@uapkg/cli 1.3.2 → 1.5.0

package/dist/control-plane/PublishRequestErrorMapper.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PublishRequestErrorMapper.js","names":[],"sources":["../../src/control-plane/PublishRequestErrorMapper.ts"],"sourcesContent":["import {\n  createPublishRequestFailedDiagnostic,\n  type PublishDiagnosticFact,\n  type PublishDiagnosticResource,\n  type PublishRequestFailedDiagnostic,\n} from '@uapkg/diagnostics';\nimport { z } from 'zod';\nimport { ControlPlaneError } from './ControlPlaneTypes.js';\n\nconst SERVER_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/u;\n\nconst boundedText = (maximumLength: number) =>\n  z\n    .string()\n    .trim()\n    .min(1)\n    .max(maximumLength)\n    .refine((value) => !hasUnsafeDisplayCharacter(value));\nconst packageNameSchema = boundedText(214);\nconst packageVersionSchema = boundedText(256);\nconst ownerNameSchema = boundedText(100).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/u);\nconst repositorySchema = boundedText(255).regex(/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/u);\nconst requestIdSchema = boundedText(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/u);\nconst accessModeSchema = z.enum(['none', 'selected', 'all']);\nconst missingCapabilitiesSchema = z\n  .array(z.enum(['package.publish', 'publishing.request.create']))\n  .max(10)\n  .transform((values) => [...new Set(values)]);\nconst missingOAuthScopesSchema = z\n  .array(z.enum(['publishing.request.create', 'publishing.request.read.self']))\n  .max(2)\n  .transform((values) => [...new Set(values)]);\nconst ownerNamesSchema = z\n  .array(ownerNameSchema)\n  .max(20)\n  .transform((values) => [...new Set(values)].sort());\n\nconst emptyDetailsSchema = z.object({});\nconst packageDetailsSchema = z.object({ packageName: packageNameSchema.optional() });\nconst ownerRequiredDetailsSchema = packageDetailsSchema;\nconst requestedOwnerDetailsSchema = packageDetailsSchema.extend({\n  requestedOwnerOrganizationName: ownerNameSchema.optional(),\n  ownerOrganizationName: ownerNameSchema.optional(),\n  allowedOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst gatOwnerMismatchDetailsSchema = packageDetailsSchema.extend({\n  requestedOwnerOrganizationName: ownerNameSchema.optional(),\n  tokenOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst scopeMismatchDetailsSchema = packageDetailsSchema.extend({\n  requestedScopeOwner: ownerNameSchema.optional(),\n  scopeOwner: ownerNameSchema.optional(),\n  allowedScopeOwners: ownerNamesSchema.optional(),\n  tokenOwnerOrganizationNames: ownerNamesSchema.optional(),\n});\nconst tokenAccessDetailsSchema = packageDetailsSchema.extend({\n  actualPackageAccessMode: accessModeSchema.optional(),\n  requiredPackageAccessMode: z.literal('all').optional(),\n  missingCapabilities: missingCapabilitiesSchema.optional(),\n  packageAccess: z.object({ mode: accessModeSchema }).optional(),\n  actualRegistryAccessMode: accessModeSchema.optional(),\n  requiredRegistryAccessModes: z\n    .array(z.enum(['selected', 'all']))\n    .max(2)\n    .optional(),\n  requiredPackageAccessModes: z\n    .array(z.enum(['selected', 'all']))\n    .max(2)\n    .optional(),\n  registryAccess: z.object({ mode: accessModeSchema }).optional(),\n});\nconst tokenPermissionDetailsSchema = z.object({\n  missingCapabilities: missingCapabilitiesSchema.optional(),\n});\nconst oauthScopeDetailsSchema = z.object({\n  missingScopes: missingOAuthScopesSchema.optional(),\n});\nconst oidcRepositoryDetailsSchema = packageDetailsSchema.extend({\n  submittedRepository: repositorySchema.optional(),\n  trustedRepository: repositorySchema.optional(),\n});\nconst versionDetailsSchema = z.object({\n  packageName: packageNameSchema.optional(),\n  packageVersion: packageVersionSchema.optional(),\n});\nconst activeRequestDetailsSchema = versionDetailsSchema.extend({\n  activeRequestId: requestIdSchema.optional(),\n});\nconst haltedPackageDetailsSchema = packageDetailsSchema.extend({\n  blockingRequestId: requestIdSchema.optional(),\n});\nconst retryDetailsSchema = z.object({\n  retryAfterSeconds: z.number().int().min(1).max(86_400).optional(),\n});\n\nexport interface PublishRequestErrorContext {\n  readonly packageName: string;\n  readonly packageVersion: string;\n  readonly registryAlias: string;\n  readonly registryName?: string;\n  readonly registryIssuer: string;\n  readonly credentialKind: 'login' | 'gat' | 'oidc';\n  readonly requestedOwner?: string;\n  readonly repository: string;\n}\n\ntype ResourceKind =\n  | 'access-tokens'\n  | 'help'\n  | 'login'\n  | 'owner-command'\n  | 'requests'\n  | 'security'\n  | 'registries'\n  | 'trusted-publishers';\n\ninterface PublishGuidance {\n  readonly message: string;\n  readonly hint: string;\n  readonly facts?: readonly PublishDiagnosticFact[];\n  readonly resources?: readonly ResourceKind[];\n  readonly requestId?: string;\n}\n\ninterface PublishErrorSpec {\n  build(details: unknown, context: PublishRequestErrorContext): PublishGuidance;\n}\n\nfunction defineSpec<Schema extends z.ZodObject>(\n  schema: Schema,\n  build: (details: z.output<Schema>, context: PublishRequestErrorContext) => PublishGuidance,\n): PublishErrorSpec {\n  const empty = schema.parse({});\n  return {\n    build(details, context) {\n      const parsed = schema.safeParse(details ?? {});\n      return build(parsed.success ? parsed.data : empty, context);\n    },\n  };\n}\n\nfunction fixedSpec(message: string, hint: string, resources: readonly ResourceKind[] = []): PublishErrorSpec {\n  return defineSpec(emptyDetailsSchema, () => ({ message, hint, resources }));\n}\n\nconst UPDATE_CLIENT_AND_RETRY =\n  'Update UAPKG CLI and try again. If the problem remains, report the server code to the registry operator.';\nconst RETRY_AND_REPORT =\n  'Try publishing again. If the failure continues, report the server code to the registry operator.';\nconst LOGIN_AGAIN = 'Sign in again for this registry, then retry the publication.';\nconst CHECK_TOKEN =\n  'Create or use an active granular access token with the correct owner, permissions, and package access, then try again.';\n\nconst clientRequestSpec = (message: string) => fixedSpec(message, UPDATE_CLIENT_AND_RETRY);\nconst internalServiceSpec = (message: string) => fixedSpec(message, RETRY_AND_REPORT);\nconst loginSpec = (message: string) => fixedSpec(message, LOGIN_AGAIN, ['login']);\nconst tokenSpec = (message: string) => fixedSpec(message, CHECK_TOKEN, ['access-tokens']);\n\nconst unscopedOwnerSpec = defineSpec(ownerRequiredDetailsSchema, (_details, context) => {\n  const packageName = safeDisplayValue(context.packageName, 214);\n  return {\n    message: packageName\n      ? `\"${packageName}\" needs an owner organization before it can be published for the first time.`\n      : 'This unscoped package needs an owner organization before it can be published for the first time.',\n    hint: 'Pass `--owner <organization>`, set `publish.owner` in uapkg.json, or publish the package under an `@organization/name` scope.',\n    resources: ['owner-command'],\n  };\n});\n\nconst gatOwnerMismatchSpec = defineSpec(gatOwnerMismatchDetailsSchema, (details, context) => {\n  const requestedOwner = details.requestedOwnerOrganizationName ?? safeOwner(context.requestedOwner);\n  const tokenOwners = details.tokenOwnerOrganizationNames ?? [];\n  const ownerDescription = tokenOwners.length > 0 ? quotedList(tokenOwners) : 'a different organization';\n  const requestedDescription = requestedOwner ? `\"${requestedOwner}\"` : 'the requested organization';\n  const scoped = scopedOwner(context.packageName);\n  return {\n    message: `The selected token was created for ${ownerDescription}, but this publication asks to use ${requestedDescription}.`,\n    hint: scoped\n      ? `Use a token created for \"${scoped}\", or rebuild the package under the organization scope this token acts for.`\n      : 'Correct or remove the explicit owner, or use a token created for the organization that should own this package.',\n    facts: compactFacts([\n      fact('requested-owner', requestedOwner),\n      ...tokenOwners.map((owner) => fact('token-owner', owner)),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst scopeMismatchSpec = defineSpec(scopeMismatchDetailsSchema, (details, context) => {\n  const requestedOwner = details.requestedScopeOwner ?? details.scopeOwner ?? scopedOwner(context.packageName);\n  const allowedOwners = details.allowedScopeOwners ?? details.tokenOwnerOrganizationNames ?? [];\n  const requestedDescription = requestedOwner ? `\"@${requestedOwner}\"` : 'The package scope';\n  const allowedDescription =\n    allowedOwners.length > 0\n      ? quotedList(allowedOwners.map((owner) => `@${owner}`))\n      : 'the organization this token acts for';\n  return {\n    message: `${requestedDescription} does not match ${allowedDescription}.`,\n    hint: 'Use a token created for the package scope, or rebuild the package under the organization scope this token acts for.',\n    facts: compactFacts([\n      fact('requested-owner', requestedOwner),\n      ...allowedOwners.map((owner) => fact('allowed-owner', owner)),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst initialTokenAccessSpec = defineSpec(tokenAccessDetailsSchema, (details) => {\n  const actualMode = details.actualPackageAccessMode ?? details.packageAccess?.mode;\n  const requiredMode = details.requiredPackageAccessMode ?? 'all';\n  const missing = details.missingCapabilities ?? (actualMode === undefined ? ['package.publish'] : []);\n  return {\n    message: 'This token cannot create a package during its first publication.',\n    hint: 'Create or use a token with Package Access set to All and permission to publish packages.',\n    facts: compactFacts([\n      fact('actual-access-mode', accessModeLabel(actualMode, 'package')),\n      fact('required-access-mode', accessModeLabel(requiredMode, 'package')),\n      ...missing.map((capability) => fact('missing-capability', capabilityLabel(capability))),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst tokenPermissionSpec = defineSpec(tokenPermissionDetailsSchema, (details) => ({\n  message: 'This token does not allow package publication.',\n  hint: 'Create or use a token with permission to publish packages, then try again.',\n  facts: (details.missingCapabilities ?? ['package.publish']).map((capability) => ({\n    kind: 'missing-capability' as const,\n    value: capabilityLabel(capability),\n  })),\n  resources: ['access-tokens'],\n}));\n\nconst oauthScopeSpec = defineSpec(oauthScopeDetailsSchema, (details) => ({\n  message: 'This CLI login does not include permission to submit publishing requests.',\n  hint: 'Reauthorize the login for this registry, then try publishing again.',\n  facts: (details.missingScopes ?? ['publishing.request.create']).map((scope) => ({\n    kind: 'missing-capability' as const,\n    value: oauthScopeLabel(scope),\n  })),\n  resources: ['login'],\n}));\n\nconst packageOwnerNotAuthorizedSpec = defineSpec(requestedOwnerDetailsSchema, (details, context) => {\n  const owner =\n    details.requestedOwnerOrganizationName ?? details.ownerOrganizationName ?? safeOwner(context.requestedOwner);\n  const allowedOwners = details.allowedOwnerOrganizationNames ?? [];\n  const scoped = scopedOwner(context.packageName);\n  const retryOwner = allowedOwners.length === 1 && !scoped ? allowedOwners[0] : undefined;\n  return {\n    message: owner\n      ? `Your account is not allowed to create this package for UAPKG organization \"${owner}\".`\n      : 'Your account is not allowed to create this package for the requested UAPKG organization.',\n    hint: scoped\n      ? allowedOwners.length > 0\n        ? 'This package’s `@owner` scope determines ownership. Rebuild it under one of the allowed UAPKG organization scopes shown above.'\n        : 'This package’s `@owner` scope determines ownership. Rebuild it under a UAPKG organization scope where you can publish, or ask an organization administrator to grant access.'\n      : retryOwner\n        ? `Retry with \\`--owner ${retryOwner}\\` to use the allowed UAPKG organization namespace.`\n        : allowedOwners.length > 0\n          ? 'Choose one of the allowed UAPKG organization namespaces with `--owner`, or ask a UAPKG organization administrator to grant access.'