@uapkg/cli 1.3.0 → 1.3.2

package/dist/control-plane/AuthMetadataStore.js

@@ -1,116 +1,114 @@
-import { randomUUID } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
-import { dirname, resolve } from 'node:path';
-import { z } from 'zod';
-import { resolveAuthStoragePaths } from './AuthStoragePaths.js';
-import { FileRegistryGrantLock } from './RegistryGrantLock.js';
-const AUTH_METADATA_LOCK_NAMESPACE = 'urn:uapkg:auth-metadata';
-const accountSchema = z
-    .object({
-    id: z.uuid(),
-    username: z.string().min(1),
-    displayName: z.string().min(1),
-})
-    .strict();
-const grantSchema = z
-    .object({
-    issuer: z.url(),
-    registryId: z.uuid(),
-    registryName: z.string().min(1),
-    grantId: z.uuid(),
-    clientId: z.string().min(1),
-    keyReference: z.string().min(1),
-    refreshTokenReference: z.string().min(1),
-    publicKeyThumbprint: z.string().min(1),
-    deviceName: z.string().min(1),
-    repositoryFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-    account: accountSchema,
-    createdAt: z.number().int().nonnegative(),
-    idleExpiresAt: z.number().int().positive(),
-    expiresAt: z.number().int().positive(),
-})
-    .strict();
-const fileSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    grants: z.record(z.string(), grantSchema),
-})
-    .strict();
-export class AuthMetadataStore {
-    filePath;
-    mutationLock;
-    constructor(filePath = resolveAuthStoragePaths().metadataFile, mutationLock) {
-        this.filePath = filePath;
-        this.mutationLock = mutationLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(filePath).locksDirectory);
-    }
-    get path() {
-        return this.filePath;
-    }
-    async find(issuer, registryId) {
-        return (await this.read()).grants[grantKey(issuer, registryId)];
-    }
-    async upsert(metadata) {
-        await this.withMutationLock(async () => {
-            const current = await this.read();
-            await this.write({
-                schemaVersion: 1,
-                grants: {
-                    ...current.grants,
-                    [grantKey(metadata.issuer, metadata.registryId)]: metadata,
-                },
-            });
-        });
-    }
-    async remove(issuer, registryId) {
-        await this.withMutationLock(async () => {
-            const current = await this.read();
-            const key = grantKey(issuer, registryId);
-            if (!(key in current.grants))
-                return;
-            const next = { ...current.grants };
-            delete next[key];
-            await this.write({ schemaVersion: 1, grants: next });
-        });
-    }
-    async read() {
-        if (!existsSync(this.filePath)) {
-            return { schemaVersion: 1, grants: {} };
-        }
-        let raw;
-        try {
-            raw = await readFile(this.filePath, 'utf8');
-        }
-        catch (error) {
-            throw new Error(`Unable to read saved UAPKG login metadata at ${this.filePath}.`, { cause: error });
-        }
-        let json;
-        try {
-            json = JSON.parse(raw);
-        }
-        catch (error) {
-            throw new Error(`Saved UAPKG login metadata at ${this.filePath} is not valid JSON. Move it aside and run \`uapkg login\` again.`, { cause: error });
-        }
-        const parsed = fileSchema.safeParse(json);
-        if (!parsed.success) {
-            throw new Error(`Saved UAPKG login metadata at ${this.filePath} is invalid. Move it aside and run \`uapkg login\` again.`);
-        }
-        return parsed.data;
-    }
-    async write(value) {
-        await mkdir(dirname(this.filePath), { recursive: true });
-        const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
-        await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
-        await rename(temporaryPath, this.filePath);
-    }
-    async withMutationLock(operation) {
-        return this.mutationLock.withLock(AUTH_METADATA_LOCK_NAMESPACE, resolve(this.filePath), operation);
-    }
-}
+import { resolveAuthStoragePaths } from "./AuthStoragePaths.js";
+import { FileRegistryGrantLock } from "./RegistryGrantLock.js";
+import { dirname, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { z } from "zod";
+
+//#region src/control-plane/AuthMetadataStore.ts
+const AUTH_METADATA_LOCK_NAMESPACE = "urn:uapkg:auth-metadata";
+const accountSchema = z.object({
+	id: z.uuid(),
+	username: z.string().min(1),
+	displayName: z.string().min(1)
+}).strict();
+const grantSchema = z.object({
+	issuer: z.url(),
+	registryId: z.uuid(),
+	registryName: z.string().min(1),
+	grantId: z.uuid(),
+	clientId: z.string().min(1),
+	keyReference: z.string().min(1),
+	refreshTokenReference: z.string().min(1),
+	publicKeyThumbprint: z.string().min(1),
+	deviceName: z.string().min(1),
+	repositoryFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+	account: accountSchema,
+	createdAt: z.number().int().nonnegative(),
+	idleExpiresAt: z.number().int().positive(),
+	expiresAt: z.number().int().positive()
+}).strict();
+const fileSchema = z.object({
+	schemaVersion: z.literal(1),
+	grants: z.record(z.string(), grantSchema)
+}).strict();
+var AuthMetadataStore = class {
+	filePath;
+	mutationLock;
+	constructor(filePath = resolveAuthStoragePaths().metadataFile, mutationLock) {
+		this.filePath = filePath;
+		this.mutationLock = mutationLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(filePath).locksDirectory);
+	}
+	get path() {
+		return this.filePath;
+	}
+	async find(issuer, registryId) {
+		return (await this.read()).grants[grantKey(issuer, registryId)];
+	}
+	async upsert(metadata) {
+		await this.withMutationLock(async () => {
+			const current = await this.read();
+			await this.write({
+				schemaVersion: 1,
+				grants: {
+					...current.grants,
+					[grantKey(metadata.issuer, metadata.registryId)]: metadata
+				}
+			});
+		});
+	}
+	async remove(issuer, registryId) {
+		await this.withMutationLock(async () => {
+			const current = await this.read();
+			const key = grantKey(issuer, registryId);
+			if (!(key in current.grants)) return;
+			const next = { ...current.grants };
+			delete next[key];
+			await this.write({
+				schemaVersion: 1,
+				grants: next
+			});
+		});
+	}
+	async read() {
+		if (!existsSync(this.filePath)) return {
+			schemaVersion: 1,
+			grants: {}
+		};
+		let raw;
+		try {
+			raw = await readFile(this.filePath, "utf8");
+		} catch (error) {
+			throw new Error(`Unable to read saved UAPKG login metadata at ${this.filePath}.`, { cause: error });
+		}
+		let json;
+		try {
+			json = JSON.parse(raw);
+		} catch (error) {
+			throw new Error(`Saved UAPKG login metadata at ${this.filePath} is not valid JSON. Move it aside and run \`uapkg login\` again.`, { cause: error });
+		}
+		const parsed = fileSchema.safeParse(json);
+		if (!parsed.success) throw new Error(`Saved UAPKG login metadata at ${this.filePath} is invalid. Move it aside and run \`uapkg login\` again.`);
+		return parsed.data;
+	}
+	async write(value) {
+		await mkdir(dirname(this.filePath), { recursive: true });
+		const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+		await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+		await rename(temporaryPath, this.filePath);
+	}
+	async withMutationLock(operation) {
+		return this.mutationLock.withLock(AUTH_METADATA_LOCK_NAMESPACE, resolve(this.filePath), operation);
+	}
+};
 function grantKey(issuer, registryId) {
-    return `${issuer.replace(/\/+$/, '')}|${registryId.toLowerCase()}`;
+	return `${issuer.replace(/\/+$/, "")}|${registryId.toLowerCase()}`;
 }
+
+//#endregion
+export { AuthMetadataStore };
 //# sourceMappingURL=AuthMetadataStore.js.map

