@uapkg/cli 1.3.0 → 1.3.2

package/dist/control-plane/RegistryGrantLock.js.map

@@ -1 +1 @@
-{"version":3,"file":"RegistryGrantLock.js","sourceRoot":"","sources":["../../src/control-plane/RegistryGrantLock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAuB5C;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IAUb;IATF,aAAa,CAAS;IACtB,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,mBAAmB,CAAS;IAC5B,GAAG,CAAe;IAClB,KAAK,CAA0C;IAC/C,cAAc,CAA2B;IAE1D,YACmB,SAAiB,EAClC,UAAwC,EAAE;QADzB,cAAS,GAAT,SAAS,CAAQ;QAGlC,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;QACvF,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QAC7F,IAAI,CAAC,mBAAmB,GAAG,oBAAoB,CAC7C,OAAO,CAAC,mBAAmB,EAC3B,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,cAAc,CAAC;IACjE,CAAC;IAEM,OAAO,CAAC,MAAc,EAAE,UAAkB;QAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;aACpE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAI,MAAc,EAAE,UAAkB,EAAE,SAA2B;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAc;YACvB,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,UAAU,EAAE;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;SACvB,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAEjD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAClD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7B,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,KAAgB;QACzD,IAAI,MAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC3C,IAAI,QAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,aAAa,EAAE,CAAC;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,qEAAqE;YACrE,uEAAuE;YACvE,uCAAuC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,QAAQ,UAAU,UAAU,EAAE,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,aAAa,IAAI,UAAU,EAAE,OAAO,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,OAAe;QAC1D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,OAAO,KAAK,OAAO;YAAE,OAAO;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,OAAe;QAC5D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,OAAO;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAC;QACtE,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,OAAO,KAAK,iBAAiB;YAC3D,OAAQ,KAA4B,CAAC,OAAO,KAAK,QAAQ;YACzD,CAAC,MAAM,CAAC,SAAS,CAAE,KAA4B,CAAC,GAAG,CAAC;YACpD,OAAQ,KAA4B,CAAC,UAAU,KAAK,QAAQ,EAC5D,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAAE,QAAgB;IACvE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QACnE,CAAC,CAAC,MAAM,CAAE,KAAqC,CAAC,IAAI,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,YAAoB;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"RegistryGrantLock.js","names":[],"sources":["../../src/control-plane/RegistryGrantLock.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\nimport { mkdir, open, readFile, rename, stat, unlink, utimes } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nconst LOCK_FILE_VERSION = 1;\nconst DEFAULT_WAIT_TIMEOUT_MS = 30_000;\nconst DEFAULT_STALE_AFTER_MS = 120_000;\nconst DEFAULT_POLL_INTERVAL_MS = 50;\nconst DEFAULT_HEARTBEAT_INTERVAL_MS = 5_000;\n\ninterface LockOwner {\n  readonly version: typeof LOCK_FILE_VERSION;\n  readonly ownerId: string;\n  readonly pid: number;\n  readonly acquiredAt: number;\n}\n\nexport interface RegistryGrantLock {\n  withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;\n}\n\nexport interface FileRegistryGrantLockOptions {\n  readonly waitTimeoutMs?: number;\n  readonly staleAfterMs?: number;\n  readonly pollIntervalMs?: number;\n  readonly heartbeatIntervalMs?: number;\n  readonly now?: () => number;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly isProcessAlive?: (pid: number) => boolean;\n}\n\n/**\n * Cross-process serialization for a registry grant's rotating refresh-token\n * family. Lock file names contain only a SHA-256 digest of the issuer and\n * registry ID; lock contents contain only an opaque owner ID, PID, and time.\n */\nexport class FileRegistryGrantLock implements RegistryGrantLock {\n  private readonly waitTimeoutMs: number;\n  private readonly staleAfterMs: number;\n  private readonly pollIntervalMs: number;\n  private readonly heartbeatIntervalMs: number;\n  private readonly now: () => number;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly isProcessAlive: (pid: number) => boolean;\n\n  public constructor(\n    private readonly directory: string,\n    options: FileRegistryGrantLockOptions = {},\n  ) {\n    this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);\n    this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);\n    this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);\n    this.heartbeatIntervalMs = positiveMilliseconds(\n      options.heartbeatIntervalMs,\n      Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))),\n    );\n    this.now = options.now ?? Date.now;\n    this.sleep = options.sleep ?? delay;\n    this.isProcessAlive = options.isProcessAlive ?? processIsAlive;\n  }\n\n  public pathFor(issuer: string, registryId: string): string {\n    const digest = createHash('sha256')\n      .update(`${issuer.replace(/\\/+$/, '')}\\0${registryId.toLowerCase()}`)\n      .digest('hex');\n    return join(this.directory, `${digest}.lock`);\n  }\n\n  public async withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T> {\n    await mkdir(this.directory, { recursive: true, mode: 0o700 });\n    const lockPath = this.pathFor(issuer, registryId);\n    const owner: LockOwner = {\n      version: LOCK_FILE_VERSION,\n      ownerId: randomUUID(),\n      pid: process.pid,\n      acquiredAt: this.now(),\n    };\n    const deadline = this.now() + this.waitTimeoutMs;\n\n    while (!(await this.tryAcquire(lockPath, owner))) {\n      if (await this.reclaimIfStale(lockPath)) continue;\n      const remaining = deadline - this.now();\n      if (remaining <= 0) {\n        throw new Error(\n          'Timed out waiting for another UAPKG process to finish using the saved login for this registry.',\n        );\n      }\n      await this.sleep(Math.min(this.pollIntervalMs, remaining));\n    }\n\n    const heartbeat = setInterval(() => {\n      void this.touchIfOwned(lockPath, owner.ownerId);\n    }, this.heartbeatIntervalMs);\n    heartbeat.unref?.