\n          : 'Choose a UAPKG organization namespace where you can publish, or ask a UAPKG organization administrator to grant access.',\n    facts: compactFacts([\n      fact('requested-owner', owner),\n      ...allowedOwners.map((allowedOwner) => fact('allowed-owner', allowedOwner)),\n    ]),\n  };\n});\n\nconst publishingAuthorityDeniedSpec = defineSpec(emptyDetailsSchema, (_details, context) => {\n  switch (context.credentialKind) {\n    case 'oidc':\n      return {\n        message: 'This GitHub Actions workflow does not currently have publishing authority for the package.',\n        hint: 'Check the package’s trusted-publisher repository, workflow, and optional GitHub Environment setting, then run the workflow again.',\n        resources: ['trusted-publishers'],\n      };\n    case 'gat':\n      return {\n        message: 'This granular access token does not currently have publishing authority for the package.',\n        hint: 'Create or use a token for the package owner with the required package access and publishing permission.',\n        resources: ['access-tokens'],\n      };\n    case 'login':\n      return {\n        message: 'Your account does not currently have publishing authority for the package.',\n        hint: 'Choose an owner organization where you can publish, or ask an organization administrator to grant access.',\n      };\n  }\n});\n\nconst tokenResourceAccessSpec = defineSpec(tokenAccessDetailsSchema, (details) => {\n  const actualPackageMode = details.actualPackageAccessMode ?? details.packageAccess?.mode;\n  const actualRegistryMode = details.actualRegistryAccessMode ?? details.registryAccess?.mode;\n  const requiredPackageModes = details.requiredPackageAccessModes;\n  const requiredRegistryModes = details.requiredRegistryAccessModes;\n  return {\n    message: 'This token does not cover the package or registry selected for publication.',\n    hint: 'Create or use a token whose package and registry access cover this publication.',\n    facts: compactFacts([\n      fact('actual-access-mode', accessModeLabel(actualPackageMode, 'package')),\n      fact('actual-access-mode', accessModeLabel(actualRegistryMode, 'registry')),\n      fact('required-access-mode', accessModesLabel(requiredPackageModes, 'package')),\n      fact('required-access-mode', accessModesLabel(requiredRegistryModes, 'registry')),\n    ]),\n    resources: ['access-tokens'],\n  };\n});\n\nconst oidcRepositorySpec = defineSpec(oidcRepositoryDetailsSchema, (details, context) => {\n  const submitted = details.submittedRepository ?? safeRepository(context.repository);\n  const trusted = details.trustedRepository;\n  if (!trusted) {\n    return {\n      message: 'The registry could not determine the trusted repository for this workflow session.',\n      hint: 'Start a new trusted-publishing workflow and try again. If the failure continues, review the trusted-publisher rule and report the server code.',\n      facts: compactFacts([fact('requested-repository', submitted)]),\n      resources: ['trusted-publishers'],\n    };\n  }\n  return {\n    message: submitted\n      ? `This workflow submitted \"${submitted}\", but its trusted-publisher rule is bound to \"${trusted}\".`\n      : 'The registry could not compare the package source with this workflow’s trusted-publisher rule.',\n    hint: submitted\n      ? 'Publish from the repository named by the trusted-publisher rule, or update the rule for the intended package source.'\n      : 'Start a new trusted-publishing workflow and try again. If the failure continues, report the server code.',\n    facts: compactFacts([fact('requested-repository', submitted), fact('trusted-repository', trusted)]),\n    resources: ['trusted-publishers'],\n  };\n});\n\nconst versionConflictSpec = (kind: 'exists' | 'tombstoned') =>\n  defineSpec(versionDetailsSchema, (_details, context) => {\n    const coordinate = packageCoordinate(context);\n    return kind === 'exists'\n      ? {\n          message: `${coordinate} is already published in this registry.`,\n          hint: 'Choose a new version in uapkg.json, rebuild the archive, and publish that version instead.',\n          resources: ['requests'],\n        }\n      : {\n          message: `${coordinate} was previously unpublished and cannot be reused.`,\n          hint: 'Choose a new version in uapkg.json, rebuild the archive, and publish that version instead.',\n          resources: ['requests'],\n        };\n  });\n\nconst activeRequestSpec = (ownershipConflict: boolean) =>\n  defineSpec(activeRequestDetailsSchema, (details, context) => {\n    const coordinate = packageCoordinate(context);\n    const readableRequestId = ownershipConflict ? undefined : details.activeRequestId;\n    return {\n      message: ownershipConflict\n        ? `Another organization already has an active first-publication request for ${safePackageLabel(context.packageName)}.`\n        : `An active publishing request already covers ${coordinate}.`,\n      hint: ownershipConflict\n        ? 'Wait for that request to finish before trying to claim this package name, or review your own request when a request ID is shown.'\n        : 'Wait for the active request to finish instead of submitting the same publication again.',\n      facts: compactFacts([fact('request-id', readableRequestId)]),\n      resources: ['requests'],\n      requestId: readableRequestId,\n    };\n  });\n\nconst haltedPackageSpec = defineSpec(haltedPackageDetailsSchema, (details, context) => ({\n  message: `Publishing for ${safePackageLabel(context.packageName)} is paused because an earlier request could not be completed.`,\n  hint: 'Review the earlier request and ask the registry operator to resolve its failure before publishing again.',\n  facts: compactFacts([fact('request-id', details.blockingRequestId)]),\n  resources: ['requests'],\n  requestId: details.blockingRequestId,\n}));\n\nconst rateLimitSpec = defineSpec(retryDetailsSchema, (details) => ({\n  message: 'Too many publishing requests were submitted in a short time.',\n  hint: details.retryAfterSeconds\n    ? `Wait ${formatDuration(details.retryAfterSeconds)}, then try publishing again.`\n    : 'Wait a moment, then try publishing again.',\n  facts: compactFacts([\n    fact('retry-after', details.retryAfterSeconds ? formatDuration(details.retryAfterSeconds) : undefined),\n  ]),\n}));\n\n/**\n * Explicit inventory of errors that can be returned synchronously while the\n * CLI submits POST /v1/registry-requests/publish. Unknown future codes use the\n * non-leaking fallback in {@link publishRequestDiagnosticForError}.\n */\nexport const PUBLISH_SUBMISSION_ERROR_CATALOG = {\n  // Authentication and request-bound authorization.\n  AUTH_REQUIRED: loginSpec('Authentication is required to publish this package.'),\n  CONTROL_PLANE_AUTHENTICATION_REQUIRED: loginSpec('The saved registry login was rejected.'),\n  DPOP_AUTH_UNAVAILABLE: internalServiceSpec('The registry cannot validate CLI logins right now.'),\n  DPOP_AUTH_REQUIRED: loginSpec('The publishing request did not include a valid CLI login.'),\n  DPOP_PROOF_INVALID: loginSpec('The saved CLI login proof was rejected.'),\n  DPOP_PROOF_REPLAYED: fixedSpec(\n    'The security proof for this CLI login was already used.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  DPOP_ACCESS_TOKEN_INVALID: loginSpec('The saved CLI login is invalid or no longer usable.'),\n  DPOP_PROOF_STALE: fixedSpec(\n    'The security proof for this CLI login expired before the request arrived.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  DPOP_NONCE_REQUIRED: fixedSpec(\n    'The registry could not complete the security challenge for this CLI login.',\n    'Run the publish command again. If the failure continues, sign in to the selected registry again.',\n    ['login'],\n  ),\n  REGISTRY_GRANT_INVALID: loginSpec('The registry login was revoked, expired, or belongs to another registry.'),\n  CLI_LOGIN_ACTIVATION_EXPIRED: loginSpec('This CLI login expired before the device finished confirming it.'),\n  ACCOUNT_NOT_ACTIVE: loginSpec('The account for this registry login is not active.'),\n  CLI_ACCESS_TOKEN_INVALID: loginSpec('The saved CLI login is invalid.'),\n  CLI_ACCESS_TOKEN_EXPIRED: loginSpec('The saved CLI login has expired.'),\n  OAUTH_SCOPE_INSUFFICIENT: oauthScopeSpec,\n  OAUTH_SCOPE_UNSUPPORTED: fixedSpec(\n    'This CLI version does not understand a capability required by the registry.',\n    'Update UAPKG CLI, sign in again, and retry the publication.',\n    ['login'],\n  ),\n  TOKEN_INVALID: tokenSpec('The selected granular access token is invalid.'),\n  TOKEN_REVOKED: tokenSpec('The selected granular access token has been revoked.'),\n  TOKEN_EXPIRED: tokenSpec('The selected granular access token has expired.'),\n  UAPKG_TOKEN_APPROVAL_PENDING: fixedSpec(\n    'The selected token is still waiting for organization approval.',\n    'Ask an organization administrator to approve the token, or select a different active token.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_APPROVAL_DENIED: fixedSpec(\n    'The organization denied the selected token request.',\n    'Use an approved token, or request a new token from the organization.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_ORGANIZATION_POLICY_DENIED: fixedSpec(\n    'The organization’s token policy blocks this publication.',\n    'Ask an organization administrator to review the token policy, or publish with an allowed credential.',\n    ['access-tokens'],\n  ),\n  UAPKG_TOKEN_TEMPORARILY_BLOCKED_OWNER_MFA_REQUIRED: fixedSpec(\n    'This token is temporarily blocked because its owner must enable two-factor authentication.',\n    'Enable two-factor authentication for the token owner, then try again.',\n    ['access-tokens', 'security'],\n  ),\n  UAPKG_TOKEN_LIFECYCLE_DISABLED: tokenSpec('The selected token is not currently usable.'),\n  UAPKG_TOKEN_PERMISSION_DENIED: tokenPermissionSpec,\n  UAPKG_TOKEN_RESOURCE_ACCESS_DENIED: tokenResourceAccessSpec,\n  SECOND_FACTOR_REQUIRED: fixedSpec(\n    'A current two-factor authentication code is required for this publication.',\n    'Run the publish command again and enter the current code when prompted.',\n    ['security'],\n  ),\n  OTP_INVALID: fixedSpec(\n    'The two-factor authentication code was incorrect or expired.',\n    'Run the publish command again and enter a new code when prompted.',\n    ['security'],\n  ),\n  OTP_NOT_ENROLLED: fixedSpec(\n    'This account must enroll in two-factor authentication before publishing.',\n    'Enable two-factor authentication in account settings, then try publishing again.',\n    ['security'],\n  ),\n  OTP_RATE_LIMITED: rateLimitSpec,\n  OTP_ERROR: internalServiceSpec('The registry could not verify the two-factor authentication code.'),\n  OTP_UNSUPPORTED_PRINCIPAL: fixedSpec(\n    'This credential cannot use an interactive two-factor authentication code.',\n    'Select a CLI login or granular access token that supports attended publication.',\n  ),\n  SECURED_ACCOUNT_REQUIRED: fixedSpec(\n    'Publishing requires an active account with two-factor authentication enabled.',\n    'Activate the account and enable two-factor authentication, then try again.',\n    ['security'],\n  ),\n  ACTOR_WRITE_FORBIDDEN: fixedSpec(\n    'This account is not allowed to submit registry changes.',\n    'Use an account with publishing access, or ask an organization administrator for access.',\n  ),\n  UAPKG_PRINCIPAL_NOT_ALLOWED: fixedSpec(\n    'This kind of credential cannot submit a publishing request.',\n    'Use a CLI login, granular access token, or configured GitHub Actions trusted publisher.',\n  ),\n\n  // Ownership, package naming, and token access.\n  UNSCOPED_PACKAGE_OWNER_REQUIRED: unscopedOwnerSpec,\n  GAT_OWNER_ORGANIZATION_MISMATCH: gatOwnerMismatchSpec,\n  UAPKG_PACKAGE_SCOPE_OWNER_MISMATCH: scopeMismatchSpec,\n  UAPKG_REGISTRY_REQUIRES_SCOPED_PACKAGE: defineSpec(packageDetailsSchema, (_details, context) => ({\n    message: `This registry requires a scoped name for the first publication of ${safePackageLabel(context.packageName)}.`,\n    hint: 'Rename the package to `@organization/name`, rebuild the archive, and publish it again.',\n  })),\n  INITIAL_PUBLICATION_PACKAGE_ACCESS_ALL_REQUIRED: initialTokenAccessSpec,\n  PACKAGE_OWNER_NOT_AUTHORIZED: packageOwnerNotAuthorizedSpec,\n  INITIAL_PUBLICATION_CREDENTIAL_UNSUPPORTED: fixedSpec(\n    'This credential cannot create a package during its first publication.',\n    'Publish the package once with an interactive CLI login or an attended granular access token.',\n    ['login', 'access-tokens'],\n  ),\n  CLI_REGISTRY_GRANT_NOT_AUTHORIZED: fixedSpec(\n    'The saved CLI login cannot publish to this registry.',\n    'Reauthorize the login for the selected registry, then try again.',\n    ['login'],\n  ),\n  REGISTRY_WRITE_DENIED_REBAC: publishingAuthorityDeniedSpec,\n  GAT_CREDENTIAL_CONTEXT_REQUIRED: internalServiceSpec('The registry could not validate the selected token.'),\n  PACKAGE_OWNER_NOT_RESOLVED: internalServiceSpec('The registry could not determine this package’s owner.'),\n\n  // GitHub Actions trusted publishing.\n  OIDC_SESSION_INVALID: fixedSpec(\n    'The GitHub Actions publishing session expired or is no longer trusted.',\n    'Run the workflow again. If it still fails, verify that the package still has an active trusted-publisher rule for this repository and workflow.',\n    ['trusted-publishers'],\n  ),\n  OIDC_PROVIDER_UNAVAILABLE: fixedSpec(\n    'The registry cannot validate GitHub trusted publishing right now.',\n    'Run the workflow again later. If the failure continues, report the server code to the registry operator.',\n    ['trusted-publishers'],\n  ),\n  OIDC_INITIAL_PUBLICATION_NOT_SUPPORTED: fixedSpec(\n    'GitHub Actions cannot create this package during its first publication.',\n    'Publish the package once with an interactive CLI login, then configure its trusted-publisher rule and rerun the workflow.',\n    ['login', 'trusted-publishers'],\n  ),\n  OIDC_SOURCE_REPOSITORY_MISMATCH: oidcRepositorySpec,\n  TRUSTED_PUBLISHER_NOT_AUTHORIZED: fixedSpec(\n    'This GitHub Actions workflow is not authorized to publish the package.',\n    'Check the package’s trusted-publisher repository, workflow, and optional GitHub Environment setting, then rerun the workflow.',\n    ['trusted-publishers'],\n  ),\n\n  // Archive, source, claims, and request-contract validation.