@uapkg/cli 1.4.0 → 1.5.0

package/dist/control-plane/AccountManager.js

@@ -1,822 +0,0 @@
-import { resolveAuthStoragePaths } from "./AuthStoragePaths.js";
-import { FileRegistryGrantLock } from "./RegistryGrantLock.js";
-import { AuthMetadataStore } from "./AuthMetadataStore.js";
-import { ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, isUAPKGCliScope, parseUAPKGCliScopeString, registryAudience } from "./ControlPlaneTypes.js";
-import { ControlPlaneClient } from "./ControlPlaneClient.js";
-import { CredentialStore } from "./CredentialStore.js";
-import { DPoPKeyStore } from "./DPoPKeyStore.js";
-import { createControlPlaneCommandFailedDiagnostic } from "@uapkg/diagnostics";
-import { createServer } from "node:http";
-import { hostname } from "node:os";
-import isCI from "is-ci";
-import * as oauth from "oauth4webapi";
-
-//#region src/control-plane/AccountManager.ts
-const INTERACTIVE_LOGIN_TIMEOUT_MS = 18e4;
-const INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS = 6e4;
-const CLI_LOGIN_RECONCILIATION_TIMEOUT_MS = 5e3;
-const OAUTH_BACKCHANNEL_TIMEOUT_MS = 3e4;
-const LOOPBACK_CALLBACK_PATH = "/callback";
-const ACCOUNT_COMPLETION_PATH = "/cli-login/complete";
-const CONTROL_PLANE_SERVER_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,127}$/;
-var LoginError = class extends Error {
-	code;
-	oauthError;
-	constructor(code, message, oauthError) {
-		super(message);
-		this.code = code;
-		this.oauthError = oauthError;
-		this.name = "LoginError";
-	}
-};
-var AccountManager = class {
-	metadata;
-	credentials;
-	openBrowser;
-	isInteractiveLogin;
-	interactiveLoginTimeoutMs;
-	interactiveLoginFinalizationTimeoutMs;
-	keyStore;
-	accessTokenCache = /* @__PURE__ */ new Map();
-	grantOperationTails = /* @__PURE__ */ new Map();
-	grantLock;
-	constructor(metadata = new AuthMetadataStore(), credentials = new CredentialStore(), openBrowser = async (url) => {
-		const { default: open } = await import("open");
-		await open(url, { wait: false });
-	}, isInteractiveLogin = () => Boolean(process.stdin.isTTY && process.stdout.isTTY && !isCI), grantLock, interactiveLoginTimeoutMs = INTERACTIVE_LOGIN_TIMEOUT_MS, interactiveLoginFinalizationTimeoutMs = INTERACTIVE_LOGIN_FINALIZATION_TIMEOUT_MS) {
-		this.metadata = metadata;
-		this.credentials = credentials;
-		this.openBrowser = openBrowser;
-		this.isInteractiveLogin = isInteractiveLogin;
-		this.interactiveLoginTimeoutMs = interactiveLoginTimeoutMs;
-		this.interactiveLoginFinalizationTimeoutMs = interactiveLoginFinalizationTimeoutMs;
-		this.keyStore = new DPoPKeyStore(credentials);
-		const metadataPath = typeof metadata.path === "string" ? metadata.path : void 0;
-		this.grantLock = grantLock ?? new FileRegistryGrantLock(resolveAuthStoragePaths(metadataPath).locksDirectory);
-	}
-	async hasGrant(trust) {
-		return Boolean(await this.metadata.find(trust.issuer, trust.registryId));
-	}
-	invalidateAccessCredentials(trust) {
-		for (const key of this.accessTokenCache.keys()) if (key.startsWith(`${trust.issuer}|${trust.registryId}|`)) this.accessTokenCache.delete(key);
-	}
-	async login(trust, options = {}) {
-		this.assertPinnedTrust(trust);
-		this.assertInteractiveLogin();
-		await this.credentials.assertAvailable();
-		const previous = await this.metadata.find(trust.issuer, trust.registryId);
-		if (previous && !options.reauthorize) throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
-		emitLoginProgress(options.onProgress, {
-			type: "preparing",
-			registryAlias: trust.alias
-		});
-		const issuer = new URL(trust.issuer);
-		const as = await this.discover(issuer);
-		this.validateAuthorizationServer(as);
-		this.assertIssuerSupportsScopes(as, trust, UAPKG_CLI_SCOPES);
-		const client = this.client();
-		const keyPair = await this.keyStore.generate();
-		const dpop = oauth.DPoP(client, keyPair);
-		const publicKeyThumbprint = await dpop.calculateThumbprint();
-		const receiver = await LoopbackAuthorizationReceiver.listen(issuer);
-		let issuedRefreshToken;
-		let retainedIssuedGrant = false;
-		let preserveIssuedGrant = false;
-		let callbackReceipt;
-		let finalizationController;
-		let finalizationTimeout;
-		try {
-			const codeVerifier = oauth.generateRandomCodeVerifier();
-			const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
-			const state = oauth.generateRandomState();
-			const nonce = oauth.generateRandomNonce();
-			const requestedScopes = [
-				"openid",
-				"offline_access",
-				...UAPKG_CLI_SCOPES
-			];
-			const scope = requestedScopes.join(" ");
-			const deviceName = normalizeDeviceName(options.deviceName);
-			const parameters = new URLSearchParams({
-				client_id: client.client_id,
-				redirect_uri: receiver.redirectUri,
-				response_type: "code",
-				code_challenge: codeChallenge,
-				code_challenge_method: "S256",
-				state,
-				nonce,
-				scope,
-				resource: trust.resource,
-				dpop_jkt: publicKeyThumbprint,
-				registry_id: trust.registryId,
-				registry_source_fingerprint: trust.repositoryFingerprint,
-				device_name: deviceName,
-				max_age: "300"
-			});
-			if (requestedScopes.includes("offline_access")) parameters.set("prompt", "consent");
-			const expectedPredecessorGrantId = options.reauthorize && previous ? previous.grantId : null;
-			if (expectedPredecessorGrantId) parameters.set("replace_grant_id", expectedPredecessorGrantId);