();\n\n    try {\n      return await operation();\n    } finally {\n      clearInterval(heartbeat);\n      await this.releaseIfOwned(lockPath, owner.ownerId);\n    }\n  }\n\n  private async tryAcquire(lockPath: string, owner: LockOwner): Promise<boolean> {\n    let handle: Awaited<ReturnType<typeof open>>;\n    try {\n      handle = await open(lockPath, 'wx', 0o600);\n    } catch (error) {\n      if (errorCode(error) === 'EEXIST') return false;\n      throw new Error('Unable to create the UAPKG registry-grant lock.', { cause: error });\n    }\n\n    try {\n      await handle.writeFile(JSON.stringify(owner), { encoding: 'utf8' });\n      return true;\n    } catch (error) {\n      await unlink(lockPath).catch(() => undefined);\n      throw new Error('Unable to initialize the UAPKG registry-grant lock.', { cause: error });\n    } finally {\n      await handle.close();\n    }\n  }\n\n  private async reclaimIfStale(lockPath: string): Promise<boolean> {\n    let lockStat: Awaited<ReturnType<typeof stat>>;\n    try {\n      lockStat = await stat(lockPath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return true;\n      throw new Error('Unable to inspect the UAPKG registry-grant lock.', { cause: error });\n    }\n\n    const observedOwner = await readOwner(lockPath);\n    if (observedOwner) {\n      // A valid owner record with a definitely dead PID is safe to reclaim\n      // immediately. Waiting for the general stale threshold would make a\n      // refresh retry miss the authorization server's bounded predecessor\n      // grace after a process dies between rotation and local persistence.\n      if (this.isProcessAlive(observedOwner.pid)) return false;\n    } else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) {\n      // A just-created lock can briefly be empty while its owner record is\n      // written. Malformed or unreadable ownership therefore remains subject\n      // to the conservative stale threshold.\n      return false;\n    }\n\n    const quarantinePath = `${lockPath}.stale-${randomUUID()}`;\n    try {\n      await rename(lockPath, quarantinePath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return true;\n      throw new Error('Unable to quarantine a stale UAPKG registry-grant lock.', { cause: error });\n    }\n\n    const movedOwner = await readOwner(quarantinePath);\n    if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {\n      await rename(quarantinePath, lockPath).catch(() => undefined);\n      return false;\n    }\n\n    await unlink(quarantinePath).catch((error: unknown) => {\n      throw new Error('Unable to remove a stale UAPKG registry-grant lock.', { cause: error });\n    });\n    return true;\n  }\n\n  private async touchIfOwned(lockPath: string, ownerId: string): Promise<void> {\n    const owner = await readOwner(lockPath);\n    if (owner?.ownerId !== ownerId) return;\n    const now = new Date(this.now());\n    await utimes(lockPath, now, now).catch(() => undefined);\n  }\n\n  private async releaseIfOwned(lockPath: string, ownerId: string): Promise<void> {\n    const owner = await readOwner(lockPath);\n    if (!owner) return;\n    if (owner.ownerId !== ownerId) {\n      throw new Error('The UAPKG registry-grant lock changed ownership before it could be released.');\n    }\n    try {\n      await unlink(lockPath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return;\n      throw new Error('Unable to release the UAPKG registry-grant lock.', { cause: error });\n    }\n  }\n}\n\nasync function readOwner(lockPath: string): Promise<LockOwner | undefined> {\n  try {\n    const value = JSON.parse(await readFile(lockPath, 'utf8')) as unknown;\n    if (\n      typeof value !== 'object' ||\n      value === null ||\n      (value as Partial<LockOwner>).version !== LOCK_FILE_VERSION ||\n      typeof (value as Partial<LockOwner>).ownerId !== 'string' ||\n      !Number.isInteger((value as Partial<LockOwner>).pid) ||\n      typeof (value as Partial<LockOwner>).acquiredAt !== 'number'\n    ) {\n      return undefined;\n    }\n    return value as LockOwner;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction processIsAlive(pid: number): boolean {\n  if (pid === process.pid) return true;\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return errorCode(error) !== 'ESRCH';\n  }\n}\n\nfunction positiveMilliseconds(value: number | undefined, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;\n}\n\nfunction errorCode(error: unknown): string | undefined {\n  return typeof error === 'object' && error !== null && 'code' in error\n    ? String((error as { readonly code?: unknown }).code)\n    : undefined;\n}\n\nfunction delay(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n"],"mappings":";;;;;AAIA,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;AAC/B,MAAM,2BAA2B;AACjC,MAAM,gCAAgC;;;;;;AA4BtC,IAAa,wBAAb,MAAgE;CAU3C;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,AAAO,YACL,AAAiB,WACjB,UAAwC,CAAC,GACzC;EAFiB;EAGjB,KAAK,gBAAgB,qBAAqB,QAAQ,eAAe,uBAAuB;EACxF,KAAK,eAAe,qBAAqB,QAAQ,cAAc,sBAAsB;EACrF,KAAK,iBAAiB,qBAAqB,QAAQ,gBAAgB,wBAAwB;EAC3F,KAAK,sBAAsB,qBACzB,QAAQ,qBACR,KAAK,IAAI,+BAA+B,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,CACxF;EACA,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,iBAAiB,QAAQ,kBAAkB;CAClD;CAEA,AAAO,QAAQ,QAAgB,YAA4B;EACzD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,EAAE,IAAI,WAAW,YAAY,GAAG,CAAC,CACpE,OAAO,KAAK;EACf,OAAO,KAAK,KAAK,WAAW,GAAG,OAAO,MAAM;CAC9C;CAEA,MAAa,SAAY,QAAgB,YAAoB,WAAyC;EACpG,MAAM,MAAM,KAAK,WAAW;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC5D,MAAM,WAAW,KAAK,QAAQ,QAAQ,UAAU;EAChD,MAAM,QAAmB;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,KAAK,QAAQ;GACb,YAAY,KAAK,IAAI;EACvB;EACA,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK;EAEnC,OAAO,CAAE,MAAM,