package/dist/control-plane/AuthMetadataStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthMetadataStore.js","sourceRoot":"","sources":["../../src/control-plane/AuthMetadataStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAA0B,MAAM,wBAAwB,CAAC;AAEvF,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;IACf,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAChE,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,OAAO,iBAAiB;IAIT;IAHF,YAAY,CAAoB;IAEjD,YACmB,WAAW,uBAAuB,EAAE,CAAC,YAAY,EAClE,YAAgC;QADf,aAAQ,GAAR,QAAQ,CAAyC;QAGlE,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAC;IAClH,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,UAAkB;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAA+B;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,KAAK,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE;oBACN,GAAG,OAAO,CAAC,MAAM;oBACjB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ;iBAC3D;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,UAAkB;QACpD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACzC,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO;YACrC,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,CAAC,QAAQ,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,QAAQ,kEAAkE,EAChH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,QAAQ,2DAA2D,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,KAAuB;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QAC5E,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAI,SAA2B;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,4BAA4B,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,UAAkB;IAClD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;AACrE,CAAC"}
+{"version":3,"file":"AuthMetadataStore.js","names":[],"sources":["../../src/control-plane/AuthMetadataStore.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, rename, writeFile } from 'node:fs/promises';\nimport { dirname, resolve } from 'node:path';\nimport { z } from 'zod';\nimport { resolveAuthStoragePaths } from './AuthStoragePaths.js';\nimport type { AuthMetadataFile, RegistryGrantMetadata } from './ControlPlaneTypes.js';\nimport { FileRegistryGrantLock, type RegistryGrantLock } from './RegistryGrantLock.js';\n\nconst AUTH_METADATA_LOCK_NAMESPACE = 'urn:uapkg:auth-metadata';\n\nconst accountSchema = z\n  .object({\n    id: z.uuid(),\n    username: z.string().min(1),\n    displayName: z.string().min(1),\n  })\n  .strict();\n\nconst grantSchema = z\n  .object({\n    issuer: z.url(),\n    registryId: z.uuid(),\n    registryName: z.string().min(1),\n    grantId: z.uuid(),\n    clientId: z.string().min(1),\n    keyReference: z.string().min(1),\n    refreshTokenReference: z.string().min(1),\n    publicKeyThumbprint: z.string().min(1),\n    deviceName: z.string().min(1),\n    repositoryFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/),\n    account: accountSchema,\n    createdAt: z.number().int().nonnegative(),\n    idleExpiresAt: z.number().int().positive(),\n    expiresAt: z.number().int().positive(),\n  })\n  .strict();\n\nconst fileSchema = z\n  .object({\n    schemaVersion: z.literal(1),\n    grants: z.record(z.string(), grantSchema),\n  })\n  .strict();\n\nexport class AuthMetadataStore {\n  private readonly mutationLock: RegistryGrantLock;\n\n  public constructor(\n    private readonly filePath = resolveAuthStoragePaths().metadataFile,\n    mutationLock?: RegistryGrantLock,\n  ) {\n    this.mutationLock = mutationLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(filePath).locksDirectory);\n  }\n\n  public get path(): string {\n    return this.filePath;\n  }\n\n  public async find(issuer: string, registryId: string): Promise<RegistryGrantMetadata | undefined> {\n    return (await this.read()).grants[grantKey(issuer, registryId)];\n  }\n\n  public async upsert(metadata: RegistryGrantMetadata): Promise<void> {\n    await this.withMutationLock(async () => {\n      const current = await this.read();\n      await this.write({\n        schemaVersion: 1,\n        grants: {\n          ...current.grants,\n          [grantKey(metadata.issuer, metadata.registryId)]: metadata,\n        },\n      });\n    });\n  }\n\n  public async remove(issuer: string, registryId: string): Promise<void> {\n    await this.withMutationLock(async () => {\n      const current = await this.read();\n      const key = grantKey(issuer, registryId);\n      if (!