@uapkg/cli 1.4.0 → 1.5.0

package/dist/control-plane/ControlPlaneClient.js

@@ -1,291 +0,0 @@
-import { ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, UAPKG_CONTROL_PLANE_API, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, parseOAuthScopeTokens } from "./ControlPlaneTypes.js";
-import * as oauth from "oauth4webapi";
-import { randomUUID } from "node:crypto";
-import { z } from "zod";
-
-//#region src/control-plane/ControlPlaneClient.ts
-const errorSchema = z.object({
-	ok: z.literal(false),
-	error: z.object({
-		code: z.string(),
-		message: z.string(),
-		details: z.record(z.string(), z.unknown()).optional()
-	})
-});
-const insufficientScopeDetailsSchema = z.object({
-	requiredScopes: z.array(z.string()),
-	missingScopes: z.array(z.string())
-});
-const accountSchema = z.object({
-	id: z.uuid(),
-	username: z.string().min(1),
-	displayName: z.string().min(1)
-});
-const accountGrantSchema = z.object({
-	id: z.uuid(),
-	deviceName: z.string().min(1),
-	idleExpiresAt: z.iso.datetime(),
-	absoluteExpiresAt: z.iso.datetime(),
-	scopes: z.array(z.string())
-});
-const accountResponseSchema = z.object({
-	ok: z.literal(true),
-	account: accountSchema,
-	registry: z.object({ id: z.uuid() }),
-	grant: accountGrantSchema
-});
-const cliLoginConfirmationResponseSchema = accountResponseSchema.extend({ grant: accountGrantSchema.extend({
-	status: z.enum(["pending", "active"]),
-	activationExpiresAt: z.iso.datetime(),
-	replacesGrantId: z.uuid().nullable()
-}) });
-const activatedCliLoginResponseSchema = z.object({
-	ok: z.literal(true),
-	grant: z.object({
-		id: z.uuid(),
-		status: z.literal("active"),
-		replacesGrantId: z.uuid().nullable()
-	})
-});
-const requestStatusSchema = z.enum([
-	"queued",
-	"checking",
-	"accepted",
-	"ready",
-	"ready_superseded",
-	"rejected",
-	"operationally_failed"
-]);
-const requestSummarySchema = z.object({
-	id: z.string().min(1),
-	registryId: z.string().min(1),
-	kind: z.string().min(1),
-	status: requestStatusSchema,
-	currentStep: z.string().optional(),
-	createdAt: z.number().optional(),
-	updatedAt: z.number().optional(),
-	payload: z.object({
-		packageName: z.string().optional(),
-		packageVersion: z.string().optional()
-	}).loose().optional()
-}).loose();
-const requestCheckIdSchema = z.string().trim().min(1).max(128).refine((value) => !hasUnsafeDisplayCharacter(value));
-const requestCheckReasonCodeSchema = z.string().trim().min(1).max(128).refine((value) => !hasUnsafeDisplayCharacter(value));
-const terminalFailureReasonCodeSchema = z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/u);
-const requestCheckSchema = z.object({
-	checkId: requestCheckIdSchema,
-	executionState: z.enum([
-		"pending",
-		"running",
-		"retrying",
-		"blocked_by_dependency",
-		"completed"
-	]),
-	conclusion: z.enum([
-		"success",
-		"failure",
-		"skipped"
-	]).optional(),
-	reasonCode: requestCheckReasonCodeSchema.optional()
-});
-const terminalFailureSchema = z.object({
-	reasonCode: terminalFailureReasonCodeSchema,
-	attempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
-	maxAttempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
-});
-const requestDetailResponseSchema = z.object({
-	ok: z.literal(true),
-	request: requestSummarySchema,
-	checks: z.array(requestCheckSchema).max(100).optional(),
-	terminalFailure: terminalFailureSchema.optional()
-});
-var ControlPlaneClient = class {
-	apiBaseUrl;
-	constructor(apiBaseUrl = UAPKG_CONTROL_PLANE_API) {
-		const normalized = new URL(apiBaseUrl).href.replace(/\/+$/, "");
-		if (normalized !== UAPKG_CONTROL_PLANE_API) throw new Error(`UAPKG v1 control-plane requests are pinned to ${UAPKG_CONTROL_PLANE_API}.`);
-		this.apiBaseUrl = normalized;
-	}
-	async getSelf(credential, signal) {
-		const value = await this.requestJson(credential, "GET", "/v1/account/self", { signal });
-		const parsed = accountResponseSchema.safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("ACCOUNT_SELF_RESPONSE_INVALID", "The account identity response was invalid.");
-		return {
-			account: parsed.data.account,
-			registry: parsed.data.registry,
-			grant: parsed.data.grant
-		};
-	}
-	async getCliLoginConfirmation(credential, signal) {
-		const value = await this.requestJson(credential, "GET", "/v1/account/cli-login/confirmation", { signal });
-		const parsed = cliLoginConfirmationResponseSchema.safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID", "The CLI login confirmation response was invalid.");
-		return {
-			account: parsed.data.account,
-			registry: parsed.data.registry,
-			grant: parsed.data.grant
-		};
-	}
-	async confirmCliLogin(credential, signal) {
-		const value = await this.requestJson(credential, "POST", "/v1/account/cli-login/confirmation", { signal });
-		const parsed = activatedCliLoginResponseSchema.safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID", "The CLI login confirmation response was invalid.");
-		return parsed.data.grant;
-	}
-	async submitRegistryRequest(credential, operation, submission, options = {}) {
-		const value = await this.requestJson(credential, "POST", `/v1/registry-requests/${encodeURIComponent(operation)}`, {
-			body: JSON.stringify(submission),
-			headers: {
-				"content-type": "application/json",
-				"x-uapkg-idempotency-key": options.idempotencyKey ?? randomUUID(),
-				...options.otp ? { "x-uapkg-otp": options.otp } : {}
-			}
-		});
-		const parsed = z.object({
-			ok: z.literal(true),
-			requestId: z.string().min(1),
-			status: requestStatusSchema,
-			message: z.string()
-		}).safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
-		return parsed.data;
-	}
-	async getRegistryRequest(credential, requestId) {
-		const value = await this.requestJson(credential, "GET", `/v1/registry-requests/${encodeURIComponent(requestId)}`);
-		const parsed = z.object({
-			ok: z.literal(true),
-			request: requestSummarySchema
-		}).safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
-		return parsed.data.request;
-	}
-	/**
-	* Reads the additive request-detail projection. The older
-	* `getRegistryRequest` method deliberately remains summary-only so callers
-	* compiled against the original response contract keep their behavior.
-	*/
-	async getRegistryRequestDetail(credential, requestId) {
-		const value = await this.requestJson(credential, "GET", `/v1/registry-requests/${encodeURIComponent(requestId)}`);
-		const parsed = requestDetailResponseSchema.safeParse(value);
-		if (!parsed.success) throw new ControlPlaneError("REGISTRY_REQUEST_RESPONSE_INVALID", "The publishing request response was invalid.");
-		return {
-			request: parsed.data.request,
-			...parsed.data.checks ? { checks: parsed.data.checks } : {},
-			...parsed.data.terminalFailure ? { terminalFailure: parsed.data.terminalFailure } : {}
-		};
-	}
-	async listRegistryRequests(credential, registryId, status) {
-		const query = new URLSearchParams({ registryId });
-		if (status) query.set("status", status);
-		const value = await this.requestJson(credential, "GET", `/v1/registry-requests?${query.toString()}`);
-		const parsed = z.object({
-			ok: z.literal(true),
-			recentRequests: z.array(requestSummarySchema).optional(),
-			requests: z.array(requestSummarySchema).optional()
-		}).safeParse(value);
-		if (!parsed.success || !parsed.data.recentRequests && !parsed.data.requests) throw new ControlPlaneError("REGISTRY_REQUEST_LIST_RESPONSE_INVALID", "The publishing request list response was invalid.");
-		return parsed.data.recentRequests ?? parsed.data.requests ?? [];
-	}
-	async requestJson(credential, method, path, init = {}) {
-		const url = new URL(path, this.apiBaseUrl);
-		const headers = new Headers(init.headers);
-		let response;
-		if (credential.kind === "dpop") try {
-			response = await this.withDPoPNonceRetry(() => oauth.protectedResourceRequest(credential.accessToken, method, url, headers, init.body, {
-				DPoP: credential.dpop,
-				signal: boundedRequestSignal(init.signal)
-			}));
-		} catch (error) {
-			if (error instanceof oauth.WWWAuthenticateChallengeError) throw await controlPlaneChallengeError(error, credential);
-			throw error;
-		}
-		else {
-			headers.set("authorization", `Bearer ${credential.accessToken}`);
-			response = await fetch(url, {
-				method,
-				headers,
-				body: init.body,
-				redirect: "error",
-				signal: boundedRequestSignal(init.signal)
-			});
-		}
-		const value = await readJson(response);
-		if (!response.ok) {
-			const parsed = errorSchema.safeParse(value);
-			if (parsed.success) throw new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, response.status, parsed.data.error.details);
-			throw new ControlPlaneError(`HTTP_${response.status}`, `The UAPKG control plane returned HTTP ${response.status}.`, response.status);
-		}
-		return value;
-	}
-	async withDPoPNonceRetry(operation) {
-		try {
-			return await operation();
-		} catch (error) {
-			if (!oauth.isDPoPNonceError(error)) throw error;
-			return operation();
-		}
-	}
-};
-function hasUnsafeDisplayCharacter(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0);
-		if (codePoint !== void 0 && (codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 1564 || codePoint === 8206 || codePoint === 8207 || codePoint >= 8232 && codePoint <= 8238 || codePoint >= 8294 && codePoint <= 8297)) return true;
-	}
-	return false;
-}
-function boundedRequestSignal(signal) {
-	const timeout = AbortSignal.timeout(3e4);
-	return signal ? AbortSignal.any([signal, timeout]) : timeout;
-}
-async function readJson(response) {
-	const text = await response.text();
-	if (text.trim().length === 0) return {};
-	try {
-		return JSON.parse(text);
-	} catch (error) {
-		throw new ControlPlaneError("CONTROL_PLANE_RESPONSE_NOT_JSON", `The UAPKG control plane returned a non-JSON response (HTTP ${response.status}).`, response.status, void 0, { cause: error });
-	}
-}
-async function controlPlaneChallengeError(error, credential) {
-	const value = await tryReadJson(error.response);
-	const parsed = errorSchema.safeParse(value);
-	if (error.status === 403 && parsed.success && parsed.data.error.code === "OAUTH_SCOPE_INSUFFICIENT") {
-		const details = insufficientScopeDetailsSchema.safeParse(parsed.data.error.details);
-		if (details.success) {
-			const headerRequiredScopeTokens = error.cause.flatMap((challenge) => challenge.scheme === "dpop" && challenge.parameters.error === "insufficient_scope" ? parseOAuthScopeTokens(challenge.parameters.scope) : []);
-			const bodyRequiredScopeTokens = validatedOAuthScopeTokens(details.data.requiredScopes);
-			const bodyMissingScopeTokens = validatedOAuthScopeTokens(details.data.missingScopes);
-			if (bodyRequiredScopeTokens && bodyMissingScopeTokens) {
-				const consistentRequiredScopeTokens = headerRequiredScopeTokens.filter((scope) => bodyRequiredScopeTokens.includes(scope));
-				const consistentMissingScopeTokens = consistentRequiredScopeTokens.filter((scope) => bodyMissingScopeTokens.includes(scope));
-				const requestedScopes = knownUAPKGCliScopes(credential.requestedScopes);
-				if (consistentMissingScopeTokens.some((scope) => !isUAPKGCliScope(scope))) return new OAuthScopeUnsupportedError(credential.registryAlias, requestedScopes, [], {
-					cause: error,
-					reason: "cli-update-required",
-					status: error.status
-				});
-				const requiredScopes = knownUAPKGCliScopes(consistentRequiredScopeTokens);
-				const missingScopes = knownUAPKGCliScopes(consistentMissingScopeTokens).filter((scope) => requestedScopes.includes(scope));
-				if (requiredScopes.length > 0 && missingScopes.length > 0) return new OAuthScopeInsufficientError(parsed.data.error.message, credential.registryAlias, requestedScopes, requiredScopes, missingScopes, error.status, { cause: error });
-			}
-		}
-	}
-	if (parsed.success) return new ControlPlaneError(parsed.data.error.code, parsed.data.error.message, error.status, parsed.data.error.details, { cause: error });
-	return new ControlPlaneError("CONTROL_PLANE_AUTHENTICATION_REQUIRED", "The UAPKG control plane rejected the saved login.", error.status, void 0, { cause: error });
-}
-function validatedOAuthScopeTokens(values) {
-	if (values.some((scope) => !isOAuthScopeToken(scope))) return void 0;
-	return [...new Set(values)];
-}
-async function tryReadJson(response) {
-	try {
-		const text = await response.text();
-		return text.trim().length > 0 ? JSON.parse(text) : void 0;
-	} catch {
-		return;
-	}
-}
-
-//#endregion
-export { ControlPlaneClient };
-//# sourceMappingURL=ControlPlaneClient.js.map