\n  INVALID_PACKAGE_NAME: fixedSpec(\n    'The packaged manifest contains an invalid package name.',\n    'Set `name` in uapkg.json to a name such as `my-package` or `@organization/my-package`, rebuild the archive, and publish it again.',\n  ),\n  SCOPED_PACKAGES_DISABLED: fixedSpec(\n    'The selected registry does not accept organization-scoped package names.',\n    'Select a registry that supports scoped packages, or intentionally rename and rebuild the package as an unscoped package with an explicit owner.',\n    ['registries', 'owner-command'],\n  ),\n  INVALID_VERSION: fixedSpec(\n    'The packaged manifest contains an invalid semantic version.',\n    'Set `version` in uapkg.json to a semantic version such as `1.2.3`, rebuild the archive, and publish it again.',\n  ),\n  INVALID_OWNER_ORGANIZATION_NAME: fixedSpec(\n    'The selected owner is not a valid organization name.',\n    'Correct `--owner <organization>` or `publish.owner` in uapkg.json, then try publishing again.',\n    ['owner-command'],\n  ),\n  SOURCE_REQUIRED: fixedSpec(\n    'The publishing request did not identify its GitHub Release source.',\n    'Set `publish.repository` or pass `--repository owner/repository`, and make sure the release tag and asset exist before retrying.',\n  ),\n  GITHUB_RELEASE_SOURCE_REQUIRED: fixedSpec(\n    'The publishing request did not identify its GitHub Release source.',\n    'Set `publish.repository` or pass `--repository owner/repository`, and make sure the release tag and asset exist before retrying.',\n  ),\n  SOURCE_TYPE_UNSUPPORTED: fixedSpec(\n    'The registry does not support this kind of package source.',\n    'Publish from an uploaded GitHub Release asset. If this CLI produced another source type, update it and try again.',\n  ),\n  GITHUB_REPOSITORY_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub repository coordinate.',\n    'Pass `--repository owner/repository` or correct `publish.repository` in uapkg.json, then try again.',\n  ),\n  RELEASE_TAG_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub Release tag.',\n    'Pass a non-empty GitHub Release tag with `--tag <tag>`, or correct the package version used by the default tag.',\n  ),\n  RELEASE_ASSET_NAME_INVALID: fixedSpec(\n    'The publishing request contains an invalid GitHub Release asset name.',\n    'Pass the uploaded file name—not a path—with `--asset <file-name>`, then try again.',\n  ),\n  OBSERVED_INTEGRITY_REQUIRED: fixedSpec(\n    'The publishing request is missing the archive’s integrity information.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  OBSERVED_DIGEST_INVALID: fixedSpec(\n    'The publishing request contains an invalid archive digest.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  OBSERVED_SIZE_INVALID: fixedSpec(\n    'The publishing request contains an invalid archive size.',\n    'Re-read or rebuild the archive and try again. If the problem remains, update UAPKG CLI and report the server code.',\n  ),\n  CLAIMS_REQUIRED: fixedSpec(\n    'The publishing request is missing package information from the packaged manifest.',\n    'Rebuild the archive so it contains a valid uapkg.json, then publish the rebuilt file.',\n  ),\n  CLAIMS_IDENTITY_MISMATCH: fixedSpec(\n    'The package name or version inside the archive does not match the publication being submitted.',\n    'Rebuild the archive from the intended uapkg.json and publish the rebuilt file.',\n  ),\n  CLAIMS_PRIVATE_INVALID: fixedSpec(\n    'The packaged manifest has an invalid private-package setting.',\n    'Set `private` in uapkg.json to `true` or `false`, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_BUCKET_INVALID: fixedSpec(\n    'The packaged manifest has an invalid dependency section.',\n    'Make each dependency section in uapkg.json an object, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCIES_TOO_MANY: fixedSpec(\n    'A dependency section in the packaged manifest is too large.',\n    'Reduce the dependency entries in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_NAME_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency name.',\n    'Correct the dependency name in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_RANGE_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency version range.',\n    'Set a non-empty bounded version range for the dependency, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_REGISTRY_INVALID: fixedSpec(\n    'The packaged manifest contains an invalid dependency registry.',\n    'Correct the dependency registry alias in uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  CLAIMS_DEPENDENCY_FIELDS_INVALID: fixedSpec(\n    'A packaged dependency contains unsupported fields.',\n    'Remove unsupported dependency fields from uapkg.json, rebuild the archive, and publish it again.',\n  ),\n  OFFICIAL_REGISTRY_PRIVATE_PACKAGE_FORBIDDEN: fixedSpec(\n    'This package is marked private, but the selected registry accepts only public packages.',\n    'Publish to a private registry, or intentionally remove the private setting, rebuild the archive, and try again.',\n    ['registries'],\n  ),\n  SERVER_RESOLVED_METADATA_NOT_ALLOWED: clientRequestSpec('The publishing request contains server-owned metadata.'),\n  UNRECOGNIZED_REQUEST_FIELDS: clientRequestSpec(\n    'The publishing request contains fields this registry does not recognize.',\n  ),\n  INVALID_REGISTRY_ID: clientRequestSpec('The CLI resolved an invalid registry identity.'),\n  PAYLOAD_TOO_LARGE: fixedSpec(\n    'The packaged publication information is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  REQUEST_BODY_TOO_LARGE: fixedSpec(\n    'The publishing request is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  UAPKG_OPERATION_INPUT_TOO_LARGE: fixedSpec(\n    'The publishing request is too large for this registry.',\n    'Reduce oversized manifest metadata or dependency entries, rebuild the archive, and try again.',\n  ),\n  INVALID_CONTENT_LENGTH: clientRequestSpec('The registry received an incomplete publishing request.'),\n  INVALID_JSON: clientRequestSpec('The registry could not read the publishing request.'),\n  INVALID_REQUEST_BODY: clientRequestSpec('The registry could not understand the publishing request.'),\n  UAPKG_OPERATION_INPUT_INVALID: clientRequestSpec('The registry could not understand the publishing request.'),\n  IDEMPOTENCY_KEY_REQUIRED: clientRequestSpec('The publishing request was missing its retry-safety key.'),\n  REQUEST_KIND_NOT_PUBLIC: internalServiceSpec('The CLI reached the wrong registry operation.'),\n  SOURCE_NOT_ALLOWED: internalServiceSpec('The CLI reached the wrong registry operation for an artifact publication.'),\n  REASON_REQUIRED: internalServiceSpec('The CLI reached an operation that requires a reason.'),\n  DEPRECATION_MESSAGE_REQUIRED: internalServiceSpec(\n    'The CLI reached an operation that requires a deprecation message.',\n  ),\n\n  // Registry readiness, versions, and concurrent requests.\n  REGISTRY_NOT_FOUND: fixedSpec(\n    'The selected registry is no longer available to the publishing service.',\n    'Refresh or reconfigure the registry, then try publishing again.',\n    ['registries'],\n  ),\n  REGISTRY_LINK_MISSING: fixedSpec(\n    'The selected registry is not connected to an initialized repository.',\n    'Finish the registry repository connection in account settings, then try publishing again.',\n    ['registries'],\n  ),\n  REGISTRY_LINK_NOT_READY: fixedSpec(\n    'The selected registry repository connection is incomplete.',\n    'Finish reconnecting the registry repository in account settings, then try publishing again.',\n    ['registries'],\n  ),\n  PACKAGE_POLICY_NOT_CONFIGURED: internalServiceSpec(\n    'The registry is not ready to assign ownership for a new package.',\n  ),\n  PACKAGE_NOT_FOUND: fixedSpec(\n    'The package does not exist in the selected registry.',\n    'Check the package and registry, then try again.',\n    ['registries'],\n  ),\n  PACKAGE_HALTED: haltedPackageSpec,\n  VERSION_ALREADY_EXISTS: versionConflictSpec('exists'),\n  VERSION_TOMBSTONED: versionConflictSpec('tombstoned'),\n  DUPLICATE_ACTIVE_REQUEST: activeRequestSpec(false),\n  PACKAGE_OWNERSHIP_PENDING_CONFLICT: activeRequestSpec(true),\n  IDEMPOTENCY_KEY_CONFLICT: fixedSpec(\n    'The retry-safety key for this publication is already attached to a different request.',\n    'Run the publication again. If the conflict continues, report the server code to the registry operator.',\n    ['requests'],\n  ),\n  RATE_LIMIT_EXCEEDED: rateLimitSpec,\n\n  // Defensive catalog entries for invalid route state and server failures.\n  REQUEST_ATTRIBUTION_INVALID: internalServiceSpec('The registry could not safely attribute this publishing request.'),\n  AUTHORIZATION_RECEIPT_REQUIRED: internalServiceSpec(\n    'The registry could not preserve authorization for this request.',\n  ),\n  REQUEST_CREATE_FAILED: internalServiceSpec('The registry could not save the publishing request.'),\n  OPERATION_AUTHORIZATION_ACTION_MISMATCH: internalServiceSpec('The publishing endpoint is misconfigured.'),\n  OPERATION_BODY_LIMIT_UNREGISTERED: internalServiceSpec('The publishing endpoint is missing its request-size policy.'),\n  UAPKG_OPERATION_BINDING_MISMATCH: internalServiceSpec('The publishing endpoint is bound incorrectly.'),\n  UAPKG_OPERATION_BINDER_MISMATCH: internalServiceSpec(\n    'The publishing endpoint uses the wrong authentication boundary.',\n  ),\n  UAPKG_OPERATION_BODY_LIMIT_UNREGISTERED: internalServiceSpec(\n    'The publishing endpoint is missing its request-size policy.',\n  ),\n  UAPKG_SERVICE_AUTHENTICATION_REQUIRED: internalServiceSpec(\n    'The publishing endpoint rejected an unsupported credential.',\n  ),\n  REGISTRY_REQUEST_RESPONSE_INVALID: internalServiceSpec('The registry returned an invalid publishing response.'),\n  CONTROL_PLANE_RESPONSE_NOT_JSON: internalServiceSpec('The registry returned an unreadable publishing response.'),\n\n  // These normally belong to lifecycle routes, but cataloging them keeps a\n  // misrouted publish response helpful and non-leaking.\n  DESTRUCTIVE_POLICY_NOT_CONFIGURED: internalServiceSpec('The registry’s version policy is not configured.'),\n  PACKAGE_VERSION_TARGET_NOT_FOUND: fixedSpec(\n    'The selected package version does not exist in the registry.',\n    'Check the package version and selected registry.',\n    ['requests'],\n  ),\n  VERSION_ALREADY_UNPUBLISHED: fixedSpec(\n    'This package version is already unpublished.',\n    'No further action is needed.',\n  ),\n  VERSION_ALREADY_YANKED: fixedSpec('This package version is already yanked.', 'No further action is needed.'),\n  VERSION_NOT_YANKED: fixedSpec(\n    'This package version is not yanked.',\n    'Check the current request state before trying again.',\n  ),\n  VERSION_ALREADY_DEPRECATED: fixedSpec('This package version is already deprecated.', 'No further action is needed.'),\n  VERSION_NOT_DEPRECATED: fixedSpec(\n    'This package version is not deprecated.',\n    'Check the current request state before trying again.',\n  ),\n  UNPUBLISH_WINDOW_EXPIRED: fixedSpec(\n    'The allowed time window for unpublishing this version has closed.',\n    'Contact the registry operator if the version presents a security or legal issue.',\n  ),\n} as const satisfies Record<string, PublishErrorSpec>;\n\nexport type PublishSubmissionErrorCode = keyof typeof PUBLISH_SUBMISSION_ERROR_CATALOG;\n\nexport function publishRequestDiagnosticForError(\n  error: unknown,\n  context: PublishRequestErrorContext,\n): PublishRequestFailedDiagnostic {\n  const serverCode = validatedServerCode(error);\n  const status = validatedStatus(error);\n  const spec = serverCode\n    ? (PUBLISH_SUBMISSION_ERROR_CATALOG as Record<string, PublishErrorSpec>)[serverCode]\n    : undefined;\n  const guidance = spec\n    ? spec.build(error instanceof ControlPlaneError ? error.details : undefined, context)\n    : fallback(error, status);\n  const facts = dedupeFacts([...baseFacts(context), ...(guidance.facts ?? [])]);\n  const resources = resourcesFor(guidance.resources ?? [], context, guidance.requestId);\n\n  return createPublishRequestFailedDiagnostic(\n    guidance.message,\n    {\n      ...(serverCode ? { serverCode } : {}),\n      ...(status !== undefined ? { status } : {}),\n      facts,\n      resources,\n    },\n    guidance.hint,\n  );\n}\n\nfunction fallback(error: unknown, status: number | undefined): PublishGuidance {\n  if (isNetworkFailure(error)) {\n    return {\n      message: 'UAPKG could not reach the publishing service.',\n      hint: 'Check the network connection and registry availability, then try publishing again.',\n    };\n  }\n  if (status !