(key in current.grants)) return;\n      const next = { ...current.grants };\n      delete next[key];\n      await this.write({ schemaVersion: 1, grants: next });\n    });\n  }\n\n  private async read(): Promise<AuthMetadataFile> {\n    if (!existsSync(this.filePath)) {\n      return { schemaVersion: 1, grants: {} };\n    }\n\n    let raw: string;\n    try {\n      raw = await readFile(this.filePath, 'utf8');\n    } catch (error) {\n      throw new Error(`Unable to read saved UAPKG login metadata at ${this.filePath}.`, { cause: error });\n    }\n\n    let json: unknown;\n    try {\n      json = JSON.parse(raw) as unknown;\n    } catch (error) {\n      throw new Error(\n        `Saved UAPKG login metadata at ${this.filePath} is not valid JSON. Move it aside and run \\`uapkg login\\` again.`,\n        { cause: error },\n      );\n    }\n\n    const parsed = fileSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new Error(\n        `Saved UAPKG login metadata at ${this.filePath} is invalid. Move it aside and run \\`uapkg login\\` again.`,\n      );\n    }\n    return parsed.data;\n  }\n\n  private async write(value: AuthMetadataFile): Promise<void> {\n    await mkdir(dirname(this.filePath), { recursive: true });\n    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;\n    await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\\n`, {\n      encoding: 'utf8',\n      mode: 0o600,\n    });\n    await rename(temporaryPath, this.filePath);\n  }\n\n  private async withMutationLock<T>(operation: () => Promise<T>): Promise<T> {\n    return this.mutationLock.withLock(AUTH_METADATA_LOCK_NAMESPACE, resolve(this.filePath), operation);\n  }\n}\n\nfunction grantKey(issuer: string, registryId: string): string {\n  return `${issuer.replace(/\\/+$/, '')}|${registryId.toLowerCase()}`;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,+BAA+B;AAErC,MAAM,gBAAgB,EACnB,OAAO;CACN,IAAI,EAAE,KAAK;CACX,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,CAAC,CACD,OAAO;AAEV,MAAM,cAAc,EACjB,OAAO;CACN,QAAQ,EAAE,IAAI;CACd,YAAY,EAAE,KAAK;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC9B,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC9B,uBAAuB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACrC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,uBAAuB,EAAE,OAAO,CAAC,CAAC,MAAM,uBAAuB;CAC/D,SAAS;CACT,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACxC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACzC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AACvC,CAAC,CAAC,CACD,OAAO;AAEV,MAAM,aAAa,EAChB,OAAO;CACN,eAAe,EAAE,QAAQ,CAAC;CAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;AAC1C,CAAC,CAAC,CACD,OAAO;AAEV,IAAa,oBAAb,MAA+B;CAIV;CAHnB,AAAiB;CAEjB,AAAO,YACL,AAAiB,WAAW,wBAAwB,CAAC,CAAC,cACtD,cACA;EAFiB;EAGjB,KAAK,eAAe,gBAAgB,IAAI,sBAAsB,wBAAwB,QAAQ,CAAC,CAAC,cAAc;CAChH;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK;CACd;CAEA,MAAa,KAAK,QAAgB,YAAgE;EAChG,QAAQ,MAAM,KAAK,KAAK,EAAC,CAAE,OAAO,SAAS,QAAQ,UAAU;CAC/D;CAEA,MAAa,OAAO,UAAgD;EAClE,MAAM,KAAK,iBAAiB,YAAY;GACtC,MAAM,UAAU,MAAM,KAAK,KAAK;GAChC,MAAM,KAAK,MAAM;IACf,eAAe;IACf,QAAQ;KACN,GAAG,QAAQ;MACV,SAAS,SAAS,QAAQ,SAAS,UAAU,IAAI;IACpD;GACF,CAAC;EACH,CAAC;CACH;CAEA,MAAa,OAAO,QAAgB,YAAmC;EACrE,MAAM,KAAK,iBAAiB,YAAY;GACtC,MAAM,UAAU,MAAM,KAAK,KAAK;GAChC,MAAM,MAAM,SAAS,QAAQ,UAAU;GACvC,IAAI,EAAE,OAAO,QAAQ,SAAS;GAC9B,MAAM,OAAO,EAAE,GAAG,QAAQ,OAAO;GACjC,OAAO,KAAK;GACZ,MAAM,KAAK,MAAM;IAAE,eAAe;IAAG,QAAQ;GAAK,CAAC;EACrD,CAAC;CACH;CAEA,MAAc,OAAkC;EAC9C,IAAI,CAAC,WAAW,KAAK,QAAQ,GAC3B,OAAO;GAAE,eAAe;GAAG,QAAQ,CAAC;EAAE;EAGxC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,SAAS,KAAK,UAAU,MAAM;EAC5C,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,gDAAgD,KAAK,SAAS,IAAI,EAAE,OAAO,MAAM,CAAC;EACpG;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,MAAM,GAAG;EACvB,SAAS,OAAO;GACd,MAAM,IAAI,MACR,iCAAiC,KAAK,SAAS,mEAC/C,EAAE,OAAO,MAAM,CACjB;EACF;EAEA,MAAM,SAAS,WAAW,UAAU,IAAI;EACxC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,iCAAiC,KAAK,SAAS,0DACjD;EAEF,OAAO,OAAO;CAChB;CAEA,MAAc,MAAM,OAAwC;EAC1D,MAAM,MAAM,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,gBAAgB,GAAG,KAAK,SAAS,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;EACtE,MAAM,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK;GACpE,UAAU;GACV,MAAM;EACR,CAAC;EACD,MAAM,OAAO,eAAe,KAAK,QAAQ;CAC3C;CAEA,MAAc,iBAAoB,WAAyC;EACzE,OAAO,KAAK,aAAa,SAAS,8BAA8B,QAAQ,KAAK,QAAQ,GAAG,SAAS;CACnG;AACF;AAEA,SAAS,SAAS,QAAgB,YAA4B;CAC5D,OAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,EAAE,GAAG,WAAW,YAAY;AACjE"}

