npm - @uapkg/cli - Versions diffs - 1.3.2 → 1.5.0 - Mend

@uapkg/cli 1.3.2 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (625) hide show

package/dist/control-plane/AccountManager.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"AccountManager.js","names":[],"sources":["../../src/control-plane/AccountManager.ts"],"sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';\nimport { hostname } from 'node:os';\nimport {\n type ControlPlaneCommandFailedDiagnostic,\n type ControlPlaneDiagnostic,\n createControlPlaneCommandFailedDiagnostic,\n type LoginDiagnosticCode,\n} from '@uapkg/diagnostics';\nimport isCI from 'is-ci';\nimport * as oauth from 'oauth4webapi';\nimport { AuthMetadataStore } from './AuthMetadataStore.js';\nimport { resolveAuthStoragePaths } from './AuthStoragePaths.js';\nimport { ControlPlaneClient, type ControlPlaneCredential } from './ControlPlaneClient.js';\nimport {\n ControlPlaneError,\n isUAPKGCliScope,\n OAuthScopeInsufficientError,\n OAuthScopeUnsupportedError,\n parseUAPKGCliScopeString,\n type RegistryGrantMetadata,\n type RegistryTrust,\n registryAudience,\n UAPKG_AUTHORIZATION_ISSUER,\n UAPKG_CLI_CLIENT_ID,\n UAPKG_CLI_SCOPES,\n UAPKG_CONTROL_PLANE_API,\n type UAPKGCliScope,\n} from './ControlPlaneTypes.js';\nimport { CredentialStore } from './CredentialStore.js';\nimport { DPoPKeyStore } from './DPoPKeyStore.js';\nimport { FileRegistryGrantLock, type RegistryGrantLock } from './RegistryGrantLock.js';\n\nconst INTERACTIVE_LOGIN_TIMEOUT_MS = 3 * 60 * 1000;\nconst INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS = 60 * 1000;\nconst CLI_LOGIN_RECONCILIATION_TIMEOUT_MS = 5 * 1000;\nconst OAUTH_BACKCHANNEL_TIMEOUT_MS = 30 * 1000;\nconst LOOPBACK_CALLBACK_PATH = '/callback';\nconst ACCOUNT_COMPLETION_PATH = '/cli-login/complete';\nconst CONTROL_PLANE_SERVER_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;\n\nexport interface LoginOptions {\n readonly deviceName?: string;\n readonly reauthorize?: boolean;\n readonly onProgress?: (event: LoginProgressEvent) => void;\n}\n\nexport type LoginProgressEvent =\n | { readonly type: 'preparing'; readonly registryAlias: string }\n | { readonly type: 'opening-browser' }\n | { readonly type: 'browser-open-failed'; readonly authorizationUrl: string }\n | { readonly type: 'waiting-for-decision' }\n | { readonly type: 'approval-received' }\n | { readonly type: 'saving-local-credentials' }\n | { readonly type: 'confirming-with-service' };\n\ntype LoginCompletionOutcome = 'success' | 'denied' | 'failed';\n\ntype CliLoginActivationOutcome =\n | { readonly kind: 'active' }\n | { readonly kind: 'rejected'; readonly error: unknown }\n | { readonly kind: 'ambiguous'; readonly error: LoginError };\n\nexport class LoginError extends Error {\n public constructor(\n public readonly code: LoginDiagnosticCode,\n message: string,\n public readonly oauthError?: string,\n ) {\n super(message);\n this.name = 'LoginError';\n }\n}\n\nexport interface LoginResult {\n readonly grant: RegistryGrantMetadata;\n readonly warnings: readonly string[];\n}\n\nexport interface AccessCredential {\n readonly credential: ControlPlaneCredential;\n readonly grant: RegistryGrantMetadata;\n}\n\nexport type BrowserOpener = (url: string) => Promise<void>;\n\nexport class AccountManager {\n private readonly keyStore: DPoPKeyStore;\n private readonly accessTokenCache = new Map<\n string,\n { readonly token: string; readonly expiresAt: number; readonly dpop: oauth.DPoPHandle }\n >();\n private readonly grantOperationTails = new Map<string, Promise<void>>();\n private readonly grantLock: RegistryGrantLock;\n\n public constructor(\n private readonly metadata = new AuthMetadataStore(),\n private readonly credentials = new CredentialStore(),\n private readonly openBrowser: BrowserOpener = async (url) => {\n const { default: open } = await import('open');\n await open(url, { wait: false });\n },\n private readonly isInteractiveLogin = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI),\n grantLock?: RegistryGrantLock,\n private readonly interactiveLoginTimeoutMs = INTERACTIVE_LOGIN_TIMEOUT_MS,\n private readonly interactiveLoginFinalizationTimeoutMs = INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS,\n ) {\n this.keyStore = new DPoPKeyStore(credentials);\n const metadataPath = typeof metadata.path === 'string' ? metadata.path : undefined;\n this.grantLock = grantLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(metadataPath).locksDirectory);\n }\n\n public async hasGrant(trust: RegistryTrust): Promise<boolean> {\n return Boolean(await this.metadata.find(trust.issuer, trust.registryId));\n }\n\n public invalidateAccessCredentials(trust: RegistryTrust): void {\n for (const key of this.accessTokenCache.keys()) {\n if (key.startsWith(`${trust.issuer}|${trust.registryId}|`)) {\n this.accessTokenCache.delete(key);\n }\n }\n }\n\n public async login(trust: RegistryTrust, options: LoginOptions = {}): Promise<LoginResult> {\n this.assertPinnedTrust(trust);\n this.assertInteractiveLogin();\n await this.credentials.assertAvailable();\n\n const previous = await this.metadata.find(trust.issuer, trust.registryId);\n if (previous && !options.reauthorize) {\n throw new Error(\n `This device already has a saved login for \"${trust.alias}\". Use \\`uapkg login --registry ${trust.alias} --reauthorize\\` to replace it.`,\n );\n }\n\n emitLoginProgress(options.onProgress, { type: 'preparing', registryAlias: trust.alias });\n const issuer = new URL(trust.issuer);\n const as = await this.discover(issuer);\n this.validateAuthorizationServer(as);\n this.assertIssuerSupportsScopes(as, trust, UAPKG_CLI_SCOPES);\n const client = this.client();\n const keyPair = await this.keyStore.generate();\n const dpop = oauth.DPoP(client, keyPair);\n const publicKeyThumbprint = await dpop.calculateThumbprint();\n const receiver = await LoopbackAuthorizationReceiver.listen(issuer);\n let issuedRefreshToken: string | undefined;\n let retainedIssuedGrant = false;\n let preserveIssuedGrant = false;\n let callbackReceipt: LoopbackAuthorizationReceipt | undefined;\n let finalizationController: AbortController | undefined;\n let finalizationTimeout: NodeJS.Timeout | undefined;\n\n try {\n const codeVerifier = oauth.generateRandomCodeVerifier();\n const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);\n const state = oauth.generateRandomState();\n const nonce = oauth.generateRandomNonce();\n const requestedScopes = ['openid', 'offline_access', ...UAPKG_CLI_SCOPES];\n const scope = requestedScopes.join(' ');\n const deviceName = normalizeDeviceName(options.deviceName);\n\n const parameters = new URLSearchParams({\n client_id: client.client_id,\n redirect_uri: receiver.redirectUri,\n response_type: 'code',\n code_challenge: codeChallenge,\n code_challenge_method: 'S256',\n state,\n nonce,\n scope,\n resource: trust.resource,\n dpop_jkt: publicKeyThumbprint,\n registry_id: trust.registryId,\n registry_source_fingerprint: trust.repositoryFingerprint,\n device_name: deviceName,\n max_age: '300',\n });\n if (requestedScopes.includes('offline_access')) {\n parameters.set('prompt', 'consent');\n }\n const expectedPredecessorGrantId = options.reauthorize && previous ? previous.grantId : null;\n if (expectedPredecessorGrantId) {\n parameters.set('replace_grant_id', expectedPredecessorGrantId);\n }\n\n const pushed = await this.withDPoPNonceRetry(\n () =>\n oauth.pushedAuthorizationRequest(as, client, oauth.None(), parameters, {\n DPoP: dpop,\n signal: () => AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),\n }),\n (response) => oauth.processPushedAuthorizationResponse(as, client, response),\n );\n\n if (!as.authorization_endpoint) {\n throw new Error('The authorization server did not advertise an authorization endpoint.');\n }\n const authorizationUrl = new URL(as.authorization_endpoint);\n authorizationUrl.searchParams.set('client_id', client.client_id);\n authorizationUrl.searchParams.set('request_uri', pushed.request_uri);\n\n emitLoginProgress(options.onProgress, { type: 'opening-browser' });\n try {\n await this.openBrowser(authorizationUrl.href);\n } catch {\n emitLoginProgress(options.onProgress, {\n type: 'browser-open-failed',\n authorizationUrl: authorizationUrl.href,\n });\n }\n emitLoginProgress(options.onProgress, { type: 'waiting-for-decision' });\n callbackReceipt = await receiver.waitForCallback(this.interactiveLoginTimeoutMs, trust.alias);\n finalizationController = new AbortController();\n finalizationTimeout = setTimeout(() => {\n finalizationController?.abort(loginFinalizationTimeoutError(trust.alias));\n }, this.interactiveLoginFinalizationTimeoutMs);\n const finalizationSignal = finalizationController.signal;\n const callbackUrl = callbackReceipt.url;\n if (callbackUrl.searchParams.get('iss') !== trust.issuer) {\n throw new LoginError(\n 'LOGIN_AUTHORIZATION_RESPONSE_INVALID',\n 'The browser authorization response came from an unexpected issuer. Run `uapkg login` again.',\n );\n }\n\n let callbackParameters: URLSearchParams;\n try {\n callbackParameters = oauth.validateAuthResponse(as, client, callbackUrl, state);\n } catch (error) {\n throw authorizationResponseLoginError(error);\n }\n emitLoginProgress(options.onProgress, { type: 'approval-received' });\n const tokens = await this.withDPoPNonceRetry(\n () =>\n oauth.authorizationCodeGrantRequest(\n as,\n client,\n oauth.None(),\n callbackParameters,\n receiver.redirectUri,\n codeVerifier,\n { DPoP: dpop, signal: finalizationSignal },\n ),\n (response) =>\n oauth.processAuthorizationCodeResponse(as, client, response, {\n expectedNonce: nonce,\n maxAge: 300,\n requireIdToken: true,\n }),\n );\n finalizationSignal.throwIfAborted();\n\n if (tokens.token_type !== 'dpop') {\n throw new Error('The authorization server did not issue a DPoP-bound access token.');\n }\n if (!tokens.refresh_token) {\n throw new Error('The authorization server did not issue a persistent registry grant.');\n }\n const refreshToken = tokens.refresh_token;\n issuedRefreshToken = refreshToken;\n\n const controlPlane = new ControlPlaneClient(trust.apiBaseUrl);\n const issuedCredential: ControlPlaneCredential = {\n kind: 'dpop',\n accessToken: tokens.access_token,\n dpop,\n registryAlias: trust.alias,\n requestedScopes: UAPKG_CLI_SCOPES,\n };\n const self = await controlPlane.getCliLoginConfirmation(issuedCredential, finalizationSignal);\n finalizationSignal.throwIfAborted();\n if (self.grant.replacesGrantId !== expectedPredecessorGrantId) {\n throw loginReplacementBindingError(trust.alias);\n }\n if (self.registry.id !== trust.registryId) {\n throw new Error('The authorization server returned a registry grant for an unexpected registry.');\n }\n const missingScopes = UAPKG_CLI_SCOPES.filter((scope) => !self.grant.scopes.includes(scope));\n if (missingScopes.length > 0) {\n throw new Error(`The authorization server omitted required CLI capabilities: ${missingScopes.join(', ')}.`);\n }\n if (\n self.grant.status === 'pending' &&\n timestampFromIso(self.grant.activationExpiresAt) <= Math.floor(Date.now() / 1000)\n ) {\n throw new LoginError(\n 'LOGIN_AUTHORIZATION_TIMEOUT',\n `Login approval expired before this device could confirm it. Run \\`uapkg login --registry ${trust.alias}\\` to try again.`,\n );\n }\n const grantId = self.grant.id;\n const keyReference = this.credentials.createReference('dpop-key', trust.issuer, trust.registryId, grantId);\n const refreshTokenReference = this.credentials.createReference('grant', trust.issuer, trust.registryId, grantId);\n const metadata: RegistryGrantMetadata = {\n issuer: trust.issuer,\n registryId: trust.registryId,\n registryName: trust.registryName,\n grantId,\n clientId: client.client_id,\n keyReference,\n refreshTokenReference,\n publicKeyThumbprint,\n deviceName: self.grant.deviceName,\n repositoryFingerprint: trust.repositoryFingerprint,\n account: self.account,\n createdAt: Math.floor(Date.now() / 1000),\n idleExpiresAt: timestampFromIso(self.grant.idleExpiresAt),\n expiresAt: timestampFromIso(self.grant.absoluteExpiresAt),\n };\n\n let previousForCleanup: RegistryGrantMetadata | undefined;\n await this.serializeGrantOperation(trust, async () => {\n const currentPrevious = await this.metadata.find(trust.issuer, trust.registryId);\n if (!isSameRegistryGrant(previous, currentPrevious)) {\n if (options.reauthorize) {\n throw loginReauthorizationConflictError(trust.alias);\n }\n throw new Error(\n `This device already has a saved login for \"${trust.alias}\". Use \\`uapkg login --registry ${trust.alias} --reauthorize\\` to replace it.`,\n );\n }\n if (currentPrevious && !options.reauthorize) {\n throw new Error(\n `This device already has a saved login for \"${trust.alias}\". Use \\`uapkg login --registry ${trust.alias} --reauthorize\\` to replace it.`,\n );\n }\n emitLoginProgress(options.onProgress, { type: 'saving-local-credentials' });\n await this.persistPreparedGrant(metadata, keyPair, refreshToken, currentPrevious, finalizationSignal);\n if (self.grant.status === 'pending') {\n emitLoginProgress(options.onProgress, { type: 'confirming-with-service' });\n const activation = await this.activatePreparedGrant(\n controlPlane,\n issuedCredential,\n metadata.grantId,\n expectedPredecessorGrantId,\n finalizationSignal,\n trust.alias,\n );\n if (activation.kind === 'rejected') {\n await this.rollbackPreparedGrant(metadata, currentPrevious);\n throw activation.error;\n }\n if (activation.kind === 'ambiguous') {\n preserveIssuedGrant = true;\n throw activation.error;\n }\n }\n\n retainedIssuedGrant = true;\n this.invalidateAccessCredentials(trust);\n if (finalizationTimeout) {\n clearTimeout(finalizationTimeout);\n finalizationTimeout = undefined;\n }\n previousForCleanup = currentPrevious;\n });\n await callbackReceipt.complete('success');\n let warnings: readonly string[] = [];\n if (previousForCleanup) {\n try {\n warnings = await this.serializeGrantOperation(trust, () =>\n this.cleanupPreviousLocalCredentials(metadata, previousForCleanup),\n );\n } catch {\n warnings = [\n 'The new login is active, but UAPKG could not remove one or more old protected credential entries. Remove the stale UAPKG entries from the operating-system credential store.',\n ];\n }\n }\n return { grant: metadata, warnings };\n } catch (error) {\n if (finalizationTimeout) {\n clearTimeout(finalizationTimeout);\n finalizationTimeout = undefined;\n }\n const failure =\n error instanceof LoginError\n ? error\n : finalizationController?.signal.aborted && finalizationController.signal.reason instanceof LoginError\n ? finalizationController.signal.reason\n : error;\n if (issuedRefreshToken && !retainedIssuedGrant && !preserveIssuedGrant) {\n await this.revokeToken(as, client, issuedRefreshToken, dpop).catch(() => undefined);\n }\n const loginError = normalizeLoginError(failure);\n if (callbackReceipt) {\n const outcome = loginError.code === 'LOGIN_ACCESS_DENIED' ? 