== undefined && status >= 500) {\n    return {\n      message: 'The publishing service could not complete the request.',\n      hint: RETRY_AND_REPORT,\n    };\n  }\n  return {\n    message: 'The registry did not accept the publishing request.',\n    hint: 'Review the publication details and try again. If the failure continues, report this diagnostic to the registry operator.',\n  };\n}\n\nfunction baseFacts(context: PublishRequestErrorContext): PublishDiagnosticFact[] {\n  const registryName = safeDisplayValue(context.registryName ?? '', 100);\n  const registryAlias = safeDisplayValue(context.registryAlias, 100);\n  const registry =\n    registryName && registryAlias && registryName !== registryAlias\n      ? `${registryName} (${registryAlias})`\n      : (registryName ?? registryAlias);\n  return compactFacts([\n    fact('package', safeDisplayValue(context.packageName, 214)),\n    fact('version', safeDisplayValue(context.packageVersion, 256)),\n    fact('registry', registry),\n    fact('credential-kind', credentialKindLabel(context.credentialKind)),\n    fact('requested-owner', safeOwner(context.requestedOwner)),\n    fact('repository', safeRepository(context.repository)),\n  ]);\n}\n\nfunction resourcesFor(\n  requested: readonly ResourceKind[],\n  context: PublishRequestErrorContext,\n  requestId?: string,\n): PublishDiagnosticResource[] {\n  const kinds = [...new Set([...requested, 'help' as const])];\n  const accountOrigin = accountOriginForIssuer(context.registryIssuer);\n  const resources: PublishDiagnosticResource[] = [];\n  for (const kind of kinds) {\n    switch (kind) {\n      case 'help':\n        resources.push({ kind: 'command', command: 'uapkg publish --help', label: 'Publish command help' });\n        break;\n      case 'login':\n        resources.push({\n          kind: 'command',\n          command: `uapkg login --registry ${shellDisplayArgument(context.registryAlias)} --reauthorize`,\n          label: 'Reauthorize this registry login',\n        });\n        break;\n      case 'owner-command':\n        resources.push({\n          kind: 'command',\n          command: 'uapkg publish --owner <organization>',\n          label: 'Publish with an explicit owner',\n        });\n        break;\n      case 'requests':\n        if (requestId) {\n          resources.push({\n            kind: 'command',\n            command: `uapkg requests status ${requestId}`,\n            label: 'Inspect the related request',\n          });\n        }\n        addAccountUrl(resources, accountOrigin, '/requests', 'Publishing requests');\n        break;\n      case 'access-tokens':\n        addAccountUrl(resources, accountOrigin, '/settings/access-tokens', 'Access token settings');\n        break;\n      case 'trusted-publishers':\n        addAccountUrl(resources, accountOrigin, '/trusted-publishers', 'Trusted publishers');\n        break;\n      case 'registries':\n        addAccountUrl(resources, accountOrigin, '/settings/registries', 'Registry settings');\n        break;\n      case 'security':\n        addAccountUrl(\n          resources,\n          accountOrigin,\n          '/settings/two-factor-authentication',\n          'Two-factor authentication settings',\n        );\n        break;\n    }\n  }\n  return dedupeResources(resources);\n}\n\nfunction addAccountUrl(\n  resources: PublishDiagnosticResource[],\n  origin: string | undefined,\n  path: string,\n  label: string,\n): void {\n  if (!origin) return;\n  resources.push({ kind: 'url', url: new URL(path, origin).href, label });\n}\n\nfunction accountOriginForIssuer(issuer: string): string | undefined {\n  try {\n    const url = new URL(issuer);\n    return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction validatedServerCode(error: unknown): string | undefined {\n  return error instanceof ControlPlaneError && SERVER_CODE_PATTERN.test(error.code) ? error.code : undefined;\n}\n\nfunction validatedStatus(error: unknown): number | undefined {\n  if (!(error instanceof ControlPlaneError) || error.status === undefined) return undefined;\n  return Number.isInteger(error.status) && error.status >= 100 && error.status <= 599 ? error.status : undefined;\n}\n\nfunction isNetworkFailure(error: unknown): boolean {\n  return (\n    error instanceof TypeError ||\n    (error instanceof Error && (error.name === 'AbortError' || error.name === 'TimeoutError'))\n  );\n}\n\nfunction safeDisplayValue(value: unknown, maximumLength: number): string | undefined {\n  if (typeof value !== 'string') return undefined;\n  const normalized = value.trim();\n  return normalized.length > 0 && normalized.length <= maximumLength && !hasUnsafeDisplayCharacter(normalized)\n    ? normalized\n    : undefined;\n}\n\nfunction hasUnsafeDisplayCharacter(value: string): boolean {\n  for (const character of value) {\n    const codePoint = character.codePointAt(0);\n    if (\n      codePoint !== undefined &&\n      (codePoint <= 0x1f ||\n        (codePoint >= 0x7f && codePoint <= 0x9f) ||\n        codePoint === 0x061c ||\n        codePoint === 0x200e ||\n        codePoint === 0x200f ||\n        (codePoint >= 0x2028 && codePoint <= 0x202e) ||\n        (codePoint >= 0x2066 && codePoint <= 0x2069))\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction safeOwner(value: unknown): string | undefined {\n  const parsed = ownerNameSchema.safeParse(value);\n  return parsed.success ? parsed.data : undefined;\n}\n\nfunction safeRepository(value: unknown): string | undefined {\n  const parsed = repositorySchema.safeParse(value);\n  return parsed.success ? parsed.data : undefined;\n}\n\nfunction safePackageLabel(packageName: string): string {\n  const safe = safeDisplayValue(packageName, 214);\n  return safe ? `\"${safe}\"` : 'this package';\n}\n\nfunction packageCoordinate(context: PublishRequestErrorContext): string {\n  const packageName = safeDisplayValue(context.packageName, 214);\n  const version = safeDisplayValue(context.packageVersion, 256);\n  return packageName && version ? `\"${packageName}@${version}\"` : 'This package version';\n}\n\nfunction scopedOwner(packageName: string): string | undefined {\n  const match = safeDisplayValue(packageName, 214)?.match(/^@([^/]+)\\//u);\n  return safeOwner(match?.[1]);\n}\n\nfunction credentialKindLabel(kind: PublishRequestErrorContext['credentialKind']): string {\n  switch (kind) {\n    case 'login':\n      return 'CLI login';\n    case 'gat':\n      return 'Granular access token';\n    case 'oidc':\n      return 'GitHub Actions trusted publishing';\n  }\n}\n\nfunction capabilityLabel(capability: z.output<typeof missingCapabilitiesSchema>[number]): string {\n  return capability === 'package.publish' ? 'Publish packages' : 'Submit publishing requests';\n}\n\nfunction oauthScopeLabel(scope: z.output<typeof missingOAuthScopesSchema>[number]): string {\n  return scope === 'publishing.request.create' ? 'Submit publishing requests' : 'Read your publishing requests';\n}\n\nfunction accessModeLabel(\n  mode: z.output<typeof accessModeSchema> | undefined,\n  category: 'package' | 'registry',\n): string | undefined {\n  if (!mode) return undefined;\n  const noun = category === 'package' ? 'packages' : 'registries';\n  switch (mode) {\n    case 'none':\n      return `No ${noun}`;\n    case 'selected':\n      return `Selected ${noun}`;\n    case 'all':\n      return `All ${noun}`;\n  }\n}\n\nfunction accessModesLabel(\n  modes: readonly ('selected' | 'all')[] | undefined,\n  category: 'package' | 'registry',\n): string | undefined {\n  if (!modes || modes.length === 0) return undefined;\n  const labels = [...new Set(modes)].map((mode) => accessModeLabel(mode, category)).filter(Boolean);\n  return labels.join(' or ');\n}\n\nfunction formatDuration(seconds: number): string {\n  if (seconds === 1) return '1 second';\n  if (seconds < 60) return `${seconds} seconds`;\n  if (seconds % 60 === 0) {\n    const minutes = seconds / 60;\n    return `${minutes} ${minutes === 1 ? 'minute' : 'minutes'}`;\n  }\n  return `${seconds} seconds`;\n}\n\nfunction quotedList(values: readonly string[]): string {\n  const quoted = values.map((value) => `\"${value}\"`);\n  if (quoted.length === 1) return quoted[0] as string;\n  if (quoted.length === 2) return `${quoted[0]} or ${quoted[1]}`;\n  return `${quoted.slice(0, -1).join(', ')}, or ${quoted.at(-1)}`;\n}\n\nfunction fact(kind: PublishDiagnosticFact['kind'], value: string | undefined): PublishDiagnosticFact | undefined {\n  return value ? { kind, value } : undefined;\n}\n\nfunction compactFacts(facts: readonly (PublishDiagnosticFact | undefined)[]): PublishDiagnosticFact[] {\n  return facts.filter((value): value is PublishDiagnosticFact => value !== undefined);\n}\n\nfunction dedupeFacts(facts: readonly PublishDiagnosticFact[]): PublishDiagnosticFact[] {\n  const seen = new Set<string>();\n  return facts.filter((factValue) => {\n    const key = `${factValue.kind}\\0${factValue.value}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction dedupeResources(resources: readonly PublishDiagnosticResource[]): PublishDiagnosticResource[] {\n  const seen = new Set<string>();\n  return resources.filter((resource) => {\n    const key = resource.kind === 'command' ? `command\\0${resource.command}` : `url\\0${resource.url}`;\n    if (seen.has(key)) return false;\n    seen.add(key);\n    return true;\n  });\n}\n\nfunction shellDisplayArgument(value: string): string {\n  const safe = safeDisplayValue(value, 100);\n  return safe && /^[A-Za-z0-9._-]+$/u.test(safe) ? safe : '<registry>';\n}\n"],"mappings":";;;;;AASA,MAAM,sBAAsB;AAE5B,MAAM,eAAe,kBACnB,EACG,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,CAAC,CAAC,CACN,IAAI,aAAa,CAAC,CAClB,QAAQ,UAAU,CAAC,0BAA0B,KAAK,CAAC;AACxD,MAAM,oBAAoB,YAAY,GAAG;AACzC,MAAM,uBAAuB,YAAY,GAAG;AAC5C,MAAM,kBAAkB,YAAY,GAAG,CAAC,CAAC,MAAM,8BAA8B;AAC7E,MAAM,mBAAmB,YAAY,GAAG,CAAC,CAAC,MAAM,qCAAqC;AACrF,MAAM,kBAAkB,YAAY,GAAG,CAAC,CAAC,MAAM,gCAAgC;AAC/E,MAAM,mBAAmB,EAAE,KAAK;CAAC;CAAQ;CAAY;AAAK,CAAC;AAC3D,MAAM,4BAA4B,EAC/B,MAAM,EAAE,KAAK,CAAC,mBAAmB,2BAA2B,CAAC,CAAC,CAAC,CAC/D,IAAI,EAAE,CAAC,CACP,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC;AAC7C,MAAM,2BAA2B,EAC9B,MAAM,EAAE,KAAK,CAAC,6BAA6B,8BAA8B,CAAC,CAAC,CAAC,CAC5E,IAAI,CAAC,CAAC,CACN,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC;AAC7C,MAAM,mBAAmB,EACtB,MAAM,eAAe,CAAC,CACtB,IAAI,EAAE,CAAC,CACP,WAAW,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAEpD,MAAM,qBAAqB,EAAE,OAAO,CAAC,CAAC;AACtC,MAAM,uBAAuB,EAAE,OAAO,EAAE,aAAa,kBAAkB,SAAS,EAAE,CAAC;AACnF,MAAM,6BAA6B;AACnC,MAAM,8BAA8B,qBAAqB,OAAO;CAC9D,gCAAgC,gBAAgB,SAAS;CACzD,uBAAuB,gBAAgB,SAAS;CAChD,+BAA+B,iBAAiB,SAAS;AAC3D,CAAC;AACD,MAAM,gCAAgC,qBAAqB,OAAO;CAChE,gCAAgC,gBAAgB,SAAS;CACzD,6BAA6B,iBAAiB,SAAS;AACzD,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO;CAC7D,qBAAqB,gBAAgB,SAAS;CAC9C,YAAY,gBAAgB,SAAS;CACrC,oBAAoB,iBAAiB,SAAS;CAC9C,6BAA6B,iBAAiB,SAAS;AACzD,CAAC;AACD,MAAM,2BAA2B,qBAAqB,OAAO;CAC3D,yBAAyB,iBAAiB,SAAS;CACnD,2BAA2B,EAAE,QAAQ,KAAK,CAAC,CAAC,SAAS;CACrD,qBAAqB,0BAA0B,SAAS;CACxD,eAAe,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,SAAS;CAC7D,0BAA0B,iBAAiB,SAAS;CACpD,6BAA6B,EAC1B,MAAM,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAClC,IAAI,CAAC,CAAC,CACN,SAAS;CACZ,4BAA4B,EACzB,MAAM,EAAE,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAClC,IAAI,CAAC,CAAC,CACN,SAAS;CACZ,gBAAgB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC,CAAC,CAAC,SAAS;AAChE,CAAC;AACD,MAAM,+BAA+B,EAAE,OAAO,EAC5C,qBAAqB,0BAA0B,SAAS,EAC1D,CAAC;AACD,MAAM,0BAA0B,EAAE,OAAO,EACvC,eAAe,yBAAyB,SAAS,EACnD,CAAC;AACD,MAAM,8BAA8B,qBAAqB,OAAO;CAC9D,qBAAqB,iBAAiB,SAAS;CAC/C,mBAAmB,iBAAiB,SAAS;AAC/C,CAAC;AACD,MAAM,uBAAuB,EAAE,OAAO;CACpC,aAAa,kBAAkB,SAAS;CACxC,gBAAgB,qBAAqB,SAAS;AAChD,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO,EAC7D,iBAAiB,gBAAgB,SAAS,EAC5C,CAAC;AACD,MAAM,6BAA6B,qBAAqB,OAAO,EAC7D,mBAAmB,gBAAgB,SAAS,EAC9C,CAAC;AACD,MAAM,qBAAqB,EAAE,OAAO,EAClC,mBAAmB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAM,CAAC,CAAC,SAAS,EAClE,CAAC;AAmCD,SAAS,WACP,QACA,OACkB;CAClB,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;CAC7B,OAAO,EACL,MAAM,SAAS,SAAS;EACtB,MAAM,SAAS,OAAO,UAAU,WAAW,CAAC,CAAC;EAC7C,OAAO,MAAM,OAAO,UAAU,OAAO,OAAO,OAAO,OAAO;CAC5D,EACF;AACF;AAEA,SAAS,UAAU,SAAiB,MAAc,YAAqC,CAAC,GAAqB;CAC3G,OAAO,WAAW,2BAA2B;EAAE;EAAS;EAAM;CAAU,EAAE;AAC5E;AAEA,MAAM,0BACJ;AACF,MAAM,mBACJ;AACF,MAAM,cAAc;AACpB,MAAM,cACJ;AAEF,MAAM,qBAAqB,YAAoB,UAAU,SAAS,uBAAuB;AACzF,MAAM,uBAAuB,YAAoB,UAAU,SAAS,gBAAgB;AACpF,MAAM,aAAa,YAAoB,UAAU,SAAS,aAAa,CAAC,OAAO,CAAC;AAChF,MAAM,aAAa,YAAoB,UAAU,SAAS,aAAa,CAAC,eAAe,CAAC;AAExF,MAAM,oBAAoB,WAAW,6BAA6B,UAAU,YAAY;CACtF,MAAM,cAAc,iBAAiB,QAAQ,aAAa,GAAG;CAC7D,OAAO;EACL,SAAS,cACL,IAAI,YAAY,gFAChB;EACJ,MAAM;EACN,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,uBAAuB,WAAW,gCAAgC,SAAS,YAAY;CAC3F,MAAM,iBAAiB,QAAQ,kCAAkC,UAAU,QAAQ,cAAc;CACjG,MAAM,cAAc,QAAQ,+BAA+B,CAAC;CAC5D,MAAM,mBAAmB,YAAY,SAAS,IAAI,