package/dist/control-plane/AuthStoragePaths.d.ts

@@ -1,11 +1,14 @@
-export interface AuthStoragePaths {
-    readonly metadataFile: string;
-    readonly locksDirectory: string;
+//#region src/control-plane/AuthStoragePaths.d.ts
+interface AuthStoragePaths {
+  readonly metadataFile: string;
+  readonly locksDirectory: string;
 }
 /**
  * Resolves the CLI-owned files used for persistent authentication state.
  * An explicit metadata path keeps the historical custom-store behavior by
  * placing its locks alongside that file.
  */
-export declare function resolveAuthStoragePaths(metadataFile?: string): AuthStoragePaths;
+declare function resolveAuthStoragePaths(metadataFile?: string): AuthStoragePaths;
+//#endregion
+export { AuthStoragePaths, resolveAuthStoragePaths };
 //# sourceMappingURL=AuthStoragePaths.d.ts.map

package/dist/control-plane/AuthStoragePaths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthStoragePaths.d.ts","sourceRoot":"","sources":["../../src/control-plane/AuthStoragePaths.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAM/E"}
+{"version":3,"file":"AuthStoragePaths.d.ts","names":[],"sources":["../../src/control-plane/AuthStoragePaths.ts"],"mappings":";UAMiB;WACN;WACA;;;;;;;iBAQK,wBAAwB,wBAAwB"}

package/dist/control-plane/AuthStoragePaths.js

@@ -1,17 +1,22 @@
-import { dirname, join } from 'node:path';
-import { resolveActiveUapkgProfileRoot } from '@uapkg/common';
-const AUTH_METADATA_FILE_NAME = 'auth.json';
-const AUTH_LOCKS_DIRECTORY_NAME = 'auth-locks';
+import { resolveActiveUapkgProfileRoot } from "@uapkg/common";
+import { dirname, join } from "node:path";
+
+//#region src/control-plane/AuthStoragePaths.ts
+const AUTH_METADATA_FILE_NAME = "auth.json";
+const AUTH_LOCKS_DIRECTORY_NAME = "auth-locks";
 /**
- * Resolves the CLI-owned files used for persistent authentication state.
- * An explicit metadata path keeps the historical custom-store behavior by
- * placing its locks alongside that file.
- */
-export function resolveAuthStoragePaths(metadataFile) {
-    const resolvedMetadataFile = metadataFile ?? join(resolveActiveUapkgProfileRoot(), AUTH_METADATA_FILE_NAME);
-    return {
-        metadataFile: resolvedMetadataFile,
-        locksDirectory: join(dirname(resolvedMetadataFile), AUTH_LOCKS_DIRECTORY_NAME),
-    };
+* Resolves the CLI-owned files used for persistent authentication state.
+* An explicit metadata path keeps the historical custom-store behavior by
+* placing its locks alongside that file.
+*/
+function resolveAuthStoragePaths(metadataFile) {
+	const resolvedMetadataFile = metadataFile ?? join(resolveActiveUapkgProfileRoot(), AUTH_METADATA_FILE_NAME);
+	return {
+		metadataFile: resolvedMetadataFile,
+		locksDirectory: join(dirname(resolvedMetadataFile), AUTH_LOCKS_DIRECTORY_NAME)
+	};
 }
+
+//#endregion
+export { resolveAuthStoragePaths };
 //# sourceMappingURL=AuthStoragePaths.js.map