KAAK,WAAW,UAAU,KAAK,GAAI;GAChD,IAAI,MAAM,KAAK,eAAe,QAAQ,GAAG;GACzC,MAAM,YAAY,WAAW,KAAK,IAAI;GACtC,IAAI,aAAa,GACf,MAAM,IAAI,MACR,gGACF;GAEF,MAAM,KAAK,MAAM,KAAK,IAAI,KAAK,gBAAgB,SAAS,CAAC;EAC3D;EAEA,MAAM,YAAY,kBAAkB;GAClC,AAAK,KAAK,aAAa,UAAU,MAAM,OAAO;EAChD,GAAG,KAAK,mBAAmB;EAC3B,UAAU,QAAQ;EAElB,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,UAAU;GACR,cAAc,SAAS;GACvB,MAAM,KAAK,eAAe,UAAU,MAAM,OAAO;EACnD;CACF;CAEA,MAAc,WAAW,UAAkB,OAAoC;EAC7E,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,KAAK,UAAU,MAAM,GAAK;EAC3C,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,mDAAmD,EAAE,OAAO,MAAM,CAAC;EACrF;EAEA,IAAI;GACF,MAAM,OAAO,UAAU,KAAK,UAAU,KAAK,GAAG,EAAE,UAAU,OAAO,CAAC;GAClE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,OAAO,QAAQ,CAAC,CAAC,YAAY,MAAS;GAC5C,MAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;EACzF,UAAU;GACR,MAAM,OAAO,MAAM;EACrB;CACF;CAEA,MAAc,eAAe,UAAoC;EAC/D,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ;EAChC,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,MAAM,CAAC;EACtF;EAEA,MAAM,gBAAgB,MAAM,UAAU,QAAQ;EAC9C,IAAI,eAKF;OAAI,KAAK,eAAe,cAAc,GAAG,GAAG,OAAO;EAAK,OACnD,IAAI,KAAK,IAAI,IAAI,SAAS,WAAW,KAAK,cAI/C,OAAO;EAGT,MAAM,iBAAiB,GAAG,SAAS,SAAS,WAAW;EACvD,IAAI;GACF,MAAM,OAAO,UAAU,cAAc;EACvC,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,2DAA2D,EAAE,OAAO,MAAM,CAAC;EAC7F;EAEA,MAAM,aAAa,MAAM,UAAU,cAAc;EACjD,IAAI,iBAAiB,YAAY,YAAY,cAAc,SAAS;GAClE,MAAM,OAAO,gBAAgB,QAAQ,CAAC,CAAC,YAAY,MAAS;GAC5D,OAAO;EACT;EAEA,MAAM,OAAO,cAAc,CAAC,CAAC,OAAO,UAAmB;GACrD,MAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;EACzF,CAAC;EACD,OAAO;CACT;CAEA,MAAc,aAAa,UAAkB,SAAgC;EAE3E,KAAI,MADgB,UAAU,QAAQ,EAC7B,EAAE,YAAY,SAAS;EAChC,MAAM,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;EAC/B,MAAM,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,YAAY,MAAS;CACxD;CAEA,MAAc,eAAe,UAAkB,SAAgC;EAC7E,MAAM,QAAQ,MAAM,UAAU,QAAQ;EACtC,IAAI,CAAC,OAAO;EACZ,IAAI,MAAM,YAAY,SACpB,MAAM,IAAI,MAAM,8EAA8E;EAEhG,IAAI;GACF,MAAM,OAAO,QAAQ;EACvB,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU;GACnC,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,MAAM,CAAC;EACtF;CACF;AACF;AAEA,eAAe,UAAU,UAAkD;CACzE,IAAI;EACF,MAAM,QAAQ,KAAK,MAAM,MAAM,SAAS,UAAU,MAAM,CAAC;EACzD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,YAAY,qBAC1C,OAAQ,MAA6B,YAAY,YACjD,CAAC,OAAO,UAAW,MAA6B,GAAG,KACnD,OAAQ,MAA6B,eAAe,UAEpD;EAEF,OAAO;CACT,QAAQ;EACN;CACF;AACF;AAEA,SAAS,eAAe,KAAsB;CAC5C,IAAI,QAAQ,QAAQ,KAAK,OAAO;CAChC,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,OAAO;EACd,OAAO,UAAU,KAAK,MAAM;CAC9B;AACF;AAEA,SAAS,qBAAqB,OAA2B,UAA0B;CACjF,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ;AACpF;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QAC5D,OAAQ,MAAsC,IAAI,IAClD;AACN;AAEA,SAAS,MAAM,cAAqC;CAClD,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,YAAY,CAAC;AACnE"}

package/dist/control-plane/RegistryTrustResolver.d.ts

@@ -1,17 +1,20 @@
-import type { CompositionRoot } from '../app/CompositionRoot.js';
-import { type RegistryTrust } from './ControlPlaneTypes.js';
-export declare class RegistryTrustResolver {
-    private readonly root;
-    constructor(root: CompositionRoot);
-    resolve(requestedAlias?: string): Promise<RegistryTrust>;
-    forceRefresh(trust: RegistryTrust): Promise<void>;
-    private selectedAlias;
+import { RegistryTrust } from "./ControlPlaneTypes.js";
+import { CompositionRoot } from "../app/CompositionRoot.js";
+//#region src/control-plane/RegistryTrustResolver.d.ts
+declare class RegistryTrustResolver {
+  private readonly root;
+  constructor(root: CompositionRoot);
+  resolve(requestedAlias?: string): Promise<RegistryTrust>;
+  forceRefresh(trust: RegistryTrust): Promise<void>;
+  private selectedAlias;
 }
 /**
  * GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same
  * repository. Control-plane authorization must bind all three spellings to one
  * stable source identity.
  */
-export declare function canonicalizeRegistryGitOrigin(origin: string): string;
-export declare function fingerprintRegistryGitOrigin(origin: string): string;
+declare function canonicalizeRegistryGitOrigin(origin: string): string;
+declare function fingerprintRegistryGitOrigin(origin: string): string;
+//#endregion
+export { RegistryTrustResolver, canonicalizeRegistryGitOrigin, fingerprintRegistryGitOrigin };
 //# sourceMappingURL=RegistryTrustResolver.d.ts.map

package/dist/control-plane/RegistryTrustResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RegistryTrustResolver.d.ts","sourceRoot":"","sources":["../../src/control-plane/RegistryTrustResolver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,wBAAwB,CAAC;AAiBhC,qBAAa,qBAAqB;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAE5C,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAoDxD,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9D,OAAO,CAAC,aAAa;CAOtB;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAuBpE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnE"}
+{"version":3,"file":"RegistryTrustResolver.d.ts","names":[],"sources":["../../src/control-plane/RegistryTrustResolver.ts"],"mappings":";;;cAca;mBACyB;EAApC,YAAoC,MAAM;EAE7B,QAAQ,0BAA0B,QAAQ;EAoD1C,aAAa,OAAO,gBAAgB;UAczC;;;;;;;iBAcM,8BAA8B;iBAyB9B,6BAA6B"}

package/dist/control-plane/RegistryTrustResolver.js

@@ -1,140 +1,105 @@
-import { createHash } from 'node:crypto';
-import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { normalizeUrl } from '@uapkg/common';
-import { getRegistryRepoPath } from '@uapkg/registry-core';
-import { z } from 'zod';
-import { registryAudience, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CONTROL_PLANE_API, } from './ControlPlaneTypes.js';
-const registryMetaSchema = z
-    .object({
-    schemaVersion: z.literal(1),
-    registry: z.object({
-        id: z.uuid(),
-        name: z.string().min(1),
-    }),
-    sourceOfTruth: z.object({
-        type: z.literal('uapkg-service'),
-        // Advisory only. The CLI deliberately does not use this URL.