'denied' : 'failed';\n await callbackReceipt.complete(outcome).catch(() => undefined);\n }\n throw loginError;\n } finally {\n if (finalizationTimeout) clearTimeout(finalizationTimeout);\n receiver.close();\n }\n }\n\n public async getAccessCredential(trust: RegistryTrust, scopes: readonly UAPKGCliScope[]): Promise<AccessCredential> {\n this.assertPinnedTrust(trust);\n const requestedScopes = [...new Set(scopes)].sort();\n if (requestedScopes.length === 0 || requestedScopes.some((scope) => !isUAPKGCliScope(scope))) {\n throw new Error('A control-plane operation requested an unsupported OAuth capability scope.');\n }\n const grant = await this.requireUsableGrant(trust);\n const as = await this.discover(new URL(trust.issuer));\n this.assertIssuerSupportsScopes(as, trust, requestedScopes);\n const cacheKey = this.accessTokenCacheKey(grant, requestedScopes);\n const cached = this.accessTokenCache.get(cacheKey);\n if (cached && cached.expiresAt > Date.now() + 15_000) {\n return {\n grant,\n credential: {\n kind: 'dpop',\n accessToken: cached.token,\n dpop: cached.dpop,\n registryAlias: trust.alias,\n requestedScopes,\n },\n };\n }\n\n return this.serializeGrantOperation(trust, async () => {\n // Another process may have replaced the grant or rotated its refresh\n // token while this process waited. Reload every persistent component\n // only after the cross-process lock has been acquired.\n const currentGrant = await this.requireUsableGrant(trust);\n const currentCacheKey = this.accessTokenCacheKey(currentGrant, requestedScopes);\n const refreshedCached = this.accessTokenCache.get(currentCacheKey);\n if (refreshedCached && refreshedCached.expiresAt > Date.now() + 15_000) {\n return {\n grant: currentGrant,\n credential: {\n kind: 'dpop',\n accessToken: refreshedCached.token,\n dpop: refreshedCached.dpop,\n registryAlias: trust.alias,\n requestedScopes,\n },\n };\n }\n\n const pair = await this.keyStore.load(currentGrant.keyReference);\n if (!pair) throw missingKeyError(trust);\n const client = this.client();\n const dpop = oauth.DPoP(client, pair);\n if ((await dpop.calculateThumbprint()) !== currentGrant.publicKeyThumbprint) {\n throw missingKeyError(trust);\n }\n\n // Refresh tokens rotate on every successful use. Read the current value\n // only after acquiring both the process-local and filesystem lock.\n const refreshToken = await this.credentials.get(currentGrant.refreshTokenReference);\n if (!refreshToken) {\n throw new Error(\n `The saved login for \"${trust.alias}\" is missing its protected registry grant. Run \\`uapkg login --registry ${trust.alias}\\` again.`,\n );\n }\n let tokenResponse: oauth.TokenEndpointResponse;\n try {\n tokenResponse = await this.withDPoPNonceRetry(\n () =>\n oauth.refreshTokenGrantRequest(as, client, oauth.None(), refreshToken, {\n DPoP: dpop,\n additionalParameters: {\n resource: trust.resource,\n scope: requestedScopes.join(' '),\n },\n }),\n (response) => oauth.processRefreshTokenResponse(as, client, response),\n );\n } catch (error) {\n if (error instanceof oauth.ResponseBodyError && error.error === 'invalid_scope') {\n const hintedScopes = parseUAPKGCliScopeString(error.cause.scope).filter((scope) =>\n requestedScopes.includes(scope),\n );\n const missingScopes = hintedScopes.length > 0 ? hintedScopes : requestedScopes;\n throw new OAuthScopeInsufficientError(\n 'The saved registry grant does not include every OAuth scope required by this operation.',\n trust.alias,\n requestedScopes,\n requestedScopes,\n missingScopes,\n 403,\n { cause: error },\n );\n }\n if (\n error instanceof oauth.ResponseBodyError &&\n (error.error === 'invalid_grant' || error.error === 'invalid_token')\n ) {\n throw new Error(\n `Your saved login for \"${trust.alias}\" is no longer valid. Run \\`uapkg login --registry ${trust.alias} --reauthorize\\` to authenticate again.`,\n { cause: error },\n );\n }\n throw error;\n }\n if (tokenResponse.token_type !== 'dpop') {\n throw new Error('The authorization server returned an access token that is not DPoP-bound.');\n }\n if (tokenResponse.refresh_token && tokenResponse.refresh_token !== refreshToken) {\n await this.credentials.set(currentGrant.refreshTokenReference, tokenResponse.refresh_token);\n }\n\n const expiresAt = Date.now() + Math.max(1, tokenResponse.expires_in ?? 300) * 1000;\n this.accessTokenCache.set(currentCacheKey, { token: tokenResponse.access_token, expiresAt, dpop });\n return {\n grant: currentGrant,\n credential: {\n kind: 'dpop',\n accessToken: tokenResponse.access_token,\n dpop,\n registryAlias: trust.alias,\n requestedScopes,\n },\n };\n });\n }\n\n public async logout(trust: RegistryTrust, localOnly = false): Promise<'not-logged-in' | 'removed'> {\n this.assertPinnedTrust(trust);\n return this.serializeGrantOperation(trust, async () => {\n const grant = await this.metadata.find(trust.issuer, trust.registryId);\n if (!grant) return 'not-logged-in';\n\n if (!localOnly) {\n try {\n await this.revokeSavedGrant(grant);\n } catch (error) {\n throw new Error(\n `Unable to revoke the registry grant for \"${trust.alias}\". The local login was kept so you can retry. Use --local-only only if you accept that account-site revocation may still be required.`,\n { cause: error },\n );\n }\n }\n await Promise.all([\n this.keyStore.delete(grant.keyReference),\n this.credentials.delete(grant.refreshTokenReference),\n ]);\n await this.metadata.remove(grant.issuer, grant.registryId);\n this.invalidateAccessCredentials(trust);\n return 'removed';\n });\n }\n\n private async requireUsableGrant(trust: RegistryTrust): Promise<RegistryGrantMetadata> {\n const grant = await this.metadata.find(trust.issuer, trust.registryId);\n if (!grant) {\n throw new Error(`You are not logged in to \"${trust.alias}\". Run \\`uapkg login --registry ${trust.alias}\\`.`);\n }\n if (grant.repositoryFingerprint !== trust.repositoryFingerprint) {\n throw new Error(\n `The configured Git source for \"${trust.alias}\" does not match the source authorized by the saved login. Run \\`uapkg login --registry ${trust.alias} --reauthorize\\`.`,\n );\n }\n const now = Math.floor(Date.now() / 1000);\n // The idle deadline advances whenever the grant is used. The saved value\n // is display metadata from login time, so the server remains authoritative\n // for idle expiry; the absolute deadline is stable and safe to reject\n // locally.\n if (grant.expiresAt && grant.expiresAt <= now) {\n throw new Error(\n `Your saved login for \"${trust.alias}\" has expired. Run \\`uapkg login --registry ${trust.alias}\\` again.`,\n );\n }\n return grant;\n }\n\n private async revokeSavedGrant(grant: RegistryGrantMetadata): Promise<void> {\n const refreshToken = await this.credentials.get(grant.refreshTokenReference);\n if (!refreshToken) {\n throw new Error('The registry grant cannot be revoked because its protected credential is missing.');\n }\n const pair = await this.keyStore.load(grant.keyReference);\n if (!pair) throw new Error('The registry grant cannot be revoked because its DPoP key is missing.');\n const dpop = oauth.DPoP(this.client(), pair);\n if ((await dpop.calculateThumbprint()) !== grant.publicKeyThumbprint) {\n throw new Error('The registry grant cannot be revoked because its DPoP key has changed.');\n }\n const as = await this.discover(new URL(grant.issuer));\n await this.revokeToken(as, this.client(), refreshToken, dpop);\n }\n\n private async activatePreparedGrant(\n controlPlane: ControlPlaneClient,\n credential: ControlPlaneCredential,\n expectedGrantId: string,\n expectedPredecessorGrantId: string | null,\n signal: AbortSignal,\n registryAlias: string,\n ): Promise<CliLoginActivationOutcome> {\n try {\n const confirmed = await controlPlane.confirmCliLogin(credential, signal);\n if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) {\n return { kind: 'active' };\n }\n return this.reconcilePreparedGrant(\n controlPlane,\n credential,\n expectedGrantId,\n expectedPredecessorGrantId,\n registryAlias,\n );\n } catch (error) {\n if (isCliLoginReauthorizationConflict(error)) {\n return { kind: 'rejected', error: reauthorizationConflictLoginError(error) };\n }\n if (isDefinitiveCliLoginConfirmationRejection(error)) return { kind: 'rejected', error };\n return this.reconcilePreparedGrant(\n controlPlane,\n credential,\n expectedGrantId,\n expectedPredecessorGrantId,\n registryAlias,\n );\n }\n }\n\n private async reconcilePreparedGrant(\n controlPlane: ControlPlaneClient,\n credential: ControlPlaneCredential,\n expectedGrantId: string,\n expectedPredecessorGrantId: string | null,\n registryAlias: string,\n ): Promise<CliLoginActivationOutcome> {\n const signal = AbortSignal.timeout(CLI_LOGIN_RECONCILIATION_TIMEOUT_MS);\n let retryActivation = true;\n try {\n const observed = await controlPlane.getCliLoginConfirmation(credential, signal);\n if (observed.grant.id !== expectedGrantId || observed.grant.replacesGrantId !== expectedPredecessorGrantId) {\n retryActivation = false;\n } else if (observed.grant.status === 'active') {\n return { kind: 'active' };\n }\n } catch {\n // An idempotent activation retry can still resolve a failed status read.\n }\n\n if (retryActivation) {\n try {\n const confirmed = await controlPlane.confirmCliLogin(credential, signal);\n if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) {\n return { kind: 'active' };\n }\n } catch {\n // Once the first activation outcome is ambiguous, even a later 4xx\n // cannot prove that the original request did not commit.\n }\n }\n\n try {\n const observed = await controlPlane.getCliLoginConfirmation(credential, signal);\n if (\n observed.grant.id === expectedGrantId &&\n observed.grant.replacesGrantId === expectedPredecessorGrantId &&\n observed.grant.status === 'active'\n ) {\n return { kind: 'active' };\n }\n } catch {\n // Fall through to the explicit ambiguous outcome below.\n }\n\n return { kind: 'ambiguous', error: loginConfirmationAmbiguousError(registryAlias) };\n }\n\n private async persistPreparedGrant(\n metadata: RegistryGrantMetadata,\n keyPair: oauth.CryptoKeyPair,\n refreshToken: string,\n previous?: RegistryGrantMetadata,\n signal?: AbortSignal,\n ): Promise<void> {\n let metadataWriteAttempted = false;\n try {\n signal?.throwIfAborted();\n await this.keyStore.save(metadata.keyReference, keyPair);\n signal?.throwIfAborted();\n await this.credentials.set(metadata.refreshTokenReference, refreshToken);\n signal?.throwIfAborted();\n metadataWriteAttempted = true;\n await this.metadata.upsert(metadata);\n signal?.throwIfAborted();\n } catch (error) {\n const cleanup: Promise<unknown>[] = [\n this.keyStore.delete(metadata.keyReference),\n this.credentials.delete(metadata.refreshTokenReference),\n ];\n let metadataRollbackIndex: number | undefined;\n if (metadataWriteAttempted) {\n metadataRollbackIndex = cleanup.length;\n cleanup.push(\n previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId),\n );\n }\n const cleanupResults = await Promise.allSettled(cleanup);\n if (metadataRollbackIndex !== undefined && cleanupResults[metadataRollbackIndex]?.status === 'rejected') {\n throw new LoginError(\n 'LOGIN_FAILED',\n 'Login failed, and UAPKG could not roll back the local login metadata safely. Check `uapkg whoami --json` before retrying.',\n );\n }\n throw error;\n }\n }\n\n private async rollbackPreparedGrant(\n metadata: RegistryGrantMetadata,\n previous?: RegistryGrantMetadata,\n ): Promise<void> {\n const cleanupResults = await Promise.allSettled([\n this.keyStore.delete(metadata.keyReference),\n this.credentials.delete(metadata.refreshTokenReference),\n previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId),\n ]);\n if (cleanupResults.some(({ status }) => status === 'rejected')) {\n throw new LoginError(\n 'LOGIN_FAILED',\n 'Login confirmation failed, and UAPKG could not roll back the local login safely. Check `uapkg whoami --json` before retrying.',\n );\n }\n }\n\n private async cleanupPreviousLocalCredentials(\n metadata: RegistryGrantMetadata,\n previous?: RegistryGrantMetadata,\n ): Promise<readonly string[]> {\n if (!previous) return [];\n if (\n previous.grantId === metadata.grantId ||\n (previous.keyReference === metadata.keyReference &&\n previous.refreshTokenReference === metadata.refreshTokenReference)\n ) {\n return [];\n }\n\n const cleanupResults = await Promise.allSettled([\n this.keyStore.delete(previous.keyReference),\n this.credentials.delete(previous.refreshTokenReference),\n ]);\n const warnings: string[] = [];\n if (cleanupResults.some(({ status }) => status === 'rejected')) {\n warnings.push(\n 'The previous registry grant was replaced, but one or more old protected credential entries could not be removed. Remove the stale UAPKG entries from the operating-system credential store.',\n );\n }\n return warnings;\n }\n\n private async revokeToken(\n as: oauth.AuthorizationServer,\n client: oauth.Client,\n refreshToken: string,\n dpop: oauth.DPoPHandle,\n ): Promise<void> {\n const signer = signingDPoPHandle(dpop);\n await this.withDPoPNonceRetry(\n () =>\n oauth.revocationRequest(as, client, oauth.None(), refreshToken, {\n additionalParameters: { token_type_hint: 'refresh_token' },\n signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),\n [oauth.customFetch]: async (url, options) => {\n const endpoint = new URL(url);\n const headers = new Headers(options.headers);\n await signer.addProof(endpoint, headers, 'POST');\n const response = await fetch(url, { ...options, headers });\n signer.cacheNonce(response, endpoint);\n return response;\n },\n }),\n (response) => oauth.processRevocationResponse(response),\n );\n }\n\n private async discover(issuer: URL): Promise<oauth.AuthorizationServer> {\n const discoveryUrl = oidcDiscoveryUrl(issuer);\n let response: Response;\n try {\n response = await oauth.discoveryRequest(issuer, {\n algorithm: 'oidc',\n signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),\n });\n } catch {\n throw new Error(\n `Unable to retrieve OAuth metadata for build-pinned issuer \"${issuer.href}\" from discovery URL \"${discoveryUrl.href}\".