package/dist/control-plane/AuthStoragePaths.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthStoragePaths.js","sourceRoot":"","sources":["../../src/control-plane/AuthStoragePaths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,uBAAuB,GAAG,WAAW,CAAC;AAC5C,MAAM,yBAAyB,GAAG,YAAY,CAAC;AAO/C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAqB;IAC3D,MAAM,oBAAoB,GAAG,YAAY,IAAI,IAAI,CAAC,6BAA6B,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC5G,OAAO;QACL,YAAY,EAAE,oBAAoB;QAClC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC;KAC/E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"AuthStoragePaths.js","names":[],"sources":["../../src/control-plane/AuthStoragePaths.ts"],"sourcesContent":["import { dirname, join } from 'node:path';\nimport { resolveActiveUapkgProfileRoot } from '@uapkg/common';\n\nconst AUTH_METADATA_FILE_NAME = 'auth.json';\nconst AUTH_LOCKS_DIRECTORY_NAME = 'auth-locks';\n\nexport interface AuthStoragePaths {\n  readonly metadataFile: string;\n  readonly locksDirectory: string;\n}\n\n/**\n * Resolves the CLI-owned files used for persistent authentication state.\n * An explicit metadata path keeps the historical custom-store behavior by\n * placing its locks alongside that file.\n */\nexport function resolveAuthStoragePaths(metadataFile?: string): AuthStoragePaths {\n  const resolvedMetadataFile = metadataFile ?? join(resolveActiveUapkgProfileRoot(), AUTH_METADATA_FILE_NAME);\n  return {\n    metadataFile: resolvedMetadataFile,\n    locksDirectory: join(dirname(resolvedMetadataFile), AUTH_LOCKS_DIRECTORY_NAME),\n  };\n}\n"],"mappings":";;;;AAGA,MAAM,0BAA0B;AAChC,MAAM,4BAA4B;;;;;;AAYlC,SAAgB,wBAAwB,cAAyC;CAC/E,MAAM,uBAAuB,gBAAgB,KAAK,8BAA8B,GAAG,uBAAuB;CAC1G,OAAO;EACL,cAAc;EACd,gBAAgB,KAAK,QAAQ,oBAAoB,GAAG,yBAAyB;CAC/E;AACF"}

package/dist/control-plane/AuthenticationSelector.d.ts

@@ -1,21 +1,24 @@
-import type { PromptService } from '../prompts/PromptService.js';
-import type { AccountManager } from './AccountManager.js';
-import type { ControlPlaneCredential } from './ControlPlaneClient.js';
-import type { ControlPlaneAuthMode, RegistryTrust, UAPKGCliScope } from './ControlPlaneTypes.js';
-import { GitHubActionsOidcCredentialProvider } from './GitHubActionsOidcCredentialProvider.js';
-export interface SelectedAuthentication {
-    readonly kind: 'oidc' | 'login' | 'gat';
-    readonly credential: ControlPlaneCredential;
-    readonly otp?: string;
+import { ControlPlaneAuthMode, RegistryTrust, UAPKGCliScope } from "./ControlPlaneTypes.js";
+import { ControlPlaneCredential } from "./ControlPlaneClient.js";
+import { AccountManager } from "./AccountManager.js";
+import { PromptService } from "../prompts/PromptService.js";
+import { GitHubActionsOidcCredentialProvider, GitHubActionsOidcTarget } from "./GitHubActionsOidcCredentialProvider.js";
+//#region src/control-plane/AuthenticationSelector.d.ts
+interface SelectedAuthentication {
+  readonly kind: 'oidc' | 'login' | 'gat';
+  readonly credential: ControlPlaneCredential;
+  readonly otp?: string;
 }
-export declare class AuthenticationSelector {
-    private readonly account;
-    private readonly prompts;
-    private readonly oidc;
-    private readonly isInteractive;
-    constructor(account: AccountManager, prompts: PromptService, oidc?: GitHubActionsOidcCredentialProvider, isInteractive?: () => boolean);
-    select(mode: ControlPlaneAuthMode, trust: RegistryTrust, scopes: readonly UAPKGCliScope[], requireRequestOtp: boolean): Promise<SelectedAuthentication>;
-    private readOtp;
-    private assertInteractiveRequestOtp;
+declare class AuthenticationSelector {
+  private readonly account;
+  private readonly prompts;
+  private readonly oidc;
+  private readonly isInteractive;
+  constructor(account: AccountManager, prompts: PromptService, oidc?: GitHubActionsOidcCredentialProvider, isInteractive?: () => boolean);
+  select(mode: ControlPlaneAuthMode, trust: RegistryTrust, scopes: readonly UAPKGCliScope[], requireRequestOtp: boolean, oidcTarget?: GitHubActionsOidcTarget): Promise<SelectedAuthentication>;
+  private readOtp;
+  private assertInteractiveRequestOtp;
 }
+//#endregion
+export { AuthenticationSelector, SelectedAuthentication };
 //# sourceMappingURL=AuthenticationSelector.d.ts.map