-        apiBaseUrl: z.string().optional(),
-    }),
-})
-    .passthrough();
-export class RegistryTrustResolver {
-    root;
-    constructor(root) {
-        this.root = root;
-    }
-    async resolve(requestedAlias) {
-        const alias = requestedAlias ?? this.selectedAlias();
-        const result = this.root.registryCore.getOrCreateRegistry(alias);
-        if (!result.ok) {
-            throw new Error(firstDiagnostic(result.diagnostics, `Registry "${alias}" is not configured.`));
-        }
-        const registry = result.value;
-        const updated = await registry.ensureUpToDate({
-            logicalRegistryName: alias,
-            bypassFreshnessCheck: true,
-        });
-        if (!updated.ok || updated.value === 'Failed') {
-            throw new Error(firstDiagnostic(updated.diagnostics, `Unable to update registry "${alias}".`));
-        }
-        const metadataPath = join(getRegistryRepoPath(registry.shortId), '.uapkg', 'registry.meta.json');
-        let raw;
-        try {
-            raw = await readFile(metadataPath, 'utf8');
-        }
-        catch (error) {
-            throw new Error(`Registry "${alias}" does not contain .uapkg/registry.meta.json. It cannot be used for authenticated control-plane commands.`, { cause: error });
-        }
-        let json;
-        try {
-            json = JSON.parse(raw);
-        }
-        catch (error) {
-            throw new Error(`Registry metadata for "${alias}" is not valid JSON.`, { cause: error });
-        }
-        const parsed = registryMetaSchema.safeParse(json);
-        if (!parsed.success) {
-            throw new Error(`Registry metadata for "${alias}" does not match the supported schema.`);
-        }
-        const repositoryUrl = canonicalizeRegistryGitOrigin(registry.descriptor.url);
-        return {
-            alias,
-            registryId: parsed.data.registry.id,
-            registryName: parsed.data.registry.name,
-            repositoryUrl,
-            repositoryFingerprint: fingerprintRegistryGitOrigin(repositoryUrl),
-            issuer: UAPKG_AUTHORIZATION_ISSUER,
-            apiBaseUrl: UAPKG_CONTROL_PLANE_API,
-            resource: registryAudience(parsed.data.registry.id),
-            cacheShortId: registry.shortId,
-        };
-    }
-    async forceRefresh(trust) {
-        const result = this.root.registryCore.getOrCreateRegistry(trust.alias);
-        if (!result.ok) {
-            throw new Error(firstDiagnostic(result.diagnostics, `Registry "${trust.alias}" is not configured.`));
-        }
-        const updated = await result.value.ensureUpToDate({
-            logicalRegistryName: trust.alias,
-            bypassFreshnessCheck: true,
-        });
-        if (!updated.ok || updated.value === 'Failed') {
-            throw new Error(firstDiagnostic(updated.diagnostics, `Unable to refresh registry "${trust.alias}".`));
-        }
-    }
-    selectedAlias() {
-        const selected = this.root.config.get('registry');
-        if (typeof selected !== 'string' || selected.trim().length === 0) {
-            throw new Error('No registry is selected. Configure one with `uapkg registry use <name>`.');
-        }
-        return selected;
-    }
-}
+import { UAPKG_AUTHORIZATION_ISSUER, UAPKG_CONTROL_PLANE_API, registryAudience } from "./ControlPlaneTypes.js";
+import { normalizeUrl } from "@uapkg/common";
+import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { getRegistryRepoPath } from "@uapkg/registry-core";
+import { RegistryMetaSchema } from "@uapkg/registry-schema";
+
+//#region src/control-plane/RegistryTrustResolver.ts
+var RegistryTrustResolver = class {
+	root;
+	constructor(root) {
+		this.root = root;
+	}
+	async resolve(requestedAlias) {
+		const alias = requestedAlias ?? this.selectedAlias();
+		const result = this.root.registryCore.getOrCreateRegistry(alias);
+		if (!result.ok) throw new Error(firstDiagnostic(result.diagnostics, `Registry "${alias}" is not configured.`));
+		const registry = result.value;
+		const updated = await registry.ensureUpToDate({
+			logicalRegistryName: alias,
+			bypassFreshnessCheck: true
+		});
+		if (!updated.ok || updated.value === "Failed") throw new Error(firstDiagnostic(updated.diagnostics, `Unable to update registry "${alias}".`));
+		const metadataPath = join(getRegistryRepoPath(registry.shortId), ".uapkg", "registry.meta.json");
+		let raw;
+		try {
+			raw = await readFile(metadataPath, "utf8");
+		} catch (error) {
+			throw new Error(`Registry "${alias}" does not contain .uapkg/registry.meta.json. It cannot be used for authenticated control-plane commands.`, { cause: error });
+		}
+		let json;
+		try {
+			json = JSON.parse(raw);
+		} catch (error) {
+			throw new Error(`Registry metadata for "${alias}" is not valid JSON.`, { cause: error });
+		}
+		const parsed = RegistryMetaSchema.safeParse(json);
+		if (!parsed.success) throw new Error(`Registry metadata for "${alias}" does not match the supported schema.`);
+		const repositoryUrl = canonicalizeRegistryGitOrigin(registry.descriptor.url);
+		return {
+			alias,
+			registryId: parsed.data.registry.id,
+			registryName: parsed.data.registry.name,
+			repositoryUrl,
+			repositoryFingerprint: fingerprintRegistryGitOrigin(repositoryUrl),
+			issuer: UAPKG_AUTHORIZATION_ISSUER,
+			apiBaseUrl: UAPKG_CONTROL_PLANE_API,
+			resource: registryAudience(parsed.data.registry.id),
+			cacheShortId: registry.shortId
+		};
+	}
+	async forceRefresh(trust) {
+		const result = this.root.registryCore.getOrCreateRegistry(trust.alias);
+		if (!result.ok) throw new Error(firstDiagnostic(result.diagnostics, `Registry "${trust.alias}" is not configured.`));
+		const updated = await result.value.ensureUpToDate({
+			logicalRegistryName: trust.alias,
+			bypassFreshnessCheck: true
+		});
+		if (!updated.ok || updated.value === "Failed") throw new Error(firstDiagnostic(updated.diagnostics, `Unable to refresh registry "${trust.alias}".`));
+	}
+	selectedAlias() {
+		const selected = this.root.config.get("registry");
+		if (typeof selected !== "string" || selected.trim().length === 0) throw new Error("No registry is selected. Configure one with `uapkg registry use <name>`.");
+		return selected;
+	}
+};
 /**
- * GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same
- * repository. Control-plane authorization must bind all three spellings to one
- * stable source identity.
- */
-export function canonicalizeRegistryGitOrigin(origin) {
-    const value = origin.trim();
-    const scpLike = /^(?:git@)?github\.com:([^/\s]+)\/([^/\s]+?)\/?$/i.exec(value);
-    if (scpLike) {
-        return canonicalGitHubRepository(scpLike[1], scpLike[2]);
-    }
-    try {
-        const parsed = new URL(value);
-        if (parsed.hostname.toLowerCase() === 'github.com') {
-            const path = parsed.pathname.replace(/^\/+|\/+$/g, '').split('/');
-            if (path.length !== 2) {
-                throw new Error('A GitHub registry origin must identify exactly one owner and repository.');
-            }
-            return canonicalGitHubRepository(path[0], path[1]);
-        }
-    }
-    catch (error) {
-        if (error instanceof Error && error.message.startsWith('A GitHub registry origin')) {
-            throw error;
-        }
-    }
-    return normalizeUrl(value);
+* GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same
+* repository. Control-plane authorization must bind all three spellings to one
+* stable source identity.