-			const pushed = await this.withDPoPNonceRetry(() => oauth.pushedAuthorizationRequest(as, client, oauth.None(), parameters, {
-				DPoP: dpop,
-				signal: () => AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS)
-			}), (response) => oauth.processPushedAuthorizationResponse(as, client, response));
-			if (!as.authorization_endpoint) throw new Error("The authorization server did not advertise an authorization endpoint.");
-			const authorizationUrl = new URL(as.authorization_endpoint);
-			authorizationUrl.searchParams.set("client_id", client.client_id);
-			authorizationUrl.searchParams.set("request_uri", pushed.request_uri);
-			emitLoginProgress(options.onProgress, { type: "opening-browser" });
-			try {
-				await this.openBrowser(authorizationUrl.href);
-			} catch {
-				emitLoginProgress(options.onProgress, {
-					type: "browser-open-failed",
-					authorizationUrl: authorizationUrl.href
-				});
-			}
-			emitLoginProgress(options.onProgress, { type: "waiting-for-decision" });
-			callbackReceipt = await receiver.waitForCallback(this.interactiveLoginTimeoutMs, trust.alias);
-			finalizationController = new AbortController();
-			finalizationTimeout = setTimeout(() => {
-				finalizationController?.abort(loginFinalizationTimeoutError(trust.alias));
-			}, this.interactiveLoginFinalizationTimeoutMs);
-			const finalizationSignal = finalizationController.signal;
-			const callbackUrl = callbackReceipt.url;
-			if (callbackUrl.searchParams.get("iss") !== trust.issuer) throw new LoginError("LOGIN_AUTHORIZATION_RESPONSE_INVALID", "The browser authorization response came from an unexpected issuer. Run `uapkg login` again.");
-			let callbackParameters;
-			try {
-				callbackParameters = oauth.validateAuthResponse(as, client, callbackUrl, state);
-			} catch (error) {
-				throw authorizationResponseLoginError(error);
-			}
-			emitLoginProgress(options.onProgress, { type: "approval-received" });
-			const tokens = await this.withDPoPNonceRetry(() => oauth.authorizationCodeGrantRequest(as, client, oauth.None(), callbackParameters, receiver.redirectUri, codeVerifier, {
-				DPoP: dpop,
-				signal: finalizationSignal
-			}), (response) => oauth.processAuthorizationCodeResponse(as, client, response, {
-				expectedNonce: nonce,
-				maxAge: 300,
-				requireIdToken: true
-			}));
-			finalizationSignal.throwIfAborted();
-			if (tokens.token_type !== "dpop") throw new Error("The authorization server did not issue a DPoP-bound access token.");
-			if (!tokens.refresh_token) throw new Error("The authorization server did not issue a persistent registry grant.");
-			const refreshToken = tokens.refresh_token;
-			issuedRefreshToken = refreshToken;
-			const controlPlane = new ControlPlaneClient(trust.apiBaseUrl);
-			const issuedCredential = {
-				kind: "dpop",
-				accessToken: tokens.access_token,
-				dpop,
-				registryAlias: trust.alias,
-				requestedScopes: UAPKG_CLI_SCOPES
-			};
-			const self = await controlPlane.getCliLoginConfirmation(issuedCredential, finalizationSignal);
-			finalizationSignal.throwIfAborted();
-			if (self.grant.replacesGrantId !== expectedPredecessorGrantId) throw loginReplacementBindingError(trust.alias);
-			if (self.registry.id !== trust.registryId) throw new Error("The authorization server returned a registry grant for an unexpected registry.");
-			const missingScopes = UAPKG_CLI_SCOPES.filter((scope) => !self.grant.scopes.includes(scope));
-			if (missingScopes.length > 0) throw new Error(`The authorization server omitted required CLI capabilities: ${missingScopes.join(", ")}.`);
-			if (self.grant.status === "pending" && timestampFromIso(self.grant.activationExpiresAt) <= Math.floor(Date.now() / 1e3)) throw new LoginError("LOGIN_AUTHORIZATION_TIMEOUT", `Login approval expired before this device could confirm it. Run \`uapkg login --registry ${trust.alias}\` to try again.`);
-			const grantId = self.grant.id;
-			const keyReference = this.credentials.createReference("dpop-key", trust.issuer, trust.registryId, grantId);
-			const refreshTokenReference = this.credentials.createReference("grant", trust.issuer, trust.registryId, grantId);
-			const metadata = {
-				issuer: trust.issuer,
-				registryId: trust.registryId,
-				registryName: trust.registryName,
-				grantId,
-				clientId: client.client_id,
-				keyReference,
-				refreshTokenReference,
-				publicKeyThumbprint,
-				deviceName: self.grant.deviceName,
-				repositoryFingerprint: trust.repositoryFingerprint,
-				account: self.account,
-				createdAt: Math.floor(Date.now() / 1e3),
-				idleExpiresAt: timestampFromIso(self.grant.idleExpiresAt),
-				expiresAt: timestampFromIso(self.grant.absoluteExpiresAt)
-			};
-			let previousForCleanup;
-			await this.serializeGrantOperation(trust, async () => {
-				const currentPrevious = await this.metadata.find(trust.issuer, trust.registryId);
-				if (!isSameRegistryGrant(previous, currentPrevious)) {
-					if (options.reauthorize) throw loginReauthorizationConflictError(trust.alias);
-					throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
-				}
-				if (currentPrevious && !options.reauthorize) throw new Error(`This device already has a saved login for "${trust.alias}". Use \`uapkg login --registry ${trust.alias} --reauthorize\` to replace it.`);
-				emitLoginProgress(options.onProgress, { type: "saving-local-credentials" });
-				await this.persistPreparedGrant(metadata, keyPair, refreshToken, currentPrevious, finalizationSignal);