package/dist/control-plane/AuthenticationSelector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationSelector.d.ts","sourceRoot":"","sources":["../../src/control-plane/AuthenticationSelector.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAE/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,aAAa,EACtB,IAAI,sCAA4C,EAChD,aAAa,gBAAsE;IAGzF,MAAM,CACjB,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,iBAAiB,EAAE,OAAO,GACzB,OAAO,CAAC,sBAAsB,CAAC;YA0CpB,OAAO;IASrB,OAAO,CAAC,2BAA2B;CAMpC"}
+{"version":3,"file":"AuthenticationSelector.d.ts","names":[],"sources":["../../src/control-plane/AuthenticationSelector.ts"],"mappings":";;;;;;UAUiB;WACN;WACA,YAAY;WACZ;;cAGE;mBAEQ;mBACA;mBACA;mBACA;EAJnB,YACmB,SAAS,gBACT,SAAS,eACT,OAAI,qCACJ;EAGN,OACX,MAAM,sBACN,OAAO,eACP,iBAAiB,iBACjB,4BACA,aAAa,0BACZ,QAAQ;UA6CG;UASN"}

package/dist/control-plane/AuthenticationSelector.js

@@ -1,64 +1,70 @@
-import isCI from 'is-ci';
-import { GitHubActionsOidcCredentialProvider } from './GitHubActionsOidcCredentialProvider.js';
-export class AuthenticationSelector {
-    account;
-    prompts;
-    oidc;
-    isInteractive;
-    constructor(account, prompts, oidc = new GitHubActionsOidcCredentialProvider(), isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI)) {
-        this.account = account;
-        this.prompts = prompts;
-        this.oidc = oidc;
-        this.isInteractive = isInteractive;
-    }
-    async select(mode, trust, scopes, requireRequestOtp) {
-        if (mode === 'oidc' || (mode === 'auto' && this.oidc.isAvailable())) {
-            const accessToken = await this.oidc.exchange(trust);
-            return { kind: 'oidc', credential: { kind: 'bearer', accessToken } };
-        }
-        if (mode === 'login' || (mode === 'auto' && (await this.account.hasGrant(trust)))) {
-            if (requireRequestOtp)
-                this.assertInteractiveRequestOtp();
-            const access = await this.account.getAccessCredential(trust, scopes);
-            return {
-                kind: 'login',
-                credential: access.credential,
-                otp: requireRequestOtp ? await this.readOtp() : undefined,
-            };
-        }
-        const environmentToken = process.env.UAPKG_TOKEN?.trim();
-        if (mode === 'gat' || (mode === 'auto' && environmentToken)) {
-            if (!this.isInteractive()) {
-                throw new Error('Human GAT authentication requires an attended TTY. Headless publishing must use a configured GitHub Actions OIDC trusted publisher.');
-            }
-            const accessToken = environmentToken || (await this.prompts.secret('UAPKG granular access token')).trim();
-            if (!accessToken)
-                throw new Error('A granular access token is required.');
-            return {
-                kind: 'gat',
-                credential: { kind: 'bearer', accessToken },
-                otp: requireRequestOtp ? await this.readOtp() : undefined,
-            };
-        }
-        throw new Error([
-            `No supported publishing credential is available for "${trust.alias}".`,
-            '',
-            `Run \`uapkg login --registry ${trust.alias}\` on a browser-capable workstation,`,
-            'set UAPKG_TOKEN for an attended GAT publish, or configure GitHub Actions OIDC.',
-        ].join('\n'));
-    }
-    async readOtp() {
-        this.assertInteractiveRequestOtp();
-        const otp = (await this.prompts.secret('Current TOTP code')).trim();
-        if (!/^[0-9]{6}$/.test(otp)) {
-            throw new Error('A current 6-digit TOTP code is required for this publishing request.');
-        }
-        return otp;
-    }
-    assertInteractiveRequestOtp() {
-        if (this.isInteractive())
-            return;
-        throw new Error('Request-scoped TOTP confirmation requires an attended TTY. Human publishing is not supported in headless environments.');
-    }
-}
+import { GitHubActionsOidcCredentialProvider } from "./GitHubActionsOidcCredentialProvider.js";
+import isCI from "is-ci";
+
+//#region src/control-plane/AuthenticationSelector.ts
+var AuthenticationSelector = class {
+	account;
+	prompts;
+	oidc;
+	isInteractive;
+	constructor(account, prompts, oidc = new GitHubActionsOidcCredentialProvider(), isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI)) {
+		this.account = account;
+		this.prompts = prompts;
+		this.oidc = oidc;
+		this.isInteractive = isInteractive;
+	}
+	async select(mode, trust, scopes, requireRequestOtp, oidcTarget) {
+		if (mode === "oidc" || mode === "auto" && this.oidc.isAvailable()) {
+			if (!oidcTarget) throw new Error("GitHub Actions OIDC requires a target package resolved from the requested operation.");
+			return {
+				kind: "oidc",
+				credential: {
+					kind: "bearer",
+					accessToken: await this.oidc.exchange(trust, oidcTarget)
+				}
+			};
+		}
+		if (mode === "login" || mode === "auto" && await this.account.hasGrant(trust)) {
+			if (requireRequestOtp) this.assertInteractiveRequestOtp();
+			return {
+				kind: "login",
+				credential: (await this.account.getAccessCredential(trust, scopes)).credential,
+				otp: requireRequestOtp ? await this.readOtp() : void 0
+			};
+		}
+		const environmentToken = process.env.UAPKG_TOKEN?.trim();
+		if (mode === "gat" || mode === "auto" && environmentToken) {
+			if (!this.isInteractive()) throw new Error("Human GAT authentication requires an attended TTY. Headless publishing must use a configured GitHub Actions OIDC trusted publisher.");
+			const accessToken = environmentToken || (await this.prompts.secret("UAPKG granular access token")).trim();
+			if (!accessToken) throw new Error("A granular access token is required.");
+			return {
+				kind: "gat",
+				credential: {
+					kind: "bearer",
+					accessToken
+				},
+				otp: requireRequestOtp ? await this.readOtp() : void 0
+			};
+		}
+		throw new Error([
+			`No supported publishing credential is available for "${trust.alias}".`,
+			"",
+			`Run \`uapkg login --registry ${trust.alias}\` on a browser-capable workstation,`,
+			"set UAPKG_TOKEN for an attended GAT publish, or configure GitHub Actions OIDC."
+		].join("\n"));
+	}
+	async readOtp() {
+		this.assertInteractiveRequestOtp();
+		const otp = (await this.prompts.secret("Current TOTP code")).trim();
+		if (!/^[0-9]{6}$/.test(otp)) throw new Error("A current 6-digit TOTP code is required for this publishing request.");
+		return otp;
+	}
+	assertInteractiveRequestOtp() {
+		if (this.isInteractive()) return;
+		throw new Error("Request-scoped TOTP confirmation requires an attended TTY. Human publishing is not supported in headless environments.");
+	}
+};
+
+//#endregion
+export { AuthenticationSelector };
 //# sourceMappingURL=AuthenticationSelector.js.map