+*/
+function canonicalizeRegistryGitOrigin(origin) {
+	const value = origin.trim();
+	const scpLike = /^(?:git@)?github\.com:([^/\s]+)\/([^/\s]+?)\/?$/i.exec(value);
+	if (scpLike) return canonicalGitHubRepository(scpLike[1], scpLike[2]);
+	try {
+		const parsed = new URL(value);
+		if (parsed.hostname.toLowerCase() === "github.com") {
+			const path = parsed.pathname.replace(/^\/+|\/+$/g, "").split("/");
+			if (path.length !== 2) throw new Error("A GitHub registry origin must identify exactly one owner and repository.");
+			return canonicalGitHubRepository(path[0], path[1]);
+		}
+	} catch (error) {
+		if (error instanceof Error && error.message.startsWith("A GitHub registry origin")) throw error;
+	}
+	return normalizeUrl(value);
 }
-export function fingerprintRegistryGitOrigin(origin) {
-    const canonical = canonicalizeRegistryGitOrigin(origin);
-    return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;
+function fingerprintRegistryGitOrigin(origin) {
+	const canonical = canonicalizeRegistryGitOrigin(origin);
+	return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
 }
 function canonicalGitHubRepository(owner, repository) {
-    const normalizedOwner = owner.trim().toLowerCase();
-    const normalizedRepository = repository
-        .trim()
-        .replace(/\.git$/i, '')
-        .toLowerCase();
-    if (!normalizedOwner || !normalizedRepository) {
-        throw new Error('A GitHub registry origin must include an owner and repository.');
-    }
-    return `https://github.com/${normalizedOwner}/${normalizedRepository}.git`;
+	const normalizedOwner = owner.trim().toLowerCase();
+	const normalizedRepository = repository.trim().replace(/\.git$/i, "").toLowerCase();
+	if (!normalizedOwner || !normalizedRepository) throw new Error("A GitHub registry origin must include an owner and repository.");
+	return `https://github.com/${normalizedOwner}/${normalizedRepository}.git`;
 }
 function firstDiagnostic(diagnostics, fallback) {
-    return diagnostics[0]?.message ?? fallback;
+	return diagnostics[0]?.message ?? fallback;
 }
+
+//#endregion
+export { RegistryTrustResolver, canonicalizeRegistryGitOrigin, fingerprintRegistryGitOrigin };
 //# sourceMappingURL=RegistryTrustResolver.js.map

package/dist/control-plane/RegistryTrustResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"RegistryTrustResolver.js","sourceRoot":"","sources":["../../src/control-plane/RegistryTrustResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,6DAA6D;QAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAClC,CAAC;CACH,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,OAAO,qBAAqB;IACI;IAApC,YAAoC,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,cAAuB;QAC1C,MAAM,KAAK,GAAG,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,KAAK,sBAAsB,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC;YAC5C,mBAAmB,EAAE,KAAK;YAC1B,oBAAoB,EAAE,IAAI;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,8BAA8B,KAAK,IAAI,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACjG,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,aAAa,KAAK,2GAA2G,EAC7H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,wCAAwC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,aAAa,GAAG,6BAA6B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YACnC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YACvC,aAAa;YACb,qBAAqB,EAAE,4BAA4B,CAAC,aAAa,CAAC;YAClE,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,YAAY,EAAE,QAAQ,CAAC,OAAO;SAC/B,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,KAAoB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,KAAK,CAAC,KAAK,sBAAsB,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;YAChD,mBAAmB,EAAE,KAAK,CAAC,KAAK;YAChC,oBAAoB,EAAE,IAAI;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,+BAA+B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;YACnF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa,EAAE,UAAkB;IAClE,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,oBAAoB,GAAG,UAAU;SACpC,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,WAAW,EAAE,CAAC;IACjB,IAAI,CAAC,eAAe,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,sBAAsB,eAAe,IAAI,oBAAoB,MAAM,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,WAAoD,EAAE,QAAgB;IAC7F,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,QAAQ,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"RegistryTrustResolver.js","names":[],"sources":["../../src/control-plane/RegistryTrustResolver.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { normalizeUrl } from '@uapkg/common';\nimport { getRegistryRepoPath } from '@uapkg/registry-core';\nimport { RegistryMetaSchema } from '@uapkg/registry-schema';\nimport type { CompositionRoot } from '../app/CompositionRoot.js';\nimport {\n  type RegistryTrust,\n  registryAudience,\n  UAPKG_AUTHORIZATION_ISSUER,\n  UAPKG_CONTROL_PLANE_API,\n} from './ControlPlaneTypes.js';\n\nexport class RegistryTrustResolver {\n  public constructor(private readonly root: CompositionRoot) {}\n\n  public async resolve(requestedAlias?: string): Promise<RegistryTrust> {\n    const alias = requestedAlias ?? this.selectedAlias();\n    const result = this.root.registryCore.getOrCreateRegistry(alias);\n    if (!result.ok) {\n      throw new Error(firstDiagnostic(result.diagnostics, `Registry \"${alias}\" is not configured.`));\n    }\n\n    const registry = result.value;\n    const updated = await registry.ensureUpToDate({\n      logicalRegistryName: alias,\n      bypassFreshnessCheck: true,\n    });\n    if (!updated.ok || updated.value === 'Failed') {\n      throw new Error(firstDiagnostic(updated.diagnostics, `Unable to update registry \"${alias}\".`));\n    }\n\n    const metadataPath = join(getRegistryRepoPath(registry.shortId), '.uapkg', 'registry.meta.json');\n    let raw: string;\n    try {\n      raw = await readFile(metadataPath, 'utf8');\n    } catch (error) {\n      throw new Error(\n        `Registry \"${alias}\" does not contain .uapkg/registry.meta.json. It cannot be used for authenticated control-plane commands.`,\n        { cause: error },\n      );\n    }\n\n    let json: unknown;\n    try {\n      json = JSON.parse(raw) as unknown;\n    } catch (error) {\n      throw new Error(`Registry metadata for \"${alias}\" is not valid JSON.`, { cause: error });\n    }\n    const parsed = RegistryMetaSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new Error(`Registry metadata for \"${alias}\" does not match the supported schema.