package/dist/control-plane/ControlPlaneClient.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ControlPlaneClient.js","names":[],"sources":["../../src/control-plane/ControlPlaneClient.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport * as oauth from 'oauth4webapi';\nimport { z } from 'zod';\nimport {\n  type AccountSelf,\n  type ActivatedCliLoginGrant,\n  type CliLoginConfirmation,\n  ControlPlaneError,\n  isOAuthScopeToken,\n  isUAPKGCliScope,\n  knownUAPKGCliScopes,\n  OAuthScopeInsufficientError,\n  OAuthScopeUnsupportedError,\n  parseOAuthScopeTokens,\n  type RegistryOperation,\n  type RegistryRequestDetail,\n  type RegistryRequestStatus,\n  type RegistryRequestSubmission,\n  type RegistryRequestSummary,\n  UAPKG_CONTROL_PLANE_API,\n  type UAPKGCliScope,\n} from '#cli/control-plane/ControlPlaneTypes.ts';\n\nexport type ControlPlaneCredential =\n  | {\n      readonly kind: 'dpop';\n      readonly accessToken: string;\n      readonly dpop: oauth.DPoPHandle;\n      readonly registryAlias: string;\n      readonly requestedScopes: readonly UAPKGCliScope[];\n    }\n  | {\n      readonly kind: 'bearer';\n      readonly accessToken: string;\n    };\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.object({\n    code: z.string(),\n    message: z.string(),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\n\nconst insufficientScopeDetailsSchema = z.object({\n  requiredScopes: z.array(z.string()),\n  missingScopes: z.array(z.string()),\n});\n\nconst accountSchema = z.object({\n  id: z.uuid(),\n  username: z.string().min(1),\n  displayName: z.string().min(1),\n});\n\nconst accountGrantSchema = z.object({\n  id: z.uuid(),\n  deviceName: z.string().min(1),\n  idleExpiresAt: z.iso.datetime(),\n  absoluteExpiresAt: z.iso.datetime(),\n  scopes: z.array(z.string()),\n});\n\nconst accountResponseSchema = z.object({\n  ok: z.literal(true),\n  account: accountSchema,\n  registry: z.object({\n    id: z.uuid(),\n  }),\n  grant: accountGrantSchema,\n});\n\nconst cliLoginConfirmationResponseSchema = accountResponseSchema.extend({\n  grant: accountGrantSchema.extend({\n    status: z.enum(['pending', 'active']),\n    activationExpiresAt: z.iso.datetime(),\n    replacesGrantId: z.uuid().nullable(),\n  }),\n});\n\nconst activatedCliLoginResponseSchema = z.object({\n  ok: z.literal(true),\n  grant: z.object({\n    id: z.uuid(),\n    status: z.literal('active'),\n    replacesGrantId: z.uuid().nullable(),\n  }),\n});\n\nconst requestStatusSchema = z.enum([\n  'queued',\n  'checking',\n  'accepted',\n  'ready',\n  'ready_superseded',\n  'rejected',\n  'operationally_failed',\n]);\n\nconst requestSummarySchema = z\n  .object({\n    id: z.string().min(1),\n    registryId: z.string().min(1),\n    kind: z.string().min(1),\n    status: requestStatusSchema,\n    currentStep: z.string().optional(),\n    createdAt: z.number().optional(),\n    updatedAt: z.number().optional(),\n    payload: z\n      .object({\n        packageName: z.string().optional(),\n        packageVersion: z.string().optional(),\n      })\n      .loose()\n      .optional(),\n  })\n  .loose();\n\nconst requestCheckIdSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine((value) => !hasUnsafeDisplayCharacter(value));\nconst requestCheckReasonCodeSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine((value) => !hasUnsafeDisplayCharacter(value));\nconst terminalFailureReasonCodeSchema = z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/u);\nconst requestCheckSchema = z.object({\n  checkId: requestCheckIdSchema,\n  executionState: z.enum(['pending', 'running', 'retrying', 'blocked_by_dependency', 'completed']),\n  conclusion: z.enum(['success', 'failure', 'skipped']).optional(),\n  reasonCode: requestCheckReasonCodeSchema.optional(),\n});\nconst terminalFailureSchema = z.object({\n  reasonCode: terminalFailureReasonCodeSchema,\n  attempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),\n  maxAttempts: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),\n});\nconst requestDetailResponseSchema = z.object({\n  ok: z.literal(true),\n  request: requestSummarySchema,\n  checks: z.array(requestCheckSchema).max(100).optional(),\n  terminalFailure: terminalFailureSchema.optional(),\n});\n\nexport class ControlPlaneClient {\n  private readonly apiBaseUrl: string;\n\n  public constructor(apiBaseUrl = UAPKG_CONTROL_PLANE_API) {\n    const normalized = new URL(apiBaseUrl).href.replace(/\\/+$/, '');\n    if (normalized !== UAPKG_CONTROL_PLANE_API) {\n      throw new Error(`UAPKG v1 control-plane requests are pinned to ${UAPKG_CONTROL_PLANE_API}.`);\n    }\n    this.apiBaseUrl = normalized;\n  }\n\n  public async getSelf(credential: ControlPlaneCredential, signal?: AbortSignal): Promise<AccountSelf> {\n    const value = await this.requestJson(credential, 'GET', '/v1/account/self', { signal });\n    const parsed = accountResponseSchema.safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError('ACCOUNT_SELF_RESPONSE_INVALID', 'The account identity response was invalid.');\n    }\n    return {\n      account: parsed.data.account,\n      registry: parsed.data.registry,\n      grant: parsed.data.grant,\n    };\n  }\n\n  public async getCliLoginConfirmation(\n    credential: ControlPlaneCredential,\n    signal?: AbortSignal,\n  ): Promise<CliLoginConfirmation> {\n    const value = await this.requestJson(credential, 'GET', '/v1/account/cli-login/confirmation', { signal });\n    const parsed = cliLoginConfirmationResponseSchema.safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError(\n        'CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID',\n        'The CLI login confirmation response was invalid.',\n      );\n    }\n    return {\n      account: parsed.data.account,\n      registry: parsed.data.registry,\n      grant: parsed.data.grant,\n    };\n  }\n\n  public async confirmCliLogin(\n    credential: ControlPlaneCredential,\n    signal?: AbortSignal,\n  ): Promise<ActivatedCliLoginGrant> {\n    const value = await this.requestJson(credential, 'POST', '/v1/account/cli-login/confirmation', { signal });\n    const parsed = activatedCliLoginResponseSchema.safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError(\n        'CLI_LOGIN_CONFIRMATION_RESPONSE_INVALID',\n        'The CLI login confirmation response was invalid.',\n      );\n    }\n    return parsed.data.grant;\n  }\n\n  public async submitRegistryRequest(\n    credential: ControlPlaneCredential,\n    operation: RegistryOperation,\n    submission: RegistryRequestSubmission,\n    options: { readonly idempotencyKey?: string; readonly otp?: string } = {},\n  ): Promise<{ requestId: string; status: RegistryRequestStatus; message: string }> {\n    const value = await this.requestJson(credential, 'POST', `/v1/registry-requests/${encodeURIComponent(operation)}`, {\n      body: JSON.stringify(submission),\n      headers: {\n        'content-type': 'application/json',\n        'x-uapkg-idempotency-key': options.idempotencyKey ?? randomUUID(),\n        ...(options.otp ? { 'x-uapkg-otp': options.otp } : {}),\n      },\n    });\n    const parsed = z\n      .object({\n        ok: z.literal(true),\n        requestId: z.string().min(1),\n        status: requestStatusSchema,\n        message: z.string(),\n      })\n      .safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');\n    }\n    return parsed.data;\n  }\n\n  public async getRegistryRequest(\n    credential: ControlPlaneCredential,\n    requestId: string,\n  ): Promise<RegistryRequestSummary> {\n    const value = await this.requestJson(credential, 'GET', `/v1/registry-requests/${encodeURIComponent(requestId)}`);\n    const parsed = z.object({ ok: z.literal(true), request: requestSummarySchema }).safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');\n    }\n    return parsed.data.request;\n  }\n\n  /**\n   * Reads the additive request-detail projection. The older\n   * `getRegistryRequest` method deliberately remains summary-only so callers\n   * compiled against the original response contract keep their behavior.