WAAW,WAAW,IAAI;CAC5E,MAAM,uBAAuB,iBAAiB,IAAI,eAAe,KAAK;CACtE,MAAM,SAAS,YAAY,QAAQ,WAAW;CAC9C,OAAO;EACL,SAAS,sCAAsC,iBAAiB,qCAAqC,qBAAqB;EAC1H,MAAM,SACF,4BAA4B,OAAO,+EACnC;EACJ,OAAO,aAAa,CAClB,KAAK,mBAAmB,cAAc,GACtC,GAAG,YAAY,KAAK,UAAU,KAAK,eAAe,KAAK,CAAC,CAC1D,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,oBAAoB,WAAW,6BAA6B,SAAS,YAAY;CACrF,MAAM,iBAAiB,QAAQ,uBAAuB,QAAQ,cAAc,YAAY,QAAQ,WAAW;CAC3G,MAAM,gBAAgB,QAAQ,sBAAsB,QAAQ,+BAA+B,CAAC;CAM5F,OAAO;EACL,SAAS,GANkB,iBAAiB,KAAK,eAAe,KAAK,oBAMpC,kBAJjC,cAAc,SAAS,IACnB,WAAW,cAAc,KAAK,UAAU,IAAI,OAAO,CAAC,IACpD,uCAEkE;EACtE,MAAM;EACN,OAAO,aAAa,CAClB,KAAK,mBAAmB,cAAc,GACtC,GAAG,cAAc,KAAK,UAAU,KAAK,iBAAiB,KAAK,CAAC,CAC9D,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,yBAAyB,WAAW,2BAA2B,YAAY;CAC/E,MAAM,aAAa,QAAQ,2BAA2B,QAAQ,eAAe;CAC7E,MAAM,eAAe,QAAQ,6BAA6B;CAC1D,MAAM,UAAU,QAAQ,wBAAwB,eAAe,SAAY,CAAC,iBAAiB,IAAI,CAAC;CAClG,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa;GAClB,KAAK,sBAAsB,gBAAgB,YAAY,SAAS,CAAC;GACjE,KAAK,wBAAwB,gBAAgB,cAAc,SAAS,CAAC;GACrE,GAAG,QAAQ,KAAK,eAAe,KAAK,sBAAsB,gBAAgB,UAAU,CAAC,CAAC;EACxF,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,sBAAsB,WAAW,+BAA+B,aAAa;CACjF,SAAS;CACT,MAAM;CACN,QAAQ,QAAQ,uBAAuB,CAAC,iBAAiB,EAAC,CAAE,KAAK,gBAAgB;EAC/E,MAAM;EACN,OAAO,gBAAgB,UAAU;CACnC,EAAE;CACF,WAAW,CAAC,eAAe;AAC7B,EAAE;AAEF,MAAM,iBAAiB,WAAW,0BAA0B,aAAa;CACvE,SAAS;CACT,MAAM;CACN,QAAQ,QAAQ,iBAAiB,CAAC,2BAA2B,EAAC,CAAE,KAAK,WAAW;EAC9E,MAAM;EACN,OAAO,gBAAgB,KAAK;CAC9B,EAAE;CACF,WAAW,CAAC,OAAO;AACrB,EAAE;AAEF,MAAM,gCAAgC,WAAW,8BAA8B,SAAS,YAAY;CAClG,MAAM,QACJ,QAAQ,kCAAkC,QAAQ,yBAAyB,UAAU,QAAQ,cAAc;CAC7G,MAAM,gBAAgB,QAAQ,iCAAiC,CAAC;CAChE,MAAM,SAAS,YAAY,QAAQ,WAAW;CAC9C,MAAM,aAAa,cAAc,WAAW,KAAK,CAAC,SAAS,cAAc,KAAK;CAC9E,OAAO;EACL,SAAS,QACL,8EAA8E,MAAM,MACpF;EACJ,MAAM,SACF,cAAc,SAAS,IACrB,mIACA,iLACF,aACE,wBAAwB,WAAW,uDACnC,cAAc,SAAS,IACrB,uIACA;EACR,OAAO,aAAa,CAClB,KAAK,mBAAmB,KAAK,GAC7B,GAAG,cAAc,KAAK,iBAAiB,KAAK,iBAAiB,YAAY,CAAC,CAC5E,CAAC;CACH;AACF,CAAC;AAED,MAAM,gCAAgC,WAAW,qBAAqB,UAAU,YAAY;CAC1F,QAAQ,QAAQ,gBAAhB;EACE,KAAK,QACH,OAAO;GACL,SAAS;GACT,MAAM;GACN,WAAW,CAAC,oBAAoB;EAClC;EACF,KAAK,OACH,OAAO;GACL,SAAS;GACT,MAAM;GACN,WAAW,CAAC,eAAe;EAC7B;EACF,KAAK,SACH,OAAO;GACL,SAAS;GACT,MAAM;EACR;CACJ;AACF,CAAC;AAED,MAAM,0BAA0B,WAAW,2BAA2B,YAAY;CAChF,MAAM,oBAAoB,QAAQ,2BAA2B,QAAQ,eAAe;CACpF,MAAM,qBAAqB,QAAQ,4BAA4B,QAAQ,gBAAgB;CACvF,MAAM,uBAAuB,QAAQ;CACrC,MAAM,wBAAwB,QAAQ;CACtC,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa;GAClB,KAAK,sBAAsB,gBAAgB,mBAAmB,SAAS,CAAC;GACxE,KAAK,sBAAsB,gBAAgB,oBAAoB,UAAU,CAAC;GAC1E,KAAK,wBAAwB,iBAAiB,sBAAsB,SAAS,CAAC;GAC9E,KAAK,wBAAwB,iBAAiB,uBAAuB,UAAU,CAAC;EAClF,CAAC;EACD,WAAW,CAAC,eAAe;CAC7B;AACF,CAAC;AAED,MAAM,qBAAqB,WAAW,8BAA8B,SAAS,YAAY;CACvF,MAAM,YAAY,QAAQ,uBAAuB,eAAe,QAAQ,UAAU;CAClF,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,SACH,OAAO;EACL,SAAS;EACT,MAAM;EACN,OAAO,aAAa,CAAC,KAAK,wBAAwB,SAAS,CAAC,CAAC;EAC7D,WAAW,CAAC,oBAAoB;CAClC;CAEF,OAAO;EACL,SAAS,YACL,4BAA4B,UAAU,iDAAiD,QAAQ,MAC/F;EACJ,MAAM,YACF,yHACA;EACJ,OAAO,aAAa,CAAC,KAAK,wBAAwB,SAAS,GAAG,KAAK,sBAAsB,OAAO,CAAC,CAAC;EAClG,WAAW,CAAC,oBAAoB;CAClC;AACF,CAAC;AAED,MAAM,uBAAuB,SAC3B,WAAW,uBAAuB,UAAU,YAAY;CACtD,MAAM,aAAa,kBAAkB,OAAO;CAC5C,OAAO,SAAS,WACZ;EACE,SAAS,GAAG,WAAW;EACvB,MAAM;EACN,WAAW,CAAC,UAAU;CACxB,IACA;EACE,SAAS,GAAG,WAAW;EACvB,MAAM;EACN,WAAW,CAAC,UAAU;CACxB;AACN,CAAC;AAEH,MAAM,qBAAqB,sBACzB,WAAW,6BAA6B,SAAS,YAAY;CAC3D,MAAM,aAAa,kBAAkB,OAAO;CAC5C,MAAM,oBAAoB,oBAAoB,SAAY,QAAQ;CAClE,OAAO;EACL,SAAS,oBACL,4EAA4E,iBAAiB,QAAQ,WAAW,EAAE,KAClH,+CAA+C,WAAW;EAC9D,MAAM,oBACF,qIACA;EACJ,OAAO,aAAa,CAAC,KAAK,cAAc,iBAAiB,CAAC,CAAC;EAC3D,WAAW,CAAC,UAAU;EACtB,WAAW;CACb;AACF,CAAC;AAEH,MAAM,oBAAoB,WAAW,6BAA6B,SAAS,aAAa;CACtF,SAAS,kBAAkB,iBAAiB,QAAQ,WAAW,EAAE;CACjE,MAAM;CACN,OAAO,aAAa,CAAC,KAAK,cAAc,QAAQ,iBAAiB,CAAC,CAAC;CACnE,WAAW,CAAC,UAAU;CACtB,WAAW,QAAQ;AACrB,EAAE;AAEF,MAAM,gBAAgB,WAAW,qBAAqB,aAAa;CACjE,SAAS;CACT,MAAM,QAAQ,oBACV,QAAQ,eAAe,QAAQ,iBAAiB,EAAE,gCAClD;CACJ,OAAO,aAAa,CAClB,KAAK,eAAe,QAAQ,oBAAoB,eAAe,QAAQ,iBAAiB,IAAI,MAAS,CACvG,CAAC;AACH,EAAE;;;;;;AAOF,MAAa,mCAAmC;CAE9C,eAAe,UAAU,qDAAqD;CAC9E,uCAAuC,UAAU,wCAAwC;CACzF,uBAAuB,oBAAoB,oDAAoD;CAC/F,oBAAoB,UAAU,2DAA2D;CACzF,oBAAoB,UAAU,yCAAyC;CACvE,qBAAqB,UACnB,2DACA,oGACA,CAAC,OAAO,CACV;CACA,2BAA2B,UAAU,qDAAqD;CAC1F,kBAAkB,UAChB,6EACA,oGACA,CAAC,OAAO,CACV;CACA,qBAAqB,UACnB,8EACA,oGACA,CAAC,OAAO,CACV;CACA,wBAAwB,UAAU,0EAA0E;CAC5G,8BAA8B,UAAU,kEAAkE;CAC1G,oBAAoB,UAAU,oDAAoD;CAClF,0BAA0B,UAAU,iCAAiC;CACrE,0BAA0B,UAAU,kCAAkC;CACtE,0BAA0B;CAC1B,yBAAyB,UACvB,+EACA,+DACA,CAAC,OAAO,CACV;CACA,eAAe,UAAU,gDAAgD;CACzE,eAAe,UAAU,sDAAsD;CAC/E,eAAe,UAAU,iDAAiD;CAC1E,8BAA8B,UAC5B,kEACA,+FACA,CAAC,eAAe,CAClB;CACA,6BAA6B,UAC3B,uDACA,wEACA,CAAC,eAAe,CAClB;CACA,wCAAwC,UACtC,4DACA,wGACA,CAAC,eAAe,CAClB;CACA,oDAAoD,UAClD,8FACA,yEACA,CAAC,iBAAiB,UAAU,CAC9B;CACA,gCAAgC,UAAU,6CAA6C;CACvF,+BAA+B;CAC/B,oCAAoC;CACpC,wBAAwB,UACtB,8EACA,2EACA,CAAC,UAAU,CACb;CACA,aAAa,UACX,gEACA,qEACA,CAAC,UAAU,CACb;CACA,kBAAkB,UAChB,4EACA,oFACA,CAAC,UAAU,CACb;CACA,kBAAkB;CAClB,WAAW,oBAAoB,mEAAmE;CAClG,2BAA2B,UACzB,6EACA,iFACF;CACA,0BAA0B,UACxB,iFACA,8EACA,CAAC,UAAU,CACb;CACA,uBAAuB,UACrB,2DACA,yFACF;CACA,6BAA6B,UAC3B,+DACA,yFACF;CAGA,iCAAiC;CACjC,iCAAiC;CACjC,oCAAoC;CACpC,wCAAwC,WAAW,uBAAuB,UAAU,aAAa;EAC/F,SAAS,qEAAqE,iBAAiB,QAAQ,WAAW,EAAE;EACpH,MAAM;CACR,EAAE;CACF,iDAAiD;CACjD,8BAA8B;CAC9B,4CAA4C,UAC1C,yEACA,gGACA,CAAC,SAAS,eAAe,CAC3B;CACA,mCAAmC,UACjC,wDACA,oEACA,CAAC,OAAO,CACV;CACA,6BAA6B;CAC7B,iCAAiC,oBAAoB,qDAAqD;CAC1G,4BAA4B,oBAAoB,wDAAwD;CAGxG,sBAAsB,UACpB,0EACA,mJACA,CAAC,oBAAoB,CACvB;CACA,2BAA2B,UACzB,qEACA,4GACA,CAAC,oBAAoB,CACvB;CACA,wCAAwC,UACtC,2EACA,6HACA,CAAC,SAAS,oBAAoB,CAChC;CACA,iCAAiC;CACjC,kCAAkC,UAChC,0EACA,iIACA,CAAC,oBAAoB,CACvB;CAGA,sBAAsB,UACpB,2DACA,mIACF;CACA,0BAA0B,UACxB,4EACA,mJACA,CAAC,cAAc,eAAe,CAChC;CACA,iBAAiB,UACf,+DACA,+GACF;CACA,iCAAiC,UAC/B,wDACA,iGACA,CAAC,eAAe,CAClB;CACA,iBAAiB,UACf,sEACA,kIACF;CACA,gCAAgC,UAC9B,sEACA,kIACF;CACA,yBAAyB,UACvB,8DACA,mHACF;CACA,2BAA2B,UACzB,4EACA,qGACF;CACA,qBAAqB,UACnB,kEACA,iHACF;CACA,4BAA4B,UAC1B,yEACA,oFACF;CACA,6BAA6B,UAC3B,0EACA,oHACF;CACA,yBAAyB,UACvB,8DACA,oHACF;CACA,uBAAuB,UACrB,4DACA,oHACF;CACA,iBAAiB,UACf,qFACA,uFACF;CACA,0BAA0B,UACxB,kGACA,gFACF;CACA,wBAAwB,UACtB,iEACA,8FACF;CACA,uBAAuB,UACrB,4DACA,kGACF;CACA,8BAA8B,UAC5B,+DACA,yFACF;CACA,gCAAgC,UAC9B,8DACA,uFACF;CACA,iCAAiC,UAC/B,uEACA,sGACF;CACA,oCAAoC,UAClC,kEACA,iGACF;CACA,kCAAkC,UAChC,sDACA,kGACF;CACA,6CAA6C,UAC3C,2FACA,mHACA,CAAC,YAAY,CACf;CACA,sCAAsC,kBAAkB,wDAAwD;CAChH,6BAA6B,kBAC3B,0EACF;CACA,qBAAqB,kBAAkB,gDAAgD;CACvF,mBAAmB,UACjB,wEACA,+FACF;CACA,wBAAwB,UACtB,0DACA,+FACF;CACA,iCAAiC,UAC/B,0DACA,+FACF;CACA,wBAAwB,kBAAkB,yDAAyD;CACnG,cAAc,kBAAkB,qDAAqD;CACrF,sBAAsB,kBAAkB,2DAA2D;CACnG,+BAA+B,kBAAkB,2DAA2D;CAC5G,0BAA0B,kBAAkB,0DAA0D;CACtG,yBAAyB,oBAAoB,+CAA+C;CAC5F,oBAAoB,oBAAoB,2EAA2E;CACnH,iBAAiB,oBAAoB,sDAAsD;CAC3F,8BAA8B,oBAC5B,mEACF;CAGA,oBAAoB,UAClB,2EACA,mEACA,CAAC,YAAY,CACf;CACA,uBAAuB,UACrB,wEACA,6FACA,CAAC,YAAY,CACf;CACA,yBAAyB,UACvB,8DACA,+FACA,CAAC,YAAY,CACf;CACA,+BAA+B,oBAC7B,kEACF;CACA,mBAAmB,UACjB,wDACA,mDACA,CAAC,YAAY,CACf;CACA,gBAAgB;CAChB,wBAAwB,oBAAoB,QAAQ;CACpD,oBAAoB,oBAAoB,YAAY;CACpD,0BAA0B,kBAAkB,KAAK;CACjD,oCAAoC,kBAAkB,IAAI;CAC1D,0BAA0B,UACxB,yFACA,0GACA,CAAC,UAAU,CACb;CACA,qBAAqB;CAGrB,6BAA6B,oBAAoB,kEAAkE;CACnH,gCAAgC,oBAC9B,iEACF;CACA,uBAAuB,oBAAoB,qDAAqD;CAChG,yCAAyC,oBAAoB,2CAA2C;CACxG,mCAAmC,oBAAoB,6DAA6D;CACpH,kCAAkC,oBAAoB,+CAA+C;CACrG,iCAAiC,oBAC/B,iEACF;CACA,yCAAyC,oBACvC,6DACF;CACA,uCAAuC,oBACrC,6DACF;CACA,mCAAmC,oBAAoB,uDAAuD;CAC9G,iCAAiC,oBAAoB,0DAA0D;CAI/G,mCAAmC,oBAAoB,kDAAkD;CACzG,kCAAkC,UAChC,gEACA,oDACA,CAAC,UAAU,CACb;CACA,6BAA6B,UAC3B,gDACA,8BACF;CACA,wBAAwB,UAAU,2CAA2C,8BAA8B;CAC3G,oBAAoB,UAClB,uCACA,sDACF;CACA,4BAA4B,UAAU,+CAA+C,8BAA8B;CACnH,wBAAwB,UACtB,2CACA,sDACF;CACA,0BAA0B,UACxB,qEACA,kFACF;AACF;AAIA,SAAgB,iCACd,OACA,SACgC;CAChC,MAAM,aAAa,oBAAoB,KAAK;CAC5C,MAAM,SAAS,gBAAgB,KAAK;CACpC,MAAM,OAAO,aACR,iCAAsE,cACvE;CACJ,MAAM,WAAW,OACb,KAAK,MAAM,iBAAiB,oBAAoB,MAAM,UAAU,QAAW,OAAO,IAClF,SAAS,OAAO,MAAM;CAC1B,MAAM,QAAQ,YAAY,CAAC,GAAG,UAAU,OAAO,GAAG,GAAI,SAAS,SAAS,CAAC,CAAE,CAAC;CAC5E,MAAM,YAAY,aAAa,SAAS,aAAa,CAAC,GAAG,SAAS,SAAS,SAAS;CAEpF,OAAO,qCACL,SAAS,SACT;EACE,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EACzC;EACA;CACF,GACA,SAAS,IACX;AACF;AAEA,SAAS,SAAS,OAAgB,QAA6C;CAC7E,IAAI,iBAAiB,KAAK,GACxB,OAAO;EACL,SAAS;EACT,MAAM;CACR;CAEF,IAAI,WAAW,UAAa,UAAU,KACpC,OAAO;EACL,SAAS;EACT,MAAM;CACR;CAEF,OAAO;EACL,SAAS;EACT,MAAM;CACR;AACF;AAEA,SAAS,UAAU,SAA8D;CAC/E,MAAM,eAAe,iBAAiB,QAAQ,gBAAgB,IAAI,GAAG;CACrE,MAAM,gBAAgB,iBAAiB,QAAQ,eAAe,GAAG;CACjE,MAAM,WACJ,gBAAgB,iBAAiB,iBAAiB,gBAC9C,GAAG,aAAa,IAAI,cAAc,KACjC,gBAAgB;CACvB,OAAO,aAAa;EAClB,KAAK,WAAW,iBAAiB,QAAQ,aAAa,GAAG,CAAC;EAC1D,KAAK,WAAW,iBAAiB,QAAQ,gBAAgB,GAAG,CAAC;EAC7D,KAAK,YAAY,QAAQ;EACzB,KAAK,mBAAmB,oBAAoB,QAAQ,cAAc,CAAC;EACnE,KAAK,mBAAmB,UAAU,QAAQ,cAAc,CAAC;EACzD,KAAK,cAAc,eAAe,QAAQ,UAAU,CAAC;CACvD,CAAC;AACH;AAEA,SAAS,aACP,WACA,SACA,WAC6B;CAC7B,MAAM,QAAQ,CAAC,mBAAG,IAAI,IAAI,CAAC,GAAG,WAAW,MAAe,CAAC,CAAC;CAC1D,MAAM,gBAAgB,uBAAuB,QAAQ,cAAc;CACnE,MAAM,YAAyC,CAAC;CAChD,KAAK,MAAM,QAAQ,OACjB,QAAQ,MAAR;EACE,KAAK;GACH,UAAU,KAAK;IAAE,MAAM;IAAW,SAAS;IAAwB,OAAO;GAAuB,CAAC;GAClG;EACF,KAAK;GACH,UAAU,KAAK;IACb,MAAM;IACN,SAAS,0BAA0B,qBAAqB,QAAQ,aAAa,EAAE;IAC/E,OAAO;GACT,CAAC;GACD;EACF,KAAK;GACH,UAAU,KAAK;IACb,MAAM;IACN,SAAS;IACT,OAAO;GACT,CAAC;GACD;EACF,KAAK;GACH,IAAI,WACF,UAAU,KAAK;IACb,MAAM;IACN,SAAS,yBAAyB;IAClC,OAAO;GACT,CAAC;GAEH,cAAc,WAAW,eAAe,aAAa,qBAAqB;GAC1E;EACF,KAAK;GACH,cAAc,WAAW,eAAe,2BAA2B,uBAAuB;GAC1F;EACF,KAAK;GACH,cAAc,WAAW,eAAe,uBAAuB,oBAAoB;GACnF;EACF,KAAK;GACH,cAAc,WAAW,eAAe,wBAAwB,mBAAmB;GACnF;EACF,KAAK,YACH,cACE,WACA,eACA,uCACA,oCACF;CAEJ;CAEF,OAAO,gBAAgB,SAAS;AAClC;AAEA,SAAS,cACP,WACA,QACA,MACA,OACM;CACN,IAAI,CAAC,QAAQ;CACb,UAAU,KAAK;EAAE,MAAM;EAAO,KAAK,IAAI,IAAI,MAAM,MAAM,CAAC,CAAC;EAAM;CAAM,CAAC;AACxE;AAEA,SAAS,uBAAuB,QAAoC;CAClE,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,MAAM;EAC1B,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,UAAU,IAAI,SAAS;CAC9E,QAAQ;EACN;CACF;AACF;AAEA,SAAS,oBAAoB,OAAoC;CAC/D,OAAO,iBAAiB,qBAAqB,oBAAoB,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO;AACnG;AAEA,SAAS,gBAAgB,OAAoC;CAC3D,IAAI,EAAE,iBAAiB,sBAAsB,MAAM,WAAW,QAAW,OAAO;CAChF,OAAO,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS;AACvG;AAEA,SAAS,iBAAiB,OAAyB;CACjD,OACE,iBAAiB,aAChB,iBAAiB,UAAU,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE9E;AAEA,SAAS,iBAAiB,OAAgB,eAA2C;CACnF,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,KAAK,WAAW,UAAU,iBAAiB,CAAC,0BAA0B,UAAU,IACvG,aACA;AACN;AAEA,SAAS,0BAA0B,OAAwB;CACzD,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,YAAY,UAAU,YAAY,CAAC;EACzC,IACE,cAAc,WACb,aAAa,MACX,aAAa,OAAQ,aAAa,OACnC,cAAc,QACd,cAAc,QACd,cAAc,QACb,aAAa,QAAU,aAAa,QACpC,aAAa,QAAU,aAAa,OAEvC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,UAAU,OAAoC;CACrD,MAAM,SAAS,gBAAgB,UAAU,KAAK;CAC9C,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,eAAe,OAAoC;CAC1D,MAAM,SAAS,iBAAiB,UAAU,KAAK;CAC/C,OAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,iBAAiB,aAA6B;CACrD,MAAM,OAAO,iBAAiB,aAAa,GAAG;CAC9C,OAAO,OAAO,IAAI,KAAK,KAAK;AAC9B;AAEA,SAAS,kBAAkB,SAA6C;CACtE,MAAM,cAAc,iBAAiB,QAAQ,aAAa,GAAG;CAC7D,MAAM,UAAU,iBAAiB,QAAQ,gBAAgB,GAAG;CAC5D,OAAO,eAAe,UAAU,IAAI,YAAY,GAAG,QAAQ,KAAK;AAClE;AAEA,SAAS,YAAY,aAAyC;CAC5D,MAAM,QAAQ,iBAAiB,aAAa,GAAG,CAAC,EAAE,MAAM,cAAc;CACtE,OAAO,UAAU,QAAQ,EAAE;AAC7B;AAEA,SAAS,oBAAoB,MAA4D;CACvF,QAAQ,MAAR;EACE,KAAK,SACH,OAAO;EACT,KAAK,OACH,OAAO;EACT,KAAK,QACH,OAAO;CACX;AACF;AAEA,SAAS,gBAAgB,YAAwE;CAC/F,OAAO,eAAe,oBAAoB,qBAAqB;AACjE;AAEA,SAAS,gBAAgB,OAAkE;CACzF,OAAO,UAAU,8BAA8B,+BAA+B;AAChF;AAEA,SAAS,gBACP,MACA,UACoB;CACpB,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,OAAO,aAAa,YAAY,aAAa;CACnD,QAAQ,MAAR;EACE,KAAK,QACH,OAAO,MAAM;EACf,KAAK,YACH,OAAO,YAAY;EACrB,KAAK,OACH,OAAO,OAAO;CAClB;AACF;AAEA,SAAS,iBACP,OACA,UACoB;CACpB,IAAI,CAAC,SAAS,MAAM,WAAW,GAAG,OAAO;CAEzC,OADe,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,gBAAgB,MAAM,QAAQ,CAAC,CAAC,CAAC,OAAO,OAC7E,CAAC,CAAC,KAAK,MAAM;AAC3B;AAEA,SAAS,eAAe,SAAyB;CAC/C,IAAI,YAAY,GAAG,OAAO;CAC1B,IAAI,UAAU,IAAI,OAAO,GAAG,QAAQ;CACpC,IAAI,UAAU,OAAO,GAAG;EACtB,MAAM,UAAU,UAAU;EAC1B,OAAO,GAAG,QAAQ,GAAG,YAAY,IAAI,WAAW;CAClD;CACA,OAAO,GAAG,QAAQ;AACpB;AAEA,SAAS,WAAW,QAAmC;CACrD,MAAM,SAAS,OAAO,KAAK,UAAU,IAAI,MAAM,EAAE;CACjD,IAAI,OAAO,WAAW,GAAG,OAAO,OAAO;CACvC,IAAI,OAAO,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,OAAO;CAC1D,OAAO,GAAG,OAAO,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,OAAO,GAAG,EAAE;AAC9D;AAEA,SAAS,KAAK,MAAqC,OAA8D;CAC/G,OAAO,QAAQ;EAAE;EAAM;CAAM,IAAI;AACnC;AAEA,SAAS,aAAa,OAAgF;CACpG,OAAO,MAAM,QAAQ,UAA0C,UAAU,MAAS;AACpF;AAEA,SAAS,YAAY,OAAkE;CACrF,MAAM,uBAAO,IAAI,IAAY;CAC7B,OAAO,MAAM,QAAQ,cAAc;EACjC,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,UAAU;EAC5C,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,KAAK,IAAI,GAAG;EACZ,OAAO;CACT,CAAC;AACH;AAEA,SAAS,gBAAgB,WAA8E;CACrG,MAAM,uBAAO,IAAI,IAAY;CAC7B,OAAO,UAAU,QAAQ,aAAa;EACpC,MAAM,MAAM,SAAS,SAAS,YAAY,YAAY,SAAS,YAAY,QAAQ,SAAS;EAC5F,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAC1B,KAAK,IAAI,GAAG;EACZ,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAuB;CACnD,MAAM,OAAO,iBAAiB,OAAO,GAAG;CACxC,OAAO,QAAQ,qBAAqB,KAAK,IAAI,IAAI,OAAO;AAC1D"}