-				if (self.grant.status === "pending") {
-					emitLoginProgress(options.onProgress, { type: "confirming-with-service" });
-					const activation = await this.activatePreparedGrant(controlPlane, issuedCredential, metadata.grantId, expectedPredecessorGrantId, finalizationSignal, trust.alias);
-					if (activation.kind === "rejected") {
-						await this.rollbackPreparedGrant(metadata, currentPrevious);
-						throw activation.error;
-					}
-					if (activation.kind === "ambiguous") {
-						preserveIssuedGrant = true;
-						throw activation.error;
-					}
-				}
-				retainedIssuedGrant = true;
-				this.invalidateAccessCredentials(trust);
-				if (finalizationTimeout) {
-					clearTimeout(finalizationTimeout);
-					finalizationTimeout = void 0;
-				}
-				previousForCleanup = currentPrevious;
-			});
-			await callbackReceipt.complete("success");
-			let warnings = [];
-			if (previousForCleanup) try {
-				warnings = await this.serializeGrantOperation(trust, () => this.cleanupPreviousLocalCredentials(metadata, previousForCleanup));
-			} catch {
-				warnings = ["The new login is active, but UAPKG could not remove one or more old protected credential entries. Remove the stale UAPKG entries from the operating-system credential store."];
-			}
-			return {
-				grant: metadata,
-				warnings
-			};
-		} catch (error) {
-			if (finalizationTimeout) {
-				clearTimeout(finalizationTimeout);
-				finalizationTimeout = void 0;
-			}
-			const failure = error instanceof LoginError ? error : finalizationController?.signal.aborted && finalizationController.signal.reason instanceof LoginError ? finalizationController.signal.reason : error;
-			if (issuedRefreshToken && !retainedIssuedGrant && !preserveIssuedGrant) await this.revokeToken(as, client, issuedRefreshToken, dpop).catch(() => void 0);
-			const loginError = normalizeLoginError(failure);
-			if (callbackReceipt) {
-				const outcome = loginError.code === "LOGIN_ACCESS_DENIED" ? "denied" : "failed";
-				await callbackReceipt.complete(outcome).catch(() => void 0);
-			}
-			throw loginError;
-		} finally {
-			if (finalizationTimeout) clearTimeout(finalizationTimeout);
-			receiver.close();
-		}
-	}
-	async getAccessCredential(trust, scopes) {
-		this.assertPinnedTrust(trust);
-		const requestedScopes = [...new Set(scopes)].sort();
-		if (requestedScopes.length === 0 || requestedScopes.some((scope) => !isUAPKGCliScope(scope))) throw new Error("A control-plane operation requested an unsupported OAuth capability scope.");
-		const grant = await this.requireUsableGrant(trust);
-		const as = await this.discover(new URL(trust.issuer));
-		this.assertIssuerSupportsScopes(as, trust, requestedScopes);
-		const cacheKey = this.accessTokenCacheKey(grant, requestedScopes);
-		const cached = this.accessTokenCache.get(cacheKey);
-		if (cached && cached.expiresAt > Date.now() + 15e3) return {
-			grant,
-			credential: {
-				kind: "dpop",
-				accessToken: cached.token,
-				dpop: cached.dpop,
-				registryAlias: trust.alias,
-				requestedScopes
-			}
-		};
-		return this.serializeGrantOperation(trust, async () => {
-			const currentGrant = await this.requireUsableGrant(trust);
-			const currentCacheKey = this.accessTokenCacheKey(currentGrant, requestedScopes);
-			const refreshedCached = this.accessTokenCache.get(currentCacheKey);
-			if (refreshedCached && refreshedCached.expiresAt > Date.now() + 15e3) return {
-				grant: currentGrant,
-				credential: {
-					kind: "dpop",
-					accessToken: refreshedCached.token,
-					dpop: refreshedCached.dpop,
-					registryAlias: trust.alias,
-					requestedScopes
-				}
-			};
-			const pair = await this.keyStore.load(currentGrant.keyReference);
-			if (!pair) throw missingKeyError(trust);
-			const client = this.client();
-			const dpop = oauth.DPoP(client, pair);
-			if (await dpop.calculateThumbprint() !== currentGrant.publicKeyThumbprint) throw missingKeyError(trust);
-			const refreshToken = await this.credentials.get(currentGrant.refreshTokenReference);
-			if (!refreshToken) throw new Error(`The saved login for "${trust.alias}" is missing its protected registry grant. Run \`uapkg login --registry ${trust.alias}\` again.`);
-			let tokenResponse;
-			try {
-				tokenResponse = await this.withDPoPNonceRetry(() => oauth.refreshTokenGrantRequest(as, client, oauth.None(), refreshToken, {
-					DPoP: dpop,
-					additionalParameters: {
-						resource: trust.resource,
-						scope: requestedScopes.join(" ")
-					}
-				}), (response) => oauth.processRefreshTokenResponse(as, client, response));
-			} catch (error) {
-				if (error instanceof oauth.ResponseBodyError && error.error === "invalid_scope") {
-					const hintedScopes = parseUAPKGCliScopeString(error.cause.scope).filter((scope) => requestedScopes.includes(scope));
-					const missingScopes = hintedScopes.length > 0 ? hintedScopes : requestedScopes;
-					throw new OAuthScopeInsufficientError("The saved registry grant does not include every OAuth scope required by this operation.", trust.alias, requestedScopes, requestedScopes, missingScopes, 403, { cause: error });
-				}
-				if (error instanceof oauth.ResponseBodyError && (error.error === "invalid_grant" || error.error === "invalid_token")) throw new Error(`Your saved login for "${trust.alias}" is no longer valid. Run \`uapkg login --registry ${trust.alias} --reauthorize\` to authenticate again.`, { cause: error });
