INVALID', 'The account identity response was invalid.');
-        }
-        return {
-            account: parsed.data.account,
-            registry: parsed.data.registry,
-            grant: parsed.data.grant,
-        };
-    }
-    async getCliLoginConfirmation(credential, signal) {
-        const value = await this.requestJson(credential, 'GET', '/v1/account/cli-login/confirmation', { signal });
-        const parsed = cliLoginConfirmationResponseSchema.safeParse(value);
-        if (!parsed.success) {
-            throw new ControlPlaneError('CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID', 'The CLI login confirmation response was invalid.');
-        }
-        return {
-            account: parsed.data.account,
-            registry: parsed.data.registry,
-            grant: parsed.data.grant,
-        };
-    }
-    async confirmCliLogin(credential, signal) {
-        const value = await this.requestJson(credential, 'POST', '/v1/account/cli-login/confirmation', { signal });
-        const parsed = activatedCliLoginResponseSchema.safeParse(value);
-        if (!parsed.success) {
-            throw new ControlPlaneError('CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID', 'The CLI login confirmation response was invalid.');
-        }
-        return parsed.data.grant;
-    }
-    async submitRegistryRequest(credential, operation, submission, options = {}) {
-        const value = await this.requestJson(credential, 'POST', `/v1/registry-requests/${encodeURIComponent(operation)}`, {
-            body: JSON.stringify(submission),
-            headers: {
-                'content-type': 'application/json',
-                'x-uapkg-idempotency-key': options.idempotencyKey ?? randomUUID(),
-                ...(options.otp ? { 'x-uapkg-otp': options.otp } : {}),
-            },
-        });
-        const parsed = z
-            .object({
-            ok: z.literal(true),
-            requestId: z.string().min(1),
-            status: requestStatusSchema,
-            message: z.string(),
-        })
-            .safeParse(value);
-        if (!parsed.success) {
-            throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');
-        }
-        return parsed.data;
-    }
-    async getRegistryRequest(credential, requestId) {
-        const value = await this.requestJson(credential, 'GET', `/v1/registry-requests/${encodeURIComponent(requestId)}`);
-        const parsed = z.object({ ok: z.literal(true), request: requestSummarySchema }).safeParse(value);
-        if (!parsed.success) {
-            throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');
-        }
-        return parsed.data.request;
-    }
-    async listRegistryRequests(credential, registryId, status) {
-        const query = new URLSearchParams({ registryId });
-        if (status)
-            query.set('status', status);
-        const value = await this.requestJson(credential, 'GET', `/v1/registry-requests?${query}`);
-        const parsed = z
-            .object({
-            ok: z.literal(true),
-            recentRequests: z.array(requestSummarySchema).optional(),
-            requests: z.array(requestSummarySchema).optional(),
-        })
-            .safeParse(value);
-        if (!parsed.success || (!parsed.data.recentRequests && !parsed.data.requests)) {
-            throw new ControlPlaneError('REGISTRY_REQUEST_LIST_RESPONSE_INVALID', 'The publishing request list response was invalid.');
-        }
-        return parsed.data.recentRequests ?? parsed.data.requests ?? [];
-    }
-    async requestJson(credential, method, path, init = {}) {
-        const url = new URL(path, this.apiBaseUrl);
-        const headers = new Headers(init.headers);
-        let response;
-        if (credential.kind === 'dpop') {
-            try {
-                response = await this.withDPoPNonceRetry(() => oauth.protectedResourceRequest(credential.accessToken, method, url, headers, init.body, {
-                    DPoP: credential.dpop,
-                    signal: boundedRequestSignal(init.signal),
-                }));
-            }
-            catch (error) {
-                if (error instanceof oauth.WWWAuthenticateChallengeError) {
-                    throw await controlPlaneChallengeError(error, credential);
-                }
-                throw error;
-            }
-        }
-        else {
-            headers.set('authorization', `Bearer ${credential.accessToken}`);
-            response = await fetch(url, {
-                method,
-                headers,
-                body: init.body,
-                redirect: 'error',
-                signal: boundedRequestSignal(init.signal),
-            });
-        }
-        const value = await readJson(response);
-        if (!response.ok) {
-            const parsed = errorSchema.safeParse(value);
-            if (parsed.success) {