`,\n );\n }\n\n try {\n return await oauth.processDiscoveryResponse(issuer, response);\n } catch {\n throw new Error(\n `Invalid OAuth metadata for build-pinned issuer \"${issuer.href}\" from discovery URL \"${discoveryUrl.href}\" (HTTP ${response.status}).`,\n );\n }\n }\n\n private validateAuthorizationServer(as: oauth.AuthorizationServer): void {\n if (!as.authorization_endpoint || !as.token_endpoint || !as.pushed_authorization_request_endpoint) {\n throw new Error('The UAPKG authorization server is missing required authorization, token, or PAR endpoints.');\n }\n if (!as.revocation_endpoint) {\n throw new Error('The UAPKG authorization server is missing its grant revocation endpoint.');\n }\n if (as.code_challenge_methods_supported && !as.code_challenge_methods_supported.includes('S256')) {\n throw new Error('The UAPKG authorization server does not support PKCE S256.');\n }\n if (as.dpop_signing_alg_values_supported && !as.dpop_signing_alg_values_supported.includes('ES256')) {\n throw new Error('The UAPKG authorization server does not support ES256 DPoP proofs.');\n }\n }\n\n private assertIssuerSupportsScopes(\n as: oauth.AuthorizationServer,\n trust: RegistryTrust,\n requestedScopes: readonly UAPKGCliScope[],\n ): void {\n const advertisedScopes = new Set(Array.isArray(as.scopes_supported) ? as.scopes_supported : []);\n const unsupportedScopes = requestedScopes.filter((scope) => !advertisedScopes.has(scope));\n if (unsupportedScopes.length > 0) {\n throw new OAuthScopeUnsupportedError(trust.alias, requestedScopes, unsupportedScopes);\n }\n }\n\n private client(): oauth.Client {\n return {\n client_id: UAPKG_CLI_CLIENT_ID,\n token_endpoint_auth_method: 'none',\n };\n }\n\n private assertPinnedTrust(trust: RegistryTrust): void {\n if (\n trust.issuer !== UAPKG_AUTHORIZATION_ISSUER ||\n trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API ||\n trust.resource !== registryAudience(trust.registryId)\n ) {\n throw new Error('UAPKG v1 does not accept project-configured authorization issuers or API URLs.');\n }\n }\n\n private assertInteractiveLogin(): void {\n if (this.isInteractiveLogin()) return;\n throw new Error(\n [\n 'Unable to complete interactive login on this machine.',\n '',\n 'Persistent login is not supported in headless environments.',\n '',\n 'For automated publishing, configure a GitHub Actions OIDC trusted publisher.',\n 'For interactive publishing, run `uapkg login` from a trusted, browser-capable workstation.',\n ].join('\\n'),\n );\n }\n\n private async withDPoPNonceRetry<T>(\n request: () => Promise<Response>,\n processResponse: (response: Response) => Promise<T>,\n ): Promise<T> {\n try {\n return await processResponse(await request());\n } catch (error) {\n if (!oauth.isDPoPNonceError(error)) throw error;\n return processResponse(await request());\n }\n }\n\n private accessTokenCacheKey(grant: RegistryGrantMetadata, scopes: readonly UAPKGCliScope[]): string {\n return `${grant.issuer}|${grant.registryId}|${grant.grantId}|${scopes.join(' ')}`;\n }\n\n private async serializeGrantOperation<T>(trust: RegistryTrust, operation: () => Promise<T>): Promise<T> {\n const key = `${trust.issuer}|${trust.registryId}`;\n const previous = this.grantOperationTails.get(key) ?? Promise.resolve();\n const result = previous.then(() => this.grantLock.withLock(trust.issuer, trust.registryId, operation));\n const tail = result.then(\n () => undefined,\n () => undefined,\n );\n this.grantOperationTails.set(key, tail);\n\n try {\n return await result;\n } finally {\n if (this.grantOperationTails.get(key) === tail) {\n this.grantOperationTails.delete(key);\n }\n }\n }\n}\n\ninterface SigningDPoPHandle extends oauth.DPoPHandle {\n addProof(url: URL, headers: Headers, method: string, accessToken?: string): Promise<void>;\n cacheNonce(response: Response, url: URL): void;\n}\n\nfunction signingDPoPHandle(handle: oauth.DPoPHandle): SigningDPoPHandle {\n const signer = handle as SigningDPoPHandle;\n if (typeof signer.addProof !== 'function' || typeof signer.cacheNonce !== 'function') {\n throw new Error('The installed OAuth implementation cannot sender-constrain grant revocation.');\n }\n return signer;\n}\n\nexport interface LoopbackAuthorizationReceipt {\n readonly url: URL;\n complete(outcome: LoginCompletionOutcome): Promise<void>;\n}\n\ntype LoopbackReceiverState = 'listening' | 'callback-accepted' | 'closed';\n\nexport class LoopbackAuthorizationReceiver {\n private callbackPromise?: Promise<LoopbackAuthorizationReceipt>;\n private callbackResolve?: (receipt: LoopbackAuthorizationReceipt) => void;\n private callbackReject?: (error: LoginError) => void;\n private receivedReceipt?: LoopbackAuthorizationReceipt;\n private timeout?: NodeJS.Timeout;\n private state: LoopbackReceiverState = 'listening';\n private terminalError?: LoginError;\n private pendingResponse?: ServerResponse;\n private completion?: Promise<void>;\n\n private constructor(\n private readonly server: Server,\n private readonly callbackPath: string,\n private readonly expectedHost: string,\n private readonly completionUrl: URL,\n public readonly redirectUri: string,\n ) {}\n\n public static async listen(issuer: URL): Promise<LoopbackAuthorizationReceiver> {\n const callbackPath = LOOPBACK_CALLBACK_PATH;\n let receiver: LoopbackAuthorizationReceiver | undefined;\n const server = createServer((request, response) => {\n if (!receiver) {\n response.writeHead(503).end();\n return;\n }\n receiver.receive(request, response);\n });\n\n await new Promise<void>((resolve, reject) => {\n server.once('error', reject);\n server.listen(0, '127.0.0.1', () => resolve());\n });\n const address = server.address();\n if (!address || typeof address === 'string') {\n server.close();\n throw new Error('Unable to determine the interactive login callback address.');\n }\n const expectedHost = `127.0.0.1:${address.port}`;\n receiver = new LoopbackAuthorizationReceiver(\n server,\n callbackPath,\n expectedHost,\n new URL(ACCOUNT_COMPLETION_PATH, issuer.origin),\n `http://${expectedHost}${callbackPath}`,\n );\n return receiver;\n }\n\n public async waitForCallback(timeoutMs: number, registryAlias?: string): Promise<LoopbackAuthorizationReceipt> {\n if (this.receivedReceipt) return this.receivedReceipt;\n if (this.state === 'closed') {\n throw this.terminalError ?? new LoginError('LOGIN_FAILED', 'The browser authorization listener was closed.');\n }\n if (this.callbackPromise) return this.callbackPromise;\n this.callbackPromise = new Promise<LoopbackAuthorizationReceipt>((resolve, reject) => {\n this.callbackResolve = resolve;\n this.callbackReject = reject;\n this.timeout = setTimeout(() => {\n if (this.state !== 'listening') return;\n this.terminate(\n new LoginError(\n 'LOGIN_AUTHORIZATION_TIMEOUT',\n registryAlias\n ? `Login timed out while waiting for browser authorization. Run \\`uapkg login --registry ${registryAlias}\\` to try again.`\n : 'Login timed out while waiting for browser authorization. Run `uapkg login` to try again.',\n ),\n );\n }, timeoutMs);\n });\n return this.callbackPromise;\n }\n\n public close(): void {\n this.terminate(new LoginError('LOGIN_FAILED', 'The browser authorization listener was closed.'));\n }\n\n private receive(request: IncomingMessage, response: ServerResponse): void {\n if (\n this.state !== 'listening' ||\n request.method !== 'GET' ||\n request.headers.host !== this.expectedHost ||\n (request.url !== this.callbackPath && !request.url?.startsWith(`${this.callbackPath}?`))\n ) {\n rejectLoopbackRequest(response);\n return;\n }\n\n let url: URL;\n try {\n url = new URL(request.url, this.redirectUri);\n } catch {\n rejectLoopbackRequest(response);\n return;\n }\n if (url.origin !== new URL(this.redirectUri).origin || url.pathname !== this.callbackPath) {\n rejectLoopbackRequest(response);\n return;\n }\n\n this.state = 'callback-accepted';\n if (this.timeout) clearTimeout(this.timeout);\n this.timeout = undefined;\n this.pendingResponse = response;\n const receipt: LoopbackAuthorizationReceipt = {\n url,\n complete: (outcome) => this.complete(response, outcome),\n };\n this.receivedReceipt = receipt;\n this.callbackResolve?.(receipt);\n this.callbackResolve = undefined;\n this.callbackReject = undefined;\n }\n\n private complete(response: ServerResponse, outcome: LoginCompletionOutcome): Promise<void> {\n if (this.completion) return this.completion;\n this.completion = new Promise<void>((resolve) => {\n let settled = false;\n const finish = () => {\n if (settled) return;\n settled = true;\n this.pendingResponse = undefined;\n this.close();\n resolve();\n };\n response.once('finish', finish);\n response.once('close', finish);\n response.once('error', finish);\n\n if (response.destroyed || response.writableEnded) {\n finish();\n return;\n }\n\n const location = new URL(this.completionUrl);\n location.hash = new URLSearchParams({ result: outcome }).toString();\n try {\n response\n .writeHead(303, {\n location: location.href,\n 'cache-control': 'no-store',\n 'referrer-policy': 'no-referrer',\n 'content-length': '0',\n 'x-content-type-options': 'nosniff',\n connection: 'close',\n })\n .end();\n } catch {\n finish();\n }\n });\n return this.completion;\n }\n\n private terminate(error: LoginError): void {\n if (this.state === 'closed') return;\n this.state = 'closed';\n this.terminalError = error;\n if (this.timeout) clearTimeout(this.timeout);\n this.timeout = undefined;\n this.callbackReject?.(error);\n this.callbackResolve = undefined;\n this.callbackReject = undefined;\n if (this.pendingResponse && !this.pendingResponse.writableEnded) {\n this.pendingResponse.destroy();\n }\n this.pendingResponse = undefined;\n this.server.close();\n }\n}\n\nfunction rejectLoopbackRequest(response: ServerResponse): void {\n response\n .writeHead(404, {\n 'cache-control': 'no-store',\n 'content-type': 'text/plain; charset=utf-8',\n 'x-content-type-options': 'nosniff',\n })\n .end('Not found.');\n}\n\nfunction normalizeDeviceName(value?: string): string {\n const candidate = value?.trim() || hostname().trim() || 'UAPKG CLI';\n return candidate.slice(0, 80);\n}\n\nfunction oidcDiscoveryUrl(issuer: URL): URL {\n const discoveryUrl = new URL(issuer);\n discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\\/+$/, '')}/.well-known/openid-configuration`;\n return discoveryUrl;\n}\n\nfunction timestampFromIso(value: string): number {\n const parsed = Date.parse(value);\n if (!Number.isFinite(parsed)) {\n throw new Error('The authorization server returned an invalid registry-grant expiration.');\n }\n return Math.floor(parsed / 1000);\n}\n\nfunction missingKeyError(trust: RegistryTrust): Error {\n return new Error(\n [\n `The saved login for \"${trust.alias}\" cannot be used because its device-bound signing key is missing or has changed.`,\n '',\n 'This can happen after copying configuration to another computer, resetting secure storage,',\n 'restoring an incomplete backup, or reinstalling the operating system.',\n '',\n `Run \\`uapkg login --registry ${trust.alias} --reauthorize\\` to authorize this device again.`,\n ].join('\\n'),\n );\n}\n\nfunction loginFinalizationTimeoutError(registryAlias: string): LoginError {\n return new LoginError(\n 'LOGIN_AUTHORIZATION_TIMEOUT',\n `Login timed out while verifying and saving browser authorization. No new login was saved. Run \\`uapkg login --registry ${registryAlias}\\` to try again.`,\n );\n}\n\nfunction loginConfirmationAmbiguousError(registryAlias: string): LoginError {\n return new LoginError(\n 'LOGIN_FAILED',\n [\n 'UAPKG could not determine whether the service activated this login.',\n 'The locally saved credentials were kept to avoid orphaning a possibly active grant.',\n `Run \\`uapkg whoami --registry ${registryAlias}\\` to check the login before retrying.`,\n ].join(' '),\n );\n}\n\nfunction loginReauthorizationConflictError(registryAlias: string): LoginError {\n return new LoginError(\n 'LOGIN_REAUTHORIZATION_CONFLICT',\n `The saved login for \"${registryAlias}\" changed while reauthorization was in progress. The newer local login was preserved. Run \\`uapkg login --registry ${registryAlias} --reauthorize\\` again if you still want to replace it.`,\n );\n}\n\nfunction loginReplacementBindingError(registryAlias: string): LoginError {\n return new LoginError(\n 'LOGIN_REAUTHORIZATION_CONFLICT',\n `The authorization service did not bind this login to the expected saved grant for \"${registryAlias}\". No new local login was saved. Run \\`uapkg login --registry ${registryAlias} --reauthorize\\` to try again.