package/dist/control-plane/RegistryGrantLock.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RegistryGrantLock.d.ts","names":[],"sources":["../../src/control-plane/RegistryGrantLock.ts"],"mappings":";UAiBiB;EACf,SAAS,GAAG,gBAAgB,oBAAoB,iBAAiB,QAAQ,KAAK,QAAQ;;UAGvE;WACN;WACA;WACA;WACA;WACA;WACA,SAAS,yBAAyB;WAClC,kBAAkB;;;;;;;cAQhB,iCAAiC;mBAUzB;mBATF;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,YACmB,mBACjB,UAAS;EAcJ,QAAQ,gBAAgB;EAOlB,SAAS,GAAG,gBAAgB,oBAAoB,iBAAiB,QAAQ,KAAK,QAAQ;UAmCrF;UAoBA;UA2CA;UAOA"}

package/dist/control-plane/RegistryGrantLock.js

@@ -1,163 +0,0 @@
-import { join } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-import { mkdir, open, readFile, rename, stat, unlink, utimes } from "node:fs/promises";
-
-//#region src/control-plane/RegistryGrantLock.ts
-const LOCK_FILE_VERSION = 1;
-const DEFAULT_WAIT_TIMEOUT_MS = 3e4;
-const DEFAULT_STALE_AFTER_MS = 12e4;
-const DEFAULT_POLL_INTERVAL_MS = 50;
-const DEFAULT_HEARTBEAT_INTERVAL_MS = 5e3;
-/**
-* Cross-process serialization for a registry grant's rotating refresh-token
-* family. Lock file names contain only a SHA-256 digest of the issuer and
-* registry ID; lock contents contain only an opaque owner ID, PID, and time.
-*/
-var FileRegistryGrantLock = class {
-	directory;
-	waitTimeoutMs;
-	staleAfterMs;
-	pollIntervalMs;
-	heartbeatIntervalMs;
-	now;
-	sleep;
-	isProcessAlive;
-	constructor(directory, options = {}) {
-		this.directory = directory;
-		this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);
-		this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);
-		this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);
-		this.heartbeatIntervalMs = positiveMilliseconds(options.heartbeatIntervalMs, Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))));
-		this.now = options.now ?? Date.now;
-		this.sleep = options.sleep ?? delay;
-		this.isProcessAlive = options.isProcessAlive ?? processIsAlive;
-	}
-	pathFor(issuer, registryId) {
-		const digest = createHash("sha256").update(`${issuer.replace(/\/+$/, "")}\0${registryId.toLowerCase()}`).digest("hex");
-		return join(this.directory, `${digest}.lock`);
-	}
-	async withLock(issuer, registryId, operation) {
-		await mkdir(this.directory, {
-			recursive: true,
-			mode: 448
-		});
-		const lockPath = this.pathFor(issuer, registryId);
-		const owner = {
-			version: LOCK_FILE_VERSION,
-			ownerId: randomUUID(),
-			pid: process.pid,
-			acquiredAt: this.now()
-		};
-		const deadline = this.now() + this.waitTimeoutMs;
-		while (!await this.tryAcquire(lockPath, owner)) {
-			if (await this.reclaimIfStale(lockPath)) continue;
-			const remaining = deadline - this.now();
-			if (remaining <= 0) throw new Error("Timed out waiting for another UAPKG process to finish using the saved login for this registry.");
-			await this.sleep(Math.min(this.pollIntervalMs, remaining));
-		}
-		const heartbeat = setInterval(() => {
-			this.touchIfOwned(lockPath, owner.ownerId);
-		}, this.heartbeatIntervalMs);
-		heartbeat.unref?.();
-		try {
-			return await operation();
-		} finally {
-			clearInterval(heartbeat);
-			await this.releaseIfOwned(lockPath, owner.ownerId);
-		}
-	}
-	async tryAcquire(lockPath, owner) {
-		let handle;
-		try {
-			handle = await open(lockPath, "wx", 384);
-		} catch (error) {
-			if (errorCode(error) === "EEXIST") return false;
-			throw new Error("Unable to create the UAPKG registry-grant lock.", { cause: error });
-		}
-		try {
-			await handle.writeFile(JSON.stringify(owner), { encoding: "utf8" });
-			return true;
-		} catch (error) {
-			await unlink(lockPath).catch(() => void 0);
-			throw new Error("Unable to initialize the UAPKG registry-grant lock.", { cause: error });
-		} finally {
-			await handle.close();
-		}
-	}
-	async reclaimIfStale(lockPath) {
-		let lockStat;
-		try {
-			lockStat = await stat(lockPath);
-		} catch (error) {
-			if (errorCode(error) === "ENOENT") return true;
-			throw new Error("Unable to inspect the UAPKG registry-grant lock.", { cause: error });
-		}
-		const observedOwner = await readOwner(lockPath);
-		if (observedOwner) {
-			if (this.isProcessAlive(observedOwner.pid)) return false;
-		} else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) return false;
-		const quarantinePath = `${lockPath}.stale-${randomUUID()}`;
-		try {
-			await rename(lockPath, quarantinePath);
-		} catch (error) {
-			if (errorCode(error) === "ENOENT") return true;
-			throw new Error("Unable to quarantine a stale UAPKG registry-grant lock.", { cause: error });
-		}
-		const movedOwner = await readOwner(quarantinePath);
-		if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {
-			await rename(quarantinePath, lockPath).catch(() => void 0);
-			return false;
-		}
-		await unlink(quarantinePath).catch((error) => {
-			throw new Error("Unable to remove a stale UAPKG registry-grant lock.", { cause: error });
-		});
-		return true;
-	}
-	async touchIfOwned(lockPath, ownerId) {
-		if ((await readOwner(lockPath))?.ownerId !== ownerId) return;
-		const now = new Date(this.now());
-		await utimes(lockPath, now, now).catch(() => void 0);
-	}
-	async releaseIfOwned(lockPath, ownerId) {
-		const owner = await readOwner(lockPath);
-		if (!owner) return;
-		if (owner.ownerId !== ownerId) throw new Error("The UAPKG registry-grant lock changed ownership before it could be released.");
-		try {
-			await unlink(lockPath);
-		} catch (error) {
-			if (errorCode(error) === "ENOENT") return;
-			throw new Error("Unable to release the UAPKG registry-grant lock.", { cause: error });
-		}
-	}
-};
-async function readOwner(lockPath) {
-	try {
-		const value = JSON.parse(await readFile(lockPath, "utf8"));
-		if (typeof value !== "object" || value === null || value.version !== LOCK_FILE_VERSION || typeof value.ownerId !== "string" || !Number.isInteger(value.pid) || typeof value.acquiredAt !== "number") return;
-		return value;
-	} catch {
-		return;
-	}
-}
-function processIsAlive(pid) {
-	if (pid === process.pid) return true;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return errorCode(error) !== "ESRCH";
-	}
-}
-function positiveMilliseconds(value, fallback) {
-	return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
-}
-function errorCode(error) {
-	return typeof error === "object" && error !== null && "code" in error ? String(error.code) : void 0;
-}
-function delay(milliseconds) {
-	return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-
-//#endregion
-export { FileRegistryGrantLock };
-//# sourceMappingURL=RegistryGrantLock.js.map

package/dist/control-plane/RegistryGrantLock.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RegistryGrantLock.js","names":[],"sources":["../../src/control-plane/RegistryGrantLock.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\nimport { mkdir, open, readFile, rename, stat, unlink, utimes } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nconst LOCK_FILE_VERSION = 1;\nconst DEFAULT_WAIT_TIMEOUT_MS = 30_000;\nconst DEFAULT_STALE_AFTER_MS = 120_000;\nconst DEFAULT_POLL_INTERVAL_MS = 50;\nconst DEFAULT_HEARTBEAT_INTERVAL_MS = 5_000;\n\ninterface LockOwner {\n  readonly version: typeof LOCK_FILE_VERSION;\n  readonly ownerId: string;\n  readonly pid: number;\n  readonly acquiredAt: number;\n}\n\nexport interface RegistryGrantLock {\n  withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T>;\n}\n\nexport interface FileRegistryGrantLockOptions {\n  readonly waitTimeoutMs?: number;\n  readonly staleAfterMs?: number;\n  readonly pollIntervalMs?: number;\n  readonly heartbeatIntervalMs?: number;\n  readonly now?: () => number;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly isProcessAlive?: (pid: number) => boolean;\n}\n\n/**\n * Cross-process serialization for a registry grant's rotating refresh-token\n * family. Lock file names contain only a SHA-256 digest of the issuer and\n * registry ID; lock contents contain only an opaque owner ID, PID, and time.\n */\nexport class FileRegistryGrantLock implements RegistryGrantLock {\n  private readonly waitTimeoutMs: number;\n  private readonly staleAfterMs: number;\n  private readonly pollIntervalMs: number;\n  private readonly heartbeatIntervalMs: number;\n  private readonly now: () => number;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly isProcessAlive: (pid: number) => boolean;\n\n  public constructor(\n    private readonly directory: string,\n    options: FileRegistryGrantLockOptions = {},\n  ) {\n    this.waitTimeoutMs = positiveMilliseconds(options.waitTimeoutMs, DEFAULT_WAIT_TIMEOUT_MS);\n    this.staleAfterMs = positiveMilliseconds(options.staleAfterMs, DEFAULT_STALE_AFTER_MS);\n    this.pollIntervalMs = positiveMilliseconds(options.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS);\n    this.heartbeatIntervalMs = positiveMilliseconds(\n      options.heartbeatIntervalMs,\n      Math.min(DEFAULT_HEARTBEAT_INTERVAL_MS, Math.max(1, Math.floor(this.staleAfterMs / 3))),\n    );\n    this.now = options.now ?? Date.now;\n    this.sleep = options.sleep ?? delay;\n    this.isProcessAlive = options.isProcessAlive ?? processIsAlive;\n  }\n\n  public pathFor(issuer: string, registryId: string): string {\n    const digest = createHash('sha256')\n      .update(`${issuer.replace(/\\/+$/, '')}\\0${registryId.toLowerCase()}`)\n      .digest('hex');\n    return join(this.directory, `${digest}.lock`);\n  }\n\n  public async withLock<T>(issuer: string, registryId: string, operation: () => Promise<T>): Promise<T> {\n    await mkdir(this.directory, { recursive: true, mode: 0o700 });\n    const lockPath = this.pathFor(issuer, registryId);\n    const owner: LockOwner = {\n      version: LOCK_FILE_VERSION,\n      ownerId: randomUUID(),\n      pid: process.pid,\n      acquiredAt: this.now(),\n    };\n    const deadline = this.now() + this.waitTimeoutMs;\n\n    while (!(await this.tryAcquire(lockPath, owner))) {\n      if (await this.reclaimIfStale(lockPath)) continue;\n      const remaining = deadline - this.now();\n      if (remaining <= 0) {\n        throw new Error(\n          'Timed out waiting for another UAPKG process to finish using the saved login for this registry.',\n        );\n      }\n      await this.sleep(Math.min(this.pollIntervalMs, remaining));\n    }\n\n    const heartbeat = setInterval(() => {\n      void this.touchIfOwned(lockPath, owner.ownerId);\n    }, this.heartbeatIntervalMs);\n    heartbeat.unref?.();\n\n    try {\n      return await operation();\n    } finally {\n      clearInterval(heartbeat);\n      await this.releaseIfOwned(lockPath, owner.ownerId);\n    }\n  }\n\n  private async tryAcquire(lockPath: string, owner: LockOwner): Promise<boolean> {\n    let handle: Awaited<ReturnType<typeof open>>;\n    try {\n      handle = await open(lockPath, 'wx', 0o600);\n    } catch (error) {\n      if (errorCode(error) === 'EEXIST') return false;\n      throw new Error('Unable to create the UAPKG registry-grant lock.', { cause: error });\n    }\n\n    try {\n      await handle.writeFile(JSON.stringify(owner), { encoding: 'utf8' });\n      return true;\n    } catch (error) {\n      await unlink(lockPath).catch(() => undefined);\n      throw new Error('Unable to initialize the UAPKG registry-grant lock.', { cause: error });\n    } finally {\n      await handle.close();\n    }\n  }\n\n  private async reclaimIfStale(lockPath: string): Promise<boolean> {\n    let lockStat: Awaited<ReturnType<typeof stat>>;\n    try {\n      lockStat = await stat(lockPath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return true;\n      throw new Error('Unable to inspect the UAPKG registry-grant lock.', { cause: error });\n    }\n\n    const observedOwner = await readOwner(lockPath);\n    if (observedOwner) {\n      // A valid owner record with a definitely dead PID is safe to reclaim\n      // immediately. Waiting for the general stale threshold would make a\n      // refresh retry miss the authorization server's bounded predecessor\n      // grace after a process dies between rotation and local persistence.\n      if (this.isProcessAlive(observedOwner.pid)) return false;\n    } else if (this.now() - lockStat.mtimeMs <= this.staleAfterMs) {\n      // A just-created lock can briefly be empty while its owner record is\n      // written. Malformed or unreadable ownership therefore remains subject\n      // to the conservative stale threshold.\n      return false;\n    }\n\n    const quarantinePath = `${lockPath}.stale-${randomUUID()}`;\n    try {\n      await rename(lockPath, quarantinePath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return true;\n      throw new Error('Unable to quarantine a stale UAPKG registry-grant lock.', { cause: error });\n    }\n\n    const movedOwner = await readOwner(quarantinePath);\n    if (observedOwner && movedOwner?.ownerId !== observedOwner.ownerId) {\n      await rename(quarantinePath, lockPath).catch(() => undefined);\n      return false;\n    }\n\n    await unlink(quarantinePath).catch((error: unknown) => {\n      throw new Error('Unable to remove a stale UAPKG registry-grant lock.', { cause: error });\n    });\n    return true;\n  }\n\n  private async touchIfOwned(lockPath: string, ownerId: string): Promise<void> {\n    const owner = await readOwner(lockPath);\n    if (owner?.ownerId !== ownerId) return;\n    const now = new Date(this.now());\n    await utimes(lockPath, now, now).catch(() => undefined);\n  }\n\n  private async releaseIfOwned(lockPath: string, ownerId: string): Promise<void> {\n    const owner = await readOwner(lockPath);\n    if (!owner) return;\n    if (owner.ownerId !== ownerId) {\n      throw new Error('The UAPKG registry-grant lock changed ownership before it could be released.');\n    }\n    try {\n      await unlink(lockPath);\n    } catch (error) {\n      if (errorCode(error) === 'ENOENT') return;\n      throw new Error('Unable to release the UAPKG registry-grant lock.', { cause: error });\n    }\n  }\n}\n\nasync function readOwner(lockPath: string): Promise<LockOwner | undefined> {\n  try {\n    const value = JSON.parse(await readFile(lockPath, 'utf8')) as unknown;\n    if (\n      typeof value !== 'object' ||\n      value === null ||\n      (value as Partial<LockOwner>).version !== LOCK_FILE_VERSION ||\n      typeof (value as Partial<LockOwner>).ownerId !== 'string' ||\n      !Number.isInteger((value as Partial<LockOwner>).pid) ||\n      typeof (value as Partial<LockOwner>).acquiredAt !== 'number'\n    ) {\n      return undefined;\n    }\n    return value as LockOwner;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction processIsAlive(pid: number): boolean {\n  if (pid === process.pid) return true;\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (error) {\n    return errorCode(error) !== 'ESRCH';\n  }\n}\n\nfunction positiveMilliseconds(value: number | undefined, fallback: number): number {\n  return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;\n}\n\nfunction errorCode(error: unknown): string | undefined {\n  return typeof error === 'object' && error !== null && 'code' in error\n    ? String((error as { readonly code?: unknown }).code)\n    : undefined;\n}\n\nfunction delay(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n"],"mappings":";;;;;AAIA,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B;AAChC,MAAM,yBAAyB;AAC/B,MAAM,2BAA2B;AACjC,MAAM,gCAAgC;;;;;;AA4BtC,IAAa,wBAAb,MAAgE;CAU3C;CATnB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,AAAO,YACL,AAAiB,WACjB,UAAwC,CAAC,GACzC;EAFiB;EAGjB,KAAK,gBAAgB,qBAAqB,QAAQ,eAAe,uBAAuB;EACxF,KAAK,eAAe,qBAAqB,QAAQ,cAAc,sBAAsB;EACrF,KAAK,iBAAiB,qBAAqB,QAAQ,gBAAgB,wBAAwB;EAC3F,KAAK,sBAAsB,qBACzB,QAAQ,qBACR,KAAK,IAAI,+BAA+B,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,CACxF;EACA,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,iBAAiB,QAAQ,kBAAkB;CAClD;CAEA,AAAO,QAAQ,QAAgB,YAA4B;EACzD,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,GAAG,OAAO,QAAQ,QAAQ,EAAE,EAAE,IAAI,WAAW,YAAY,GAAG,CAAC,CACpE,OAAO,KAAK;EACf,OAAO,KAAK,KAAK,WAAW,GAAG,OAAO,MAAM;CAC9C;CAEA,MAAa,SAAY,QAAgB,YAAoB,WAAyC;EACpG,MAAM,MAAM,KAAK,WAAW;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC5D,MAAM,WAAW,KAAK,QAAQ,QAAQ,UAAU;EAChD,MAAM,QAAmB;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,KAAK,QAAQ;GACb,YAAY,KAAK,IAAI;EACvB;EACA,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK;EAEnC,OAAO,CAAE,MAAM,KAAK,WAAW,UAAU,KAAK,GAAI;GAChD,IAAI,MAAM,KAAK,eAAe,QAAQ,GAAG;GACzC,MAAM,YAAY,WAAW,KAAK,IAAI;GACtC,IAAI,aAAa,GACf,MAAM,IAAI,MACR,gGACF;GAEF,MAAM,KAAK,MAAM,KAAK,IAAI,KAAK,gBAAgB,SAAS,CAAC;EAC3D;EAEA,MAAM,YAAY,kBAAkB;GAClC,AAAK,KAAK,aAAa,UAAU,MAAM,OAAO;EAChD,GAAG,KAAK,mBAAmB;EAC3B,UAAU,QAAQ;EAElB,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,UAAU;GACR,cAAc,SAAS;GACvB,MAAM,KAAK,eAAe,UAAU,MAAM,OAAO;EACnD;CACF;CAEA,MAAc,WAAW,UAAkB,OAAoC;EAC7E,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,KAAK,UAAU,MAAM,GAAK;EAC3C,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,mDAAmD,EAAE,OAAO,MAAM,CAAC;EACrF;EAEA,IAAI;GACF,MAAM,OAAO,UAAU,KAAK,UAAU,KAAK,GAAG,EAAE,UAAU,OAAO,CAAC;GAClE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,OAAO,QAAQ,CAAC,CAAC,YAAY,MAAS;GAC5C,MAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;EACzF,UAAU;GACR,MAAM,OAAO,MAAM;EACrB;CACF;CAEA,MAAc,eAAe,UAAoC;EAC/D,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ;EAChC,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,MAAM,CAAC;EACtF;EAEA,MAAM,gBAAgB,MAAM,UAAU,QAAQ;EAC9C,IAAI,eAKF;OAAI,KAAK,eAAe,cAAc,GAAG,GAAG,OAAO;EAAK,OACnD,IAAI,KAAK,IAAI,IAAI,SAAS,WAAW,KAAK,cAI/C,OAAO;EAGT,MAAM,iBAAiB,GAAG,SAAS,SAAS,WAAW;EACvD,IAAI;GACF,MAAM,OAAO,UAAU,cAAc;EACvC,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU,OAAO;GAC1C,MAAM,IAAI,MAAM,2DAA2D,EAAE,OAAO,MAAM,CAAC;EAC7F;EAEA,MAAM,aAAa,MAAM,UAAU,cAAc;EACjD,IAAI,iBAAiB,YAAY,YAAY,cAAc,SAAS;GAClE,MAAM,OAAO,gBAAgB,QAAQ,CAAC,CAAC,YAAY,MAAS;GAC5D,OAAO;EACT;EAEA,MAAM,OAAO,cAAc,CAAC,CAAC,OAAO,UAAmB;GACrD,MAAM,IAAI,MAAM,uDAAuD,EAAE,OAAO,MAAM,CAAC;EACzF,CAAC;EACD,OAAO;CACT;CAEA,MAAc,aAAa,UAAkB,SAAgC;EAE3E,KAAI,MADgB,UAAU,QAAQ,EAC7B,EAAE,YAAY,SAAS;EAChC,MAAM,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;EAC/B,MAAM,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,YAAY,MAAS;CACxD;CAEA,MAAc,eAAe,UAAkB,SAAgC;EAC7E,MAAM,QAAQ,MAAM,UAAU,QAAQ;EACtC,IAAI,CAAC,OAAO;EACZ,IAAI,MAAM,YAAY,SACpB,MAAM,IAAI,MAAM,8EAA8E;EAEhG,IAAI;GACF,MAAM,OAAO,QAAQ;EACvB,SAAS,OAAO;GACd,IAAI,UAAU,KAAK,MAAM,UAAU;GACnC,MAAM,IAAI,MAAM,oDAAoD,EAAE,OAAO,MAAM,CAAC;EACtF;CACF;AACF;AAEA,eAAe,UAAU,UAAkD;CACzE,IAAI;EACF,MAAM,QAAQ,KAAK,MAAM,MAAM,SAAS,UAAU,MAAM,CAAC;EACzD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,YAAY,qBAC1C,OAAQ,MAA6B,YAAY,YACjD,CAAC,OAAO,UAAW,MAA6B,GAAG,KACnD,OAAQ,MAA6B,eAAe,UAEpD;EAEF,OAAO;CACT,QAAQ;EACN;CACF;AACF;AAEA,SAAS,eAAe,KAAsB;CAC5C,IAAI,QAAQ,QAAQ,KAAK,OAAO;CAChC,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,OAAO;EACd,OAAO,UAAU,KAAK,MAAM;CAC9B;AACF;AAEA,SAAS,qBAAqB,OAA2B,UAA0B;CACjF,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ;AACpF;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QAC5D,OAAQ,MAAsC,IAAI,IAClD;AACN;AAEA,SAAS,MAAM,cAAqC;CAClD,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,YAAY,CAAC;AACnE"}