-				throw error;
-			}
-			if (tokenResponse.token_type !== "dpop") throw new Error("The authorization server returned an access token that is not DPoP-bound.");
-			if (tokenResponse.refresh_token && tokenResponse.refresh_token !== refreshToken) await this.credentials.set(currentGrant.refreshTokenReference, tokenResponse.refresh_token);
-			const expiresAt = Date.now() + Math.max(1, tokenResponse.expires_in ?? 300) * 1e3;
-			this.accessTokenCache.set(currentCacheKey, {
-				token: tokenResponse.access_token,
-				expiresAt,
-				dpop
-			});
-			return {
-				grant: currentGrant,
-				credential: {
-					kind: "dpop",
-					accessToken: tokenResponse.access_token,
-					dpop,
-					registryAlias: trust.alias,
-					requestedScopes
-				}
-			};
-		});
-	}
-	async logout(trust, localOnly = false) {
-		this.assertPinnedTrust(trust);
-		return this.serializeGrantOperation(trust, async () => {
-			const grant = await this.metadata.find(trust.issuer, trust.registryId);
-			if (!grant) return "not-logged-in";
-			if (!localOnly) try {
-				await this.revokeSavedGrant(grant);
-			} catch (error) {
-				throw new Error(`Unable to revoke the registry grant for "${trust.alias}". The local login was kept so you can retry. Use --local-only only if you accept that account-site revocation may still be required.`, { cause: error });
-			}
-			await Promise.all([this.keyStore.delete(grant.keyReference), this.credentials.delete(grant.refreshTokenReference)]);
-			await this.metadata.remove(grant.issuer, grant.registryId);
-			this.invalidateAccessCredentials(trust);
-			return "removed";
-		});
-	}
-	async requireUsableGrant(trust) {
-		const grant = await this.metadata.find(trust.issuer, trust.registryId);
-		if (!grant) throw new Error(`You are not logged in to "${trust.alias}". Run \`uapkg login --registry ${trust.alias}\`.`);
-		if (grant.repositoryFingerprint !== trust.repositoryFingerprint) throw new Error(`The configured Git source for "${trust.alias}" does not match the source authorized by the saved login. Run \`uapkg login --registry ${trust.alias} --reauthorize\`.`);
-		const now = Math.floor(Date.now() / 1e3);
-		if (grant.expiresAt && grant.expiresAt <= now) throw new Error(`Your saved login for "${trust.alias}" has expired. Run \`uapkg login --registry ${trust.alias}\` again.`);
-		return grant;
-	}
-	async revokeSavedGrant(grant) {
-		const refreshToken = await this.credentials.get(grant.refreshTokenReference);
-		if (!refreshToken) throw new Error("The registry grant cannot be revoked because its protected credential is missing.");
-		const pair = await this.keyStore.load(grant.keyReference);
-		if (!pair) throw new Error("The registry grant cannot be revoked because its DPoP key is missing.");
-		const dpop = oauth.DPoP(this.client(), pair);
-		if (await dpop.calculateThumbprint() !== grant.publicKeyThumbprint) throw new Error("The registry grant cannot be revoked because its DPoP key has changed.");
-		const as = await this.discover(new URL(grant.issuer));
-		await this.revokeToken(as, this.client(), refreshToken, dpop);
-	}
-	async activatePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, signal, registryAlias) {
-		try {
-			const confirmed = await controlPlane.confirmCliLogin(credential, signal);
-			if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) return { kind: "active" };
-			return this.reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias);
-		} catch (error) {
-			if (isCliLoginReauthorizationConflict(error)) return {
-				kind: "rejected",
-				error: reauthorizationConflictLoginError(error)
-			};
-			if (isDefinitiveCliLoginConfirmationRejection(error)) return {
-				kind: "rejected",
-				error
-			};
-			return this.reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias);
-		}
-	}
-	async reconcilePreparedGrant(controlPlane, credential, expectedGrantId, expectedPredecessorGrantId, registryAlias) {
-		const signal = AbortSignal.timeout(CLI_LOGIN_RECONCILIATION_TIMEOUT_MS);
-		let retryActivation = true;
-		try {
-			const observed = await controlPlane.getCliLoginConfirmation(credential, signal);
-			if (observed.grant.id !== expectedGrantId || observed.grant.replacesGrantId !== expectedPredecessorGrantId) retryActivation = false;
-			else if (observed.grant.status === "active") return { kind: "active" };
-		} catch {}
-		if (retryActivation) try {
-			const confirmed = await controlPlane.confirmCliLogin(credential, signal);
-			if (confirmed.id === expectedGrantId && confirmed.replacesGrantId === expectedPredecessorGrantId) return { kind: "active" };
-		} catch {}
-		try {
-			const observed = await controlPlane.getCliLoginConfirmation(credential, signal);
-			if (observed.grant.id === expectedGrantId && observed.grant.replacesGrantId === expectedPredecessorGrantId && observed.grant.status === "active") return { kind: "active" };
-		} catch {}
-		return {
-			kind: "ambiguous",
-			error: loginConfirmationAmbiguousError(registryAlias)
-		};
-	}
-	async persistPreparedGrant(metadata, keyPair, refreshToken, previous, signal) {
-		let metadataWriteAttempted = false;
-		try {
-			signal?.throwIfAborted();
-			await this.keyStore.save(metadata.keyReference, keyPair);
-			signal?.throwIfAborted();
-			await this.credentials.set(metadata.refreshTokenReference, refreshToken);
-			signal?.throwIfAborted();
-			metadataWriteAttempted = true;