`,\n );\n}\n\nfunction reauthorizationConflictLoginError(error: ControlPlaneError): LoginError {\n return new LoginError('LOGIN_REAUTHORIZATION_CONFLICT', error.message);\n}\n\nfunction isCliLoginReauthorizationConflict(error: unknown): error is ControlPlaneError {\n return error instanceof ControlPlaneError && error.code === 'CLI_LOGIN_REAUTHORIZATION_CONFLICT';\n}\n\nfunction isSameRegistryGrant(\n expected: RegistryGrantMetadata | undefined,\n current: RegistryGrantMetadata | undefined,\n): boolean {\n if (!expected || !current) return expected === current;\n return (\n expected.grantId === current.grantId &&\n expected.keyReference === current.keyReference &&\n expected.refreshTokenReference === current.refreshTokenReference\n );\n}\n\nfunction isDefinitiveCliLoginConfirmationRejection(error: unknown): boolean {\n if (!(error instanceof ControlPlaneError) || error.status === undefined) return false;\n if (error.status < 400 || error.status >= 500) return false;\n return ![408, 409, 425, 429].includes(error.status);\n}\n\nfunction emitLoginProgress(onProgress: LoginOptions['onProgress'], event: LoginProgressEvent): void {\n try {\n onProgress?.(event);\n } catch {\n // Reporting must never change the authorization outcome.\n }\n}\n\nfunction authorizationResponseLoginError(error: unknown): LoginError {\n if (error instanceof oauth.AuthorizationResponseError) {\n const oauthError = sanitizeOAuthErrorIdentifier(error.error);\n const description = sanitizeOAuthErrorDescription(error.error_description);\n if (oauthError === 'access_denied') {\n return new LoginError(\n 'LOGIN_ACCESS_DENIED',\n `Login denied: ${description ?? 'The user denied the registry grant.'} (access_denied)`,\n oauthError,\n );\n }\n return new LoginError(\n 'LOGIN_OAUTH_ERROR',\n `Login failed: ${description ?? 'The authorization server rejected the request.'}${oauthError ? ` (${oauthError})` : ''}`,\n oauthError,\n );\n }\n return new LoginError(\n 'LOGIN_AUTHORIZATION_RESPONSE_INVALID',\n 'The browser authorization response was invalid. Run `uapkg login` again.',\n );\n}\n\nfunction normalizeLoginError(error: unknown): LoginError {\n if (error instanceof LoginError) return error;\n if (isCliLoginReauthorizationConflict(error)) return reauthorizationConflictLoginError(error);\n if (error instanceof oauth.AuthorizationResponseError) return authorizationResponseLoginError(error);\n if (error instanceof oauth.ResponseBodyError) {\n const oauthError = sanitizeOAuthErrorIdentifier(error.error);\n const description = sanitizeOAuthErrorDescription(error.error_description);\n return new LoginError(\n 'LOGIN_OAUTH_ERROR',\n `Login failed: ${description ?? 'The authorization server rejected the request.'}${oauthError ? ` (${oauthError})` : ''}`,\n oauthError,\n );\n }\n return new LoginError('LOGIN_FAILED', describeControlPlaneError(error));\n}\n\nfunction sanitizeOAuthErrorIdentifier(value: string | undefined): string | undefined {\n return value && /^[a-z][a-z0-9._~-]{0,63}$/i.test(value) ? value : undefined;\n}\n\nfunction sanitizeOAuthErrorDescription(value: string | undefined): string | undefined {\n if (!value) return undefined;\n const sanitized = Array.from(value, (character) => {\n const codePoint = character.codePointAt(0) ?? 0;\n return isUnsafeOAuthDescriptionCodePoint(codePoint) ? ' ' : character;\n })\n .join('')\n .replace(/\\s+/g, ' ')\n .trim();\n return sanitized ? Array.from(sanitized).slice(0, 300).join('') : undefined;\n}\n\nfunction isUnsafeOAuthDescriptionCodePoint(codePoint: number): boolean {\n return (\n codePoint <= 0x1f ||\n (codePoint >= 0x7f && codePoint <= 0x9f) ||\n codePoint === 0x061c ||\n codePoint === 0x200e ||\n codePoint === 0x200f ||\n (codePoint >= 0x202a && codePoint <= 0x202e) ||\n codePoint === 0x2028 ||\n codePoint === 0x2029 ||\n (codePoint >= 0x2066 && codePoint <= 0x2069)\n );\n}\n\nexport function loginDiagnosticForError(error: unknown): ControlPlaneDiagnostic {\n const loginError = normalizeLoginError(error);\n return {\n level: 'error',\n code: loginError.code,\n message: loginError.message,\n data: loginError.oauthError ? { oauthError: loginError.oauthError } : {},\n } as ControlPlaneDiagnostic;\n}\n\nexport function controlPlaneDiagnosticForError(error: unknown, operation: string): ControlPlaneCommandFailedDiagnostic {\n const serverCode =\n error instanceof ControlPlaneError && CONTROL_PLANE_SERVER_CODE_PATTERN.test(error.code) ? error.code : undefined;\n const status =\n error instanceof ControlPlaneError &&\n error.status !== undefined &&\n Number.isInteger(error.status) &&\n error.status >= 100 &&\n error.status <= 599\n ? error.status\n : undefined;\n const data = {\n operation,\n ...(serverCode === undefined ? {} : { serverCode }),\n ...(status === undefined ? {} : { status }),\n };\n return createControlPlaneCommandFailedDiagnostic(describeControlPlaneError(error), data);\n}\n\nexport function describeControlPlaneError(error: unknown): string {\n if (error instanceof LoginError) return error.message;\n if (error instanceof OAuthScopeInsufficientError && error.missingScopes.length > 0) {\n const scopes = error.missingScopes.map((scope) => `\\`${scope}\\``).join(', ');\n const noun = error.missingScopes.length === 1 ? 'scope' : 'scopes';\n return `Missing authorization ${noun} ${scopes} for this action.\\nRun \\`uapkg login --registry ${error.registryAlias} --reauthorize\\` to authorize the capabilities required by this CLI version.`;\n }\n if (error instanceof ControlPlaneError) {\n if (error.status === 401 && requiresSavedLoginRenewal(error.code)) {\n return `${error.message}\\n\\nRun \\`uapkg login\\` to authenticate again.`;\n }\n return `${error.message} (${error.code})`;\n }\n return error instanceof Error ? error.message : String(error);\n}\n\nfunction requiresSavedLoginRenewal(code: string): boolean {\n const normalized = code.toUpperCase();\n return (\n normalized.startsWith('DPOP_') ||\n normalized.startsWith('REGISTRY_GRANT_') ||\n normalized === 'CONTROL_PLANE_AUTHENTICATION_REQUIRED' ||\n normalized === 'CLI_ACCESS_TOKEN_INVALID' ||\n normalized === 'CLI_ACCESS_TOKEN_EXPIRED'\n );\n}\n"],"mappings":";;;;;;;;;;;;;;AAgCA,MAAM,+BAA+B;AACrC,MAAM,4CAA4C;AAClD,MAAM,sCAAsC;AAC5C,MAAM,+BAA+B;AACrC,MAAM,yBAAyB;AAC/B,MAAM,0BAA0B;AAChC,MAAM,oCAAoC;AAwB1C,IAAa,aAAb,cAAgC,MAAM;CAElB;CAEA;CAHlB,AAAO,YACL,AAAgB,MAChB,SACA,AAAgB,YAChB;EACA,MAAM,OAAO;EAJG;EAEA;EAGhB,KAAK,OAAO;CACd;AACF;AAcA,IAAa,iBAAb,MAA4B;CAUP;CACA;CACA;CAIA;CAEA;CACA;CAlBnB,AAAiB;CACjB,AAAiB,mCAAmB,IAAI,IAGtC;CACF,AAAiB,sCAAsB,IAAI,IAA2B;CACtE,AAAiB;CAEjB,AAAO,YACL,AAAiB,WAAW,IAAI,kBAAkB,GAClD,AAAiB,cAAc,IAAI,gBAAgB,GACnD,AAAiB,cAA6B,OAAO,QAAQ;EAC3D,MAAM,EAAE,SAAS,SAAS,MAAM,OAAO;EACvC,MAAM,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC;CACjC,GACA,AAAiB,2BAA2B,QAAQ,QAAQ,MAAM,SAAS,QAAQ,OAAO,SAAS,CAAC,IAAI,GACxG,WACA,AAAiB,4BAA4B,8BAC7C,AAAiB,wCAAwC,2CACzD;EAViB;EACA;EACA;EAIA;EAEA;EACA;EAEjB,KAAK,WAAW,IAAI,aAAa,WAAW;EAC5C,MAAM,eAAe,OAAO,SAAS,SAAS,WAAW,SAAS,OAAO;EACzE,KAAK,YAAY,aAAa,IAAI,sBAAsB,wBAAwB,YAAY,CAAC,CAAC,cAAc;CAC9G;CAEA,MAAa,SAAS,OAAwC;EAC5D,OAAO,QAAQ,MAAM,KAAK,SAAS,KAAK,MAAM,QAAQ,MAAM,UAAU,CAAC;CACzE;CAEA,AAAO,4BAA4B,OAA4B;EAC7D,KAAK,MAAM,OAAO,KAAK,iBAAiB,KAAK,GAC3C,IAAI,IAAI,WAAW,GAAG,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,GACvD,KAAK,iBAAiB,OAAO,GAAG;CAGtC;CAEA,MAAa,MAAM,OAAsB,UAAwB,CAAC,GAAyB;EACzF,KAAK,kBAAkB,KAAK;EAC5B,KAAK,uBAAuB;EAC5B,MAAM,KAAK,YAAY,gBAAgB;EAEvC,MAAM,WAAW,MAAM,KAAK,SAAS,KAAK,MAAM,QAAQ,MAAM,UAAU;EACxE,IAAI,YAAY,CAAC,QAAQ,aACvB,MAAM,IAAI,MACR,8CAA8C,MAAM,MAAM,kCAAkC,MAAM,MAAM,gCAC1G;EAGF,kBAAkB,QAAQ,YAAY;GAAE,MAAM;GAAa,eAAe,MAAM;EAAM,CAAC;EACvF,MAAM,SAAS,IAAI,IAAI,MAAM,MAAM;EACnC,MAAM,KAAK,MAAM,KAAK,SAAS,MAAM;EACrC,KAAK,4BAA4B,EAAE;EACnC,KAAK,2BAA2B,IAAI,OAAO,gBAAgB;EAC3D,MAAM,SAAS,KAAK,OAAO;EAC3B,MAAM,UAAU,MAAM,KAAK,SAAS,SAAS;EAC7C,MAAM,OAAO,MAAM,KAAK,QAAQ,OAAO;EACvC,MAAM,sBAAsB,MAAM,KAAK,oBAAoB;EAC3D,MAAM,WAAW,MAAM,8BAA8B,OAAO,MAAM;EAClE,IAAI;EACJ,IAAI,sBAAsB;EAC1B,IAAI,sBAAsB;EAC1B,IAAI;EACJ,IAAI;EACJ,IAAI;EAEJ,IAAI;GACF,MAAM,eAAe,MAAM,2BAA2B;GACtD,MAAM,gBAAgB,MAAM,MAAM,2BAA2B,YAAY;GACzE,MAAM,QAAQ,MAAM,oBAAoB;GACxC,MAAM,QAAQ,MAAM,oBAAoB;GACxC,MAAM,kBAAkB;IAAC;IAAU;IAAkB,GAAG;GAAgB;GACxE,MAAM,QAAQ,gBAAgB,KAAK,GAAG;GACtC,MAAM,aAAa,oBAAoB,QAAQ,UAAU;GAEzD,MAAM,aAAa,IAAI,gBAAgB;IACrC,WAAW,OAAO;IAClB,cAAc,SAAS;IACvB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB;IACA;IACA;IACA,UAAU,MAAM;IAChB,UAAU;IACV,aAAa,MAAM;IACnB,6BAA6B,MAAM;IACnC,aAAa;IACb,SAAS;GACX,CAAC;GACD,IAAI,gBAAgB,SAAS,gBAAgB,GAC3C,WAAW,IAAI,UAAU,SAAS;GAEpC,MAAM,6BAA6B,QAAQ,eAAe,WAAW,SAAS,UAAU;GACxF,IAAI,4BACF,WAAW,IAAI,oBAAoB,0BAA0B;GAG/D,MAAM,SAAS,MAAM,KAAK,yBAEtB,MAAM,2BAA2B,IAAI,QAAQ,MAAM,KAAK,GAAG,YAAY;IACrE,MAAM;IACN,cAAc,YAAY,QAAQ,4BAA4B;GAChE,CAAC,IACF,aAAa,MAAM,mCAAmC,IAAI,QAAQ,QAAQ,CAC7E;GAEA,IAAI,CAAC,GAAG,wBACN,MAAM,IAAI,MAAM,uEAAuE;GAEzF,MAAM,mBAAmB,IAAI,IAAI,GAAG,sBAAsB;GAC1D,iBAAiB,aAAa,IAAI,aAAa,OAAO,SAAS;GAC/D,iBAAiB,aAAa,IAAI,eAAe,OAAO,WAAW;GAEnE,kBAAkB,QAAQ,YAAY,EAAE,MAAM,kBAAkB,CAAC;GACjE,IAAI;IACF,MAAM,KAAK,YAAY,iBAAiB,IAAI;GAC9C,QAAQ;IACN,kBAAkB,QAAQ,YAAY;KACpC,MAAM;KACN,kBAAkB,iBAAiB;IACrC,CAAC;GACH;GACA,kBAAkB,QAAQ,YAAY,EAAE,MAAM,uBAAuB,CAAC;GACtE,kBAAkB,MAAM,SAAS,gBAAgB,KAAK,2BAA2B,MAAM,KAAK;GAC5F,yBAAyB,IAAI,gBAAgB;GAC7C,sBAAsB,iBAAiB;IACrC,wBAAwB,MAAM,8BAA8B,MAAM,KAAK,CAAC;GAC1E,GAAG,KAAK,qCAAqC;GAC7C,MAAM,qBAAqB,uBAAuB;GAClD,MAAM,cAAc,gBAAgB;GACpC,IAAI,YAAY,aAAa,IAAI,KAAK,MAAM,MAAM,QAChD,MAAM,IAAI,WACR,wCACA,6FACF;GAGF,IAAI;GACJ,IAAI;IACF,qBAAqB,MAAM,qBAAqB,IAAI,QAAQ,aAAa,KAAK;GAChF,SAAS,OAAO;IACd,MAAM,gCAAgC,KAAK;GAC7C;GACA,kBAAkB,QAAQ,YAAY,EAAE,MAAM,oBAAoB,CAAC;GACnE,MAAM,SAAS,MAAM,KAAK,yBAEtB,MAAM,8BACJ,IACA,QACA,MAAM,KAAK,GACX,oBACA,SAAS,aACT,cACA;IAAE,MAAM;IAAM,QAAQ;GAAmB,CAC3C,IACD,aACC,MAAM,iCAAiC,IAAI,QAAQ,UAAU;IAC3D,eAAe;IACf,QAAQ;IACR,gBAAgB;GAClB,CAAC,CACL;GACA,mBAAmB,eAAe;GAElC,IAAI,OAAO,eAAe,QACxB,MAAM,IAAI,MAAM,mEAAmE;GAErF,IAAI,CAAC,OAAO,eACV,MAAM,IAAI,MAAM,qEAAqE;GAEvF,MAAM,eAAe,OAAO;GAC5B,qBAAqB;GAErB,MAAM,eAAe,IAAI,mBAAmB,MAAM,UAAU;GAC5D,MAAM,mBAA2C;IAC/C,MAAM;IACN,aAAa,OAAO;IACpB;IACA,eAAe,MAAM;IACrB,iBAAiB;GACnB;GACA,MAAM,OAAO,MAAM,aAAa,wBAAwB,kBAAkB,kBAAkB;GAC5F,mBAAmB,eAAe;GAClC,IAAI,KAAK,MAAM,oBAAoB,4BACjC,MAAM,6BAA6B,MAAM,KAAK;GAEhD,IAAI,KAAK,SAAS,OAAO,MAAM,YAC7B,MAAM,IAAI,MAAM,gFAAgF;GAElG,MAAM,gBAAgB,iBAAiB,QAAQ,UAAU,CAAC,KAAK,MAAM,OAAO,SAAS,KAAK,CAAC;GAC3F,IAAI,cAAc,SAAS,GACzB,MAAM,IAAI,MAAM,+DAA+D,cAAc,KAAK,IAAI,EAAE,EAAE;GAE5G,IACE,KAAK,MAAM,WAAW,aACtB,iBAAiB,KAAK,MAAM,mBAAmB,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAEhF,MAAM,IAAI,WACR,+BACA,4FAA4F,MAAM,MAAM,iBAC1G;GAEF,MAAM,UAAU,KAAK,MAAM;GAC3B,MAAM,eAAe,KAAK,YAAY,gBAAgB,YAAY,MAAM,QAAQ,MAAM,YAAY,OAAO;GACzG,MAAM,wBAAwB,KAAK,YAAY,gBAAgB,SAAS,MAAM,QAAQ,MAAM,YAAY,OAAO;GAC/G,MAAM,WAAkC;IACtC,QAAQ,MAAM;IACd,YAAY,MAAM;IAClB,cAAc,MAAM;IACpB;IACA,UAAU,OAAO;IACjB;IACA;IACA;IACA,YAAY,KAAK,MAAM;IACvB,uBAAuB,MAAM;IAC7B,SAAS,KAAK;IACd,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;IACvC,eAAe,iBAAiB,KAAK,MAAM,aAAa;IACxD,WAAW,iBAAiB,KAAK,MAAM,iBAAiB;GAC1D;GAEA,IAAI;GACJ,MAAM,KAAK,wBAAwB,OAAO,YAAY;IACpD,MAAM,kBAAkB,MAAM,KAAK,SAAS,KAAK,MAAM,QAAQ,MAAM,UAAU;IAC/E,IAAI,CAAC,oBAAoB,UAAU,eAAe,GAAG;KACnD,IAAI,QAAQ,aACV,MAAM,kCAAkC,MAAM,KAAK;KAErD,MAAM,IAAI,MACR,8CAA8C,MAAM,MAAM,kCAAkC,MAAM,MAAM,gCAC1G;IACF;IACA,IAAI,mBAAmB,CAAC,QAAQ,aAC9B,MAAM,IAAI,MACR,8CAA8C,MAAM,MAAM,kCAAkC,MAAM,MAAM,gCAC1G;IAEF,kBAAkB,QAAQ,YAAY,EAAE,MAAM,2BAA2B,CAAC;IAC1E,MAAM,KAAK,qBAAqB,UAAU,SAAS,cAAc,iBAAiB,kBAAkB;IACpG,IAAI,KAAK,MAAM,WAAW,WAAW;KACnC,kBAAkB,QAAQ,YAAY,EAAE,MAAM,0BAA0B,CAAC;KACzE,MAAM,aAAa,MAAM,KAAK,sBAC5B,cACA,kBACA,SAAS,SACT,4BACA,oBACA,MAAM,KACR;KACA,IAAI,WAAW,SAAS,YAAY;MAClC,MAAM,KAAK,sBAAsB,UAAU,eAAe;MAC1D,MAAM,WAAW;KACnB;KACA,IAAI,WAAW,SAAS,aAAa;MACnC,sBAAsB;MACtB,MAAM,WAAW;KACnB;IACF;IAEA,sBAAsB;IACtB,KAAK,4BAA4B,KAAK;IACtC,IAAI,qBAAqB;KACvB,aAAa,mBAAmB;KAChC,sBAAsB;IACxB;IACA,qBAAqB;GACvB,CAAC;GACD,MAAM,gBAAgB,SAAS,SAAS;GACxC,IAAI,WAA8B,CAAC;GACnC,IAAI,oBACF,IAAI;IACF,WAAW,MAAM,KAAK,wBAAwB,aAC5C,KAAK,gCAAgC,UAAU,kBAAkB,CACnE;GACF,QAAQ;IACN,WAAW,CACT,8KACF;GACF;GAEF,OAAO;IAAE,OAAO;IAAU;GAAS;EACrC,SAAS,OAAO;GACd,IAAI,qBAAqB;IACvB,aAAa,mBAAmB;IAChC,sBAAsB;GACxB;GACA,MAAM,UACJ,iBAAiB,aACb,QACA,wBAAwB,OAAO,WAAW,uBAAuB,OAAO,kBAAkB,aACxF,uBAAuB,OAAO,SAC9B;GACR,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,qBACjD,MAAM,KAAK,YAAY,IAAI,QAAQ,oBAAoB,IAAI,CAAC,CAAC,YAAY,MAAS;GAEpF,MAAM,aAAa,oBAAoB,OAAO;GAC9C,IAAI,iBAAiB;IACnB,MAAM,UAAU,WAAW,SAAS,wBAAwB,WAAW;IACvE,MAAM,gBAAgB,SAAS,OAAO,CAAC,CAAC,YAAY,MAAS;GAC/D;GACA,MAAM;EACR,UAAU;GACR,IAAI,qBAAqB,aAAa,mBAAmB;GACzD,SAAS,MAAM;EACjB;CACF;CAEA,MAAa,oBAAoB,OAAsB,QAA6D;EAClH,KAAK,kBAAkB,KAAK;EAC5B,MAAM,kBAAkB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK;EAClD,IAAI,gBAAgB,WAAW,KAAK,gBAAgB,MAAM,UAAU,CAAC,gBAAgB,KAAK,CAAC,GACzF,MAAM,IAAI,MAAM,4EAA4E;EAE9F,MAAM,QAAQ,MAAM,KAAK,mBAAmB,KAAK;EACjD,MAAM,KAAK,MAAM,KAAK,SAAS,IAAI,IAAI,MAAM,MAAM,CAAC;EACpD,KAAK,2BAA2B,IAAI,OAAO,eAAe;EAC1D,MAAM,WAAW,KAAK,oBAAoB,OAAO,eAAe;EAChE,MAAM,SAAS,KAAK,iBAAiB,IAAI,QAAQ;EACjD,IAAI,UAAU,OAAO,YAAY,KAAK,IAAI,IAAI,MAC5C,OAAO;GACL;GACA,YAAY;IACV,MAAM;IACN,aAAa,OAAO;IACpB,MAAM,OAAO;IACb,eAAe,MAAM;IACrB;GACF;EACF;EAGF,OAAO,KAAK,wBAAwB,OAAO,YAAY;GAIrD,MAAM,eAAe,MAAM,KAAK,mBAAmB,KAAK;GACxD,MAAM,kBAAkB,KAAK,oBAAoB,cAAc,eAAe;GAC9E,MAAM,kBAAkB,KAAK,iBAAiB,IAAI,eAAe;GACjE,IAAI,mBAAmB,gBAAgB,YAAY,KAAK,IAAI,IAAI,MAC9D,OAAO;IACL,OAAO;IACP,YAAY;KACV,MAAM;KACN,aAAa,gBAAgB;KAC7B,MAAM,gBAAgB;KACtB,eAAe,MAAM;KACrB;IACF;GACF;GAGF,MAAM,OAAO,MAAM,KAAK,SAAS,KAAK,aAAa,YAAY;GAC/D,IAAI,CAAC,MAAM,MAAM,gBAAgB,KAAK;GACtC,MAAM,SAAS,KAAK,OAAO;GAC3B,MAAM,OAAO,MAAM,KAAK,QAAQ,IAAI;GACpC,IAAK,MAAM,KAAK,oBAAoB,MAAO,aAAa,qBACtD,MAAM,gBAAgB,KAAK;GAK7B,MAAM,eAAe,MAAM,KAAK,YAAY,IAAI,aAAa,qBAAqB;GAClF,IAAI,CAAC,cACH,MAAM,IAAI,MACR,wBAAwB,MAAM,MAAM,0EAA0E,MAAM,MAAM,UAC5H;GAEF,IAAI;GACJ,IAAI;IACF,gBAAgB,MAAM,KAAK,yBAEvB,MAAM,yBAAyB,IAAI,QAAQ,MAAM,KAAK,GAAG,cAAc;KACrE,MAAM;KACN,sBAAsB;MACpB,UAAU,MAAM;MAChB,OAAO,gBAAgB,KAAK,GAAG;KACjC;IACF,CAAC,IACF,aAAa,MAAM,4BAA4B,IAAI,QAAQ,QAAQ,CACtE;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,MAAM,qBAAqB,MAAM,UAAU,iBAAiB;KAC/E,MAAM,eAAe,yBAAyB,MAAM,MAAM,KAAK,CAAC,CAAC,QAAQ,UACvE,gBAAgB,SAAS,KAAK,CAChC;KACA,MAAM,gBAAgB,aAAa,SAAS,IAAI,eAAe;KAC