package/dist/control-plane/RegistryTrustResolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RegistryTrustResolver.d.ts","names":[],"sources":["../../src/control-plane/RegistryTrustResolver.ts"],"mappings":";;;cAca;mBACyB;EAApC,YAAoC,MAAM;EAE7B,QAAQ,0BAA0B,QAAQ;EAoD1C,aAAa,OAAO,gBAAgB;UAczC;;;;;;;iBAcM,8BAA8B;iBAyB9B,6BAA6B"}

package/dist/control-plane/RegistryTrustResolver.js

@@ -1,105 +0,0 @@
-import { UAPKG_AUTHORIZATION_ISSUER, UAPKG_CONTROL_PLANE_API, registryAudience } from "./ControlPlaneTypes.js";
-import { normalizeUrl } from "@uapkg/common";
-import { join } from "node:path";
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { getRegistryRepoPath } from "@uapkg/registry-core";
-import { RegistryMetaSchema } from "@uapkg/registry-schema";
-
-//#region src/control-plane/RegistryTrustResolver.ts
-var RegistryTrustResolver = class {
-	root;
-	constructor(root) {
-		this.root = root;
-	}
-	async resolve(requestedAlias) {
-		const alias = requestedAlias ?? this.selectedAlias();
-		const result = this.root.registryCore.getOrCreateRegistry(alias);
-		if (!result.ok) throw new Error(firstDiagnostic(result.diagnostics, `Registry "${alias}" is not configured.`));
-		const registry = result.value;
-		const updated = await registry.ensureUpToDate({
-			logicalRegistryName: alias,
-			bypassFreshnessCheck: true
-		});
-		if (!updated.ok || updated.value === "Failed") throw new Error(firstDiagnostic(updated.diagnostics, `Unable to update registry "${alias}".`));
-		const metadataPath = join(getRegistryRepoPath(registry.shortId), ".uapkg", "registry.meta.json");
-		let raw;
-		try {
-			raw = await readFile(metadataPath, "utf8");
-		} catch (error) {
-			throw new Error(`Registry "${alias}" does not contain .uapkg/registry.meta.json. It cannot be used for authenticated control-plane commands.`, { cause: error });
-		}
-		let json;
-		try {
-			json = JSON.parse(raw);
-		} catch (error) {
-			throw new Error(`Registry metadata for "${alias}" is not valid JSON.`, { cause: error });
-		}
-		const parsed = RegistryMetaSchema.safeParse(json);
-		if (!parsed.success) throw new Error(`Registry metadata for "${alias}" does not match the supported schema.`);
-		const repositoryUrl = canonicalizeRegistryGitOrigin(registry.descriptor.url);
-		return {
-			alias,
-			registryId: parsed.data.registry.id,
-			registryName: parsed.data.registry.name,
-			repositoryUrl,
-			repositoryFingerprint: fingerprintRegistryGitOrigin(repositoryUrl),
-			issuer: UAPKG_AUTHORIZATION_ISSUER,
-			apiBaseUrl: UAPKG_CONTROL_PLANE_API,
-			resource: registryAudience(parsed.data.registry.id),
-			cacheShortId: registry.shortId
-		};
-	}
-	async forceRefresh(trust) {
-		const result = this.root.registryCore.getOrCreateRegistry(trust.alias);
-		if (!result.ok) throw new Error(firstDiagnostic(result.diagnostics, `Registry "${trust.alias}" is not configured.`));
-		const updated = await result.value.ensureUpToDate({
-			logicalRegistryName: trust.alias,
-			bypassFreshnessCheck: true
-		});
-		if (!updated.ok || updated.value === "Failed") throw new Error(firstDiagnostic(updated.diagnostics, `Unable to refresh registry "${trust.alias}".`));
-	}
-	selectedAlias() {
-		const selected = this.root.config.get("registry");
-		if (typeof selected !== "string" || selected.trim().length === 0) throw new Error("No registry is selected. Configure one with `uapkg registry use <name>`.");
-		return selected;
-	}
-};
-/**
-* GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same
-* repository. Control-plane authorization must bind all three spellings to one
-* stable source identity.
-*/
-function canonicalizeRegistryGitOrigin(origin) {
-	const value = origin.trim();
-	const scpLike = /^(?:git@)?github\.com:([^/\s]+)\/([^/\s]+?)\/?$/i.exec(value);
-	if (scpLike) return canonicalGitHubRepository(scpLike[1], scpLike[2]);
-	try {
-		const parsed = new URL(value);
-		if (parsed.hostname.toLowerCase() === "github.com") {
-			const path = parsed.pathname.replace(/^\/+|\/+$/g, "").split("/");
-			if (path.length !== 2) throw new Error("A GitHub registry origin must identify exactly one owner and repository.");
-			return canonicalGitHubRepository(path[0], path[1]);
-		}
-	} catch (error) {
-		if (error instanceof Error && error.message.startsWith("A GitHub registry origin")) throw error;
-	}
-	return normalizeUrl(value);
-}
-function fingerprintRegistryGitOrigin(origin) {
-	const canonical = canonicalizeRegistryGitOrigin(origin);
-	return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
-}
-function canonicalGitHubRepository(owner, repository) {
-	const normalizedOwner = owner.trim().toLowerCase();
-	const normalizedRepository = repository.trim().replace(/\.git$/i, "").toLowerCase();
-	if (!normalizedOwner || !normalizedRepository) throw new Error("A GitHub registry origin must include an owner and repository.");
-	return `https://github.com/${normalizedOwner}/${normalizedRepository}.git`;
-}
-function firstDiagnostic(diagnostics, fallback) {
-	return diagnostics[0]?.message ?? fallback;
-}
-
-//#endregion
-export { RegistryTrustResolver, canonicalizeRegistryGitOrigin, fingerprintRegistryGitOrigin };
-//# sourceMappingURL=RegistryTrustResolver.js.map