-                throw new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, response.status, parsed.data.error.details);
-            }
-            throw new ControlPlaneError(`HTTP_${response.status}`, `The UAPKG control plane returned HTTP ${response.status}.`, response.status);
-        }
-        return value;
-    }
-    async withDPoPNonceRetry(operation) {
-        try {
-            return await operation();
-        }
-        catch (error) {
-            if (!oauth.isDPoPNonceError(error))
-                throw error;
-            return operation();
-        }
-    }
+const requestSummarySchema = z.object({
+	id: z.string().min(1),
+	registryId: z.string().min(1),
+	kind: z.string().min(1),
+	status: requestStatusSchema,
+	currentStep: z.string().optional(),
+	createdAt: z.number().optional(),
+	updatedAt: z.number().optional(),
+	payload: z.object({
+		packageName: z.string().optional(),
+		packageVersion: z.string().optional()
+	}).loose().optional()
+}).loose();
+const requestCheckIdSchema = z.string().trim().min(1).max(128).refine((value) => !hasUnsafeDisplayCharacter(value));
+const requestCheckReasonCodeSchema = z.string().trim().min(1).max(128).refine((value) => !hasUnsafeDisplayCharacter(value));
+const terminalFailureReasonCodeSchema = z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/u);
+const requestCheckSchema = z.object({
+	checkId: requestCheckIdSchema,
+	executionState: z.enum([
+		"pending",
+		"running",
+		"retrying",
+		"blocked_by_dependency",
+		"completed"
+	]),
+	conclusion: z.enum([
+		"success",
+		"failure",
+		"skipped"
+	]).optional(),
+	reasonCode: requestCheckReasonCodeSchema.optional()
+});
+const terminalFailureSchema = z.object({
+	reasonCode: terminalFailureReasonCodeSchema,
+	attempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+	maxAttempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+});
+const requestDetailResponseSchema = z.object({
+	ok: z.literal(true),
+	request: requestSummarySchema,
+	checks: z.array(requestCheckSchema).max(100).optional(),
+	terminalFailure: terminalFailureSchema.optional()
+});
+var ControlPlaneClient = class {
+	apiBaseUrl;
+	constructor(apiBaseUrl = UAPKG_CONTROL_PLANE_API) {
+		const normalized = new URL(apiBaseUrl).href.replace(/\/+$/, "");
+		if (normalized !== UAPKG_CONTROL_PLANE_API) throw new Error(`UAPKG v1 control-plane requests are pinned to ${UAPKG_CONTROL_PLANE_API}.`);
+		this.apiBaseUrl = normalized;
+	}
+	async getSelf(credential, signal) {
+		const value = await this.requestJson(credential, "GET", "/v1/account/self", { signal });
+		const parsed = accountResponseSchema.safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("ACCOUNT_SELF_RESPONSE_INVALID", "The account identity response was invalid.");
+		return {
+			account: parsed.data.account,
+			registry: parsed.data.registry,
+			grant: parsed.data.grant
+		};
+	}
+	async getCliLoginConfirmation(credential, signal) {
+		const value = await this.requestJson(credential, "GET", "/v1/account/cli-login/confirmation", { signal });
+		const parsed = cliLoginConfirmationResponseSchema.safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID", "The CLI login confirmation response was invalid.");
+		return {
+			account: parsed.data.account,
+			registry: parsed.data.registry,
+			grant: parsed.data.grant
+		};
+	}
+	async confirmCliLogin(credential, signal) {
+		const value = await this.requestJson(credential, "POST", "/v1/account/cli-login/confirmation", { signal });
+		const parsed = activatedCliLoginResponseSchema.safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID", "The CLI login confirmation response was invalid.");
+		return parsed.data.grant;
+	}
+	async submitRegistryRequest(credential, operation, submission, options = {}) {
+		const value = await this.requestJson(credential, "POST", `/v1/registry-requests/${encodeURIComponent(operation)}`, {
+			body: JSON.stringify(submission),
+			headers: {
+				"content-type": "application/json",
+				"x-uapkg-idempotency-key": options.idempotencyKey ?? randomUUID(),
+				...options.otp ? { "x-uapkg-otp": options.otp } : {}
+			}
+		});
+		const parsed = z.object({
+			ok: z.literal(true),
+			requestId: z.string().min(1),
+			status: requestStatusSchema,
+			message: z.string()
+		}).safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
+		return parsed.data;
+	}
+	async getRegistryRequest(credential, requestId) {
+		const value = await this.requestJson(credential, "GET", `/v1/registry-requests/${encodeURIComponent(requestId)}`);
+		const parsed = z.object({
+			ok: z.literal(true),
+			request: requestSummarySchema
+		}).safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
+		return parsed.data.request;
+	}
+	/**
+	* Reads the additive request-detail projection. The older
+	* `getRegistryRequest` method deliberately remains summary-only so callers
+	* compiled against the original response contract keep their behavior.