/D,MAAM,IAAI,4BACR,2FACA,MAAM,OACN,iBACA,iBACA,eACA,KACA,EAAE,OAAO,MAAM,CACjB;IACF;IACA,IACE,iBAAiB,MAAM,sBACtB,MAAM,UAAU,mBAAmB,MAAM,UAAU,kBAEpD,MAAM,IAAI,MACR,yBAAyB,MAAM,MAAM,qDAAqD,MAAM,MAAM,0CACtG,EAAE,OAAO,MAAM,CACjB;IAEF,MAAM;GACR;GACA,IAAI,cAAc,eAAe,QAC/B,MAAM,IAAI,MAAM,2EAA2E;GAE7F,IAAI,cAAc,iBAAiB,cAAc,kBAAkB,cACjE,MAAM,KAAK,YAAY,IAAI,aAAa,uBAAuB,cAAc,aAAa;GAG5F,MAAM,YAAY,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,cAAc,cAAc,GAAG,IAAI;GAC9E,KAAK,iBAAiB,IAAI,iBAAiB;IAAE,OAAO,cAAc;IAAc;IAAW;GAAK,CAAC;GACjG,OAAO;IACL,OAAO;IACP,YAAY;KACV,MAAM;KACN,aAAa,cAAc;KAC3B;KACA,eAAe,MAAM;KACrB;IACF;GACF;EACF,CAAC;CACH;CAEA,MAAa,OAAO,OAAsB,YAAY,OAA6C;EACjG,KAAK,kBAAkB,KAAK;EAC5B,OAAO,KAAK,wBAAwB,OAAO,YAAY;GACrD,MAAM,QAAQ,MAAM,KAAK,SAAS,KAAK,MAAM,QAAQ,MAAM,UAAU;GACrE,IAAI,CAAC,OAAO,OAAO;GAEnB,IAAI,CAAC,WACH,IAAI;IACF,MAAM,KAAK,iBAAiB,KAAK;GACnC,SAAS,OAAO;IACd,MAAM,IAAI,MACR,4CAA4C,MAAM,MAAM,wIACxD,EAAE,OAAO,MAAM,CACjB;GACF;GAEF,MAAM,QAAQ,IAAI,CAChB,KAAK,SAAS,OAAO,MAAM,YAAY,GACvC,KAAK,YAAY,OAAO,MAAM,qBAAqB,CACrD,CAAC;GACD,MAAM,KAAK,SAAS,OAAO,MAAM,QAAQ,MAAM,UAAU;GACzD,KAAK,4BAA4B,KAAK;GACtC,OAAO;EACT,CAAC;CACH;CAEA,MAAc,mBAAmB,OAAsD;EACrF,MAAM,QAAQ,MAAM,KAAK,SAAS,KAAK,MAAM,QAAQ,MAAM,UAAU;EACrE,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,6BAA6B,MAAM,MAAM,kCAAkC,MAAM,MAAM,IAAI;EAE7G,IAAI,MAAM,0BAA0B,MAAM,uBACxC,MAAM,IAAI,MACR,kCAAkC,MAAM,MAAM,0FAA0F,MAAM,MAAM,kBACtJ;EAEF,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAKxC,IAAI,MAAM,aAAa,MAAM,aAAa,KACxC,MAAM,IAAI,MACR,yBAAyB,MAAM,MAAM,8CAA8C,MAAM,MAAM,UACjG;EAEF,OAAO;CACT;CAEA,MAAc,iBAAiB,OAA6C;EAC1E,MAAM,eAAe,MAAM,KAAK,YAAY,IAAI,MAAM,qBAAqB;EAC3E,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,mFAAmF;EAErG,MAAM,OAAO,MAAM,KAAK,SAAS,KAAK,MAAM,YAAY;EACxD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,uEAAuE;EAClG,MAAM,OAAO,MAAM,KAAK,KAAK,OAAO,GAAG,IAAI;EAC3C,IAAK,MAAM,KAAK,oBAAoB,MAAO,MAAM,qBAC/C,MAAM,IAAI,MAAM,wEAAwE;EAE1F,MAAM,KAAK,MAAM,KAAK,SAAS,IAAI,IAAI,MAAM,MAAM,CAAC;EACpD,MAAM,KAAK,YAAY,IAAI,KAAK,OAAO,GAAG,cAAc,IAAI;CAC9D;CAEA,MAAc,sBACZ,cACA,YACA,iBACA,4BACA,QACA,eACoC;EACpC,IAAI;GACF,MAAM,YAAY,MAAM,aAAa,gBAAgB,YAAY,MAAM;GACvE,IAAI,UAAU,OAAO,mBAAmB,UAAU,oBAAoB,4BACpE,OAAO,EAAE,MAAM,SAAS;GAE1B,OAAO,KAAK,uBACV,cACA,YACA,iBACA,4BACA,aACF;EACF,SAAS,OAAO;GACd,IAAI,kCAAkC,KAAK,GACzC,OAAO;IAAE,MAAM;IAAY,OAAO,kCAAkC,KAAK;GAAE;GAE7E,IAAI,0CAA0C,KAAK,GAAG,OAAO;IAAE,MAAM;IAAY;GAAM;GACvF,OAAO,KAAK,uBACV,cACA,YACA,iBACA,4BACA,aACF;EACF;CACF;CAEA,MAAc,uBACZ,cACA,YACA,iBACA,4BACA,eACoC;EACpC,MAAM,SAAS,YAAY,QAAQ,mCAAmC;EACtE,IAAI,kBAAkB;EACtB,IAAI;GACF,MAAM,WAAW,MAAM,aAAa,wBAAwB,YAAY,MAAM;GAC9E,IAAI,SAAS,MAAM,OAAO,mBAAmB,SAAS,MAAM,oBAAoB,4BAC9E,kBAAkB;QACb,IAAI,SAAS,MAAM,WAAW,UACnC,OAAO,EAAE,MAAM,SAAS;EAE5B,QAAQ,CAER;EAEA,IAAI,iBACF,IAAI;GACF,MAAM,YAAY,MAAM,aAAa,gBAAgB,YAAY,MAAM;GACvE,IAAI,UAAU,OAAO,mBAAmB,UAAU,oBAAoB,4BACpE,OAAO,EAAE,MAAM,SAAS;EAE5B,QAAQ,CAGR;EAGF,IAAI;GACF,MAAM,WAAW,MAAM,aAAa,wBAAwB,YAAY,MAAM;GAC9E,IACE,SAAS,MAAM,OAAO,mBACtB,SAAS,MAAM,oBAAoB,8BACnC,SAAS,MAAM,WAAW,UAE1B,OAAO,EAAE,MAAM,SAAS;EAE5B,QAAQ,CAER;EAEA,OAAO;GAAE,MAAM;GAAa,OAAO,gCAAgC,aAAa;EAAE;CACpF;CAEA,MAAc,qBACZ,UACA,SACA,cACA,UACA,QACe;EACf,IAAI,yBAAyB;EAC7B,IAAI;GACF,QAAQ,eAAe;GACvB,MAAM,KAAK,SAAS,KAAK,SAAS,cAAc,OAAO;GACvD,QAAQ,eAAe;GACvB,MAAM,KAAK,YAAY,IAAI,SAAS,uBAAuB,YAAY;GACvE,QAAQ,eAAe;GACvB,yBAAyB;GACzB,MAAM,KAAK,SAAS,OAAO,QAAQ;GACnC,QAAQ,eAAe;EACzB,SAAS,OAAO;GACd,MAAM,UAA8B,CAClC,KAAK,SAAS,OAAO,SAAS,YAAY,GAC1C,KAAK,YAAY,OAAO,SAAS,qBAAqB,CACxD;GACA,IAAI;GACJ,IAAI,wBAAwB;IAC1B,wBAAwB,QAAQ;IAChC,QAAQ,KACN,WAAW,KAAK,SAAS,OAAO,QAAQ,IAAI,KAAK,SAAS,OAAO,SAAS,QAAQ,SAAS,UAAU,CACvG;GACF;GACA,MAAM,iBAAiB,MAAM,QAAQ,WAAW,OAAO;GACvD,IAAI,0BAA0B,UAAa,eAAe,sBAAsB,EAAE,WAAW,YAC3F,MAAM,IAAI,WACR,gBACA,2HACF;GAEF,MAAM;EACR;CACF;CAEA,MAAc,sBACZ,UACA,UACe;EAMf,KAAI,MALyB,QAAQ,WAAW;GAC9C,KAAK,SAAS,OAAO,SAAS,YAAY;GAC1C,KAAK,YAAY,OAAO,SAAS,qBAAqB;GACtD,WAAW,KAAK,SAAS,OAAO,QAAQ,IAAI,KAAK,SAAS,OAAO,SAAS,QAAQ,SAAS,UAAU;EACvG,CAAC,EACiB,CAAC,MAAM,EAAE,aAAa,WAAW,UAAU,GAC3D,MAAM,IAAI,WACR,gBACA,+HACF;CAEJ;CAEA,MAAc,gCACZ,UACA,UAC4B;EAC5B,IAAI,CAAC,UAAU,OAAO,CAAC;EACvB,IACE,SAAS,YAAY,SAAS,WAC7B,SAAS,iBAAiB,SAAS,gBAClC,SAAS,0BAA0B,SAAS,uBAE9C,OAAO,CAAC;EAGV,MAAM,iBAAiB,MAAM,QAAQ,WAAW,CAC9C,KAAK,SAAS,OAAO,SAAS,YAAY,GAC1C,KAAK,YAAY,OAAO,SAAS,qBAAqB,CACxD,CAAC;EACD,MAAM,WAAqB,CAAC;EAC5B,IAAI,eAAe,MAAM,EAAE,aAAa,WAAW,UAAU,GAC3D,SAAS,KACP,6LACF;EAEF,OAAO;CACT;CAEA,MAAc,YACZ,IACA,QACA,cACA,MACe;EACf,MAAM,SAAS,kBAAkB,IAAI;EACrC,MAAM,KAAK,yBAEP,MAAM,kBAAkB,IAAI,QAAQ,MAAM,KAAK,GAAG,cAAc;GAC9D,sBAAsB,EAAE,iBAAiB,gBAAgB;GACzD,QAAQ,YAAY,QAAQ,4BAA4B;IACvD,MAAM,cAAc,OAAO,KAAK,YAAY;IAC3C,MAAM,WAAW,IAAI,IAAI,GAAG;IAC5B,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;IAC3C,MAAM,OAAO,SAAS,UAAU,SAAS,MAAM;IAC/C,MAAM,WAAW,MAAM,MAAM,KAAK;KAAE,GAAG;KAAS;IAAQ,CAAC;IACzD,OAAO,WAAW,UAAU,QAAQ;IACpC,OAAO;GACT;EACF,CAAC,IACF,aAAa,MAAM,0BAA0B,QAAQ,CACxD;CACF;CAEA,MAAc,SAAS,QAAiD;EACtE,MAAM,eAAe,iBAAiB,MAAM;EAC5C,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,MAAM,iBAAiB,QAAQ;IAC9C,WAAW;IACX,QAAQ,YAAY,QAAQ,4BAA4B;GAC1D,CAAC;EACH,QAAQ;GACN,MAAM,IAAI,MACR,8DAA8D,OAAO,KAAK,wBAAwB,aAAa,KAAK,GACtH;EACF;EAEA,IAAI;GACF,OAAO,MAAM,MAAM,yBAAyB,QAAQ,QAAQ;EAC9D,QAAQ;GACN,MAAM,IAAI,MACR,mDAAmD,OAAO,KAAK,wBAAwB,aAAa,KAAK,UAAU,SAAS,OAAO,GACrI;EACF;CACF;CAEA,AAAQ,4BAA4B,IAAqC;EACvE,IAAI,CAAC,GAAG,0BAA0B,CAAC,GAAG,kBAAkB,CAAC,GAAG,uCAC1D,MAAM,IAAI,MAAM,4FAA4F;EAE9G,IAAI,CAAC,GAAG,qBACN,MAAM,IAAI,MAAM,0EAA0E;EAE5F,IAAI,GAAG,oCAAoC,CAAC,GAAG,iCAAiC,SAAS,MAAM,GAC7F,MAAM,IAAI,MAAM,4DAA4D;EAE9E,IAAI,GAAG,qCAAqC,CAAC,GAAG,kCAAkC,SAAS,OAAO,GAChG,MAAM,IAAI,MAAM,oEAAoE;CAExF;CAEA,AAAQ,2BACN,IACA,OACA,iBACM;EACN,MAAM,mBAAmB,IAAI,IAAI,MAAM,QAAQ,GAAG,gBAAgB,IAAI,GAAG,mBAAmB,CAAC,CAAC;EAC9F,MAAM,oBAAoB,gBAAgB,QAAQ,UAAU,CAAC,iBAAiB,IAAI,KAAK,CAAC;EACxF,IAAI,kBAAkB,SAAS,GAC7B,MAAM,IAAI,2BAA2B,MAAM,OAAO,iBAAiB,iBAAiB;CAExF;CAEA,AAAQ,SAAuB;EAC7B,OAAO;GACL,WAAW;GACX,4BAA4B;EAC9B;CACF;CAEA,AAAQ,kBAAkB,OAA4B;EACpD,IACE,MAAM,WAAW,8BACjB,MAAM,eAAe,2BACrB,MAAM,aAAa,iBAAiB,MAAM,UAAU,GAEpD,MAAM,IAAI,MAAM,gFAAgF;CAEpG;CAEA,AAAQ,yBAA+B;EACrC,IAAI,KAAK,mBAAmB,GAAG;EAC/B,MAAM,IAAI,MACR;GACE;GACA;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;CACF;CAEA,MAAc,mBACZ,SACA,iBACY;EACZ,IAAI;GACF,OAAO,MAAM,gBAAgB,MAAM,QAAQ,CAAC;EAC9C,SAAS,OAAO;GACd,IAAI,CAAC,MAAM,iBAAiB,KAAK,GAAG,MAAM;GAC1C,OAAO,gBAAgB,MAAM,QAAQ,CAAC;EACxC;CACF;CAEA,AAAQ,oBAAoB,OAA8B,QAA0C;EAClG,OAAO,GAAG,MAAM,OAAO,GAAG,MAAM,WAAW,GAAG,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG;CAChF;CAEA,MAAc,wBAA2B,OAAsB,WAAyC;EACtG,MAAM,MAAM,GAAG,MAAM,OAAO,GAAG,MAAM;EAErC,MAAM,UADW,KAAK,oBAAoB,IAAI,GAAG,KAAK,QAAQ,QAAQ,EAC/C,CAAC,WAAW,KAAK,UAAU,SAAS,MAAM,QAAQ,MAAM,YAAY,SAAS,CAAC;EACrG,MAAM,OAAO,OAAO,WACZ,cACA,MACR;EACA,KAAK,oBAAoB,IAAI,KAAK,IAAI;EAEtC,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,oBAAoB,IAAI,GAAG,MAAM,MACxC,KAAK,oBAAoB,OAAO,GAAG;EAEvC;CACF;AACF;AAOA,SAAS,kBAAkB,QAA6C;CACtE,MAAM,SAAS;CACf,IAAI,OAAO,OAAO,aAAa,cAAc,OAAO,OAAO,eAAe,YACxE,MAAM,IAAI,MAAM,8EAA8E;CAEhG,OAAO;AACT;AASA,IAAa,gCAAb,MAAa,8BAA8B;CAYtB;CACA;CACA;CACA;CACD;CAflB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ,QAA+B;CACvC,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,AAAQ,YACN,AAAiB,QACjB,AAAiB,cACjB,AAAiB,cACjB,AAAiB,eACjB,AAAgB,aAChB;EALiB;EACA;EACA;EACA;EACD;CACf;CAEH,aAAoB,OAAO,QAAqD;EAC9E,MAAM,eAAe;EACrB,IAAI;EACJ,MAAM,SAAS,cAAc,SAAS,aAAa;GACjD,IAAI,CAAC,UAAU;IACb,SAAS,UAAU,GAAG,CAAC,CAAC,IAAI;IAC5B;GACF;GACA,SAAS,QAAQ,SAAS,QAAQ;EACpC,CAAC;EAED,MAAM,IAAI,SAAe,SAAS,WAAW;GAC3C,OAAO,KAAK,SAAS,MAAM;GAC3B,OAAO,OAAO,GAAG,mBAAmB,QAAQ,CAAC;EAC/C,CAAC;EACD,MAAM,UAAU,OAAO,QAAQ;EAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU;GAC3C,OAAO,MAAM;GACb,MAAM,IAAI,MAAM,6DAA6D;EAC/E;EACA,MAAM,eAAe,aAAa,QAAQ;EAC1C,WAAW,IAAI,8BACb,QACA,cACA,cACA,IAAI,IAAI,yBAAyB,OAAO,MAAM,GAC9C,UAAU,eAAe,cAC3B;EACA,OAAO;CACT;CAEA,MAAa,gBAAgB,WAAmB,eAA+D;EAC7G,IAAI,KAAK,iBAAiB,OAAO,KAAK;EACtC,IAAI,KAAK,UAAU,UACjB,MAAM,KAAK,iBAAiB,IAAI,WAAW,gBAAgB,gDAAgD;EAE7G,IAAI,KAAK,iBAAiB,OAAO,KAAK;EACtC,KAAK,kBAAkB,IAAI,SAAuC,SAAS,WAAW;GACpF,KAAK,kBAAkB;GACvB,KAAK,iBAAiB;GACtB,KAAK,UAAU,iBAAiB;IAC9B,IAAI,KAAK,UAAU,aAAa;IAChC,KAAK,UACH,IAAI,WACF,+BACA,gBACI,yFAAyF,cAAc,oBACvG,0FACN,CACF;GACF,GAAG,SAAS;EACd,CAAC;EACD,OAAO,KAAK;CACd;CAEA,AAAO,QAAc;EACnB,KAAK,UAAU,IAAI,WAAW,gBAAgB,gDAAgD,CAAC;CACjG;CAEA,AAAQ,QAAQ,SAA0B,UAAgC;EACxE,IACE,KAAK,UAAU,eACf,QAAQ,WAAW,SACnB,QAAQ,QAAQ,SAAS,KAAK,gBAC7B,QAAQ,QAAQ,KAAK,gBAAgB,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,aAAa,EAAE,GACtF;GACA,sBAAsB,QAAQ;GAC9B;EACF;EAEA,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,QAAQ,KAAK,KAAK,WAAW;EAC7C,QAAQ;GACN,sBAAsB,QAAQ;GAC9B;EACF;EACA,IAAI,IAAI,WAAW,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,UAAU,IAAI,aAAa,KAAK,cAAc;GACzF,sBAAsB,QAAQ;GAC9B;EACF;EAEA,KAAK,QAAQ;EACb,IAAI,KAAK,SAAS,aAAa,KAAK,OAAO;EAC3C,KAAK,UAAU;EACf,KAAK,kBAAkB;EACvB,MAAM,UAAwC;GAC5C;GACA,WAAW,YAAY,KAAK,SAAS,UAAU,OAAO;EACxD;EACA,KAAK,kBAAkB;EACvB,KAAK,kBAAkB,OAAO;EAC9B,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;CACxB;CAEA,AAAQ,SAAS,UAA0B,SAAgD;EACzF,IAAI,KAAK,YAAY,OAAO,KAAK;EACjC,KAAK,aAAa,IAAI,SAAe,YAAY;GAC/C,IAAI,UAAU;GACd,MAAM,eAAe;IACnB,IAAI,SAAS;IACb,UAAU;IACV,KAAK,kBAAkB;IACvB,KAAK,MAAM;IACX,QAAQ;GACV;GACA,SAAS,KAAK,UAAU,MAAM;GAC9B,SAAS,KAAK,SAAS,MAAM;GAC7B,SAAS,KAAK,SAAS,MAAM;GAE7B,IAAI,SAAS,aAAa,SAAS,eAAe;IAChD,OAAO;IACP;GACF;GAEA,MAAM,WAAW,IAAI,IAAI,KAAK,aAAa;GAC3C,SAAS,OAAO,IAAI,gBAAgB,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC,SAAS;GAClE,IAAI;IACF,SACG,UAAU,KAAK;KACd,UAAU,SAAS;KACnB,iBAAiB;KACjB,mBAAmB;KACnB,kBAAkB;KAClB,0BAA0B;KAC1B,YAAY;IACd,CAAC,CAAC,CACD,IAAI;GACT,QAAQ;IACN,OAAO;GACT;EACF,CAAC;EACD,OAAO,KAAK;CACd;CAEA,AAAQ,UAAU,OAAyB;EACzC,IAAI,KAAK,UAAU,UAAU;EAC7B,KAAK,QAAQ;EACb,KAAK,gBAAgB;EACrB,IAAI,KAAK,SAAS,aAAa,KAAK,OAAO;EAC3C,KAAK,UAAU;EACf,KAAK,iBAAiB,KAAK;EAC3B,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;EACtB,IAAI,KAAK,mBAAmB,CAAC,KAAK,gBAAgB,eAChD,KAAK,gBAAgB,QAAQ;EAE/B,KAAK,kBAAkB;EACvB,KAAK,OAAO,MAAM;CACpB;AACF;AAEA,SAAS,sBAAsB,UAAgC;CAC7D,SACG,UAAU,KAAK;EACd,iBAAiB;EACjB,gBAAgB;EAChB,0BAA0B;CAC5B,CAAC,CAAC,CACD,IAAI,YAAY;AACrB;AAEA,SAAS,oBAAoB,OAAwB;CAEnD,QADkB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,KAAK,KAAK,YACxC,CAAC,MAAM,GAAG,EAAE;AAC9B;AAEA,SAAS,iBAAiB,QAAkB;CAC1C,MAAM,eAAe,IAAI,IAAI,MAAM;CACnC,aAAa,WAAW,GAAG,aAAa,SAAS,QAAQ,QAAQ,EAAE,EAAE;CACrE,OAAO;AACT;AAEA,SAAS,iBAAiB,OAAuB;CAC/C,MAAM,SAAS,KAAK,MAAM,KAAK;CAC/B,IAAI,CAAC,OAAO,SAAS,MAAM,GACzB,MAAM,IAAI,MAAM,yEAAyE;CAE3F,OAAO,KAAK,MAAM,SAAS,GAAI;AACjC;AAEA,SAAS,gBAAgB,OAA6B;CACpD,OAAO,IAAI,MACT;EACE,wBAAwB,MAAM,MAAM;EACpC;EACA;EACA;EACA;EACA,gCAAgC,MAAM,MAAM;CAC9C,CAAC,CAAC,KAAK,IAAI,CACb;AACF;AAEA,SAAS,8BAA8B,eAAmC;CACxE,OAAO,IAAI,WACT,+BACA,0HAA0H,cAAc,iBAC1I;AACF;AAEA,SAAS,gCAAgC,eAAmC;CAC1E,OAAO,IAAI,WACT,gBACA;EACE;EACA;EACA,iCAAiC,cAAc;CACjD,CAAC,CAAC,KAAK,GAAG,CACZ;AACF;AAEA,SAAS,kCAAkC,eAAmC;CAC5E,OAAO,IAAI,WACT,kCACA,wBAAwB,cAAc,qHAAqH,cAAc,wDAC3K;AACF;AAEA,SAAS,6BAA6B,eAAmC;CACvE,OAAO,IAAI,WACT,kCACA,sFAAsF,cAAc,gEAAgE,cAAc,+BACpL;AACF;AAEA,SAAS,kCAAkC,OAAsC;CAC/E,OAAO,IAAI,WAAW,kCAAkC,MAAM,OAAO;AACvE;AAEA,SAAS,kCAAkC,OAA4C;CACrF,OAAO,iBAAiB,qBAAqB,MAAM,SAAS;AAC9D;AAEA,SAAS,oBACP,UACA,SACS;CACT,IAAI,CAAC,YAAY,CAAC,SAAS,OAAO,aAAa;CAC/C,OACE,SAAS,YAAY,QAAQ,WAC7B,SAAS,iBAAiB,QAAQ,gBAClC,SAAS,0BAA0B,QAAQ;AAE/C;AAEA,SAAS,0CAA0C,OAAyB;CAC1E,IAAI,EAAE,iBAAiB,sBAAsB,MAAM,WAAW,QAAW,OAAO;CAChF,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,KAAK,OAAO;CACtD,OAAO,CAAC;EAAC;EAAK;EAAK;EAAK;CAAG,CAAC,CAAC,SAAS,MAAM,MAAM;AACpD;AAEA,SAAS,kBAAkB,YAAwC,OAAiC;CAClG,IAAI;EACF,aAAa,KAAK;CACpB,QAAQ,CAER;AACF;AAEA,SAAS,gCAAgC,OAA4B;CACnE,IAAI,iBAAiB,MAAM,4BAA4B;EACrD,MAAM,aAAa,6BAA6B,MAAM,KAAK;EAC3D,MAAM,cAAc,8BAA8B,MAAM,iBAAiB;EACzE,IAAI,eAAe,iBACjB,OAAO,IAAI,WACT,uBACA,iBAAiB,eAAe,sCAAsC,mBACtE,UACF;EAEF,OAAO,IAAI,WACT,qBACA,iBAAiB,eAAe,mDAAmD,aAAa,KAAK,WAAW,KAAK,MACrH,UACF;CACF;CACA,OAAO,IAAI,WACT,wCACA,0EACF;AACF;AAEA,SAAS,oBAAoB,OAA4B;CACvD,IAAI,iBAAiB,YAAY,OAAO;CACxC,IAAI,kCAAkC,KAAK,GAAG,OAAO,kCAAkC,KAAK;CAC5F,IAAI,iBAAiB,MAAM,4BAA4B,OAAO,gCAAgC,KAAK;CACnG,IAAI,iBAAiB,MAAM,mBAAmB;EAC5C,MAAM,aAAa,6BAA6B,MAAM,KAAK;EAC3D,MAAM,cAAc,8BAA8B,MAAM,iBAAiB;EACzE,OAAO,IAAI,WACT,qBACA,iBAAiB,eAAe,mDAAmD,aAAa,KAAK,WAAW,KAAK,MACrH,UACF;CACF;CACA,OAAO,IAAI,WAAW,gBAAgB,0BAA0B,KAAK,CAAC;AACxE;AAEA,SAAS,6BAA6B,OAA+C;CACnF,OAAO,SAAS,6BAA6B,KAAK,KAAK,IAAI,QAAQ;AACrE;AAEA,SAAS,8BAA8B,OAA+C;CACpF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,KAAK,QAAQ,cAAc;EAEjD,OAAO,kCADW,UAAU,YAAY,CAAC,KAAK,CACI,IAAI,MAAM;CAC9D,CAAC,CAAC,CACC,KAAK,EAAE,CAAC,CACR,QAAQ,QAAQ,GAAG,CAAC,CACpB,KAAK;CACR,OAAO,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI;AACpE;AAEA,SAAS,kCAAkC,WAA4B;CACrE,OACE,aAAa,MACZ,aAAa,OAAQ,aAAa,OACnC,cAAc,QACd,cAAc,QACd,cAAc,QACb,aAAa,QAAU,aAAa,QACrC,cAAc,QACd,cAAc,QACb,aAAa,QAAU,aAAa;AAEzC;AAEA,SAAgB,wBAAwB,OAAwC;CAC9E,MAAM,aAAa,oBAAoB,KAAK;CAC5C,OAAO;EACL,OAAO;EACP,MAAM,WAAW;EACjB,SAAS,WAAW;EACpB,MAAM,WAAW,aAAa,EAAE,YAAY,WAAW,WAAW,IAAI,CAAC;CACzE;AACF;AAEA,SAAgB,+BAA+B,OAAgB,WAAwD;CACrH,MAAM,aACJ,iBAAiB,qBAAqB,kCAAkC,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO;CAC1G,MAAM,SACJ,iBAAiB,qBACjB,MAAM,WAAW,UACjB,OAAO,UAAU,MAAM,MAAM,KAC7B,MAAM,UAAU,OAChB,MAAM,UAAU,MACZ,MAAM,SACN;CACN,MAAM,OAAO;EACX;EACA,GAAI,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;EACjD,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;CAC3C;CACA,OAAO,0CAA0C,0BAA0B,KAAK,GAAG,IAAI;AACzF;AAEA,SAAgB,0BAA0B,OAAwB;CAChE,IAAI,iBAAiB,YAAY,OAAO,MAAM;CAC9C,IAAI,iBAAiB,+BAA+B,MAAM,cAAc,SAAS,GAAG;EAClF,MAAM,SAAS,MAAM,cAAc,KAAK,UAAU,KAAK,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI;EAE3E,OAAO,yBADM,MAAM,cAAc,WAAW,IAAI,UAAU,SACrB,GAAG,OAAO,kDAAkD,MAAM,cAAc;CACvH;CACA,IAAI,iBAAiB,mBAAmB;EACtC,IAAI,MAAM,WAAW,OAAO,0BAA0B,MAAM,IAAI,GAC9D,OAAO,GAAG,MAAM,QAAQ;EAE1B,OAAO,GAAG,MAAM,QAAQ,IAAI,MAAM,KAAK;CACzC;CACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,0BAA0B,MAAuB;CACxD,MAAM,aAAa,KAAK,YAAY;CACpC,OACE,WAAW,WAAW,OAAO,KAC7B,WAAW,WAAW,iBAAiB,KACvC,eAAe,2CACf,eAAe,8BACf,eAAe;AAEnB"}