-			await this.metadata.upsert(metadata);
-			signal?.throwIfAborted();
-		} catch (error) {
-			const cleanup = [this.keyStore.delete(metadata.keyReference), this.credentials.delete(metadata.refreshTokenReference)];
-			let metadataRollbackIndex;
-			if (metadataWriteAttempted) {
-				metadataRollbackIndex = cleanup.length;
-				cleanup.push(previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId));
-			}
-			const cleanupResults = await Promise.allSettled(cleanup);
-			if (metadataRollbackIndex !== void 0 && cleanupResults[metadataRollbackIndex]?.status === "rejected") throw new LoginError("LOGIN_FAILED", "Login failed, and UAPKG could not roll back the local login metadata safely. Check `uapkg whoami --json` before retrying.");
-			throw error;
-		}
-	}
-	async rollbackPreparedGrant(metadata, previous) {
-		if ((await Promise.allSettled([
-			this.keyStore.delete(metadata.keyReference),
-			this.credentials.delete(metadata.refreshTokenReference),
-			previous ? this.metadata.upsert(previous) : this.metadata.remove(metadata.issuer, metadata.registryId)
-		])).some(({ status }) => status === "rejected")) throw new LoginError("LOGIN_FAILED", "Login confirmation failed, and UAPKG could not roll back the local login safely. Check `uapkg whoami --json` before retrying.");
-	}
-	async cleanupPreviousLocalCredentials(metadata, previous) {
-		if (!previous) return [];
-		if (previous.grantId === metadata.grantId || previous.keyReference === metadata.keyReference && previous.refreshTokenReference === metadata.refreshTokenReference) return [];
-		const cleanupResults = await Promise.allSettled([this.keyStore.delete(previous.keyReference), this.credentials.delete(previous.refreshTokenReference)]);
-		const warnings = [];
-		if (cleanupResults.some(({ status }) => status === "rejected")) warnings.push("The previous registry grant was replaced, but one or more old protected credential entries could not be removed. Remove the stale UAPKG entries from the operating-system credential store.");
-		return warnings;
-	}
-	async revokeToken(as, client, refreshToken, dpop) {
-		const signer = signingDPoPHandle(dpop);
-		await this.withDPoPNonceRetry(() => oauth.revocationRequest(as, client, oauth.None(), refreshToken, {
-			additionalParameters: { token_type_hint: "refresh_token" },
-			signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS),
-			[oauth.customFetch]: async (url, options) => {
-				const endpoint = new URL(url);
-				const headers = new Headers(options.headers);
-				await signer.addProof(endpoint, headers, "POST");
-				const response = await fetch(url, {
-					...options,
-					headers
-				});
-				signer.cacheNonce(response, endpoint);
-				return response;
-			}
-		}), (response) => oauth.processRevocationResponse(response));
-	}
-	async discover(issuer) {
-		const discoveryUrl = oidcDiscoveryUrl(issuer);
-		let response;
-		try {
-			response = await oauth.discoveryRequest(issuer, {
-				algorithm: "oidc",
-				signal: AbortSignal.timeout(OAUTH_BACKCHANNEL_TIMEOUT_MS)
-			});
-		} catch {
-			throw new Error(`Unable to retrieve OAuth metadata for build-pinned issuer "${issuer.href}" from discovery URL "${discoveryUrl.href}".`);
-		}
-		try {
-			return await oauth.processDiscoveryResponse(issuer, response);
-		} catch {
-			throw new Error(`Invalid OAuth metadata for build-pinned issuer "${issuer.href}" from discovery URL "${discoveryUrl.href}" (HTTP ${response.status}).`);
-		}
-	}
-	validateAuthorizationServer(as) {
-		if (!as.authorization_endpoint || !as.token_endpoint || !as.pushed_authorization_request_endpoint) throw new Error("The UAPKG authorization server is missing required authorization, token, or PAR endpoints.");
-		if (!as.revocation_endpoint) throw new Error("The UAPKG authorization server is missing its grant revocation endpoint.");
-		if (as.code_challenge_methods_supported && !as.code_challenge_methods_supported.includes("S256")) throw new Error("The UAPKG authorization server does not support PKCE S256.");
-		if (as.dpop_signing_alg_values_supported && !as.dpop_signing_alg_values_supported.includes("ES256")) throw new Error("The UAPKG authorization server does not support ES256 DPoP proofs.");
-	}
-	assertIssuerSupportsScopes(as, trust, requestedScopes) {
-		const advertisedScopes = new Set(Array.isArray(as.scopes_supported) ? as.scopes_supported : []);
-		const unsupportedScopes = requestedScopes.filter((scope) => !advertisedScopes.has(scope));
-		if (unsupportedScopes.length > 0) throw new OAuthScopeUnsupportedError(trust.alias, requestedScopes, unsupportedScopes);
-	}
-	client() {
-		return {
-			client_id: UAPKG_CLI_CLIENT_ID,
-			token_endpoint_auth_method: "none"
-		};
-	}
-	assertPinnedTrust(trust) {
-		if (trust.issuer !== UAPKG_AUTHORIZATION_ISSUER || trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API || trust.resource !== registryAudience(trust.registryId)) throw new Error("UAPKG v1 does not accept project-configured authorization issuers or API URLs.");
-	}
-	assertInteractiveLogin() {
-		if (this.isInteractiveLogin()) return;
-		throw new Error([
-			"Unable to complete interactive login on this machine.",
-			"",
-			"Persistent login is not supported in headless environments.",
-			"",
-			"For automated publishing, configure a GitHub Actions OIDC trusted publisher.",
-			"For interactive publishing, run `uapkg login` from a trusted, browser-capable workstation."