+	*/
+	async getRegistryRequestDetail(credential, requestId) {
+		const value = await this.requestJson(credential, "GET", `/v1/registry-requests/${encodeURIComponent(requestId)}`);
+		const parsed = requestDetailResponseSchema.safeParse(value);
+		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
+		return {
+			request: parsed.data.request,
+			...parsed.data.checks ? { checks: parsed.data.checks } : {},
+			...parsed.data.terminalFailure ? { terminalFailure: parsed.data.terminalFailure } : {}
+		};
+	}
+	async listRegistryRequests(credential, registryId, status) {
+		const query = new URLSearchParams({ registryId });
+		if (status) query.set("status", status);
+		const value = await this.requestJson(credential, "GET", `/v1/registry-requests?${query.toString()}`);
+		const parsed = z.object({
+			ok: z.literal(true),
+			recentRequests: z.array(requestSummarySchema).optional(),
+			requests: z.array(requestSummarySchema).optional()
+		}).safeParse(value);
+		if (!parsed.success || !parsed.data.recentRequests && !parsed.data.requests) throw new ControlPlaneError("REGISTRY_REQUEST_LIST_RESPONSE_INVALID", "The publishing request list response was invalid.");
+		return parsed.data.recentRequests ?? parsed.data.requests ?? [];
+	}
+	async requestJson(credential, method, path, init = {}) {
+		const url = new URL(path, this.apiBaseUrl);
+		const headers = new Headers(init.headers);
+		let response;
+		if (credential.kind === "dpop") try {
+			response = await this.withDPoPNonceRetry(() => oauth.protectedResourceRequest(credential.accessToken, method, url, headers, init.body, {
+				DPoP: credential.dpop,
+				signal: boundedRequestSignal(init.signal)
+			}));
+		} catch (error) {
+			if (error instanceof oauth.WWWAuthenticateChallengeError) throw await controlPlaneChallengeError(error, credential);
+			throw error;
+		}
+		else {
+			headers.set("authorization", `Bearer ${credential.accessToken}`);
+			response = await fetch(url, {
+				method,
+				headers,
+				body: init.body,
+				redirect: "error",
+				signal: boundedRequestSignal(init.signal)
+			});
+		}
+		const value = await readJson(response);
+		if (!response.ok) {
+			const parsed = errorSchema.safeParse(value);
+			if (parsed.success) throw new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, response.status, parsed.data.error.details);
+			throw new ControlPlaneError(`HTTP_${response.status}`, `The UAPKG control plane returned HTTP ${response.status}.`, response.status);
+		}
+		return value;
+	}
+	async withDPoPNonceRetry(operation) {
+		try {
+			return await operation();
+		} catch (error) {
+			if (!oauth.isDPoPNonceError(error)) throw error;
+			return operation();
+		}
+	}
+};
+function hasUnsafeDisplayCharacter(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint !== void 0 && (codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 1564 || codePoint === 8206 || codePoint === 8207 || codePoint >= 8232 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297)) return true;
+	}
+	return false;
 }
 function boundedRequestSignal(signal) {
-    const timeout = AbortSignal.timeout(30_000);
-    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+	const timeout = AbortSignal.timeout(3e4);
+	return signal ? AbortSignal.any([signal, timeout]) : timeout;
 }
 async function readJson(response) {
-    const text = await response.text();
-    if (text.trim().length === 0)
-        return {};
-    try {
-        return JSON.parse(text);
-    }
-    catch (error) {
-        throw new ControlPlaneError('CONTROL_PLANE_RESPONSE_NOT_JSON', `The UAPKG control plane returned a non-JSON response (HTTP ${response.status}).`, response.status, undefined, { cause: error });
-    }
+	const text = await response.text();
+	if (text.trim().length === 0) return {};
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		throw new ControlPlaneError("CONTROL_PLANE_RESPONSE_NOT_JSON", `The UAPKG control plane returned a non-JSON response (HTTP ${response.status}).`, response.status, void 0, { cause: error });
+	}
 }
 async function controlPlaneChallengeError(error, credential) {
-    const value = await tryReadJson(error.response);
-    const parsed = errorSchema.safeParse(value);
-    if (error.status === 403 && parsed.success && parsed.data.error.code === 'OAUTH_SCOPE_INSUFFICIENT') {
-        const details = insufficientScopeDetailsSchema.safeParse(parsed.data.error.details);
-        if (details.success) {
-            const headerRequiredScopeTokens = error.cause.flatMap((challenge) => challenge.scheme === 'dpop' && challenge.parameters.error === 'insufficient_scope'
-                ? parseOAuthScopeTokens(challenge.parameters.scope)
-                : []);
-            const bodyRequiredScopeTokens = validatedOAuthScopeTokens(details.data.requiredScopes);