package/dist/control-plane/ArtifactObserver.d.ts.map DELETED Viewed

	@@ -1 +0,0 @@
1	- {"version":3,"file":"ArtifactObserver.d.ts","names":[],"sources":["../../src/control-plane/ArtifactObserver.ts"],"mappings":";UAQiB;;WAEN;WACA;;WAEA;;EAET,WAAW;;;;;;;cAuBA;;EAEE,oBAAoB,sBAAsB,QAAQ;;;;;EAalD,qBACX,oBACA,oBACA,oBACC,QAAQ"}

package/dist/control-plane/ArtifactObserver.js DELETED Viewed

@@ -1,77 +0,0 @@
-import { join } from "node:path";
-import { createReadStream, createWriteStream } from "node:fs";
-import { tmpdir } from "node:os";
-import { createHash } from "node:crypto";
-import { mkdtemp, rm, stat } from "node:fs/promises";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-//#region src/control-plane/ArtifactObserver.ts
-async function hashFile(path) {
-	const hash = createHash("sha256");
-	let sizeBytes = 0;
-	const source = createReadStream(path);
-	source.on("data", (chunk) => {
-		sizeBytes += typeof chunk === "string" ? Buffer.byteLength(chunk) : chunk.length;
-		hash.update(chunk);
-	});
-	await new Promise((resolve, reject) => {
-		source.on("end", resolve);
-		source.on("error", reject);
-	});
-	return {
-		sha256: `sha256:${hash.digest("hex")}`,
-		sizeBytes
-	};
-}
-/**
-* Produces the client-observed artifact facts for a publish submission:
-* the exact bytes are hashed and later read for packaged claims, so the
-* archive — not the working tree — is what gets published (archive wins).
-*/
-var ArtifactObserver = class {
-	/** Observes a caller-provided local archive without copying it. */
-	async observeLocalArchive(archivePath) {
-		if (!(await stat(archivePath).catch(() => null))?.isFile()) throw new Error(`The archive at "${archivePath}" does not exist or is not a file.`);
-		return {
-			...await hashFile(archivePath),
-			archivePath,
-			cleanup: async () => {}
-		};
-	}
-	/**
-	* Downloads the named uploaded release asset over unauthenticated HTTPS
-	* (redirects followed) and observes the received bytes.
-	*/
-	async downloadReleaseAsset(repository, releaseTag, assetName) {
-		const url = `https://github.com/${repository}/releases/download/${encodeURIComponent(releaseTag)}/${encodeURIComponent(assetName)}`;
-		const tempDir = await mkdtemp(join(tmpdir(), "uapkg-publish-"));
-		const archivePath = join(tempDir, assetName);
-		const cleanup = async () => {
-			await rm(tempDir, {
-				recursive: true,
-				force: true
-			});
-		};
-		try {
-			const response = await fetch(url, {
-				redirect: "follow",
-				signal: AbortSignal.timeout(12e4)
-			});
-			if (!response.ok || !response.body) throw new Error(`Unable to download the release asset (${response.status}). Confirm the GitHub Release "${releaseTag}" has an uploaded asset named "${assetName}" and that the repository is accessible without credentials.\nSee how to set these options manually using \`uapkg publish --help\`.`);
-			await pipeline(Readable.fromWeb(response.body), createWriteStream(archivePath));
-			return {
-				...await hashFile(archivePath),
-				archivePath,
-				cleanup
-			};
-		} catch (error) {
-			await cleanup();
-			throw error instanceof Error ? error : new Error(String(error));
-		}
-	}
-};
-//#endregion
-export { ArtifactObserver };
-//# sourceMappingURL=ArtifactObserver.js.map