`);\n    }\n\n    const repositoryUrl = canonicalizeRegistryGitOrigin(registry.descriptor.url);\n    return {\n      alias,\n      registryId: parsed.data.registry.id,\n      registryName: parsed.data.registry.name,\n      repositoryUrl,\n      repositoryFingerprint: fingerprintRegistryGitOrigin(repositoryUrl),\n      issuer: UAPKG_AUTHORIZATION_ISSUER,\n      apiBaseUrl: UAPKG_CONTROL_PLANE_API,\n      resource: registryAudience(parsed.data.registry.id),\n      cacheShortId: registry.shortId,\n    };\n  }\n\n  public async forceRefresh(trust: RegistryTrust): Promise<void> {\n    const result = this.root.registryCore.getOrCreateRegistry(trust.alias);\n    if (!result.ok) {\n      throw new Error(firstDiagnostic(result.diagnostics, `Registry \"${trust.alias}\" is not configured.`));\n    }\n    const updated = await result.value.ensureUpToDate({\n      logicalRegistryName: trust.alias,\n      bypassFreshnessCheck: true,\n    });\n    if (!updated.ok || updated.value === 'Failed') {\n      throw new Error(firstDiagnostic(updated.diagnostics, `Unable to refresh registry \"${trust.alias}\".`));\n    }\n  }\n\n  private selectedAlias(): string {\n    const selected = this.root.config.get('registry');\n    if (typeof selected !== 'string' || selected.trim().length === 0) {\n      throw new Error('No registry is selected. Configure one with `uapkg registry use <name>`.');\n    }\n    return selected;\n  }\n}\n\n/**\n * GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same\n * repository. Control-plane authorization must bind all three spellings to one\n * stable source identity.\n */\nexport function canonicalizeRegistryGitOrigin(origin: string): string {\n  const value = origin.trim();\n  const scpLike = /^(?:git@)?github\\.com:([^/\\s]+)\\/([^/\\s]+?)\\/?$/i.exec(value);\n  if (scpLike) {\n    return canonicalGitHubRepository(scpLike[1], scpLike[2]);\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.hostname.toLowerCase() === 'github.com') {\n      const path = parsed.pathname.replace(/^\\/+|\\/+$/g, '').split('/');\n      if (path.length !== 2) {\n        throw new Error('A GitHub registry origin must identify exactly one owner and repository.');\n      }\n      return canonicalGitHubRepository(path[0], path[1]);\n    }\n  } catch (error) {\n    if (error instanceof Error && error.message.startsWith('A GitHub registry origin')) {\n      throw error;\n    }\n  }\n\n  return normalizeUrl(value);\n}\n\nexport function fingerprintRegistryGitOrigin(origin: string): string {\n  const canonical = canonicalizeRegistryGitOrigin(origin);\n  return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;\n}\n\nfunction canonicalGitHubRepository(owner: string, repository: string): string {\n  const normalizedOwner = owner.trim().toLowerCase();\n  const normalizedRepository = repository\n    .trim()\n    .replace(/\\.git$/i, '')\n    .toLowerCase();\n  if (!normalizedOwner || !normalizedRepository) {\n    throw new Error('A GitHub registry origin must include an owner and repository.');\n  }\n  return `https://github.com/${normalizedOwner}/${normalizedRepository}.git`;\n}\n\nfunction firstDiagnostic(diagnostics: readonly { readonly message: string }[], fallback: string): string {\n  return diagnostics[0]?.message ?? fallback;\n}\n"],"mappings":";;;;;;;;;AAcA,IAAa,wBAAb,MAAmC;CACG;CAApC,AAAO,YAAY,AAAiB,MAAuB;EAAvB;CAAwB;CAE5D,MAAa,QAAQ,gBAAiD;EACpE,MAAM,QAAQ,kBAAkB,KAAK,cAAc;EACnD,MAAM,SAAS,KAAK,KAAK,aAAa,oBAAoB,KAAK;EAC/D,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,gBAAgB,OAAO,aAAa,aAAa,MAAM,qBAAqB,CAAC;EAG/F,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,MAAM,SAAS,eAAe;GAC5C,qBAAqB;GACrB,sBAAsB;EACxB,CAAC;EACD,IAAI,CAAC,QAAQ,MAAM,QAAQ,UAAU,UACnC,MAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,8BAA8B,MAAM,GAAG,CAAC;EAG/F,MAAM,eAAe,KAAK,oBAAoB,SAAS,OAAO,GAAG,UAAU,oBAAoB;EAC/F,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,SAAS,cAAc,MAAM;EAC3C,SAAS,OAAO;GACd,MAAM,IAAI,MACR,aAAa,MAAM,4GACnB,EAAE,OAAO,MAAM,CACjB;EACF;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,MAAM,GAAG;EACvB,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,0BAA0B,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;EACzF;EACA,MAAM,SAAS,mBAAmB,UAAU,IAAI;EAChD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,0BAA0B,MAAM,uCAAuC;EAGzF,MAAM,gBAAgB,8BAA8B,SAAS,WAAW,GAAG;EAC3E,OAAO;GACL;GACA,YAAY,OAAO,KAAK,SAAS;GACjC,cAAc,OAAO,KAAK,SAAS;GACnC;GACA,uBAAuB,6BAA6B,aAAa;GACjE,QAAQ;GACR,YAAY;GACZ,UAAU,iBAAiB,OAAO,KAAK,SAAS,EAAE;GAClD,cAAc,SAAS;EACzB;CACF;CAEA,MAAa,aAAa,OAAqC;EAC7D,MAAM,SAAS,KAAK,KAAK,aAAa,oBAAoB,MAAM,KAAK;EACrE,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,gBAAgB,OAAO,aAAa,aAAa,MAAM,MAAM,qBAAqB,CAAC;EAErG,MAAM,UAAU,MAAM,OAAO,MAAM,eAAe;GAChD,qBAAqB,MAAM;GAC3B,sBAAsB;EACxB,CAAC;EACD,IAAI,CAAC,QAAQ,MAAM,QAAQ,UAAU,UACnC,MAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,+BAA+B,MAAM,MAAM,GAAG,CAAC;CAExG;CAEA,AAAQ,gBAAwB;EAC9B,MAAM,WAAW,KAAK,KAAK,OAAO,IAAI,UAAU;EAChD,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAC7D,MAAM,IAAI,MAAM,0EAA0E;EAE5F,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,QAAQ,OAAO,KAAK;CAC1B,MAAM,UAAU,mDAAmD,KAAK,KAAK;CAC7E,IAAI,SACF,OAAO,0BAA0B,QAAQ,IAAI,QAAQ,EAAE;CAGzD,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,KAAK;EAC5B,IAAI,OAAO,SAAS,YAAY,MAAM,cAAc;GAClD,MAAM,OAAO,OAAO,SAAS,QAAQ,cAAc,EAAE,CAAC,CAAC,MAAM,GAAG;GAChE,IAAI,KAAK,WAAW,GAClB,MAAM,IAAI,MAAM,0EAA0E;GAE5F,OAAO,0BAA0B,KAAK,IAAI,KAAK,EAAE;EACnD;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,0BAA0B,GAC/E,MAAM;CAEV;CAEA,OAAO,aAAa,KAAK;AAC3B;AAEA,SAAgB,6BAA6B,QAAwB;CACnE,MAAM,YAAY,8BAA8B,MAAM;CACtD,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;AACtE;AAEA,SAAS,0BAA0B,OAAe,YAA4B;CAC5E,MAAM,kBAAkB,MAAM,KAAK,CAAC,CAAC,YAAY;CACjD,MAAM,uBAAuB,WAC1B,KAAK,CAAC,CACN,QAAQ,WAAW,EAAE,CAAC,CACtB,YAAY;CACf,IAAI,CAAC,mBAAmB,CAAC,sBACvB,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO,sBAAsB,gBAAgB,GAAG,qBAAqB;AACvE;AAEA,SAAS,gBAAgB,aAAsD,UAA0B;CACvG,OAAO,YAAY,EAAE,EAAE,WAAW;AACpC"}

package/dist/index.d.ts

@@ -1,39 +1,62 @@
-export { CompositionRoot, type CompositionRootOptions } from './app/CompositionRoot.js';
-export { UAPKGApplication } from './app/UAPKGApplication.js';
-export { parseUAPKGCommandLine } from './cli/parseCommandLine.js';
-export { runUAPKGCLI } from './cli/runUAPKGCLI.js';
-export type { UAPKGCommandLine, UAPKGWhoamiField } from './cli/UAPKGCommandLine.js';
-export { createUAPKGCommandLineFactory, UAPKG_WHOAMI_FIELDS, UAPKGCommandLineFactory, } from './cli/UAPKGCommandLine.js';