\n   */\n  public async getRegistryRequestDetail(\n    credential: ControlPlaneCredential,\n    requestId: string,\n  ): Promise<RegistryRequestDetail> {\n    const value = await this.requestJson(credential, 'GET', `/v1/registry-requests/${encodeURIComponent(requestId)}`);\n    const parsed = requestDetailResponseSchema.safeParse(value);\n    if (!parsed.success) {\n      throw new ControlPlaneError('REGISTRY_REQUEST_RESPONSE_INVALID', 'The publishing request response was invalid.');\n    }\n    return {\n      request: parsed.data.request,\n      ...(parsed.data.checks ? { checks: parsed.data.checks } : {}),\n      ...(parsed.data.terminalFailure ? { terminalFailure: parsed.data.terminalFailure } : {}),\n    };\n  }\n\n  public async listRegistryRequests(\n    credential: ControlPlaneCredential,\n    registryId: string,\n    status?: RegistryRequestStatus,\n  ): Promise<RegistryRequestSummary[]> {\n    const query = new URLSearchParams({ registryId });\n    if (status) query.set('status', status);\n    const value = await this.requestJson(credential, 'GET', `/v1/registry-requests?${query.toString()}`);\n    const parsed = z\n      .object({\n        ok: z.literal(true),\n        recentRequests: z.array(requestSummarySchema).optional(),\n        requests: z.array(requestSummarySchema).optional(),\n      })\n      .safeParse(value);\n    if (!parsed.success || (!parsed.data.recentRequests && !parsed.data.requests)) {\n      throw new ControlPlaneError(\n        'REGISTRY_REQUEST_LIST_RESPONSE_INVALID',\n        'The publishing request list response was invalid.',\n      );\n    }\n    return parsed.data.recentRequests ?? parsed.data.requests ?? [];\n  }\n\n  private async requestJson(\n    credential: ControlPlaneCredential,\n    method: string,\n    path: string,\n    init: {\n      readonly headers?: Readonly<Record<string, string>>;\n      readonly body?: string;\n      readonly signal?: AbortSignal;\n    } = {},\n  ): Promise<unknown> {\n    const url = new URL(path, this.apiBaseUrl);\n    const headers = new Headers(init.headers);\n    let response: Response;\n\n    if (credential.kind === 'dpop') {\n      try {\n        response = await this.withDPoPNonceRetry(() =>\n          oauth.protectedResourceRequest(credential.accessToken, method, url, headers, init.body, {\n            DPoP: credential.dpop,\n            signal: boundedRequestSignal(init.signal),\n          }),\n        );\n      } catch (error) {\n        if (error instanceof oauth.WWWAuthenticateChallengeError) {\n          throw await controlPlaneChallengeError(error, credential);\n        }\n        throw error;\n      }\n    } else {\n      headers.set('authorization', `Bearer ${credential.accessToken}`);\n      response = await fetch(url, {\n        method,\n        headers,\n        body: init.body,\n        redirect: 'error',\n        signal: boundedRequestSignal(init.signal),\n      });\n    }\n\n    const value = await readJson(response);\n    if (!response.ok) {\n      const parsed = errorSchema.safeParse(value);\n      if (parsed.success) {\n        throw new ControlPlaneError(\n          parsed.data.error.code,\n          parsed.data.error.message,\n          response.status,\n          parsed.data.error.details,\n        );\n      }\n      throw new ControlPlaneError(\n        `HTTP_${response.status}`,\n        `The UAPKG control plane returned HTTP ${response.status}.`,\n        response.status,\n      );\n    }\n    return value;\n  }\n\n  private async withDPoPNonceRetry<T>(operation: () => Promise<T>): Promise<T> {\n    try {\n      return await operation();\n    } catch (error) {\n      if (!oauth.isDPoPNonceError(error)) throw error;\n      return operation();\n    }\n  }\n}\n\nfunction hasUnsafeDisplayCharacter(value: string): boolean {\n  for (const character of value) {\n    const codePoint = character.codePointAt(0);\n    if (\n      codePoint !== undefined &&\n      (codePoint <= 0x1f ||\n        (codePoint >= 0x7f && codePoint <= 0x9f) ||\n        codePoint === 0x061c ||\n        codePoint === 0x200e ||\n        codePoint === 0x200f ||\n        (codePoint >= 0x2028 && codePoint <= 0x202e) ||\n        (codePoint >= 0x2066 && codePoint <= 0x2069))\n    ) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction boundedRequestSignal(signal?: AbortSignal): AbortSignal {\n  const timeout = AbortSignal.timeout(30_000);\n  return signal ? AbortSignal.any([signal, timeout]) : timeout;\n}\n\nasync function readJson(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (text.trim().length === 0) return {};\n  try {\n    return JSON.parse(text) as unknown;\n  } catch (error) {\n    throw new ControlPlaneError(\n      'CONTROL_PLANE_RESPONSE_NOT_JSON',\n      `The UAPKG control plane returned a non-JSON response (HTTP ${response.status}).`,\n      response.status,\n      undefined,\n      { cause: error },\n    );\n  }\n}\n\nasync function controlPlaneChallengeError(\n  error: oauth.WWWAuthenticateChallengeError,\n  credential: Extract<ControlPlaneCredential, { readonly kind: 'dpop' }>,\n): Promise<ControlPlaneError> {\n  const value = await tryReadJson(error.response);\n  const parsed = errorSchema.safeParse(value);\n\n  if (error.status === 403 && parsed.success && parsed.data.error.code === 'OAUTH_SCOPE_INSUFFICIENT') {\n    const details = insufficientScopeDetailsSchema.safeParse(parsed.data.error.details);\n    if (details.success) {\n      const headerRequiredScopeTokens = error.cause.flatMap((challenge) =>\n        challenge.scheme === 'dpop' && challenge.parameters.error === 'insufficient_scope'\n          ? parseOAuthScopeTokens(challenge.parameters.scope)\n          : [],\n      );\n      const bodyRequiredScopeTokens = validatedOAuthScopeTokens(details.data.requiredScopes);\n      const bodyMissingScopeTokens = validatedOAuthScopeTokens(details.data.missingScopes);\n      if (bodyRequiredScopeTokens && bodyMissingScopeTokens) {\n        const consistentRequiredScopeTokens = headerRequiredScopeTokens.filter((scope) =>\n          bodyRequiredScopeTokens.includes(scope),\n        );\n        const consistentMissingScopeTokens = consistentRequiredScopeTokens.filter((scope) =>\n          bodyMissingScopeTokens.includes(scope),\n        );\n        const requestedScopes = knownUAPKGCliScopes(credential.requestedScopes);\n        if (consistentMissingScopeTokens.some((scope) => !isUAPKGCliScope(scope))) {\n          return new OAuthScopeUnsupportedError(credential.registryAlias, requestedScopes, [], {\n            cause: error,\n            reason: 'cli-update-required',\n            status: error.status,\n          });\n        }\n\n        const requiredScopes = knownUAPKGCliScopes(consistentRequiredScopeTokens);\n        const missingScopes = knownUAPKGCliScopes(consistentMissingScopeTokens).filter((scope) =>\n          requestedScopes.includes(scope),\n        );\n        if (requiredScopes.length > 0 && missingScopes.length > 0) {\n          return new OAuthScopeInsufficientError(\n            parsed.data.error.message,\n            credential.registryAlias,\n            requestedScopes,\n            requiredScopes,\n            missingScopes,\n            error.status,\n            { cause: error },\n          );\n        }\n      }\n    }\n  }\n\n  if (parsed.success) {\n    return new ControlPlaneError(\n      parsed.data.error.code,\n      parsed.data.error.message,\n      error.status,\n      parsed.data.error.details,\n      { cause: error },\n    );\n  }\n  return new ControlPlaneError(\n    'CONTROL_PLANE_AUTHENTICATION_REQUIRED',\n    'The UAPKG control plane rejected the saved login.',\n    error.status,\n    undefined,\n    { cause: error },\n  );\n}\n\nfunction validatedOAuthScopeTokens(values: readonly string[]): string[] | undefined {\n  if (values.some((scope) => !isOAuthScopeToken(scope))) return undefined;\n  return [...new Set(values)];\n}\n\nasync function tryReadJson(response: Response): Promise<unknown> {\n  try {\n    const text = await response.text();\n    return text.trim().length > 0 ? (JSON.parse(text) as