-		].join("\n"));
-	}
-	async withDPoPNonceRetry(request, processResponse) {
-		try {
-			return await processResponse(await request());
-		} catch (error) {
-			if (!oauth.isDPoPNonceError(error)) throw error;
-			return processResponse(await request());
-		}
-	}
-	accessTokenCacheKey(grant, scopes) {
-		return `${grant.issuer}|${grant.registryId}|${grant.grantId}|${scopes.join(" ")}`;
-	}
-	async serializeGrantOperation(trust, operation) {
-		const key = `${trust.issuer}|${trust.registryId}`;
-		const result = (this.grantOperationTails.get(key) ?? Promise.resolve()).then(() => this.grantLock.withLock(trust.issuer, trust.registryId, operation));
-		const tail = result.then(() => void 0, () => void 0);
-		this.grantOperationTails.set(key, tail);
-		try {
-			return await result;
-		} finally {
-			if (this.grantOperationTails.get(key) === tail) this.grantOperationTails.delete(key);
-		}
-	}
-};
-function signingDPoPHandle(handle) {
-	const signer = handle;
-	if (typeof signer.addProof !== "function" || typeof signer.cacheNonce !== "function") throw new Error("The installed OAuth implementation cannot sender-constrain grant revocation.");
-	return signer;
-}
-var LoopbackAuthorizationReceiver = class LoopbackAuthorizationReceiver {
-	server;
-	callbackPath;
-	expectedHost;
-	completionUrl;
-	redirectUri;
-	callbackPromise;
-	callbackResolve;
-	callbackReject;
-	receivedReceipt;
-	timeout;
-	state = "listening";
-	terminalError;
-	pendingResponse;
-	completion;
-	constructor(server, callbackPath, expectedHost, completionUrl, redirectUri) {
-		this.server = server;
-		this.callbackPath = callbackPath;
-		this.expectedHost = expectedHost;
-		this.completionUrl = completionUrl;
-		this.redirectUri = redirectUri;
-	}
-	static async listen(issuer) {
-		const callbackPath = LOOPBACK_CALLBACK_PATH;
-		let receiver;
-		const server = createServer((request, response) => {
-			if (!receiver) {
-				response.writeHead(503).end();
-				return;
-			}
-			receiver.receive(request, response);
-		});
-		await new Promise((resolve, reject) => {
-			server.once("error", reject);
-			server.listen(0, "127.0.0.1", () => resolve());
-		});
-		const address = server.address();
-		if (!address || typeof address === "string") {
-			server.close();
-			throw new Error("Unable to determine the interactive login callback address.");
-		}
-		const expectedHost = `127.0.0.1:${address.port}`;
-		receiver = new LoopbackAuthorizationReceiver(server, callbackPath, expectedHost, new URL(ACCOUNT_COMPLETION_PATH, issuer.origin), `http://${expectedHost}${callbackPath}`);
-		return receiver;
-	}
-	async waitForCallback(timeoutMs, registryAlias) {
-		if (this.receivedReceipt) return this.receivedReceipt;
-		if (this.state === "closed") throw this.terminalError ?? new LoginError("LOGIN_FAILED", "The browser authorization listener was closed.");
-		if (this.callbackPromise) return this.callbackPromise;
-		this.callbackPromise = new Promise((resolve, reject) => {
-			this.callbackResolve = resolve;
-			this.callbackReject = reject;
-			this.timeout = setTimeout(() => {
-				if (this.state !== "listening") return;
-				this.terminate(new LoginError("LOGIN_AUTHORIZATION_TIMEOUT", registryAlias ? `Login timed out while waiting for browser authorization. Run \`uapkg login --registry ${registryAlias}\` to try again.` : "Login timed out while waiting for browser authorization. Run `uapkg login` to try again."));
-			}, timeoutMs);
-		});
-		return this.callbackPromise;
-	}
-	close() {
-		this.terminate(new LoginError("LOGIN_FAILED", "The browser authorization listener was closed."));
-	}
-	receive(request, response) {
-		if (this.state !== "listening" || request.method !== "GET" || request.headers.host !== this.expectedHost || request.url !== this.callbackPath && !request.url?.startsWith(`${this.callbackPath}?`)) {
-			rejectLoopbackRequest(response);
-			return;
-		}
-		let url;
-		try {
-			url = new URL(request.url, this.redirectUri);
-		} catch {
-			rejectLoopbackRequest(response);
-			return;
-		}
-		if (url.origin !== new URL(this.redirectUri).origin || url.pathname !== this.callbackPath) {
-			rejectLoopbackRequest(response);
-			return;
-		}
-		this.state = "callback-accepted";
-		if (this.timeout) clearTimeout(this.timeout);
-		this.timeout = void 0;
-		this.pendingResponse = response;
-		const receipt = {
-			url,
-			complete: (outcome) => this.complete(response, outcome)
-		};
-		this.receivedReceipt = receipt;
-		this.callbackResolve?.(receipt);
-		this.callbackResolve = void 0;
-		this.callbackReject = void 0;
-	}
-	complete(response, outcome) {
-		if (this.completion) return this.completion;
-		this.completion = new Promise((resolve) => {