-export { AddCommand, type AddCommandOptions } from './commands/AddCommand.js';
-export { ConfigCommand } from './commands/ConfigCommand.js';
-export { InitCommand, type InitCommandOptions } from './commands/InitCommand.js';
-export { InstallCommand, type InstallCommandOptions } from './commands/InstallCommand.js';
-export { ListCommand, type ListCommandOptions } from './commands/ListCommand.js';
-export { LoginCommand, type LoginCommandOptions } from './commands/LoginCommand.js';
-export { LogoutCommand, type LogoutCommandOptions } from './commands/LogoutCommand.js';
-export { OutdatedCommand, type OutdatedCommandOptions } from './commands/OutdatedCommand.js';
-export { PackCommand } from './commands/PackCommand.js';
-export { ProjectGetNameCommand, type ProjectGetNameCommandOptions, } from './commands/ProjectGetNameCommand.js';
-export { PublishCommand, type PublishCommandOptions } from './commands/PublishCommand.js';
-export { RegistryCommand, type RegistryCommandOptions, type RegistryCommandRuntime, } from './commands/RegistryCommand.js';
-export { RemoveCommand, type RemoveCommandOptions } from './commands/RemoveCommand.js';
-export { RequestsCommand, type RequestsCommandOptions } from './commands/RequestsCommand.js';
-export { UpdateCommand, type UpdateCommandOptions } from './commands/UpdateCommand.js';
-export { WhoamiCommand, type WhoamiCommandData, type WhoamiCommandOptions, type WhoamiFieldData, } from './commands/WhoamiCommand.js';
-export { WhyCommand, type WhyCommandOptions } from './commands/WhyCommand.js';
-export { type AccessCredential, AccountManager, type BrowserOpener, controlPlaneDiagnosticForError, describeControlPlaneError, LoginError, type LoginOptions, type LoginProgressEvent, type LoginResult, loginDiagnosticForError, } from './control-plane/AccountManager.js';
-export { AuthMetadataStore } from './control-plane/AuthMetadataStore.js';
-export { ControlPlaneClient, type ControlPlaneCredential, } from './control-plane/ControlPlaneClient.js';
-export * from './control-plane/ControlPlaneTypes.js';
-export { CredentialStore, type KeyringLoader } from './control-plane/CredentialStore.js';
-export { DPoPKeyStore } from './control-plane/DPoPKeyStore.js';
-export { FileRegistryGrantLock, type FileRegistryGrantLockOptions, type RegistryGrantLock, } from './control-plane/RegistryGrantLock.js';
-export { canonicalizeRegistryGitOrigin, fingerprintRegistryGitOrigin, RegistryTrustResolver, } from './control-plane/RegistryTrustResolver.js';
-export * from './postinstall/index.js';
-export { InkPromptService } from './prompts/InkPromptService.js';
-export { type ProjectContextDetection, ProjectContextDetector, } from './prompts/ProjectContextDetector.js';
-export type { PromptService, SelectOption } from './prompts/PromptService.js';
-export { DiagnosticReporter } from './reporting/DiagnosticReporter.js';
-export { InstallProgressReporter } from './reporting/InstallProgressReporter.js';
-export { type JsonEnvelope, JsonReporter } from './reporting/JsonReporter.js';
-//# sourceMappingURL=index.d.ts.map
+import { AccountDisplayMetadata, AccountSelf, ActivatedCliLoginGrant, AuthMetadataFile, CliLoginConfirmation, ControlPlaneApiErrorBody, ControlPlaneAuthMode, ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, ObservedArtifactIntegrity, RegistryGrantMetadata, RegistryOperation, RegistryRequestCheck, RegistryRequestCheckConclusion, RegistryRequestCheckExecutionState, RegistryRequestDetail, RegistryRequestSource, RegistryRequestStatus, RegistryRequestSubmission, RegistryRequestSummary, RegistryRequestTerminalFailure, RegistryTrust, SubmittedPackageClaims, UAPKGCliScope, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, parseOAuthScopeTokens, parseUAPKGCliScopeString, registryAudience } from "./control-plane/ControlPlaneTypes.js";
+import { FileRegistryGrantLock, FileRegistryGrantLockOptions, RegistryGrantLock } from "./control-plane/RegistryGrantLock.js";
+import { AuthMetadataStore } from "./control-plane/AuthMetadataStore.js";
+import { ControlPlaneClient, ControlPlaneCredential } from "./control-plane/ControlPlaneClient.js";
+import { CredentialStore, KeyringLoader } from "./control-plane/CredentialStore.js";
+import { AccessCredential, AccountManager, BrowserOpener, LoginError, LoginOptions, LoginProgressEvent, LoginResult, controlPlaneDiagnosticForError, describeControlPlaneError, loginDiagnosticForError } from "./control-plane/AccountManager.js";
+import { RegistryTrustResolver, canonicalizeRegistryGitOrigin, fingerprintRegistryGitOrigin } from "./control-plane/RegistryTrustResolver.js";
+import { PostinstallDefinition, PostinstallDefinitionSchema, ProjectSetupDefinition, ProjectSetupSchema, ZoneDefinition, ZoneSchema } from "./postinstall/api/PostinstallDsl.js";
+import { EntryResolver, PostinstallEntryKind, ResolvedEntry } from "./postinstall/loader/EntryResolver.js";
+import { EsbuildTranspiler } from "./postinstall/loader/EsbuildTranspiler.js";
+import { ExportValidator } from "./postinstall/loader/ExportValidator.js";
+import { ModuleImporter, ModuleSource } from "./postinstall/loader/ModuleImporter.js";
+import { LoadedPostinstall, PostinstallLoader } from "./postinstall/loader/PostinstallLoader.js";
+import { PolicyConfigReader, PolicyDecision, PostinstallPolicyGate } from "./postinstall/policy/PostinstallPolicyGate.js";
+import { MarkerBlockService } from "./postinstall/markers/MarkerBlockService.js";
+import { MarkerIntegrityFail, MarkerIntegrityOk, MarkerIntegrityResult, MarkerIntegrityValidator } from "./postinstall/markers/MarkerIntegrityValidator.js";
+import { MarkerBlockEditor } from "./postinstall/markers/MarkerBlockEditor.js";
+import { CSharpFileKind, ParsedCSharpFile, ParsedClass, ParsedConstructor } from "./postinstall/unreal/CSharpStructures.js";
+import { CSharpInjectionEngine } from "./postinstall/unreal/CSharpInjectionEngine.js";
+import { CSharpStructureAnalyzer } from "./postinstall/unreal/CSharpStructureAnalyzer.js";
+import { CSharpWrapperFactory, WrapperContextType } from "./postinstall/unreal/CSharpWrapperFactory.js";
+import { BuildCsInjector } from "./postinstall/unreal/BuildCsInjector.js";
+import { ProjectFileLocator } from "./postinstall/unreal/ProjectFileLocator.js";
+import { TargetCsInjector } from "./postinstall/unreal/TargetCsInjector.js";
+import { SourceCatalog, UnrealSourceCatalogBuilder } from "./postinstall/unreal/UnrealSourceCatalog.js";