package/dist/control-plane/ArtifactObserver.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"ArtifactObserver.js","names":[],"sources":["../../src/control-plane/ArtifactObserver.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { createReadStream, createWriteStream } from 'node:fs';\nimport { mkdtemp, rm, stat } from 'node:fs/promises';\nimport { tmpdir } from 'node:os';\nimport { join } from 'node:path';\nimport { Readable } from 'node:stream';\nimport { pipeline } from 'node:stream/promises';\n\nexport interface ObservedArtifact {\n /** Exactly `sha256:` + 64 lowercase hex characters. */\n readonly sha256: string;\n readonly sizeBytes: number;\n /** Local path of the exact bytes that were hashed (source of claims). */\n readonly archivePath: string;\n /** Removes any temporary download; no-op for caller-provided archives. */\n cleanup(): Promise<void>;\n}\n\nasync function hashFile(path: string): Promise<{ sha256: string; sizeBytes: number }> {\n const hash = createHash('sha256');\n let sizeBytes = 0;\n const source = createReadStream(path);\n source.on('data', (chunk: string | Buffer) => {\n sizeBytes += typeof chunk === 'string' ? Buffer.byteLength(chunk) : chunk.length;\n hash.update(chunk);\n });\n await new Promise<void>((resolve, reject) => {\n source.on('end', resolve);\n source.on('error', reject);\n });\n return { sha256: `sha256:${hash.digest('hex')}`, sizeBytes };\n}\n\n/**\n * Produces the client-observed artifact facts for a publish submission:\n * the exact bytes are hashed and later read for packaged claims, so the\n * archive — not the working tree — is what gets published (archive wins).\n */\nexport class ArtifactObserver {\n /** Observes a caller-provided local archive without copying it. */\n public async observeLocalArchive(archivePath: string): Promise<ObservedArtifact> {\n const fileInfo = await stat(archivePath).catch(() => null);\n if (!fileInfo?.isFile()) {\n throw new Error(`The archive at \"${archivePath}\" does not exist or is not a file.`);\n }\n const digest = await hashFile(archivePath);\n return { ...digest, archivePath, cleanup: async () => {} };\n }\n\n /**\n * Downloads the named uploaded release asset over unauthenticated HTTPS\n * (redirects followed) and observes the received bytes.\n */\n public async downloadReleaseAsset(\n repository: string,\n releaseTag: string,\n assetName: string,\n ): Promise<ObservedArtifact> {\n const url = `https://github.com/${repository}/releases/download/${encodeURIComponent(releaseTag)}/${encodeURIComponent(assetName)}`;\n const tempDir = await mkdtemp(join(tmpdir(), 'uapkg-publish-'));\n const archivePath = join(tempDir, assetName);\n const cleanup = async (): Promise<void> => {\n await rm(tempDir, { recursive: true, force: true });\n };\n\n try {\n const response = await fetch(url, { redirect: 'follow', signal: AbortSignal.timeout(120_000) });\n if (!response.ok || !response.body) {\n throw new Error(\n `Unable to download the release asset (${response.status}). Confirm the GitHub Release \"${releaseTag}\" has an uploaded asset named \"${assetName}\" and that the repository is accessible without credentials.` +\n `\\nSee how to set these options manually using \\`uapkg publish --help\\`.`,\n );\n }\n await pipeline(\n Readable.fromWeb(response.body as import('node:stream/web').ReadableStream),\n createWriteStream(archivePath),\n );\n const digest = await hashFile(archivePath);\n return { ...digest, archivePath, cleanup };\n } catch (error) {\n await cleanup();\n throw error instanceof Error ? error : new Error(String(error));\n }\n }\n}\n"],"mappings":";;;;;;;;;AAkBA,eAAe,SAAS,MAA8D;CACpF,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,YAAY;CAChB,MAAM,SAAS,iBAAiB,IAAI;CACpC,OAAO,GAAG,SAAS,UAA2B;EAC5C,aAAa,OAAO,UAAU,WAAW,OAAO,WAAW,KAAK,IAAI,MAAM;EAC1E,KAAK,OAAO,KAAK;CACnB,CAAC;CACD,MAAM,IAAI,SAAe,SAAS,WAAW;EAC3C,OAAO,GAAG,OAAO,OAAO;EACxB,OAAO,GAAG,SAAS,MAAM;CAC3B,CAAC;CACD,OAAO;EAAE,QAAQ,UAAU,KAAK,OAAO,KAAK;EAAK;CAAU;AAC7D;;;;;;AAOA,IAAa,mBAAb,MAA8B;;CAE5B,MAAa,oBAAoB,aAAgD;EAE/E,IAAI,EAAC,MADkB,KAAK,WAAW,CAAC,CAAC,YAAY,IAAI,EAC5C,EAAE,OAAO,GACpB,MAAM,IAAI,MAAM,mBAAmB,YAAY,mCAAmC;EAGpF,OAAO;GAAE,GAAG,MADS,SAAS,WAAW;GACrB;GAAa,SAAS,YAAY,CAAC;EAAE;CAC3D;;;;;CAMA,MAAa,qBACX,YACA,YACA,WAC2B;EAC3B,MAAM,MAAM,sBAAsB,WAAW,qBAAqB,mBAAmB,UAAU,EAAE,GAAG,mBAAmB,SAAS;EAChI,MAAM,UAAU,MAAM,QAAQ,KAAK,OAAO,GAAG,gBAAgB,CAAC;EAC9D,MAAM,cAAc,KAAK,SAAS,SAAS;EAC3C,MAAM,UAAU,YAA2B;GACzC,MAAM,GAAG,SAAS;IAAE,WAAW;IAAM,OAAO;GAAK,CAAC;EACpD;EAEA,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,KAAK;IAAE,UAAU;IAAU,QAAQ,YAAY,QAAQ,IAAO;GAAE,CAAC;GAC9F,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,MAC5B,MAAM,IAAI,MACR,yCAAyC,SAAS,OAAO,iCAAiC,WAAW,iCAAiC,UAAU,oIAElJ;GAEF,MAAM,SACJ,SAAS,QAAQ,SAAS,IAAgD,GAC1E,kBAAkB,WAAW,CAC/B;GAEA,OAAO;IAAE,GAAG,MADS,SAAS,WAAW;IACrB;IAAa;GAAQ;EAC3C,SAAS,OAAO;GACd,MAAM,QAAQ;GACd,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;EAChE;CACF;AACF"}

package/dist/control-plane/AuthMetadataStore.d.ts.map DELETED Viewed

	@@ -1 +0,0 @@
1	- {"version":3,"file":"AuthMetadataStore.d.ts","names":[],"sources":["../../src/control-plane/AuthMetadataStore.ts"],"mappings":";;;cA6Ca;mBAIQ;mBAHF;EAEjB,YACmB,mBACjB,eAAe;MAKN;EAIE,KAAK,gBAAgB,qBAAqB,QAAQ;EAIlD,OAAO,UAAU,wBAAwB;EAazC,OAAO,gBAAgB,qBAAqB;UAW3C;UA+BA;UAUA"}

package/dist/control-plane/AuthMetadataStore.js DELETED Viewed

@@ -1,114 +0,0 @@
-import { resolveAuthStoragePaths } from "./AuthStoragePaths.js";
-import { FileRegistryGrantLock } from "./RegistryGrantLock.js";
-import { dirname, resolve } from "node:path";
-import { existsSync } from "node:fs";
-import { randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { z } from "zod";
-//#region src/control-plane/AuthMetadataStore.ts
-const AUTH_METADATA_LOCK_NAMESPACE = "urn:uapkg:auth-metadata";
-const accountSchema = z.object({
-	id: z.uuid(),
-	username: z.string().min(1),
-	displayName: z.string().min(1)
-}).strict();
-const grantSchema = z.object({
-	issuer: z.url(),
-	registryId: z.uuid(),
-	registryName: z.string().min(1),
-	grantId: z.uuid(),
-	clientId: z.string().min(1),
-	keyReference: z.string().min(1),
-	refreshTokenReference: z.string().min(1),
-	publicKeyThumbprint: z.string().min(1),
-	deviceName: z.string().min(1),
-	repositoryFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/),
-	account: accountSchema,
-	createdAt: z.number().int().nonnegative(),
-	idleExpiresAt: z.number().int().positive(),
-	expiresAt: z.number().int().positive()
-}).strict();
-const fileSchema = z.object({
-	schemaVersion: z.literal(1),
-	grants: z.record(z.string(), grantSchema)
-}).strict();
-var AuthMetadataStore = class {
-	filePath;
-	mutationLock;
-	constructor(filePath = resolveAuthStoragePaths().metadataFile, mutationLock) {
-		this.filePath = filePath;
-		this.mutationLock = mutationLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(filePath).locksDirectory);
-	}
-	get path() {
-		return this.filePath;
-	}
-	async find(issuer, registryId) {
-		return (await this.read()).grants[grantKey(issuer, registryId)];
-	}
-	async upsert(metadata) {
-		await this.withMutationLock(async () => {
-			const current = await this.read();
-			await this.write({
-				schemaVersion: 1,
-				grants: {
-					...current.grants,
-					[grantKey(metadata.issuer, metadata.registryId)]: metadata
-				}
-			});
-		});
-	}
-	async remove(issuer, registryId) {
-		await this.withMutationLock(async () => {
-			const current = await this.read();
-			const key = grantKey(issuer, registryId);
-			if (!(key in current.grants)) return;
-			const next = { ...current.grants };
-			delete next[key];
-			await this.write({
-				schemaVersion: 1,
-				grants: next
-			});
-		});
-	}
-	async read() {
-		if (!existsSync(this.filePath)) return {
-			schemaVersion: 1,
-			grants: {}
-		};
-		let raw;
-		try {
-			raw = await readFile(this.filePath, "utf8");
-		} catch (error) {
-			throw new Error(`Unable to read saved UAPKG login metadata at ${this.filePath}.`, { cause: error });
-		}
-		let json;
-		try {
-			json = JSON.parse(raw);
-		} catch (error) {
-			throw new Error(`Saved UAPKG login metadata at ${this.filePath} is not valid JSON. Move it aside and run \`uapkg login\` again.`, { cause: error });
-		}
-		const parsed = fileSchema.safeParse(json);
-		if (!parsed.success) throw new Error(`Saved UAPKG login metadata at ${this.filePath} is invalid. Move it aside and run \`uapkg login\` again.`);
-		return parsed.data;
-	}
-	async write(value) {
-		await mkdir(dirname(this.filePath), { recursive: true });
-		const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
-		await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-		await rename(temporaryPath, this.filePath);
-	}
-	async withMutationLock(operation) {
-		return this.mutationLock.withLock(AUTH_METADATA_LOCK_NAMESPACE, resolve(this.filePath), operation);
-	}
-};
-function grantKey(issuer, registryId) {
-	return `${issuer.replace(/\/+$/, "")}|${registryId.toLowerCase()}`;
-}
-//#endregion
-export { AuthMetadataStore };
-//# sourceMappingURL=AuthMetadataStore.js.map

package/dist/control-plane/AuthMetadataStore.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"AuthMetadataStore.js","names":[],"sources":["../../src/control-plane/AuthMetadataStore.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, rename, writeFile } from 'node:fs/promises';\nimport { dirname, resolve } from 'node:path';\nimport { z } from 'zod';\nimport { resolveAuthStoragePaths } from './AuthStoragePaths.js';\nimport type { AuthMetadataFile, RegistryGrantMetadata } from './ControlPlaneTypes.js';\nimport { FileRegistryGrantLock, type RegistryGrantLock } from './RegistryGrantLock.js';\n\nconst AUTH_METADATA_LOCK_NAMESPACE = 'urn:uapkg:auth-metadata';\n\nconst accountSchema = z\n .object({\n id: z.uuid(),\n username: z.string().min(1),\n displayName: z.string().min(1),\n })\n .strict();\n\nconst grantSchema = z\n .object({\n issuer: z.url(),\n registryId: z.uuid(),\n registryName: z.string().min(1),\n grantId: z.uuid(),\n clientId: z.string().min(1),\n keyReference: z.string().min(1),\n refreshTokenReference: z.string().min(1),\n publicKeyThumbprint: z.string().min(1),\n deviceName: z.string().min(1),\n repositoryFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/),\n account: accountSchema,\n createdAt: z.number().int().nonnegative(),\n idleExpiresAt: z.number().int().positive(),\n expiresAt: z.number().int().positive(),\n })\n .strict();\n\nconst fileSchema = z\n .object({\n schemaVersion: z.literal(1),\n grants: z.record(z.string(), grantSchema),\n })\n .strict();\n\nexport class AuthMetadataStore {\n private readonly mutationLock: RegistryGrantLock;\n\n public constructor(\n private readonly filePath = resolveAuthStoragePaths().metadataFile,\n mutationLock?: RegistryGrantLock,\n ) {\n this.mutationLock = mutationLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(filePath).locksDirectory);\n }\n\n public get path(): string {\n return this.filePath;\n }\n\n public async find(issuer: string, registryId: string): Promise<RegistryGrantMetadata | undefined> {\n return (await this.read()).grants[grantKey(issuer, registryId)];\n }\n\n public async upsert(metadata: RegistryGrantMetadata): Promise<void> {\n await this.withMutationLock(async () => {\n const current = await this.read();\n await this.write({\n schemaVersion: 1,\n grants: {\n ...current.grants,\n [grantKey(metadata.issuer, metadata.registryId)]: metadata,\n },\n });\n });\n }\n\n public async remove(issuer: string, registryId: string): Promise<void> {\n await this.withMutationLock(async () => {\n const current = await this.read();\n const key = grantKey(issuer, registryId);\n if (!(key in current.grants)) return;\n const next = { ...current.grants };\n delete next[key];\n await this.write({ schemaVersion: 1, grants: next });\n });\n }\n\n private async read(): Promise<AuthMetadataFile> {\n if (!existsSync(this.filePath)) {\n return { schemaVersion: 1, grants: {} };\n }\n\n let raw: string;\n try {\n raw = await readFile(this.filePath, 'utf8');\n } catch (error) {\n throw new Error(`Unable to read saved UAPKG login metadata at ${this.filePath}.`, { cause: error });\n }\n\n let json: unknown;\n try {\n json = JSON.parse(raw) as unknown;\n } catch (error) {\n throw new Error(\n `Saved UAPKG login metadata at ${this.filePath} is not valid JSON. Move it aside and run \\`uapkg login\\` again.`,\n { cause: error },\n );\n }\n\n const parsed = fileSchema.safeParse(json);\n if (!parsed.success) {\n throw new Error(\n `Saved UAPKG login metadata at ${this.filePath} is invalid. Move it aside and run \\`uapkg login\\` again.`,\n );\n }\n return parsed.data;\n }\n\n private async write(value: AuthMetadataFile): Promise<void> {\n await mkdir(dirname(this.filePath), { recursive: true });\n const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;\n await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\\n`, {\n encoding: 'utf8',\n mode: 0o600,\n });\n await rename(temporaryPath, this.filePath);\n }\n\n private async withMutationLock<T>(operation: () => Promise<T>): Promise<T> {\n return this.mutationLock.withLock(AUTH_METADATA_LOCK_NAMESPACE, resolve(this.filePath), operation);\n }\n}\n\nfunction grantKey(issuer: string, registryId: string): string {\n return `${issuer.replace(/\\/+$/, '')}|${registryId.toLowerCase()}`;\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,+BAA+B;AAErC,MAAM,gBAAgB,EACnB,OAAO;CACN,IAAI,EAAE,KAAK;CACX,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC,CAAC,CACD,OAAO;AAEV,MAAM,cAAc,EACjB,OAAO;CACN,QAAQ,EAAE,IAAI;CACd,YAAY,EAAE,KAAK;CACnB,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC9B,SAAS,EAAE,KAAK;CAChB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC9B,uBAAuB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvC,qBAAqB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACrC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,uBAAuB,EAAE,OAAO,CAAC,CAAC,MAAM,uBAAuB;CAC/D,SAAS;CACT,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACxC,eAAe,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACzC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AACvC,CAAC,CAAC,CACD,OAAO;AAEV,MAAM,aAAa,EAChB,OAAO;CACN,eAAe,EAAE,QAAQ,CAAC;CAC1B,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,WAAW;AAC1C,CAAC,CAAC,CACD,OAAO;AAEV,IAAa,oBAAb,MAA+B;CAIV;CAHnB,AAAiB;CAEjB,AAAO,YACL,AAAiB,WAAW,wBAAwB,CAAC,CAAC,cACtD,cACA;EAFiB;EAGjB,KAAK,eAAe,gBAAgB,IAAI,sBAAsB,wBAAwB,QAAQ,CAAC,CAAC,cAAc;CAChH;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK;CACd;CAEA,MAAa,KAAK,QAAgB,YAAgE;EAChG,QAAQ,MAAM,KAAK,KAAK,EAAC,CAAE,OAAO,SAAS,QAAQ,UAAU;CAC/D;CAEA,MAAa,OAAO,UAAgD;EAClE,MAAM,KAAK,iBAAiB,YAAY;GACtC,MAAM,UAAU,MAAM,KAAK,KAAK;GAChC,MAAM,KAAK,MAAM;IACf,eAAe;IACf,QAAQ;KACN,GAAG,QAAQ;MACV,SAAS,SAAS,QAAQ,SAAS,UAAU,IAAI;IACpD;GACF,CAAC;EACH,CAAC;CACH;CAEA,MAAa,OAAO,QAAgB,YAAmC;EACrE,MAAM,KAAK,iBAAiB,YAAY;GACtC,MAAM,UAAU,MAAM,KAAK,KAAK;GAChC,MAAM,MAAM,SAAS,QAAQ,UAAU;GACvC,IAAI,EAAE,OAAO,QAAQ,SAAS;GAC9B,MAAM,OAAO,EAAE,GAAG,QAAQ,OAAO;GACjC,OAAO,KAAK;GACZ,MAAM,KAAK,MAAM;IAAE,eAAe;IAAG,QAAQ;GAAK,CAAC;EACrD,CAAC;CACH;CAEA,MAAc,OAAkC;EAC9C,IAAI,CAAC,WAAW,KAAK,QAAQ,GAC3B,OAAO;GAAE,eAAe;GAAG,QAAQ,CAAC;EAAE;EAGxC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,SAAS,KAAK,UAAU,MAAM;EAC5C,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,gDAAgD,KAAK,SAAS,IAAI,EAAE,OAAO,MAAM,CAAC;EACpG;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,MAAM,GAAG;EACvB,SAAS,OAAO;GACd,MAAM,IAAI,MACR,iCAAiC,KAAK,SAAS,mEAC/C,EAAE,OAAO,MAAM,CACjB;EACF;EAEA,MAAM,SAAS,WAAW,UAAU,IAAI;EACxC,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MACR,iCAAiC,KAAK,SAAS,0DACjD;EAEF,OAAO,OAAO;CAChB;CAEA,MAAc,MAAM,OAAwC;EAC1D,MAAM,MAAM,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,gBAAgB,GAAG,KAAK,SAAS,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;EACtE,MAAM,UAAU,eAAe,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK;GACpE,UAAU;GACV,MAAM;EACR,CAAC;EACD,MAAM,OAAO,eAAe,KAAK,QAAQ;CAC3C;CAEA,MAAc,iBAAoB,WAAyC;EACzE,OAAO,KAAK,aAAa,SAAS,8BAA8B,QAAQ,KAAK,QAAQ,GAAG,SAAS;CACnG;AACF;AAEA,SAAS,SAAS,QAAgB,YAA4B;CAC5D,OAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,EAAE,GAAG,WAAW,YAAY;AACjE"}