-			let settled = false;
-			const finish = () => {
-				if (settled) return;
-				settled = true;
-				this.pendingResponse = void 0;
-				this.close();
-				resolve();
-			};
-			response.once("finish", finish);
-			response.once("close", finish);
-			response.once("error", finish);
-			if (response.destroyed || response.writableEnded) {
-				finish();
-				return;
-			}
-			const location = new URL(this.completionUrl);
-			location.hash = new URLSearchParams({ result: outcome }).toString();
-			try {
-				response.writeHead(303, {
-					location: location.href,
-					"cache-control": "no-store",
-					"referrer-policy": "no-referrer",
-					"content-length": "0",
-					"x-content-type-options": "nosniff",
-					connection: "close"
-				}).end();
-			} catch {
-				finish();
-			}
-		});
-		return this.completion;
-	}
-	terminate(error) {
-		if (this.state === "closed") return;
-		this.state = "closed";
-		this.terminalError = error;
-		if (this.timeout) clearTimeout(this.timeout);
-		this.timeout = void 0;
-		this.callbackReject?.(error);
-		this.callbackResolve = void 0;
-		this.callbackReject = void 0;
-		if (this.pendingResponse && !this.pendingResponse.writableEnded) this.pendingResponse.destroy();
-		this.pendingResponse = void 0;
-		this.server.close();
-	}
-};
-function rejectLoopbackRequest(response) {
-	response.writeHead(404, {
-		"cache-control": "no-store",
-		"content-type": "text/plain; charset=utf-8",
-		"x-content-type-options": "nosniff"
-	}).end("Not found.");
-}
-function normalizeDeviceName(value) {
-	return (value?.trim() || hostname().trim() || "UAPKG CLI").slice(0, 80);
-}
-function oidcDiscoveryUrl(issuer) {
-	const discoveryUrl = new URL(issuer);
-	discoveryUrl.pathname = `${discoveryUrl.pathname.replace(/\/+$/, "")}/.well-known/openid-configuration`;
-	return discoveryUrl;
-}
-function timestampFromIso(value) {
-	const parsed = Date.parse(value);
-	if (!Number.isFinite(parsed)) throw new Error("The authorization server returned an invalid registry-grant expiration.");
-	return Math.floor(parsed / 1e3);
-}
-function missingKeyError(trust) {
-	return new Error([
-		`The saved login for "${trust.alias}" cannot be used because its device-bound signing key is missing or has changed.`,
-		"",
-		"This can happen after copying configuration to another computer, resetting secure storage,",
-		"restoring an incomplete backup, or reinstalling the operating system.",
-		"",
-		`Run \`uapkg login --registry ${trust.alias} --reauthorize\` to authorize this device again.`
-	].join("\n"));
-}
-function loginFinalizationTimeoutError(registryAlias) {
-	return new LoginError("LOGIN_AUTHORIZATION_TIMEOUT", `Login timed out while verifying and saving browser authorization. No new login was saved. Run \`uapkg login --registry ${registryAlias}\` to try again.`);
-}
-function loginConfirmationAmbiguousError(registryAlias) {
-	return new LoginError("LOGIN_FAILED", [
-		"UAPKG could not determine whether the service activated this login.",
-		"Your saved credentials were kept because this login may be active.",
-		`Run \`uapkg whoami --registry ${registryAlias}\` to check the login before retrying.`
-	].join(" "));
-}
-function loginReauthorizationConflictError(registryAlias) {
-	return new LoginError("LOGIN_REAUTHORIZATION_CONFLICT", `The saved login for "${registryAlias}" changed while reauthorization was in progress. The newer local login was preserved. Run \`uapkg login --registry ${registryAlias} --reauthorize\` again if you still want to replace it.`);
-}
-function loginReplacementBindingError(registryAlias) {
-	return new LoginError("LOGIN_REAUTHORIZATION_CONFLICT", `The authorization service did not bind this login to the expected saved grant for "${registryAlias}". No new local login was saved. Run \`uapkg login --registry ${registryAlias} --reauthorize\` to try again.`);
-}
-function reauthorizationConflictLoginError(error) {
-	return new LoginError("LOGIN_REAUTHORIZATION_CONFLICT", error.message);
-}
-function isCliLoginReauthorizationConflict(error) {
-	return error instanceof ControlPlaneError && error.code === "CLI_LOGIN_REAUTHORIZATION_CONFLICT";
-}
-function isSameRegistryGrant(expected, current) {
-	if (!expected || !current) return expected === current;
-	return expected.grantId === current.grantId && expected.keyReference === current.keyReference && expected.refreshTokenReference === current.refreshTokenReference;
-}
-function isDefinitiveCliLoginConfirmationRejection(error) {
-	if (!(error instanceof ControlPlaneError) || error.status === void 0) return false;
-	if (error.status < 400 || error.status >= 500) return false;
-	return ![
-		408,