+import { UProjectInjector } from "./postinstall/unreal/UProjectInjector.js";
+import { UProjectMetadataReader } from "./postinstall/unreal/UProjectMetadataReader.js";
+import { PostinstallCandidate, PostinstallOrchestrator, PostinstallOrchestratorInput, PostinstallReport } from "./postinstall/runner/PostinstallOrchestrator.js";
+import { DiagnosticReporter } from "./reporting/DiagnosticReporter.js";
+import { JsonEnvelope, JsonReporter } from "./reporting/JsonReporter.js";
+import { CompositionRoot, CompositionRootOptions } from "./app/CompositionRoot.js";
+import { UAPKGCommandLine, UAPKGCommandLineFactory, UAPKGWhoamiField, UAPKG_WHOAMI_FIELDS, createUAPKGCommandLineFactory } from "./cli/UAPKGCommandLine.js";
+import { UAPKGApplication } from "./app/UAPKGApplication.js";
+import { parseUAPKGCommandLine } from "./cli/parseCommandLine.js";
+import { runUAPKGCLI } from "./cli/runUAPKGCLI.js";
+import { AddCommand, AddCommandOptions } from "./commands/AddCommand.js";
+import { ConfigCommand } from "./commands/ConfigCommand.js";
+import { ProjectContextDetection, ProjectContextDetector } from "./prompts/ProjectContextDetector.js";
+import { PromptService, SelectOption } from "./prompts/PromptService.js";
+import { InitCommand, InitCommandOptions } from "./commands/InitCommand.js";
+import { InstallCommand, InstallCommandOptions } from "./commands/InstallCommand.js";
+import { ListCommand, ListCommandOptions } from "./commands/ListCommand.js";
+import { LoginCommand, LoginCommandOptions } from "./commands/LoginCommand.js";
+import { LogoutCommand, LogoutCommandOptions } from "./commands/LogoutCommand.js";
+import { OutdatedCommand, OutdatedCommandOptions } from "./commands/OutdatedCommand.js";
+import { PackCommand } from "./commands/PackCommand.js";
+import { ProjectGetNameCommand, ProjectGetNameCommandOptions } from "./commands/ProjectGetNameCommand.js";
+import { PublishCommand, PublishCommandOptions } from "./commands/PublishCommand.js";
+import { RegistryCommand, RegistryCommandOptions, RegistryCommandRuntime } from "./commands/RegistryCommand.js";
+import { RemoveCommand, RemoveCommandOptions } from "./commands/RemoveCommand.js";
+import { RequestsCommand, RequestsCommandOptions } from "./commands/RequestsCommand.js";
+import { UpdateCommand, UpdateCommandOptions } from "./commands/UpdateCommand.js";
+import { WhoamiCommand, WhoamiCommandData, WhoamiCommandOptions, WhoamiFieldData } from "./commands/WhoamiCommand.js";
+import { WhyCommand, WhyCommandOptions } from "./commands/WhyCommand.js";
+import { DPoPKeyStore } from "./control-plane/DPoPKeyStore.js";
+import { definePostinstall } from "./postinstall/api/definePostinstall.js";
+import { getPluginHash, getWrapperClassName } from "./postinstall/unreal/PluginHash.js";
+import { PrettyParseError } from "./postinstall/unreal/PrettyParseError.js";
+import "./postinstall/index.js";
+import { InkPromptService } from "./prompts/InkPromptService.js";
+import { InstallProgressReporter } from "./reporting/InstallProgressReporter.js";
+export { type AccessCredential, AccountDisplayMetadata, AccountManager, AccountSelf, ActivatedCliLoginGrant, AddCommand, type AddCommandOptions, AuthMetadataFile, AuthMetadataStore, type BrowserOpener, BuildCsInjector, type CSharpFileKind, CSharpInjectionEngine, CSharpStructureAnalyzer, CSharpWrapperFactory, CliLoginConfirmation, CompositionRoot, type CompositionRootOptions, ConfigCommand, ControlPlaneApiErrorBody, ControlPlaneAuthMode, ControlPlaneClient, type ControlPlaneCredential, ControlPlaneError, CredentialStore, DPoPKeyStore, DiagnosticReporter, EntryResolver, EsbuildTranspiler, ExportValidator, FileRegistryGrantLock, type FileRegistryGrantLockOptions, InitCommand, type InitCommandOptions, InkPromptService, InstallCommand, type InstallCommandOptions, InstallProgressReporter, type JsonEnvelope, JsonReporter, type KeyringLoader, ListCommand, type ListCommandOptions, type LoadedPostinstall, LoginCommand, type LoginCommandOptions, LoginError, type LoginOptions, type LoginProgressEvent, type LoginResult, LogoutCommand, type LogoutCommandOptions, MarkerBlockEditor, MarkerBlockService, type MarkerIntegrityFail, type MarkerIntegrityOk, type MarkerIntegrityResult, MarkerIntegrityValidator, ModuleImporter, type ModuleSource, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, ObservedArtifactIntegrity, OutdatedCommand, type OutdatedCommandOptions, PackCommand, type ParsedCSharpFile, type ParsedClass, type ParsedConstructor, type PolicyConfigReader, type PolicyDecision, type PostinstallCandidate, type PostinstallDefinition, PostinstallDefinitionSchema, type PostinstallEntryKind, PostinstallLoader, PostinstallOrchestrator, type PostinstallOrchestratorInput, PostinstallPolicyGate, type PostinstallReport, PrettyParseError, type ProjectContextDetection, ProjectContextDetector, ProjectFileLocator, ProjectGetNameCommand, type ProjectGetNameCommandOptions, type ProjectSetupDefinition, ProjectSetupSchema, type PromptService, PublishCommand, type PublishCommandOptions, RegistryCommand, type RegistryCommandOptions, type RegistryCommandRuntime, type RegistryGrantLock, RegistryGrantMetadata, RegistryOperation, RegistryRequestCheck, RegistryRequestCheckConclusion, RegistryRequestCheckExecutionState, RegistryRequestDetail, RegistryRequestSource, RegistryRequestStatus, RegistryRequestSubmission, RegistryRequestSummary, RegistryRequestTerminalFailure, RegistryTrust, RegistryTrustResolver, RemoveCommand, type RemoveCommandOptions, RequestsCommand, type RequestsCommandOptions, type ResolvedEntry, type SelectOption, type SourceCatalog, SubmittedPackageClaims, TargetCsInjector, UAPKGApplication, UAPKGCliScope, type UAPKGCommandLine, UAPKGCommandLineFactory, type UAPKGWhoamiField, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, UAPKG_WHOAMI_FIELDS, UProjectInjector, UProjectMetadataReader, UnrealSourceCatalogBuilder, UpdateCommand, type UpdateCommandOptions, WhoamiCommand, type WhoamiCommandData, type WhoamiCommandOptions, type WhoamiFieldData, WhyCommand, type WhyCommandOptions, type WrapperContextType, type ZoneDefinition, ZoneSchema, canonicalizeRegistryGitOrigin, controlPlaneDiagnosticForError, createUAPKGCommandLineFactory, definePostinstall, describeControlPlaneError, fingerprintRegistryGitOrigin, getPluginHash, getWrapperClassName, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, loginDiagnosticForError, parseOAuthScopeTokens, parseUAPKGCliScopeString, parseUAPKGCommandLine, registryAudience, runUAPKGCLI };