package/dist/control-plane/AuthenticationSelector.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationSelector.js","sourceRoot":"","sources":["../../src/control-plane/AuthenticationSelector.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,OAAO,CAAC;AAKzB,OAAO,EAAE,mCAAmC,EAAE,MAAM,0CAA0C,CAAC;AAQ/F,MAAM,OAAO,sBAAsB;IAEd;IACA;IACA;IACA;IAJnB,YACmB,OAAuB,EACvB,OAAsB,EACtB,OAAO,IAAI,mCAAmC,EAAE,EAChD,gBAAgB,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC;QAHnF,YAAO,GAAP,OAAO,CAAgB;QACvB,YAAO,GAAP,OAAO,CAAe;QACtB,SAAI,GAAJ,IAAI,CAA4C;QAChD,kBAAa,GAAb,aAAa,CAAsE;IACnG,CAAC;IAEG,KAAK,CAAC,MAAM,CACjB,IAA0B,EAC1B,KAAoB,EACpB,MAAgC,EAChC,iBAA0B;QAE1B,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,iBAAiB;gBAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrE,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,qIAAqI,CACtI,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,gBAAgB,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1G,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1E,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;gBAC3C,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CACb;YACE,wDAAwD,KAAK,CAAC,KAAK,IAAI;YACvE,EAAE;YACF,gCAAgC,KAAK,CAAC,KAAK,sCAAsC;YACjF,gFAAgF;SACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,2BAA2B;QACjC,IAAI,IAAI,CAAC,aAAa,EAAE;YAAE,OAAO;QACjC,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"AuthenticationSelector.js","names":[],"sources":["../../src/control-plane/AuthenticationSelector.ts"],"sourcesContent":["import isCI from 'is-ci';\nimport type { PromptService } from '../prompts/PromptService.js';\nimport type { AccountManager } from './AccountManager.js';\nimport type { ControlPlaneCredential } from './ControlPlaneClient.js';\nimport type { ControlPlaneAuthMode, RegistryTrust, UAPKGCliScope } from './ControlPlaneTypes.js';\nimport {\n  GitHubActionsOidcCredentialProvider,\n  type GitHubActionsOidcTarget,\n} from './GitHubActionsOidcCredentialProvider.js';\n\nexport interface SelectedAuthentication {\n  readonly kind: 'oidc' | 'login' | 'gat';\n  readonly credential: ControlPlaneCredential;\n  readonly otp?: string;\n}\n\nexport class AuthenticationSelector {\n  public constructor(\n    private readonly account: AccountManager,\n    private readonly prompts: PromptService,\n    private readonly oidc = new GitHubActionsOidcCredentialProvider(),\n    private readonly isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI),\n  ) {}\n\n  public async select(\n    mode: ControlPlaneAuthMode,\n    trust: RegistryTrust,\n    scopes: readonly UAPKGCliScope[],\n    requireRequestOtp: boolean,\n    oidcTarget?: GitHubActionsOidcTarget,\n  ): Promise<SelectedAuthentication> {\n    if (mode === 'oidc' || (mode === 'auto' && this.oidc.isAvailable())) {\n      if (!oidcTarget) {\n        throw new Error('GitHub Actions OIDC requires a target package resolved from the requested operation.');\n      }\n      const accessToken = await this.oidc.exchange(trust, oidcTarget);\n      return { kind: 'oidc', credential: { kind: 'bearer', accessToken } };\n    }\n\n    if (mode === 'login' || (mode === 'auto' && (await this.account.hasGrant(trust)))) {\n      if (requireRequestOtp) this.assertInteractiveRequestOtp();\n      const access = await this.account.getAccessCredential(trust, scopes);\n      