unknown) : undefined;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;AAoCA,MAAM,cAAc,EAAE,OAAO;CAC3B,IAAI,EAAE,QAAQ,KAAK;CACnB,OAAO,EAAE,OAAO;EACd,MAAM,EAAE,OAAO;EACf,SAAS,EAAE,OAAO;EAClB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACtD,CAAC;AACH,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;CAC9C,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC;CAClC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AACnC,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;CAC7B,IAAI,EAAE,KAAK;CACX,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;CAClC,IAAI,EAAE,KAAK;CACX,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,eAAe,EAAE,IAAI,SAAS;CAC9B,mBAAmB,EAAE,IAAI,SAAS;CAClC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC;AAC5B,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;CACrC,IAAI,EAAE,QAAQ,IAAI;CAClB,SAAS;CACT,UAAU,EAAE,OAAO,EACjB,IAAI,EAAE,KAAK,EACb,CAAC;CACD,OAAO;AACT,CAAC;AAED,MAAM,qCAAqC,sBAAsB,OAAO,EACtE,OAAO,mBAAmB,OAAO;CAC/B,QAAQ,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;CACpC,qBAAqB,EAAE,IAAI,SAAS;CACpC,iBAAiB,EAAE,KAAK,CAAC,CAAC,SAAS;AACrC,CAAC,EACH,CAAC;AAED,MAAM,kCAAkC,EAAE,OAAO;CAC/C,IAAI,EAAE,QAAQ,IAAI;CAClB,OAAO,EAAE,OAAO;EACd,IAAI,EAAE,KAAK;EACX,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,iBAAiB,EAAE,KAAK,CAAC,CAAC,SAAS;CACrC,CAAC;AACH,CAAC;AAED,MAAM,sBAAsB,EAAE,KAAK;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,uBAAuB,EAC1B,OAAO;CACN,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACpB,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACtB,QAAQ;CACR,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;CACjC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,SAAS,EACN,OAAO;EACN,aAAa,EAAE,OAAO,CAAC,CAAC,SAAS;EACjC,gBAAgB,EAAE,OAAO,CAAC,CAAC,SAAS;CACtC,CAAC,CAAC,CACD,MAAM,CAAC,CACP,SAAS;AACd,CAAC,CAAC,CACD,MAAM;AAET,MAAM,uBAAuB,EAC1B,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,UAAU,CAAC,0BAA0B,KAAK,CAAC;AACtD,MAAM,+BAA+B,EAClC,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,QAAQ,UAAU,CAAC,0BAA0B,KAAK,CAAC;AACtD,MAAM,kCAAkC,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AACnF,MAAM,qBAAqB,EAAE,OAAO;CAClC,SAAS;CACT,gBAAgB,EAAE,KAAK;EAAC;EAAW;EAAW;EAAY;EAAyB;CAAW,CAAC;CAC/F,YAAY,EAAE,KAAK;EAAC;EAAW;EAAW;CAAS,CAAC,CAAC,CAAC,SAAS;CAC/D,YAAY,6BAA6B,SAAS;AACpD,CAAC;AACD,MAAM,wBAAwB,EAAE,OAAO;CACrC,YAAY;CACZ,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,gBAAgB,CAAC,CAAC,SAAS;CAC5E,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,gBAAgB,CAAC,CAAC,SAAS;AACjF,CAAC;AACD,MAAM,8BAA8B,EAAE,OAAO;CAC3C,IAAI,EAAE,QAAQ,IAAI;CAClB,SAAS;CACT,QAAQ,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACtD,iBAAiB,sBAAsB,SAAS;AAClD,CAAC;AAED,IAAa,qBAAb,MAAgC;CAC9B,AAAiB;CAEjB,AAAO,YAAY,aAAa,yBAAyB;EACvD,MAAM,aAAa,IAAI,IAAI,UAAU,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE;EAC9D,IAAI,eAAe,yBACjB,MAAM,IAAI,MAAM,iDAAiD,wBAAwB,EAAE;EAE7F,KAAK,aAAa;CACpB;CAEA,MAAa,QAAQ,YAAoC,QAA4C;EACnG,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,OAAO,oBAAoB,EAAE,OAAO,CAAC;EACtF,MAAM,SAAS,sBAAsB,UAAU,KAAK;EACpD,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBAAkB,iCAAiC,4CAA4C;EAE3G,OAAO;GACL,SAAS,OAAO,KAAK;GACrB,UAAU,OAAO,KAAK;GACtB,OAAO,OAAO,KAAK;EACrB;CACF;CAEA,MAAa,wBACX,YACA,QAC+B;EAC/B,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,OAAO,sCAAsC,EAAE,OAAO,CAAC;EACxG,MAAM,SAAS,mCAAmC,UAAU,KAAK;EACjE,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBACR,2CACA,kDACF;EAEF,OAAO;GACL,SAAS,OAAO,KAAK;GACrB,UAAU,OAAO,KAAK;GACtB,OAAO,OAAO,KAAK;EACrB;CACF;CAEA,MAAa,gBACX,YACA,QACiC;EACjC,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,QAAQ,sCAAsC,EAAE,OAAO,CAAC;EACzG,MAAM,SAAS,gCAAgC,UAAU,KAAK;EAC9D,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBACR,2CACA,kDACF;EAEF,OAAO,OAAO,KAAK;CACrB;CAEA,MAAa,sBACX,YACA,WACA,YACA,UAAuE,CAAC,GACQ;EAChF,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,QAAQ,yBAAyB,mBAAmB,SAAS,KAAK;GACjH,MAAM,KAAK,UAAU,UAAU;GAC/B,SAAS;IACP,gBAAgB;IAChB,2BAA2B,QAAQ,kBAAkB,WAAW;IAChE,GAAI,QAAQ,MAAM,EAAE,eAAe,QAAQ,IAAI,IAAI,CAAC;GACtD;EACF,CAAC;EACD,MAAM,SAAS,EACZ,OAAO;GACN,IAAI,EAAE,QAAQ,IAAI;GAClB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;GAC3B,QAAQ;GACR,SAAS,EAAE,OAAO;EACpB,CAAC,CAAC,CACD,UAAU,KAAK;EAClB,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBAAkB,qCAAqC,8CAA8C;EAEjH,OAAO,OAAO;CAChB;CAEA,MAAa,mBACX,YACA,WACiC;EACjC,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,OAAO,yBAAyB,mBAAmB,SAAS,GAAG;EAChH,MAAM,SAAS,EAAE,OAAO;GAAE,IAAI,EAAE,QAAQ,IAAI;GAAG,SAAS;EAAqB,CAAC,CAAC,CAAC,UAAU,KAAK;EAC/F,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBAAkB,qCAAqC,8CAA8C;EAEjH,OAAO,OAAO,KAAK;CACrB;;;;;;CAOA,MAAa,yBACX,YACA,WACgC;EAChC,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,OAAO,yBAAyB,mBAAmB,SAAS,GAAG;EAChH,MAAM,SAAS,4BAA4B,UAAU,KAAK;EAC1D,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,kBAAkB,qCAAqC,8CAA8C;EAEjH,OAAO;GACL,SAAS,OAAO,KAAK;GACrB,GAAI,OAAO,KAAK,SAAS,EAAE,QAAQ,OAAO,KAAK,OAAO,IAAI,CAAC;GAC3D,GAAI,OAAO,KAAK,kBAAkB,EAAE,iBAAiB,OAAO,KAAK,gBAAgB,IAAI,CAAC;EACxF;CACF;CAEA,MAAa,qBACX,YACA,YACA,QACmC;EACnC,MAAM,QAAQ,IAAI,gBAAgB,EAAE,WAAW,CAAC;EAChD,IAAI,QAAQ,MAAM,IAAI,UAAU,MAAM;EACtC,MAAM,QAAQ,MAAM,KAAK,YAAY,YAAY,OAAO,yBAAyB,MAAM,SAAS,GAAG;EACnG,MAAM,SAAS,EACZ,OAAO;GACN,IAAI,EAAE,QAAQ,IAAI;GAClB,gBAAgB,EAAE,MAAM,oBAAoB,CAAC,CAAC,SAAS;GACvD,UAAU,EAAE,MAAM,oBAAoB,CAAC,CAAC,SAAS;EACnD,CAAC,CAAC,CACD,UAAU,KAAK;EAClB,IAAI,CAAC,OAAO,WAAY,CAAC,OAAO,KAAK,kBAAkB,CAAC,OAAO,KAAK,UAClE,MAAM,IAAI,kBACR,0CACA,mDACF;EAEF,OAAO,OAAO,KAAK,kBAAkB,OAAO,KAAK,YAAY,CAAC;CAChE;CAEA,MAAc,YACZ,YACA,QACA,MACA,OAII,CAAC,GACa;EAClB,MAAM,MAAM,IAAI,IAAI,MAAM,KAAK,UAAU;EACzC,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;EACxC,IAAI;EAEJ,IAAI,WAAW,SAAS,QACtB,IAAI;GACF,WAAW,MAAM,KAAK,yBACpB,MAAM,yBAAyB,WAAW,aAAa,QAAQ,KAAK,SAAS,KAAK,MAAM;IACtF,MAAM,WAAW;IACjB,QAAQ,qBAAqB,KAAK,MAAM;GAC1C,CAAC,CACH;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,MAAM,+BACzB,MAAM,MAAM,2BAA2B,OAAO,UAAU;GAE1D,MAAM;EACR;OACK;GACL,QAAQ,IAAI,iBAAiB,UAAU,WAAW,aAAa;GAC/D,WAAW,MAAM,MAAM,KAAK;IAC1B;IACA;IACA,MAAM,KAAK;IACX,UAAU;IACV,QAAQ,qBAAqB,KAAK,MAAM;GAC1C,CAAC;EACH;EAEA,MAAM,QAAQ,MAAM,SAAS,QAAQ;EACrC,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,SAAS,YAAY,UAAU,KAAK;GAC1C,IAAI,OAAO,SACT,MAAM,IAAI,kBACR,OAAO,KAAK,MAAM,MAClB,OAAO,KAAK,MAAM,SAClB,SAAS,QACT,OAAO,KAAK,MAAM,OACpB;GAEF,MAAM,IAAI,kBACR,QAAQ,SAAS,UACjB,yCAAyC,SAAS,OAAO,IACzD,SAAS,MACX;EACF;EACA,OAAO;CACT;CAEA,MAAc,mBAAsB,WAAyC;EAC3E,IAAI;GACF,OAAO,MAAM,UAAU;EACzB,SAAS,OAAO;GACd,IAAI,CAAC,MAAM,iBAAiB,KAAK,GAAG,MAAM;GAC1C,OAAO,UAAU;EACnB;CACF;AACF;AAEA,SAAS,0BAA0B,OAAwB;CACzD,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,YAAY,UAAU,YAAY,CAAC;EACzC,IACE,cAAc,WACb,aAAa,MACX,aAAa,OAAQ,aAAa,OACnC,cAAc,QACd,cAAc,QACd,cAAc,QACb,aAAa,QAAU,aAAa,QACpC,aAAa,QAAU,aAAa,OAEvC,OAAO;CAEX;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,QAAmC;CAC/D,MAAM,UAAU,YAAY,QAAQ,GAAM;CAC1C,OAAO,SAAS,YAAY,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI;AACvD;AAEA,eAAe,SAAS,UAAsC;CAC5D,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC;CACtC,IAAI;EACF,OAAO,KAAK,MAAM,IAAI;CACxB,SAAS,OAAO;EACd,MAAM,IAAI,kBACR,mCACA,8DAA8D,SAAS,OAAO,KAC9E,SAAS,QACT,QACA,EAAE,OAAO,MAAM,CACjB;CACF;AACF;AAEA,eAAe,2BACb,OACA,YAC4B;CAC5B,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ;CAC9C,MAAM,SAAS,YAAY,UAAU,KAAK;CAE1C,IAAI,MAAM,WAAW,OAAO,OAAO,WAAW,OAAO,KAAK,MAAM,SAAS,4BAA4B;EACnG,MAAM,UAAU,+BAA+B,UAAU,OAAO,KAAK,MAAM,OAAO;EAClF,IAAI,QAAQ,SAAS;GACnB,MAAM,4BAA4B,MAAM,MAAM,SAAS,cACrD,UAAU,WAAW,UAAU,UAAU,WAAW,UAAU,uBAC1D,sBAAsB,UAAU,WAAW,KAAK,IAChD,CAAC,CACP;GACA,MAAM,0BAA0B,0BAA0B,QAAQ,KAAK,cAAc;GACrF,MAAM,yBAAyB,0BAA0B,QAAQ,KAAK,aAAa;GACnF,IAAI,2BAA2B,wBAAwB;IACrD,MAAM,gCAAgC,0BAA0B,QAAQ,UACtE,wBAAwB,SAAS,KAAK,CACxC;IACA,MAAM,+BAA+B,8BAA8B,QAAQ,UACzE,uBAAuB,SAAS,KAAK,CACvC;IACA,MAAM,kBAAkB,oBAAoB,WAAW,eAAe;IACtE,IAAI,6BAA6B,MAAM,UAAU,CAAC,gBAAgB,KAAK,CAAC,GACtE,OAAO,IAAI,2BAA2B,WAAW,eAAe,iBAAiB,CAAC,GAAG;KACnF,OAAO;KACP,QAAQ;KACR,QAAQ,MAAM;IAChB,CAAC;IAGH,MAAM,iBAAiB,oBAAoB,6BAA6B;IACxE,MAAM,gBAAgB,oBAAoB,4BAA4B,CAAC,CAAC,QAAQ,UAC9E,gBAAgB,SAAS,KAAK,CAChC;IACA,IAAI,eAAe,SAAS,KAAK,cAAc,SAAS,GACtD,OAAO,IAAI,4BACT,OAAO,KAAK,MAAM,SAClB,WAAW,eACX,iBACA,gBACA,eACA,MAAM,QACN,EAAE,OAAO,MAAM,CACjB;GAEJ;EACF;CACF;CAEA,IAAI,OAAO,SACT,OAAO,IAAI,kBACT,OAAO,KAAK,MAAM,MAClB,OAAO,KAAK,MAAM,SAClB,MAAM,QACN,OAAO,KAAK,MAAM,SAClB,EAAE,OAAO,MAAM,CACjB;CAEF,OAAO,IAAI,kBACT,yCACA,qDACA,MAAM,QACN,QACA,EAAE,OAAO,MAAM,CACjB;AACF;AAEA,SAAS,0BAA0B,QAAiD;CAClF,IAAI,OAAO,MAAM,UAAU,CAAC,kBAAkB,KAAK,CAAC,GAAG,OAAO;CAC9D,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAEA,eAAe,YAAY,UAAsC;CAC/D,IAAI;EACF,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAK,KAAK,MAAM,IAAI,IAAgB;CAClE,QAAQ;EACN;CACF;AACF"}