package/dist/control-plane/RegistryTrustResolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RegistryTrustResolver.js","names":[],"sources":["../../src/control-plane/RegistryTrustResolver.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { normalizeUrl } from '@uapkg/common';\nimport { getRegistryRepoPath } from '@uapkg/registry-core';\nimport { RegistryMetaSchema } from '@uapkg/registry-schema';\nimport type { CompositionRoot } from '../app/CompositionRoot.js';\nimport {\n  type RegistryTrust,\n  registryAudience,\n  UAPKG_AUTHORIZATION_ISSUER,\n  UAPKG_CONTROL_PLANE_API,\n} from './ControlPlaneTypes.js';\n\nexport class RegistryTrustResolver {\n  public constructor(private readonly root: CompositionRoot) {}\n\n  public async resolve(requestedAlias?: string): Promise<RegistryTrust> {\n    const alias = requestedAlias ?? this.selectedAlias();\n    const result = this.root.registryCore.getOrCreateRegistry(alias);\n    if (!result.ok) {\n      throw new Error(firstDiagnostic(result.diagnostics, `Registry \"${alias}\" is not configured.`));\n    }\n\n    const registry = result.value;\n    const updated = await registry.ensureUpToDate({\n      logicalRegistryName: alias,\n      bypassFreshnessCheck: true,\n    });\n    if (!updated.ok || updated.value === 'Failed') {\n      throw new Error(firstDiagnostic(updated.diagnostics, `Unable to update registry \"${alias}\".`));\n    }\n\n    const metadataPath = join(getRegistryRepoPath(registry.shortId), '.uapkg', 'registry.meta.json');\n    let raw: string;\n    try {\n      raw = await readFile(metadataPath, 'utf8');\n    } catch (error) {\n      throw new Error(\n        `Registry \"${alias}\" does not contain .uapkg/registry.meta.json. It cannot be used for authenticated control-plane commands.`,\n        { cause: error },\n      );\n    }\n\n    let json: unknown;\n    try {\n      json = JSON.parse(raw) as unknown;\n    } catch (error) {\n      throw new Error(`Registry metadata for \"${alias}\" is not valid JSON.`, { cause: error });\n    }\n    const parsed = RegistryMetaSchema.safeParse(json);\n    if (!parsed.success) {\n      throw new Error(`Registry metadata for \"${alias}\" does not match the supported schema.`);\n    }\n\n    const repositoryUrl = canonicalizeRegistryGitOrigin(registry.descriptor.url);\n    return {\n      alias,\n      registryId: parsed.data.registry.id,\n      registryName: parsed.data.registry.name,\n      repositoryUrl,\n      repositoryFingerprint: fingerprintRegistryGitOrigin(repositoryUrl),\n      issuer: UAPKG_AUTHORIZATION_ISSUER,\n      apiBaseUrl: UAPKG_CONTROL_PLANE_API,\n      resource: registryAudience(parsed.data.registry.id),\n      cacheShortId: registry.shortId,\n    };\n  }\n\n  public async forceRefresh(trust: RegistryTrust): Promise<void> {\n    const result = this.root.registryCore.getOrCreateRegistry(trust.alias);\n    if (!result.ok) {\n      throw new Error(firstDiagnostic(result.diagnostics, `Registry \"${trust.alias}\" is not configured.`));\n    }\n    const updated = await result.value.ensureUpToDate({\n      logicalRegistryName: trust.alias,\n      bypassFreshnessCheck: true,\n    });\n    if (!updated.ok || updated.value === 'Failed') {\n      throw new Error(firstDiagnostic(updated.diagnostics, `Unable to refresh registry \"${trust.alias}\".`));\n    }\n  }\n\n  private selectedAlias(): string {\n    const selected = this.root.config.get('registry');\n    if (typeof selected !== 'string' || selected.trim().length === 0) {\n      throw new Error('No registry is selected. Configure one with `uapkg registry use <name>`.');\n    }\n    return selected;\n  }\n}\n\n/**\n * GitHub accepts HTTPS, SSH URL, and SCP-like clone coordinates for the same\n * repository. Control-plane authorization must bind all three spellings to one\n * stable source identity.\n */\nexport function canonicalizeRegistryGitOrigin(origin: string): string {\n  const value = origin.trim();\n  const scpLike = /^(?:git@)?github\\.com:([^/\\s]+)\\/([^/\\s]+?)\\/?$/i.exec(value);\n  if (scpLike) {\n    return canonicalGitHubRepository(scpLike[1], scpLike[2]);\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.hostname.toLowerCase() === 'github.com') {\n      const path = parsed.pathname.replace(/^\\/+|\\/+$/g, '').split('/');\n      if (path.length !== 2) {\n        throw new Error('A GitHub registry origin must identify exactly one owner and repository.');\n      }\n      return canonicalGitHubRepository(path[0], path[1]);\n    }\n  } catch (error) {\n    if (error instanceof Error && error.message.startsWith('A GitHub registry origin')) {\n      throw error;\n    }\n  }\n\n  return normalizeUrl(value);\n}\n\nexport function fingerprintRegistryGitOrigin(origin: string): string {\n  const canonical = canonicalizeRegistryGitOrigin(origin);\n  return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;\n}\n\nfunction canonicalGitHubRepository(owner: string, repository: string): string {\n  const normalizedOwner = owner.trim().toLowerCase();\n  const normalizedRepository = repository\n    .trim()\n    .replace(/\\.git$/i, '')\n    .toLowerCase();\n  if (!normalizedOwner || !normalizedRepository) {\n    throw new Error('A GitHub registry origin must include an owner and repository.');\n  }\n  return `https://github.com/${normalizedOwner}/${normalizedRepository}.git`;\n}\n\nfunction firstDiagnostic(diagnostics: readonly { readonly message: string }[], fallback: string): string {\n  return diagnostics[0]?.message ?? fallback;\n}\n"],"mappings":";;;;;;;;;AAcA,IAAa,wBAAb,MAAmC;CACG;CAApC,AAAO,YAAY,AAAiB,MAAuB;EAAvB;CAAwB;CAE5D,MAAa,QAAQ,gBAAiD;EACpE,MAAM,QAAQ,kBAAkB,KAAK,cAAc;EACnD,MAAM,SAAS,KAAK,KAAK,aAAa,oBAAoB,KAAK;EAC/D,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,gBAAgB,OAAO,aAAa,aAAa,MAAM,qBAAqB,CAAC;EAG/F,MAAM,WAAW,OAAO;EACxB,MAAM,UAAU,MAAM,SAAS,eAAe;GAC5C,qBAAqB;GACrB,sBAAsB;EACxB,CAAC;EACD,IAAI,CAAC,QAAQ,MAAM,QAAQ,UAAU,UACnC,MAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,8BAA8B,MAAM,GAAG,CAAC;EAG/F,MAAM,eAAe,KAAK,oBAAoB,SAAS,OAAO,GAAG,UAAU,oBAAoB;EAC/F,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,SAAS,cAAc,MAAM;EAC3C,SAAS,OAAO;GACd,MAAM,IAAI,MACR,aAAa,MAAM,4GACnB,EAAE,OAAO,MAAM,CACjB;EACF;EAEA,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,MAAM,GAAG;EACvB,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,0BAA0B,MAAM,uBAAuB,EAAE,OAAO,MAAM,CAAC;EACzF;EACA,MAAM,SAAS,mBAAmB,UAAU,IAAI;EAChD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,0BAA0B,MAAM,uCAAuC;EAGzF,MAAM,gBAAgB,8BAA8B,SAAS,WAAW,GAAG;EAC3E,OAAO;GACL;GACA,YAAY,OAAO,KAAK,SAAS;GACjC,cAAc,OAAO,KAAK,SAAS;GACnC;GACA,uBAAuB,6BAA6B,aAAa;GACjE,QAAQ;GACR,YAAY;GACZ,UAAU,iBAAiB,OAAO,KAAK,SAAS,EAAE;GAClD,cAAc,SAAS;EACzB;CACF;CAEA,MAAa,aAAa,OAAqC;EAC7D,MAAM,SAAS,KAAK,KAAK,aAAa,oBAAoB,MAAM,KAAK;EACrE,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,gBAAgB,OAAO,aAAa,aAAa,MAAM,MAAM,qBAAqB,CAAC;EAErG,MAAM,UAAU,MAAM,OAAO,MAAM,eAAe;GAChD,qBAAqB,MAAM;GAC3B,sBAAsB;EACxB,CAAC;EACD,IAAI,CAAC,QAAQ,MAAM,QAAQ,UAAU,UACnC,MAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,+BAA+B,MAAM,MAAM,GAAG,CAAC;CAExG;CAEA,AAAQ,gBAAwB;EAC9B,MAAM,WAAW,KAAK,KAAK,OAAO,IAAI,UAAU;EAChD,IAAI,OAAO,aAAa,YAAY,SAAS,KAAK,CAAC,CAAC,WAAW,GAC7D,MAAM,IAAI,MAAM,0EAA0E;EAE5F,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,QAAQ,OAAO,KAAK;CAC1B,MAAM,UAAU,mDAAmD,KAAK,KAAK;CAC7E,IAAI,SACF,OAAO,0BAA0B,QAAQ,IAAI,QAAQ,EAAE;CAGzD,IAAI;EACF,MAAM,SAAS,IAAI,IAAI,KAAK;EAC5B,IAAI,OAAO,SAAS,YAAY,MAAM,cAAc;GAClD,MAAM,OAAO,OAAO,SAAS,QAAQ,cAAc,EAAE,CAAC,CAAC,MAAM,GAAG;GAChE,IAAI,KAAK,WAAW,GAClB,MAAM,IAAI,MAAM,0EAA0E;GAE5F,OAAO,0BAA0B,KAAK,IAAI,KAAK,EAAE;EACnD;CACF,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,MAAM,QAAQ,WAAW,0BAA0B,GAC/E,MAAM;CAEV;CAEA,OAAO,aAAa,KAAK;AAC3B;AAEA,SAAgB,6BAA6B,QAAwB;CACnE,MAAM,YAAY,8BAA8B,MAAM;CACtD,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAAK;AACtE;AAEA,SAAS,0BAA0B,OAAe,YAA4B;CAC5E,MAAM,kBAAkB,MAAM,KAAK,CAAC,CAAC,YAAY;CACjD,MAAM,uBAAuB,WAC1B,KAAK,CAAC,CACN,QAAQ,WAAW,EAAE,CAAC,CACtB,YAAY;CACf,IAAI,CAAC,mBAAmB,CAAC,sBACvB,MAAM,IAAI,MAAM,gEAAgE;CAElF,OAAO,sBAAsB,gBAAgB,GAAG,qBAAqB;AACvE;AAEA,SAAS,gBAAgB,aAAsD,UAA0B;CACvG,OAAO,YAAY,EAAE,EAAE,WAAW;AACpC"}

package/dist/postinstall/api/PostinstallDsl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PostinstallDsl.d.ts","names":[],"sources":["../../../src/postinstall/api/PostinstallDsl.ts"],"mappings":";;;;;;;;;;cAUa,YAAU,EAAA;;;GAKZ,EAAA,KAAA;;;;cAKE,oBAAkB,EAAA;;GAIpB,EAAA,KAAA;;;;;;;;;cAUE,6BAA2B,EAAA;;;;;;;;;;;;GAM7B,EAAA,KAAA;KAEC,iBAAiB,EAAE,aAAa;KAChC,yBAAyB,EAAE,aAAa;KACxC,wBAAwB,EAAE,aAAa"}

package/dist/postinstall/api/PostinstallDsl.js

@@ -1,36 +0,0 @@
-import { z } from "zod";
-
-//#region src/postinstall/api/PostinstallDsl.ts
-/**
-* Zone-level content injected into a single Unreal build file (Build.cs or Target.cs).
-*
-* - `includes`: raw C# `using ...;` lines appended to the file's using block.
-* - `classBody`: raw C# members placed inside the target class; uapkg wraps them
-*   in a hashed helper class and inserts a single `Apply(this)` call into the
-*   constructor. The content must compile as a member list.
-*/
-const ZoneSchema = z.object({
-	includes: z.string().min(1).optional(),
-	classBody: z.string().min(1).optional()
-}).strict();
-/**
-* Project-level setup: plugins to enable in the host project's `.uproject`.
-*/
-const ProjectSetupSchema = z.object({ plugins: z.array(z.string().min(1)).optional() }).strict();
-/**
-* The authoritative shape of `export default definePostinstall({...})`.
-*
-* Scopes:
-* - `setupModules`: applied to each *project postinstall module* Build.cs file.
-* - `setupTargets`: applied to every *.Target.cs in the host project.
-* - `setupProject`: edits the host project's `.uproject`.
-*/
-const PostinstallDefinitionSchema = z.object({
-	setupModules: ZoneSchema.optional(),
-	setupTargets: ZoneSchema.optional(),
-	setupProject: ProjectSetupSchema.optional()
-}).strict();
-
-//#endregion
-export { PostinstallDefinitionSchema, ProjectSetupSchema, ZoneSchema };
-//# sourceMappingURL=PostinstallDsl.js.map

package/dist/postinstall/api/PostinstallDsl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PostinstallDsl.js","names":[],"sources":["../../../src/postinstall/api/PostinstallDsl.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Zone-level content injected into a single Unreal build file (Build.cs or Target.cs).\n *\n * - `includes`: raw C# `using ...;` lines appended to the file's using block.\n * - `classBody`: raw C# members placed inside the target class; uapkg wraps them\n *   in a hashed helper class and inserts a single `Apply(this)` call into the\n *   constructor. The content must compile as a member list.\n */\nexport const ZoneSchema = z\n  .object({\n    includes: z.string().min(1).optional(),\n    classBody: z.string().min(1).optional(),\n  })\n  .strict();\n\n/**\n * Project-level setup: plugins to enable in the host project's `.uproject`.\n */\nexport const ProjectSetupSchema = z\n  .object({\n    plugins: z.array(z.string().min(1)).optional(),\n  })\n  .strict();\n\n/**\n * The authoritative shape of `export default definePostinstall({...})`.\n *\n * Scopes:\n * - `setupModules`: applied to each *project postinstall module* Build.cs file.\n * - `setupTargets`: applied to every *.Target.cs in the host project.\n * - `setupProject`: edits the host project's `.uproject`.\n */\nexport const PostinstallDefinitionSchema = z\n  .object({\n    setupModules: ZoneSchema.optional(),\n    setupTargets: ZoneSchema.optional(),\n    setupProject: ProjectSetupSchema.optional(),\n  })\n  .strict();\n\nexport type ZoneDefinition = z.infer<typeof ZoneSchema>;\nexport type ProjectSetupDefinition = z.infer<typeof ProjectSetupSchema>;\nexport type PostinstallDefinition = z.infer<typeof PostinstallDefinitionSchema>;\n"],"mappings":";;;;;;;;;;;AAUA,MAAa,aAAa,EACvB,OAAO;CACN,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACrC,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;AACxC,CAAC,CAAC,CACD,OAAO;;;;AAKV,MAAa,qBAAqB,EAC/B,OAAO,EACN,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAC/C,CAAC,CAAC,CACD,OAAO;;;;;;;;;AAUV,MAAa,8BAA8B,EACxC,OAAO;CACN,cAAc,WAAW,SAAS;CAClC,cAAc,WAAW,SAAS;CAClC,cAAc,mBAAmB,SAAS;AAC5C,CAAC,CAAC,CACD,OAAO"}

package/dist/postinstall/api/definePostinstall.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"definePostinstall.d.ts","names":[],"sources":["../../../src/postinstall/api/definePostinstall.ts"],"mappings":";;;;;;;;;;;;;;;;;iBAiBgB,kBAAkB,YAAY,wBAAwB"}

package/dist/postinstall/api/definePostinstall.js

@@ -1,23 +0,0 @@
-//#region src/postinstall/api/definePostinstall.ts
-/**
-* Identity helper used in user-authored `.uapkg/postinstall.ts` files:
-*
-* ```ts
-* import { definePostinstall } from 'uapkg/postinstall';
-* export default definePostinstall({
-*   setupModules: { classBody: '...' },
-* });
-* ```
-*
-* At runtime this is the identity function; at edit time it gives authors
-* full TypeScript autocomplete/validation against {@link PostinstallDefinition}.
-* The loader validates the shape regardless of whether the author used this
-* helper, so it is purely ergonomic.
-*/
-function definePostinstall(definition) {
-	return definition;
-}
-
-//#endregion
-export { definePostinstall };
-//# sourceMappingURL=definePostinstall.js.map

package/dist/postinstall/api/definePostinstall.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"definePostinstall.js","names":[],"sources":["../../../src/postinstall/api/definePostinstall.ts"],"sourcesContent":["import type { PostinstallDefinition } from './PostinstallDsl.js';\n\n/**\n * Identity helper used in user-authored `.uapkg/postinstall.ts` files:\n *\n * ```ts\n * import { definePostinstall } from 'uapkg/postinstall';\n * export default definePostinstall({\n *   setupModules: { classBody: '...' },\n * });\n * ```\n *\n * At runtime this is the identity function; at edit time it gives authors\n * full TypeScript autocomplete/validation against {@link PostinstallDefinition}.\n * The loader validates the shape regardless of whether the author used this\n * helper, so it is purely ergonomic.\n */\nexport function definePostinstall(definition: PostinstallDefinition): PostinstallDefinition {\n  return definition;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,SAAgB,kBAAkB,YAA0D;CAC1F,OAAO;AACT"}

package/dist/postinstall/index.js

@@ -1,25 +0,0 @@
-import { EntryResolver } from "./loader/EntryResolver.js";
-import { EsbuildTranspiler } from "./loader/EsbuildTranspiler.js";
-import { PostinstallDefinitionSchema, ProjectSetupSchema, ZoneSchema } from "./api/PostinstallDsl.js";
-import { ExportValidator } from "./loader/ExportValidator.js";
-import { ModuleImporter } from "./loader/ModuleImporter.js";
-import { PostinstallLoader } from "./loader/PostinstallLoader.js";
-import { PostinstallPolicyGate } from "./policy/PostinstallPolicyGate.js";
-import { MarkerBlockService } from "./markers/MarkerBlockService.js";
-import { MarkerIntegrityValidator } from "./markers/MarkerIntegrityValidator.js";
-import { MarkerBlockEditor } from "./markers/MarkerBlockEditor.js";
-import { CSharpInjectionEngine } from "./unreal/CSharpInjectionEngine.js";
-import { PrettyParseError } from "./unreal/PrettyParseError.js";
-import { CSharpStructureAnalyzer } from "./unreal/CSharpStructureAnalyzer.js";
-import { CSharpWrapperFactory } from "./unreal/CSharpWrapperFactory.js";
-import { getPluginHash, getWrapperClassName } from "./unreal/PluginHash.js";
-import { BuildCsInjector } from "./unreal/BuildCsInjector.js";
-import { ProjectFileLocator } from "./unreal/ProjectFileLocator.js";
-import { TargetCsInjector } from "./unreal/TargetCsInjector.js";
-import { UnrealSourceCatalogBuilder } from "./unreal/UnrealSourceCatalog.js";
-import { UProjectInjector } from "./unreal/UProjectInjector.js";
-import { UProjectMetadataReader } from "./unreal/UProjectMetadataReader.js";
-import { PostinstallOrchestrator } from "./runner/PostinstallOrchestrator.js";
-import { definePostinstall } from "./api/definePostinstall.js";
-
-export { BuildCsInjector, CSharpInjectionEngine, CSharpStructureAnalyzer, CSharpWrapperFactory, EntryResolver, EsbuildTranspiler, ExportValidator, MarkerBlockEditor, MarkerBlockService, MarkerIntegrityValidator, ModuleImporter, PostinstallDefinitionSchema, PostinstallLoader, PostinstallOrchestrator, PostinstallPolicyGate, PrettyParseError, ProjectFileLocator, ProjectSetupSchema, TargetCsInjector, UProjectInjector, UProjectMetadataReader, UnrealSourceCatalogBuilder, ZoneSchema, definePostinstall, getPluginHash, getWrapperClassName };

package/dist/postinstall/loader/EntryResolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"EntryResolver.d.ts","names":[],"sources":["../../../src/postinstall/loader/EntryResolver.ts"],"mappings":";;;cAKM;KACM,+BAA+B;UAE1B;WACN;WACA,MAAM;;;;;;;;;cAUJ;EACJ,QAAQ,qBAAqB,qBAAqB,OAAO"}