return {\n        kind: 'login',\n        credential: access.credential,\n        otp: requireRequestOtp ? await this.readOtp() : undefined,\n      };\n    }\n\n    const environmentToken = process.env.UAPKG_TOKEN?.trim();\n    if (mode === 'gat' || (mode === 'auto' && environmentToken)) {\n      if (!this.isInteractive()) {\n        throw new Error(\n          'Human GAT authentication requires an attended TTY. Headless publishing must use a configured GitHub Actions OIDC trusted publisher.',\n        );\n      }\n      const accessToken = environmentToken || (await this.prompts.secret('UAPKG granular access token')).trim();\n      if (!accessToken) throw new Error('A granular access token is required.');\n      return {\n        kind: 'gat',\n        credential: { kind: 'bearer', accessToken },\n        otp: requireRequestOtp ? await this.readOtp() : undefined,\n      };\n    }\n\n    throw new Error(\n      [\n        `No supported publishing credential is available for \"${trust.alias}\".`,\n        '',\n        `Run \\`uapkg login --registry ${trust.alias}\\` on a browser-capable workstation,`,\n        'set UAPKG_TOKEN for an attended GAT publish, or configure GitHub Actions OIDC.',\n      ].join('\\n'),\n    );\n  }\n\n  private async readOtp(): Promise<string> {\n    this.assertInteractiveRequestOtp();\n    const otp = (await this.prompts.secret('Current TOTP code')).trim();\n    if (!/^[0-9]{6}$/.test(otp)) {\n      throw new Error('A current 6-digit TOTP code is required for this publishing request.');\n    }\n    return otp;\n  }\n\n  private assertInteractiveRequestOtp(): void {\n    if (this.isInteractive()) return;\n    throw new Error(\n      'Request-scoped TOTP confirmation requires an attended TTY. Human publishing is not supported in headless environments.',\n    );\n  }\n}\n"],"mappings":";;;;AAgBA,IAAa,yBAAb,MAAoC;CAEf;CACA;CACA;CACA;CAJnB,AAAO,YACL,AAAiB,SACjB,AAAiB,SACjB,AAAiB,OAAO,IAAI,oCAAoC,GAChE,AAAiB,sBAAsB,QAAQ,QAAQ,MAAM,SAAS,QAAQ,OAAO,SAAS,CAAC,IAAI,GACnG;EAJiB;EACA;EACA;EACA;CAChB;CAEH,MAAa,OACX,MACA,OACA,QACA,mBACA,YACiC;EACjC,IAAI,SAAS,UAAW,SAAS,UAAU,KAAK,KAAK,YAAY,GAAI;GACnE,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sFAAsF;GAGxG,OAAO;IAAE,MAAM;IAAQ,YAAY;KAAE,MAAM;KAAU,mBAD3B,KAAK,KAAK,SAAS,OAAO,UAAU;IACG;GAAE;EACrE;EAEA,IAAI,SAAS,WAAY,SAAS,UAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,GAAK;GACjF,IAAI,mBAAmB,KAAK,4BAA4B;GAExD,OAAO;IACL,MAAM;IACN,aAAY,MAHO,KAAK,QAAQ,oBAAoB,OAAO,MAAM,EAG/C,CAAC;IACnB,KAAK,oBAAoB,MAAM,KAAK,QAAQ,IAAI;GAClD;EACF;EAEA,MAAM,mBAAmB,QAAQ,IAAI,aAAa,KAAK;EACvD,IAAI,SAAS,SAAU,SAAS,UAAU,kBAAmB;GAC3D,IAAI,CAAC,KAAK,cAAc,GACtB,MAAM,IAAI,MACR,qIACF;GAEF,MAAM,cAAc,qBAAqB,MAAM,KAAK,QAAQ,OAAO,6BAA6B,EAAC,CAAE,KAAK;GACxG,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,sCAAsC;GACxE,OAAO;IACL,MAAM;IACN,YAAY;KAAE,MAAM;KAAU;IAAY;IAC1C,KAAK,oBAAoB,MAAM,KAAK,QAAQ,IAAI;GAClD;EACF;EAEA,MAAM,IAAI,MACR;GACE,wDAAwD,MAAM,MAAM;GACpE;GACA,gCAAgC,MAAM,MAAM;GAC5C;EACF,CAAC,CAAC,KAAK,IAAI,CACb;CACF;CAEA,MAAc,UAA2B;EACvC,KAAK,4BAA4B;EACjC,MAAM,OAAO,MAAM,KAAK,QAAQ,OAAO,mBAAmB,EAAC,CAAE,KAAK;EAClE,IAAI,CAAC,aAAa,KAAK,GAAG,GACxB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;CACT;CAEA,AAAQ,8BAAoC;EAC1C,IAAI,KAAK,cAAc,GAAG;EAC1B,MAAM,IAAI,MACR,wHACF;CACF;AACF"}