package/dist/control-plane/ControlPlaneEndpoints.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ControlPlaneEndpoints.d.ts","names":[],"sources":["../../src/control-plane/ControlPlaneEndpoints.ts"],"mappings":";;UAGiB;WACN;WACA;;;;;;;iBAkBK,kCAAkC,MAAM,iBAAiB;cAI5D,+BAA6B"}

package/dist/control-plane/ControlPlaneEndpoints.js

@@ -1,24 +0,0 @@
-import { UAPKG_BUILD_METADATA } from "../build/BuildMetadata.js";
-
-//#region src/control-plane/ControlPlaneEndpoints.ts
-const DEVELOPMENT_ENDPOINTS = Object.freeze({
-	issuer: "https://account-dev.uapkg.dev/oauth",
-	apiBaseUrl: "https://api-dev.uapkg.dev"
-});
-const PRODUCTION_ENDPOINTS = Object.freeze({
-	issuer: "https://account.uapkg.dev/oauth",
-	apiBaseUrl: "https://api.uapkg.dev"
-});
-/**
-* Only an explicitly stamped development build can select development trust
-* roots. Source execution and any unrecognized runtime value fail closed to
-* the production control plane.
-*/
-function controlPlaneEndpointsForBuildMode(mode) {
-	return mode === "development" ? DEVELOPMENT_ENDPOINTS : PRODUCTION_ENDPOINTS;
-}
-const UAPKG_CONTROL_PLANE_ENDPOINTS = controlPlaneEndpointsForBuildMode(UAPKG_BUILD_METADATA.mode);
-
-//#endregion
-export { UAPKG_CONTROL_PLANE_ENDPOINTS, controlPlaneEndpointsForBuildMode };
-//# sourceMappingURL=ControlPlaneEndpoints.js.map

package/dist/control-plane/ControlPlaneEndpoints.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ControlPlaneEndpoints.js","names":[],"sources":["../../src/control-plane/ControlPlaneEndpoints.ts"],"sourcesContent":["import type { UAPKGBuildMode } from '@uapkg/common';\nimport { UAPKG_BUILD_METADATA } from '#cli/build/BuildMetadata.ts';\n\nexport interface UAPKGControlPlaneEndpoints {\n  readonly issuer: string;\n  readonly apiBaseUrl: string;\n}\n\nconst DEVELOPMENT_ENDPOINTS: UAPKGControlPlaneEndpoints = Object.freeze({\n  issuer: 'https://account-dev.uapkg.dev/oauth',\n  apiBaseUrl: 'https://api-dev.uapkg.dev',\n});\n\nconst PRODUCTION_ENDPOINTS: UAPKGControlPlaneEndpoints = Object.freeze({\n  issuer: 'https://account.uapkg.dev/oauth',\n  apiBaseUrl: 'https://api.uapkg.dev',\n});\n\n/**\n * Only an explicitly stamped development build can select development trust\n * roots. Source execution and any unrecognized runtime value fail closed to\n * the production control plane.\n */\nexport function controlPlaneEndpointsForBuildMode(mode: UAPKGBuildMode): UAPKGControlPlaneEndpoints {\n  return mode === 'development' ? DEVELOPMENT_ENDPOINTS : PRODUCTION_ENDPOINTS;\n}\n\nexport const UAPKG_CONTROL_PLANE_ENDPOINTS = controlPlaneEndpointsForBuildMode(UAPKG_BUILD_METADATA.mode);\n"],"mappings":";;;AAQA,MAAM,wBAAoD,OAAO,OAAO;CACtE,QAAQ;CACR,YAAY;AACd,CAAC;AAED,MAAM,uBAAmD,OAAO,OAAO;CACrE,QAAQ;CACR,YAAY;AACd,CAAC;;;;;;AAOD,SAAgB,kCAAkC,MAAkD;CAClG,OAAO,SAAS,gBAAgB,wBAAwB;AAC1D;AAEA,MAAa,gCAAgC,kCAAkC,qBAAqB,IAAI"}

package/dist/control-plane/ControlPlaneTypes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ControlPlaneTypes.d.ts","names":[],"sources":["../../src/control-plane/ControlPlaneTypes.ts"],"mappings":";cAEa;cACA;cACA;cACA;cAEA;KAOD,wBAAwB;iBAIpB,oBAAoB,iBAAiB;iBAMrC,yBAAyB,iBAAiB;iBAI1C,sBAAsB;iBAOtB,kBAAkB,iBAAiB;iBAInC,gBAAgB,iBAAiB,SAAS;KAI9C;UAEK;WACN;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;;UAGM;WACN;WACA;WACA;;UAGM;WACN,SAAS;WACT;aACE;;WAEF;aACE;aACA;aACA;aACA;aACA;;;UAII,6BAA6B;WACnC,OAAO;aACL;aACA;aACA;;;UAII;WACN;WACA;WACA;;UAGM;WACN;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA;WACA,SAAS;WACT;WACA;WACA;;UAGM;WACN;WACA,QAAQ,SAAS,eAAe;;UAG1B;WACN;WACA;WACA;WACA;;;UAIM;;WAEN;WACA;;;UAIM;WACN;WACA;WACA;WACA,cAAc,SAAS;aAA0B;aAA0B;;WAC3E,iBAAiB,SAAS;aAA0B;aAA0B;;WAC9E,kBAAkB,SAAS;aAA0B;aAA0B;;;;KAI9E;;;;;UAMK;WACN;WACA;WACA;aACE;aACA;aACA,SAAS;aACT,oBAAoB;aACpB,SAAS;aACT;;;KAID;UASK;WACN;WACA;WACA;WACA,QAAQ;WACR;WACA;WACA;WACA;aACE;aACA;;;KAID;KAOA;;UAGK;WACN;WACA,gBAAgB;WAChB,aAAa;WACb;;;UAIM;WACN;WACA;WACA;;;UAIM;WACN,SAAS;WACT,kBAAkB;WAClB,kBAAkB;;UAGZ;WACN;WACA;aACE;aACA;aACA,UAAU,SAAS;;;cAInB,0BAA0B;WAEnB;WAEA;WACA,UAAU,SAAS;EAJrC,YACkB,cAChB,iBACgB,6BACA,UAAU,SAAS,sCACnC,UAAU;;cAOD,oCAAoC;WAO7B;WANF,0BAA0B;WAC1B,yBAAyB;WACzB,wBAAwB;EAExC,YACE,iBACgB,uBAChB,0BAA0B,iBAC1B,yBAAyB,iBACzB,wBAAwB,iBACxB,iBACA,UAAU;;cAqBD,mCAAmC;WAM5B;WALF,0BAA0B;WAC1B,4BAA4B;WAC5B;EAEhB,YACkB,uBAChB,0BAA0B,iBAC1B,4BAA4B,iBAC5B,UAAU;aACC;aACA;;;iBA6BC,iBAAiB"}