-		409,
-		425,
-		429
-	].includes(error.status);
-}
-function emitLoginProgress(onProgress, event) {
-	try {
-		onProgress?.(event);
-	} catch {}
-}
-function authorizationResponseLoginError(error) {
-	if (error instanceof oauth.AuthorizationResponseError) {
-		const oauthError = sanitizeOAuthErrorIdentifier(error.error);
-		const description = sanitizeOAuthErrorDescription(error.error_description);
-		if (oauthError === "access_denied") return new LoginError("LOGIN_ACCESS_DENIED", `Login denied: ${description ?? "The user denied the registry grant."} (access_denied)`, oauthError);
-		return new LoginError("LOGIN_OAUTH_ERROR", `Login failed: ${description ?? "The authorization server rejected the request."}${oauthError ? ` (${oauthError})` : ""}`, oauthError);
-	}
-	return new LoginError("LOGIN_AUTHORIZATION_RESPONSE_INVALID", "The browser authorization response was invalid. Run `uapkg login` again.");
-}
-function normalizeLoginError(error) {
-	if (error instanceof LoginError) return error;
-	if (isCliLoginReauthorizationConflict(error)) return reauthorizationConflictLoginError(error);
-	if (error instanceof oauth.AuthorizationResponseError) return authorizationResponseLoginError(error);
-	if (error instanceof oauth.ResponseBodyError) {
-		const oauthError = sanitizeOAuthErrorIdentifier(error.error);
-		const description = sanitizeOAuthErrorDescription(error.error_description);
-		return new LoginError("LOGIN_OAUTH_ERROR", `Login failed: ${description ?? "The authorization server rejected the request."}${oauthError ? ` (${oauthError})` : ""}`, oauthError);
-	}
-	return new LoginError("LOGIN_FAILED", describeControlPlaneError(error));
-}
-function sanitizeOAuthErrorIdentifier(value) {
-	return value && /^[a-z][a-z0-9._~-]{0,63}$/i.test(value) ? value : void 0;
-}
-function sanitizeOAuthErrorDescription(value) {
-	if (!value) return void 0;
-	const sanitized = Array.from(value, (character) => {
-		return isUnsafeOAuthDescriptionCodePoint(character.codePointAt(0) ?? 0) ? " " : character;
-	}).join("").replace(/\s+/g, " ").trim();
-	return sanitized ? Array.from(sanitized).slice(0, 300).join("") : void 0;
-}
-function isUnsafeOAuthDescriptionCodePoint(codePoint) {
-	return codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 1564 || codePoint === 8206 || codePoint === 8207 || codePoint >= 8234 && codePoint <= 8238 || codePoint === 8232 || codePoint === 8233 || codePoint >= 8294 && codePoint <= 8297;
-}
-function loginDiagnosticForError(error) {
-	const loginError = normalizeLoginError(error);
-	return {
-		level: "error",
-		code: loginError.code,
-		message: loginError.message,
-		data: loginError.oauthError ? { oauthError: loginError.oauthError } : {}
-	};
-}
-function controlPlaneDiagnosticForError(error, operation) {
-	const serverCode = error instanceof ControlPlaneError && CONTROL_PLANE_SERVER_CODE_PATTERN.test(error.code) ? error.code : void 0;
-	const status = error instanceof ControlPlaneError && error.status !== void 0 && Number.isInteger(error.status) && error.status >= 100 && error.status <= 599 ? error.status : void 0;
-	const data = {
-		operation,
-		...serverCode === void 0 ? {} : { serverCode },
-		...status === void 0 ? {} : { status }
-	};
-	return createControlPlaneCommandFailedDiagnostic(describeControlPlaneError(error), data);
-}
-function describeControlPlaneError(error) {
-	if (error instanceof LoginError) return error.message;
-	if (error instanceof OAuthScopeInsufficientError && error.missingScopes.length > 0) {
-		const scopes = error.missingScopes.map((scope) => `\`${scope}\``).join(", ");
-		return `Missing authorization ${error.missingScopes.length === 1 ? "scope" : "scopes"} ${scopes} for this action.\nRun \`uapkg login --registry ${error.registryAlias} --reauthorize\` to authorize the capabilities required by this CLI version.`;
-	}
-	if (error instanceof ControlPlaneError) {
-		if (error.status === 401 && requiresSavedLoginRenewal(error.code)) return `${error.message}\n\nRun \`uapkg login\` to authenticate again.`;
-		return `${error.message} (${error.code})`;
-	}
-	return error instanceof Error ? error.message : String(error);
-}
-function requiresSavedLoginRenewal(code) {
-	const normalized = code.toUpperCase();
-	return normalized.startsWith("DPOP_") || normalized.startsWith("REGISTRY_GRANT_") || normalized === "CONTROL_PLANE_AUTHENTICATION_REQUIRED" || normalized === "CLI_ACCESS_TOKEN_INVALID" || normalized === "CLI_ACCESS_TOKEN_EXPIRED";
-}
-
-//#endregion
-export { AccountManager, LoginError, LoopbackAuthorizationReceiver, controlPlaneDiagnosticForError, describeControlPlaneError, loginDiagnosticForError };
-//# sourceMappingURL=AccountManager.js.map