-            const bodyMissingScopeTokens = validatedOAuthScopeTokens(details.data.missingScopes);
-            if (bodyRequiredScopeTokens && bodyMissingScopeTokens) {
-                const consistentRequiredScopeTokens = headerRequiredScopeTokens.filter((scope) => bodyRequiredScopeTokens.includes(scope));
-                const consistentMissingScopeTokens = consistentRequiredScopeTokens.filter((scope) => bodyMissingScopeTokens.includes(scope));
-                const requestedScopes = knownUAPKGCliScopes(credential.requestedScopes);
-                if (consistentMissingScopeTokens.some((scope) => !isUAPKGCliScope(scope))) {
-                    return new OAuthScopeUnsupportedError(credential.registryAlias, requestedScopes, [], {
-                        cause: error,
-                        reason: 'cli-update-required',
-                        status: error.status,
-                    });
-                }
-                const requiredScopes = knownUAPKGCliScopes(consistentRequiredScopeTokens);
-                const missingScopes = knownUAPKGCliScopes(consistentMissingScopeTokens).filter((scope) => requestedScopes.includes(scope));
-                if (requiredScopes.length > 0 && missingScopes.length > 0) {
-                    return new OAuthScopeInsufficientError(parsed.data.error.message, credential.registryAlias, requestedScopes, requiredScopes, missingScopes, error.status, { cause: error });
-                }
-            }
-        }
-    }
-    if (parsed.success) {
-        return new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, error.status, parsed.data.error.details, { cause: error });
-    }
-    return new ControlPlaneError('CONTROL_PLANE_AUTHENTICATION_REQUIRED', 'The UAPKG control plane rejected the saved login.', error.status, undefined, { cause: error });
+	const value = await tryReadJson(error.response);
+	const parsed = errorSchema.safeParse(value);
+	if (error.status === 403 && parsed.success && parsed.data.error.code === "OAUTH_SCOPE_INSUFFICIENT") {
+		const details = insufficientScopeDetailsSchema.safeParse(parsed.data.error.details);
+		if (details.success) {
+			const headerRequiredScopeTokens = error.cause.flatMap((challenge) => challenge.scheme === "dpop" && challenge.parameters.error === "insufficient_scope" ? parseOAuthScopeTokens(challenge.parameters.scope) : []);
+			const bodyRequiredScopeTokens = validatedOAuthScopeTokens(details.data.requiredScopes);
+			const bodyMissingScopeTokens = validatedOAuthScopeTokens(details.data.missingScopes);
+			if (bodyRequiredScopeTokens && bodyMissingScopeTokens) {
+				const consistentRequiredScopeTokens = headerRequiredScopeTokens.filter((scope) => bodyRequiredScopeTokens.includes(scope));
+				const consistentMissingScopeTokens = consistentRequiredScopeTokens.filter((scope) => bodyMissingScopeTokens.includes(scope));
+				const requestedScopes = knownUAPKGCliScopes(credential.requestedScopes);
+				if (consistentMissingScopeTokens.some((scope) => !isUAPKGCliScope(scope))) return new OAuthScopeUnsupportedError(credential.registryAlias, requestedScopes, [], {
+					cause: error,
+					reason: "cli-update-required",
+					status: error.status
+				});
+				const requiredScopes = knownUAPKGCliScopes(consistentRequiredScopeTokens);
+				const missingScopes = knownUAPKGCliScopes(consistentMissingScopeTokens).filter((scope) => requestedScopes.includes(scope));
+				if (requiredScopes.length > 0 && missingScopes.length > 0) return new OAuthScopeInsufficientError(parsed.data.error.message, credential.registryAlias, requestedScopes, requiredScopes, missingScopes, error.status, { cause: error });
+			}
+		}
+	}
+	if (parsed.success) return new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, error.status, parsed.data.error.details, { cause: error });
+	return new ControlPlaneError("CONTROL_PLANE_AUTHENTICATION_REQUIRED", "The UAPKG control plane rejected the saved login.", error.status, void 0, { cause: error });
 }
 function validatedOAuthScopeTokens(values) {
-    if (values.some((scope) => !isOAuthScopeToken(scope)))
-        return undefined;
-    return [...new Set(values)];
+	if (values.some((scope) => !isOAuthScopeToken(scope))) return void 0;
+	return [...new Set(values)];
 }
 async function tryReadJson(response) {
-    try {
-        const text = await response.text();
-        return text.trim().length > 0 ? JSON.parse(text) : undefined;
-    }
-    catch {
-        return undefined;
-    }
+	try {
+		const text = await response.text();
+		return text.trim().length > 0 ? JSON.parse(text) : void 0;
+	} catch {
+		return;
+	}
 }
+
+//#endregion
+export { ControlPlaneClient };
 //# sourceMappingURL=ControlPlaneClient.js.map