package/dist/control-plane/ControlPlaneTypes.js

@@ -1,100 +0,0 @@
-import { UAPKG_CONTROL_PLANE_ENDPOINTS } from "./ControlPlaneEndpoints.js";
-
-//#region src/control-plane/ControlPlaneTypes.ts
-const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;
-const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;
-const UAPKG_CLI_CLIENT_ID = "uapkg-cli";
-const UAPKG_GITHUB_OIDC_AUDIENCE = "uapkg";
-const UAPKG_CLI_SCOPES = [
-	"identity.self.read",
-	"publishing.request.create",
-	"publishing.request.read.self",
-	"registry_grant.revoke.self"
-];
-const UAPKG_CLI_SCOPE_SET = new Set(UAPKG_CLI_SCOPES);
-const OAUTH_SCOPE_TOKEN_PATTERN = /^[\x21\x23-\x5b\x5d-\x7e]+$/;
-function knownUAPKGCliScopes(value) {
-	if (!Array.isArray(value)) return [];
-	const candidates = new Set(value.filter((scope) => typeof scope === "string"));
-	return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));
-}
-function parseUAPKGCliScopeString(value) {
-	return knownUAPKGCliScopes(parseOAuthScopeTokens(value));
-}
-function parseOAuthScopeTokens(value) {
-	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) return [];
-	const scopes = value.split(" ");
-	if (scopes.some((scope) => !isOAuthScopeToken(scope))) return [];
-	return [...new Set(scopes)];
-}
-function isOAuthScopeToken(value) {
-	return typeof value === "string" && OAUTH_SCOPE_TOKEN_PATTERN.test(value);
-}
-function isUAPKGCliScope(value) {
-	return typeof value === "string" && UAPKG_CLI_SCOPE_SET.has(value);
-}
-var ControlPlaneError = class extends Error {
-	code;
-	status;
-	details;
-	constructor(code, message, status, details, options) {
-		super(message, options);
-		this.code = code;
-		this.status = status;
-		this.details = details;
-		this.name = "ControlPlaneError";
-	}
-};
-var OAuthScopeInsufficientError = class extends ControlPlaneError {
-	registryAlias;
-	requestedScopes;
-	requiredScopes;
-	missingScopes;
-	constructor(message, registryAlias, requestedScopes, requiredScopes, missingScopes, status = 403, options) {
-		const requested = knownUAPKGCliScopes(requestedScopes);
-		const required = knownUAPKGCliScopes(requiredScopes);
-		const missing = knownUAPKGCliScopes(missingScopes).filter((scope) => requested.includes(scope) && required.includes(scope));
-		super("OAUTH_SCOPE_INSUFFICIENT", message, status, {
-			requestedScopes: requested,
-			requiredScopes: required,
-			missingScopes: missing
-		}, options);
-		this.registryAlias = registryAlias;
-		this.name = "OAuthScopeInsufficientError";
-		this.requestedScopes = requested;
-		this.requiredScopes = required;
-		this.missingScopes = missing;
-	}
-};
-var OAuthScopeUnsupportedError = class extends ControlPlaneError {
-	registryAlias;
-	requestedScopes;
-	unsupportedScopes;
-	reason;
-	constructor(registryAlias, requestedScopes, unsupportedScopes, options) {
-		const requested = knownUAPKGCliScopes(requestedScopes);
-		const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));
-		const reason = options?.reason ?? "issuer-does-not-support-requested-scope";
-		const message = reason === "cli-update-required" ? `The authorization service for "${registryAlias}" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.` : unsupportedIssuerScopeMessage(registryAlias, unsupported);
-		super("OAUTH_SCOPE_UNSUPPORTED", message, options?.status, {
-			requestedScopes: requested,
-			unsupportedScopes: unsupported,
-			reason
-		}, options);
-		this.registryAlias = registryAlias;
-		this.name = "OAuthScopeUnsupportedError";
-		this.requestedScopes = requested;
-		this.unsupportedScopes = unsupported;
-		this.reason = reason;
-	}
-};
-function unsupportedIssuerScopeMessage(registryAlias, unsupportedScopes) {
-	return `The authorization service for "${registryAlias}" does not support the OAuth ${unsupportedScopes.length === 1 ? "scope" : "scopes"} required by this UAPKG CLI: ${unsupportedScopes.join(", ")}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;
-}
-function registryAudience(registryId) {
-	return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;
-}
-
-//#endregion
-export { ControlPlaneError, OAuthScopeInsufficientError, OAuthScopeUnsupportedError, UAPKG_AUTHORIZATION_ISSUER, UAPKG_CLI_CLIENT_ID, UAPKG_CLI_SCOPES, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE, isOAuthScopeToken, isUAPKGCliScope, knownUAPKGCliScopes, parseOAuthScopeTokens, parseUAPKGCliScopeString, registryAudience };
-//# sourceMappingURL=ControlPlaneTypes.js.map