package/dist/control-plane/AuthStoragePaths.d.ts.map DELETED Viewed

	@@ -1 +0,0 @@
1	- {"version":3,"file":"AuthStoragePaths.d.ts","names":[],"sources":["../../src/control-plane/AuthStoragePaths.ts"],"mappings":";UAMiB;WACN;WACA;;;;;;;iBAQK,wBAAwB,wBAAwB"}

package/dist/control-plane/AuthStoragePaths.js DELETED Viewed

@@ -1,22 +0,0 @@
-import { resolveActiveUapkgProfileRoot } from "@uapkg/common";
-import { dirname, join } from "node:path";
-//#region src/control-plane/AuthStoragePaths.ts
-const AUTH_METADATA_FILE_NAME = "auth.json";
-const AUTH_LOCKS_DIRECTORY_NAME = "auth-locks";
-/**
-* Resolves the CLI-owned files used for persistent authentication state.
-* An explicit metadata path keeps the historical custom-store behavior by
-* placing its locks alongside that file.
-*/
-function resolveAuthStoragePaths(metadataFile) {
-	const resolvedMetadataFile = metadataFile ?? join(resolveActiveUapkgProfileRoot(), AUTH_METADATA_FILE_NAME);
-	return {
-		metadataFile: resolvedMetadataFile,
-		locksDirectory: join(dirname(resolvedMetadataFile), AUTH_LOCKS_DIRECTORY_NAME)
-	};
-}
-//#endregion
-export { resolveAuthStoragePaths };
-//# sourceMappingURL=AuthStoragePaths.js.map

package/dist/control-plane/AuthStoragePaths.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"AuthStoragePaths.js","names":[],"sources":["../../src/control-plane/AuthStoragePaths.ts"],"sourcesContent":["import { dirname, join } from 'node:path';\nimport { resolveActiveUapkgProfileRoot } from '@uapkg/common';\n\nconst AUTH_METADATA_FILE_NAME = 'auth.json';\nconst AUTH_LOCKS_DIRECTORY_NAME = 'auth-locks';\n\nexport interface AuthStoragePaths {\n readonly metadataFile: string;\n readonly locksDirectory: string;\n}\n\n/**\n * Resolves the CLI-owned files used for persistent authentication state.\n * An explicit metadata path keeps the historical custom-store behavior by\n * placing its locks alongside that file.\n */\nexport function resolveAuthStoragePaths(metadataFile?: string): AuthStoragePaths {\n const resolvedMetadataFile = metadataFile ?? join(resolveActiveUapkgProfileRoot(), AUTH_METADATA_FILE_NAME);\n return {\n metadataFile: resolvedMetadataFile,\n locksDirectory: join(dirname(resolvedMetadataFile), AUTH_LOCKS_DIRECTORY_NAME),\n };\n}\n"],"mappings":";;;;AAGA,MAAM,0BAA0B;AAChC,MAAM,4BAA4B;;;;;;AAYlC,SAAgB,wBAAwB,cAAyC;CAC/E,MAAM,uBAAuB,gBAAgB,KAAK,8BAA8B,GAAG,uBAAuB;CAC1G,OAAO;EACL,cAAc;EACd,gBAAgB,KAAK,QAAQ,oBAAoB,GAAG,yBAAyB;CAC/E;AACF"}

package/dist/control-plane/AuthenticationSelector.d.ts.map DELETED Viewed

	@@ -1 +0,0 @@
1	- {"version":3,"file":"AuthenticationSelector.d.ts","names":[],"sources":["../../src/control-plane/AuthenticationSelector.ts"],"mappings":";;;;;;UAUiB;WACN;WACA,YAAY;WACZ;;cAGE;mBAEQ;mBACA;mBACA;mBACA;EAJnB,YACmB,SAAS,gBACT,SAAS,eACT,OAAI,qCACJ;EAGN,OACX,MAAM,sBACN,OAAO,eACP,iBAAiB,iBACjB,4BACA,aAAa,0BACZ,QAAQ;UA6CG;UASN"}

package/dist/control-plane/AuthenticationSelector.js DELETED Viewed

@@ -1,70 +0,0 @@
-import { GitHubActionsOidcCredentialProvider } from "./GitHubActionsOidcCredentialProvider.js";
-import isCI from "is-ci";
-//#region src/control-plane/AuthenticationSelector.ts
-var AuthenticationSelector = class {
-	account;
-	prompts;
-	oidc;
-	isInteractive;
-	constructor(account, prompts, oidc = new GitHubActionsOidcCredentialProvider(), isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI)) {
-		this.account = account;
-		this.prompts = prompts;
-		this.oidc = oidc;
-		this.isInteractive = isInteractive;
-	}
-	async select(mode, trust, scopes, requireRequestOtp, oidcTarget) {
-		if (mode === "oidc" || mode === "auto" && this.oidc.isAvailable()) {
-			if (!oidcTarget) throw new Error("GitHub Actions OIDC requires a target package resolved from the requested operation.");
-			return {
-				kind: "oidc",
-				credential: {
-					kind: "bearer",
-					accessToken: await this.oidc.exchange(trust, oidcTarget)
-				}
-			};
-		}
-		if (mode === "login" || mode === "auto" && await this.account.hasGrant(trust)) {
-			if (requireRequestOtp) this.assertInteractiveRequestOtp();
-			return {
-				kind: "login",
-				credential: (await this.account.getAccessCredential(trust, scopes)).credential,
-				otp: requireRequestOtp ? await this.readOtp() : void 0
-			};
-		}
-		const environmentToken = process.env.UAPKG_TOKEN?.trim();
-		if (mode === "gat" || mode === "auto" && environmentToken) {
-			if (!this.isInteractive()) throw new Error("Human GAT authentication requires an attended TTY. Headless publishing must use a configured GitHub Actions OIDC trusted publisher.");
-			const accessToken = environmentToken || (await this.prompts.secret("UAPKG granular access token")).trim();
-			if (!accessToken) throw new Error("A granular access token is required.");
-			return {
-				kind: "gat",
-				credential: {
-					kind: "bearer",
-					accessToken
-				},
-				otp: requireRequestOtp ? await this.readOtp() : void 0
-			};
-		}
-		throw new Error([
-			`No supported publishing credential is available for "${trust.alias}".`,
-			"",
-			`Run \`uapkg login --registry ${trust.alias}\` on a browser-capable workstation,`,
-			"set UAPKG_TOKEN for an attended GAT publish, or configure GitHub Actions OIDC."
-		].join("\n"));
-	}
-	async readOtp() {
-		this.assertInteractiveRequestOtp();
-		const otp = (await this.prompts.secret("Current TOTP code")).trim();
-		if (!/^[0-9]{6}$/.test(otp)) throw new Error("A current 6-digit TOTP code is required for this publishing request.");
-		return otp;
-	}
-	assertInteractiveRequestOtp() {
-		if (this.isInteractive()) return;
-		throw new Error("Request-scoped TOTP confirmation requires an attended TTY. Human publishing is not supported in headless environments.");
-	}
-};
-//#endregion
-export { AuthenticationSelector };
-//# sourceMappingURL=AuthenticationSelector.js.map

package/dist/control-plane/AuthenticationSelector.js.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"AuthenticationSelector.js","names":[],"sources":["../../src/control-plane/AuthenticationSelector.ts"],"sourcesContent":["import isCI from 'is-ci';\nimport type { PromptService } from '../prompts/PromptService.js';\nimport type { AccountManager } from './AccountManager.js';\nimport type { ControlPlaneCredential } from './ControlPlaneClient.js';\nimport type { ControlPlaneAuthMode, RegistryTrust, UAPKGCliScope } from './ControlPlaneTypes.js';\nimport {\n GitHubActionsOidcCredentialProvider,\n type GitHubActionsOidcTarget,\n} from './GitHubActionsOidcCredentialProvider.js';\n\nexport interface SelectedAuthentication {\n readonly kind: 'oidc' | 'login' | 'gat';\n readonly credential: ControlPlaneCredential;\n readonly otp?: string;\n}\n\nexport class AuthenticationSelector {\n public constructor(\n private readonly account: AccountManager,\n private readonly prompts: PromptService,\n private readonly oidc = new GitHubActionsOidcCredentialProvider(),\n private readonly isInteractive = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI),\n ) {}\n\n public async select(\n mode: ControlPlaneAuthMode,\n trust: RegistryTrust,\n scopes: readonly UAPKGCliScope[],\n requireRequestOtp: boolean,\n oidcTarget?: GitHubActionsOidcTarget,\n ): Promise<SelectedAuthentication> {\n if (mode === 'oidc' || (mode === 'auto' && this.oidc.isAvailable())) {\n if (!oidcTarget) {\n throw new Error('GitHub Actions OIDC requires a target package resolved from the requested operation.');\n }\n const accessToken = await this.oidc.exchange(trust, oidcTarget);\n return { kind: 'oidc', credential: { kind: 'bearer', accessToken } };\n }\n\n if (mode === 'login' || (mode === 'auto' && (await this.account.hasGrant(trust)))) {\n if (requireRequestOtp) this.assertInteractiveRequestOtp();\n const access = await this.account.getAccessCredential(trust, scopes);\n return {\n kind: 'login',\n credential: access.credential,\n otp: requireRequestOtp ? await this.readOtp() : undefined,\n };\n }\n\n const environmentToken = process.env.UAPKG_TOKEN?.trim();\n if (mode === 'gat' || (mode === 'auto' && environmentToken)) {\n if (!this.isInteractive()) {\n throw new Error(\n 'Human GAT authentication requires an attended TTY. Headless publishing must use a configured GitHub Actions OIDC trusted publisher.',\n );\n }\n const accessToken = environmentToken || (await this.prompts.secret('UAPKG granular access token')).trim();\n if (!accessToken) throw new Error('A granular access token is required.');\n return {\n kind: 'gat',\n credential: { kind: 'bearer', accessToken },\n otp: requireRequestOtp ? await this.readOtp() : undefined,\n };\n }\n\n throw new Error(\n [\n `No supported publishing credential is available for \"${trust.alias}\".`,\n '',\n `Run \\`uapkg login --registry ${trust.alias}\\` on a browser-capable workstation,`,\n 'set UAPKG_TOKEN for an attended GAT publish, or configure GitHub Actions OIDC.',\n ].join('\\n'),\n );\n }\n\n private async readOtp(): Promise<string> {\n this.assertInteractiveRequestOtp();\n const otp = (await this.prompts.secret('Current TOTP code')).trim();\n if (!/^[0-9]{6}$/.test(otp)) {\n throw new Error('A current 6-digit TOTP code is required for this publishing request.');\n }\n return otp;\n }\n\n private assertInteractiveRequestOtp(): void {\n if (this.isInteractive()) return;\n throw new Error(\n 'Request-scoped TOTP confirmation requires an attended TTY. Human publishing is not supported in headless environments.',\n );\n }\n}\n"],"mappings":";;;;AAgBA,IAAa,yBAAb,MAAoC;CAEf;CACA;CACA;CACA;CAJnB,AAAO,YACL,AAAiB,SACjB,AAAiB,SACjB,AAAiB,OAAO,IAAI,oCAAoC,GAChE,AAAiB,sBAAsB,QAAQ,QAAQ,MAAM,SAAS,QAAQ,OAAO,SAAS,CAAC,IAAI,GACnG;EAJiB;EACA;EACA;EACA;CAChB;CAEH,MAAa,OACX,MACA,OACA,QACA,mBACA,YACiC;EACjC,IAAI,SAAS,UAAW,SAAS,UAAU,KAAK,KAAK,YAAY,GAAI;GACnE,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,sFAAsF;GAGxG,OAAO;IAAE,MAAM;IAAQ,YAAY;KAAE,MAAM;KAAU,mBAD3B,KAAK,KAAK,SAAS,OAAO,UAAU;IACG;GAAE;EACrE;EAEA,IAAI,SAAS,WAAY,SAAS,UAAW,MAAM,KAAK,QAAQ,SAAS,KAAK,GAAK;GACjF,IAAI,mBAAmB,KAAK,4BAA4B;GAExD,OAAO;IACL,MAAM;IACN,aAAY,MAHO,KAAK,QAAQ,oBAAoB,OAAO,MAAM,EAG/C,CAAC;IACnB,KAAK,oBAAoB,MAAM,KAAK,QAAQ,IAAI;GAClD;EACF;EAEA,MAAM,mBAAmB,QAAQ,IAAI,aAAa,KAAK;EACvD,IAAI,SAAS,SAAU,SAAS,UAAU,kBAAmB;GAC3D,IAAI,CAAC,KAAK,cAAc,GACtB,MAAM,IAAI,MACR,qIACF;GAEF,MAAM,cAAc,qBAAqB,MAAM,KAAK,QAAQ,OAAO,6BAA6B,EAAC,CAAE,KAAK;GACxG,IAAI,CAAC,aAAa,MAAM,IAAI,MAAM,sCAAsC;GACxE,OAAO;IACL,MAAM;IACN,YAAY;KAAE,MAAM;KAAU;IAAY;IAC1C,KAAK,oBAAoB,MAAM,KAAK,QAAQ,IAAI;GAClD;EACF;EAEA,MAAM,IAAI,MACR;GACE,wDAAwD,MAAM,MAAM;GACpE;GACA,gCAAgC,MAAM,MAAM;GAC5C;EACF,CAAC,CAAC,KAAK,IAAI,CACb;CACF;CAEA,MAAc,UAA2B;EACvC,KAAK,4BAA4B;EACjC,MAAM,OAAO,MAAM,KAAK,QAAQ,OAAO,mBAAmB,EAAC,CAAE,KAAK;EAClE,IAAI,CAAC,aAAa,KAAK,GAAG,GACxB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;CACT;CAEA,AAAQ,8BAAoC;EAC1C,IAAI,KAAK,cAAc,GAAG;EAC1B,MAAM,IAAI,MACR,wHACF;CACF;AACF"}

package/dist/control-plane/ControlPlaneClient.d.ts.map DELETED Viewed

@@ -1 +0,0 @@

- {"version":3,"file":"ControlPlaneClient.d.ts","names":[],"sources":["../../src/control-plane/ControlPlaneClient.ts"],"mappings":";;;KAuBY;WAEG;WACA;WACA,MAAM,MAAM;WACZ;WACA,0BAA0B;;WAG1B;WACA;;cAqHF;mBACM;EAEjB,YAAmB;EAQN,QAAQ,YAAY,wBAAwB,SAAS,cAAc,QAAQ;EAa3E,wBACX,YAAY,wBACZ,SAAS,cACR,QAAQ;EAgBE,gBACX,YAAY,wBACZ,SAAS,cACR,QAAQ;EAYE,sBACX,YAAY,wBACZ,WAAW,mBACX,YAAY,2BACZ;aAAoB;aAAkC;MACrD;IAAU;IAAmB,QAAQ;IAAuB;;EAuBlD,mBACX,YAAY,wBACZ,oBACC,QAAQ;;;;;;EAcE,yBACX,YAAY,wBACZ,oBACC,QAAQ;EAaE,qBACX,YAAY,wBACZ,oBACA,SAAS,wBACR,QAAQ;UAoBG;UA2DA"}