package/dist/control-plane/ControlPlaneTypes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ControlPlaneTypes.js","names":[],"sources":["../../src/control-plane/ControlPlaneTypes.ts"],"sourcesContent":["import { UAPKG_CONTROL_PLANE_ENDPOINTS } from '#cli/control-plane/ControlPlaneEndpoints.ts';\n\nexport const UAPKG_AUTHORIZATION_ISSUER = UAPKG_CONTROL_PLANE_ENDPOINTS.issuer;\nexport const UAPKG_CONTROL_PLANE_API = UAPKG_CONTROL_PLANE_ENDPOINTS.apiBaseUrl;\nexport const UAPKG_CLI_CLIENT_ID = 'uapkg-cli';\nexport const UAPKG_GITHUB_OIDC_AUDIENCE = 'uapkg';\n\nexport const UAPKG_CLI_SCOPES = [\n  'identity.self.read',\n  'publishing.request.create',\n  'publishing.request.read.self',\n  'registry_grant.revoke.self',\n] as const;\n\nexport type UAPKGCliScope = (typeof UAPKG_CLI_SCOPES)[number];\nconst UAPKG_CLI_SCOPE_SET = new Set<string>(UAPKG_CLI_SCOPES);\nconst OAUTH_SCOPE_TOKEN_PATTERN = /^[\\x21\\x23-\\x5b\\x5d-\\x7e]+$/;\n\nexport function knownUAPKGCliScopes(value: unknown): UAPKGCliScope[] {\n  if (!Array.isArray(value)) return [];\n  const candidates = new Set(value.filter((scope): scope is string => typeof scope === 'string'));\n  return UAPKG_CLI_SCOPES.filter((scope) => candidates.has(scope));\n}\n\nexport function parseUAPKGCliScopeString(value: unknown): UAPKGCliScope[] {\n  return knownUAPKGCliScopes(parseOAuthScopeTokens(value));\n}\n\nexport function parseOAuthScopeTokens(value: unknown): string[] {\n  if (typeof value !== 'string' || value.length === 0 || value.trim() !== value) return [];\n  const scopes = value.split(' ');\n  if (scopes.some((scope) => !isOAuthScopeToken(scope))) return [];\n  return [...new Set(scopes)];\n}\n\nexport function isOAuthScopeToken(value: unknown): value is string {\n  return typeof value === 'string' && OAUTH_SCOPE_TOKEN_PATTERN.test(value);\n}\n\nexport function isUAPKGCliScope(value: unknown): value is UAPKGCliScope {\n  return typeof value === 'string' && UAPKG_CLI_SCOPE_SET.has(value);\n}\n\nexport type ControlPlaneAuthMode = 'auto' | 'login' | 'gat' | 'oidc';\n\nexport interface RegistryTrust {\n  readonly alias: string;\n  readonly registryId: string;\n  readonly registryName: string;\n  readonly repositoryUrl: string;\n  readonly repositoryFingerprint: string;\n  readonly issuer: string;\n  readonly apiBaseUrl: string;\n  readonly resource: string;\n  readonly cacheShortId: string;\n}\n\nexport interface AccountDisplayMetadata {\n  readonly id: string;\n  readonly username: string;\n  readonly displayName: string;\n}\n\nexport interface AccountSelf {\n  readonly account: AccountDisplayMetadata;\n  readonly registry: {\n    readonly id: string;\n  };\n  readonly grant: {\n    readonly id: string;\n    readonly deviceName: string;\n    readonly idleExpiresAt: string;\n    readonly absoluteExpiresAt: string;\n    readonly scopes: readonly string[];\n  };\n}\n\nexport interface CliLoginConfirmation extends AccountSelf {\n  readonly grant: AccountSelf['grant'] & {\n    readonly status: 'pending' | 'active';\n    readonly activationExpiresAt: string;\n    readonly replacesGrantId: string | null;\n  };\n}\n\nexport interface ActivatedCliLoginGrant {\n  readonly id: string;\n  readonly status: 'active';\n  readonly replacesGrantId: string | null;\n}\n\nexport interface RegistryGrantMetadata {\n  readonly issuer: string;\n  readonly registryId: string;\n  readonly registryName: string;\n  readonly grantId: string;\n  readonly clientId: string;\n  readonly keyReference: string;\n  readonly refreshTokenReference: string;\n  readonly publicKeyThumbprint: string;\n  readonly deviceName: string;\n  readonly repositoryFingerprint: string;\n  readonly account: AccountDisplayMetadata;\n  readonly createdAt: number;\n  readonly idleExpiresAt: number;\n  readonly expiresAt: number;\n}\n\nexport interface AuthMetadataFile {\n  readonly schemaVersion: 1;\n  readonly grants: Readonly<Record<string, RegistryGrantMetadata>>;\n}\n\nexport interface RegistryRequestSource {\n  readonly type: 'github_release';\n  readonly repository: string;\n  readonly releaseTag: string;\n  readonly assetName: string;\n}\n\n/** Artifact integrity observed by this client from the exact bytes it inspected. */\nexport interface ObservedArtifactIntegrity {\n  /** Exactly `sha256:` + 64 lowercase hex characters. */\n  readonly sha256: string;\n  readonly sizeBytes: number;\n}\n\n/** Normalized packaged-manifest claims submitted with a publish request. */\nexport interface SubmittedPackageClaims {\n  readonly name: string;\n  readonly version: string;\n  readonly private: boolean;\n  readonly dependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n  readonly devDependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n  readonly peerDependencies: Readonly<Record<string, { readonly version: string; readonly registry?: string }>>;\n}\n\n/** The six route-derived registry operations (PS-REQ-001). */\nexport type RegistryOperation = 'publish' | 'unpublish' | 'yank' | 'unyank' | 'deprecate' | 'undeprecate';\n\n/**\n * Body for `POST /v1/registry-requests/{operation}`. The operation is\n * derived from the route; the body never carries a kind.\n */\nexport interface RegistryRequestSubmission {\n  readonly registryId: string;\n  readonly ownerOrganizationName?: string;\n  readonly payload: {\n    readonly packageName: string;\n    readonly packageVersion: string;\n    readonly source?: RegistryRequestSource;\n    readonly observedIntegrity?: ObservedArtifactIntegrity;\n    readonly claims?: SubmittedPackageClaims;\n    readonly reason?: string;\n  };\n}\n\nexport type RegistryRequestStatus =\n  | 'queued'\n  | 'checking'\n  | 'accepted'\n  | 'ready'\n  | 'ready_superseded'\n  | 'rejected'\n  | 'operationally_failed';\n\nexport interface RegistryRequestSummary {\n  readonly id: string;\n  readonly registryId: string;\n  readonly kind: string;\n  readonly status: RegistryRequestStatus;\n  readonly currentStep?: string;\n  readonly createdAt?: number;\n  readonly updatedAt?: number;\n  readonly payload?: {\n    readonly packageName?: string;\n    readonly packageVersion?: string;\n  };\n}\n\nexport type RegistryRequestCheckExecutionState =\n  | 'pending'\n  | 'running'\n  | 'retrying'\n  | 'blocked_by_dependency'\n  | 'completed';\n\nexport type RegistryRequestCheckConclusion = 'success' | 'failure' | 'skipped';\n\n/** One bounded, caller-visible result from the request's sealed check plan. */\nexport interface RegistryRequestCheck {\n  readonly checkId: string;\n  readonly executionState: RegistryRequestCheckExecutionState;\n  readonly conclusion?: RegistryRequestCheckConclusion;\n  readonly reasonCode?: string;\n}\n\n/** Sanitized durable retry-exhaustion details for an operational failure. */\nexport interface RegistryRequestTerminalFailure {\n  readonly reasonCode: string;\n  readonly attempts?: number;\n  readonly maxAttempts?: number;\n}\n\n/** Additive detail returned by the request-status endpoint. */\nexport interface RegistryRequestDetail {\n  readonly request: RegistryRequestSummary;\n  readonly checks?: readonly RegistryRequestCheck[];\n  readonly terminalFailure?: RegistryRequestTerminalFailure;\n}\n\nexport interface ControlPlaneApiErrorBody {\n  readonly ok: false;\n  readonly error: {\n    readonly code: string;\n    readonly message: string;\n    readonly details?: Readonly<Record<string, unknown>>;\n  };\n}\n\nexport class ControlPlaneError extends Error {\n  public constructor(\n    public readonly code: string,\n    message: string,\n    public readonly status?: number,\n    public readonly details?: Readonly<Record<string, unknown>>,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'ControlPlaneError';\n  }\n}\n\nexport class OAuthScopeInsufficientError extends ControlPlaneError {\n  public readonly requestedScopes: readonly UAPKGCliScope[];\n  public readonly requiredScopes: readonly UAPKGCliScope[];\n  public readonly missingScopes: readonly UAPKGCliScope[];\n\n  public constructor(\n    message: string,\n    public readonly registryAlias: string,\n    requestedScopes: readonly UAPKGCliScope[],\n    requiredScopes: readonly UAPKGCliScope[],\n    missingScopes: readonly UAPKGCliScope[],\n    status = 403,\n    options?: ErrorOptions,\n  ) {\n    const requested = knownUAPKGCliScopes(requestedScopes);\n    const required = knownUAPKGCliScopes(requiredScopes);\n    const missing = knownUAPKGCliScopes(missingScopes).filter(\n      (scope) => requested.includes(scope) && required.includes(scope),\n    );\n    super(\n      'OAUTH_SCOPE_INSUFFICIENT',\n      message,\n      status,\n      { requestedScopes: requested, requiredScopes: required, missingScopes: missing },\n      options,\n    );\n    this.name = 'OAuthScopeInsufficientError';\n    this.requestedScopes = requested;\n    this.requiredScopes = required;\n    this.missingScopes = missing;\n  }\n}\n\nexport class OAuthScopeUnsupportedError extends ControlPlaneError {\n  public readonly requestedScopes: readonly UAPKGCliScope[];\n  public readonly unsupportedScopes: readonly UAPKGCliScope[];\n  public readonly reason: 'issuer-does-not-support-requested-scope' | 'cli-update-required';\n\n  public constructor(\n    public readonly registryAlias: string,\n    requestedScopes: readonly UAPKGCliScope[],\n    unsupportedScopes: readonly UAPKGCliScope[],\n    options?: ErrorOptions & {\n      readonly reason?: 'issuer-does-not-support-requested-scope' | 'cli-update-required';\n      readonly status?: number;\n    },\n  ) {\n    const requested = knownUAPKGCliScopes(requestedScopes);\n    const unsupported = knownUAPKGCliScopes(unsupportedScopes).filter((scope) => requested.includes(scope));\n    const reason = options?.reason ?? 'issuer-does-not-support-requested-scope';\n    const message =\n      reason === 'cli-update-required'\n        ? `The authorization service for \"${registryAlias}\" requires an OAuth capability that this UAPKG CLI version does not recognize. Update UAPKG CLI and try again.`\n        : unsupportedIssuerScopeMessage(registryAlias, unsupported);\n    super(\n      'OAUTH_SCOPE_UNSUPPORTED',\n      message,\n      options?.status,\n      { requestedScopes: requested, unsupportedScopes: unsupported, reason },\n      options,\n    );\n    this.name = 'OAuthScopeUnsupportedError';\n    this.requestedScopes = requested;\n    this.unsupportedScopes = unsupported;\n    this.reason = reason;\n  }\n}\n\nfunction unsupportedIssuerScopeMessage(registryAlias: string, unsupportedScopes: readonly UAPKGCliScope[]): string {\n  const noun = unsupportedScopes.length === 1 ? 'scope' : 'scopes';\n  return `The authorization service for \"${registryAlias}\" does not support the OAuth ${noun} required by this UAPKG CLI: ${unsupportedScopes.join(', ')}. Update UAPKG CLI and try again; if it is already current, the authorization service must be updated.`;\n}\n\nexport function registryAudience(registryId: string): string {\n  return `${UAPKG_CONTROL_PLANE_API}/v1/registries/${encodeURIComponent(registryId)}`;\n}\n"],"mappings":";;;AAEA,MAAa,6BAA6B,8BAA8B;AACxE,MAAa,0BAA0B,8BAA8B;AACrE,MAAa,sBAAsB;AACnC,MAAa,6BAA6B;AAE1C,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;AACF;AAGA,MAAM,sBAAsB,IAAI,IAAY,gBAAgB;AAC5D,MAAM,4BAA4B;AAElC,SAAgB,oBAAoB,OAAiC;CACnE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,CAAC;CACnC,MAAM,aAAa,IAAI,IAAI,MAAM,QAAQ,UAA2B,OAAO,UAAU,QAAQ,CAAC;CAC9F,OAAO,iBAAiB,QAAQ,UAAU,WAAW,IAAI,KAAK,CAAC;AACjE;AAEA,SAAgB,yBAAyB,OAAiC;CACxE,OAAO,oBAAoB,sBAAsB,KAAK,CAAC;AACzD;AAEA,SAAgB,sBAAsB,OAA0B;CAC9D,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,KAAK,MAAM,OAAO,OAAO,CAAC;CACvF,MAAM,SAAS,MAAM,MAAM,GAAG;CAC9B,IAAI,OAAO,MAAM,UAAU,CAAC,kBAAkB,KAAK,CAAC,GAAG,OAAO,CAAC;CAC/D,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAEA,SAAgB,kBAAkB,OAAiC;CACjE,OAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAEA,SAAgB,gBAAgB,OAAwC;CACtE,OAAO,OAAO,UAAU,YAAY,oBAAoB,IAAI,KAAK;AACnE;AAmLA,IAAa,oBAAb,cAAuC,MAAM;CAEzB;CAEA;CACA;CAJlB,AAAO,YACL,AAAgB,MAChB,SACA,AAAgB,QAChB,AAAgB,SAChB,SACA;EACA,MAAM,SAAS,OAAO;EANN;EAEA;EACA;EAIhB,KAAK,OAAO;CACd;AACF;AAEA,IAAa,8BAAb,cAAiD,kBAAkB;CAO/C;CANlB,AAAgB;CAChB,AAAgB;CAChB,AAAgB;CAEhB,AAAO,YACL,SACA,AAAgB,eAChB,iBACA,gBACA,eACA,SAAS,KACT,SACA;EACA,MAAM,YAAY,oBAAoB,eAAe;EACrD,MAAM,WAAW,oBAAoB,cAAc;EACnD,MAAM,UAAU,oBAAoB,aAAa,CAAC,CAAC,QAChD,UAAU,UAAU,SAAS,KAAK,KAAK,SAAS,SAAS,KAAK,CACjE;EACA,MACE,4BACA,SACA,QACA;GAAE,iBAAiB;GAAW,gBAAgB;GAAU,eAAe;EAAQ,GAC/E,OACF;EAlBgB;EAmBhB,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,iBAAiB;EACtB,KAAK,gBAAgB;CACvB;AACF;AAEA,IAAa,6BAAb,cAAgD,kBAAkB;CAM9C;CALlB,AAAgB;CAChB,AAAgB;CAChB,AAAgB;CAEhB,AAAO,YACL,AAAgB,eAChB,iBACA,mBACA,SAIA;EACA,MAAM,YAAY,oBAAoB,eAAe;EACrD,MAAM,cAAc,oBAAoB,iBAAiB,CAAC,CAAC,QAAQ,UAAU,UAAU,SAAS,KAAK,CAAC;EACtG,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,UACJ,WAAW,wBACP,kCAAkC,cAAc,kHAChD,8BAA8B,eAAe,WAAW;EAC9D,MACE,2BACA,SACA,SAAS,QACT;GAAE,iBAAiB;GAAW,mBAAmB;GAAa;EAAO,GACrE,OACF;EArBgB;EAsBhB,KAAK,OAAO;EACZ,KAAK,kBAAkB;EACvB,KAAK,oBAAoB;EACzB,KAAK,SAAS;CAChB;AACF;AAEA,SAAS,8BAA8B,eAAuB,mBAAqD;CAEjH,OAAO,kCAAkC,cAAc,+BAD1C,kBAAkB,WAAW,IAAI,UAAU,SACmC,+BAA+B,kBAAkB,KAAK,IAAI,EAAE;AACzJ;AAEA,SAAgB,iBAAiB,YAA4B;CAC3D,OAAO,GAAG,wBAAwB,iBAAiB,mBAAmB,UAAU;AAClF"}

package/dist/control-plane/CredentialStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CredentialStore.d.ts","names":[],"sources":["../../src/control-plane/CredentialStore.ts"],"mappings":";UAEU;EACR,YAAY;EACZ;EACA;;UAGQ;EACR,YAAY,iBAAiB,qBAAqB;;KAGxC,sBAAsB,QAAQ;;;;;cAM7B;mBAIQ;mBACA;UAJX;EAER,YACmB,cAAa,eACb;EAGN,mBAAmB;EAkBnB,IAAI,oBAAoB;EAYxB,IAAI,mBAAmB,gBAAgB;EAWvC,OAAO,oBAAoB;EAajC,gBAAgB,4BAA4B,gBAAgB,oBAAoB;UAO/E;UAOM"}

package/dist/control-plane/CredentialStore.js

@@ -1,70 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-
-//#region src/control-plane/CredentialStore.ts
-/**
-* Protected secret storage. The native module is imported only when a
-* control-plane command needs it, so install/search/update remain portable.
-*/
-var CredentialStore = class {
-	loadKeyring;
-	service;
-	module;
-	constructor(loadKeyring = async () => await import("@napi-rs/keyring"), service = "uapkg.cli") {
-		this.loadKeyring = loadKeyring;
-		this.service = service;
-	}
-	async assertAvailable() {
-		const reference = `availability:${randomUUID()}`;
-		try {
-			await this.set(reference, reference);
-			if (await this.get(reference) !== reference) throw new Error("The operating-system credential store failed a round-trip check.");
-		} catch (error) {
-			throw new Error("Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.", { cause: error });
-		} finally {
-			await this.delete(reference).catch(() => void 0);
-		}
-	}
-	async get(reference) {
-		await this.ensureModule();
-		try {
-			return this.entry(reference).getPassword() ?? void 0;
-		} catch (error) {
-			if (isMissingCredentialError(error)) return void 0;
-			throw new Error("Unable to read a UAPKG credential from protected operating-system storage.", { cause: error });
-		}
-	}
-	async set(reference, value) {
-		await this.ensureModule();
-		try {
-			this.entry(reference).setPassword(value);
-		} catch (error) {
-			throw new Error("Unable to save a UAPKG credential in protected operating-system storage.", { cause: error });
-		}
-	}
-	async delete(reference) {
-		await this.ensureModule();
-		try {
-			this.entry(reference).deleteCredential();
-		} catch (error) {
-			if (!isMissingCredentialError(error)) throw new Error("Unable to remove a UAPKG credential from protected operating-system storage.", { cause: error });
-		}
-	}
-	createReference(kind, issuer, registryId, grantId) {
-		return `${kind}:${createHash("sha256").update(`${kind}\0${issuer.replace(/\/+$/, "")}\0${registryId.toLowerCase()}\0${grantId}`).digest("hex")}`;
-	}
-	entry(reference) {
-		if (!this.module) throw new Error("CredentialStore has not loaded the native keyring yet.");
-		return new this.module.Entry(this.service, reference);
-	}
-	async ensureModule() {
-		this.module ??= await this.loadKeyring();
-	}
-};
-function isMissingCredentialError(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	return /no\s*entry|not\s*found|missing/i.test(message);
-}
-
-//#endregion
-export { CredentialStore };
-//# sourceMappingURL=CredentialStore.js.map

package/dist/control-plane/CredentialStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CredentialStore.js","names":[],"sources":["../../src/control-plane/CredentialStore.ts"],"sourcesContent":["import { createHash, randomUUID } from 'node:crypto';\n\ninterface KeyringEntry {\n  setPassword(password: string): void;\n  getPassword(): string | null;\n  deleteCredential(): boolean;\n}\n\ninterface KeyringModule {\n  Entry: new (service: string, username: string) => KeyringEntry;\n}\n\nexport type KeyringLoader = () => Promise<KeyringModule>;\n\n/**\n * Protected secret storage. The native module is imported only when a\n * control-plane command needs it, so install/search/update remain portable.\n */\nexport class CredentialStore {\n  private module?: KeyringModule;\n\n  public constructor(\n    private readonly loadKeyring: KeyringLoader = async () => (await import('@napi-rs/keyring')) as KeyringModule,\n    private readonly service = 'uapkg.cli',\n  ) {}\n\n  public async assertAvailable(): Promise<void> {\n    const reference = `availability:${randomUUID()}`;\n    try {\n      await this.set(reference, reference);\n      const roundTrip = await this.get(reference);\n      if (roundTrip !== reference) {\n        throw new Error('The operating-system credential store failed a round-trip check.');\n      }\n    } catch (error) {\n      throw new Error(\n        'Secure operating-system credential storage is unavailable. UAPKG will not save login secrets in plaintext.',\n        { cause: error },\n      );\n    } finally {\n      await this.delete(reference).catch(() => undefined);\n    }\n  }\n\n  public async get(reference: string): Promise<string | undefined> {\n    await this.ensureModule();\n    try {\n      return this.entry(reference).getPassword() ?? undefined;\n    } catch (error) {\n      if (isMissingCredentialError(error)) return undefined;\n      throw new Error('Unable to read a UAPKG credential from protected operating-system storage.', {\n        cause: error,\n      });\n    }\n  }\n\n  public async set(reference: string, value: string): Promise<void> {\n    await this.ensureModule();\n    try {\n      this.entry(reference).setPassword(value);\n    } catch (error) {\n      throw new Error('Unable to save a UAPKG credential in protected operating-system storage.', {\n        cause: error,\n      });\n    }\n  }\n\n  public async delete(reference: string): Promise<void> {\n    await this.ensureModule();\n    try {\n      this.entry(reference).deleteCredential();\n    } catch (error) {\n      if (!isMissingCredentialError(error)) {\n        throw new Error('Unable to remove a UAPKG credential from protected operating-system storage.', {\n          cause: error,\n        });\n      }\n    }\n  }\n\n  public createReference(kind: 'grant' | 'dpop-key', issuer: string, registryId: string, grantId: string): string {\n    const digest = createHash('sha256')\n      .update(`${kind}\\0${issuer.replace(/\\/+$/, '')}\\0${registryId.toLowerCase()}\\0${grantId}`)\n      .digest('hex');\n    return `${kind}:${digest}`;\n  }\n\n  private entry(reference: string): KeyringEntry {\n    if (!this.module) {\n      throw new Error('CredentialStore has not loaded the native keyring yet.');\n    }\n    return new this.module.Entry(this.service, reference);\n  }\n\n  private async ensureModule(): Promise<void> {\n    this.module ??= await this.loadKeyring();\n  }\n}\n\nfunction isMissingCredentialError(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return /no\\s*entry|not\\s*found|missing/i.test(message);\n}\n"],"mappings":";;;;;;;AAkBA,IAAa,kBAAb,MAA6B;CAIR;CACA;CAJnB,AAAQ;CAER,AAAO,YACL,AAAiB,cAA6B,YAAa,MAAM,OAAO,qBACxE,AAAiB,UAAU,aAC3B;EAFiB;EACA;CAChB;CAEH,MAAa,kBAAiC;EAC5C,MAAM,YAAY,gBAAgB,WAAW;EAC7C,IAAI;GACF,MAAM,KAAK,IAAI,WAAW,SAAS;GAEnC,IAAI,MADoB,KAAK,IAAI,SAAS,MACxB,WAChB,MAAM,IAAI,MAAM,kEAAkE;EAEtF,SAAS,OAAO;GACd,MAAM,IAAI,MACR,8GACA,EAAE,OAAO,MAAM,CACjB;EACF,UAAU;GACR,MAAM,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY,MAAS;EACpD;CACF;CAEA,MAAa,IAAI,WAAgD;EAC/D,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,OAAO,KAAK,MAAM,SAAS,CAAC,CAAC,YAAY,KAAK;EAChD,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM,IAAI,MAAM,8EAA8E,EAC5F,OAAO,MACT,CAAC;EACH;CACF;CAEA,MAAa,IAAI,WAAmB,OAA8B;EAChE,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,KAAK,MAAM,SAAS,CAAC,CAAC,YAAY,KAAK;EACzC,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,4EAA4E,EAC1F,OAAO,MACT,CAAC;EACH;CACF;CAEA,MAAa,OAAO,WAAkC;EACpD,MAAM,KAAK,aAAa;EACxB,IAAI;GACF,KAAK,MAAM,SAAS,CAAC,CAAC,iBAAiB;EACzC,SAAS,OAAO;GACd,IAAI,CAAC,yBAAyB,KAAK,GACjC,MAAM,IAAI,MAAM,gFAAgF,EAC9F,OAAO,MACT,CAAC;EAEL;CACF;CAEA,AAAO,gBAAgB,MAA4B,QAAgB,YAAoB,SAAyB;EAI9G,OAAO,GAAG,KAAK,GAHA,WAAW,QAAQ,CAAC,CAChC,OAAO,GAAG,KAAK,IAAI,OAAO,QAAQ,QAAQ,EAAE,EAAE,IAAI,WAAW,YAAY,EAAE,IAAI,SAAS,CAAC,CACzF,OAAO,KACa;CACzB;CAEA,AAAQ,MAAM,WAAiC;EAC7C,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,MAAM,wDAAwD;EAE1E,OAAO,IAAI,KAAK,OAAO,MAAM,KAAK,SAAS,SAAS;CACtD;CAEA,MAAc,eAA8B;EAC1C,KAAK,WAAW,MAAM,KAAK,YAAY;CACzC;AACF;AAEA,SAAS,yBAAyB,OAAyB;CACzD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CACrE,OAAO,kCAAkC,KAAK,OAAO;AACvD"}

package/dist/control-plane/DPoPKeyStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DPoPKeyStore.d.ts","names":[],"sources":["../../src/control-plane/DPoPKeyStore.ts"],"mappings":";;;cAUa;mBACyB;EAApC,YAAoC,aAAa;EAEpC,YAAY,QAAQ,MAAM;EAK1B,KAAK,mBAAmB,MAAM,MAAM,gBAAgB;EAapD,KAAK,oBAAoB,QAAQ,MAAM;EA4BvC,OAAO,oBAAoB"}