@uapkg/cli 1.4.0 → 1.5.0

package/dist/control-plane/DPoPKeyStore.js

@@ -1,58 +0,0 @@
-import { webcrypto } from "node:crypto";
-
-//#region src/control-plane/DPoPKeyStore.ts
-var DPoPKeyStore = class {
-	credentials;
-	constructor(credentials) {
-		this.credentials = credentials;
-	}
-	async generate() {
-		const { generateKeyPair } = await import("oauth4webapi");
-		return generateKeyPair("ES256", { extractable: true });
-	}
-	async save(reference, pair) {
-		const [publicKey, privateKey] = await Promise.all([webcrypto.subtle.exportKey("jwk", pair.publicKey), webcrypto.subtle.exportKey("jwk", pair.privateKey)]);
-		const serialized = {
-			algorithm: "ES256",
-			publicKey,
-			privateKey
-		};
-		await this.credentials.set(reference, JSON.stringify(serialized));
-	}
-	async load(reference) {
-		const raw = await this.credentials.get(reference);
-		if (!raw) return void 0;
-		let saved;
-		try {
-			saved = JSON.parse(raw);
-		} catch (error) {
-			throw new Error("The saved UAPKG DPoP key is not valid JSON.", { cause: error });
-		}
-		if (saved.algorithm !== "ES256" || !saved.publicKey || !saved.privateKey) throw new Error("The saved UAPKG DPoP key has an unsupported format.");
-		const algorithm = {
-			name: "ECDSA",
-			namedCurve: "P-256"
-		};
-		const [publicKey, privateKey] = await Promise.all([webcrypto.subtle.importKey("jwk", saved.publicKey, algorithm, true, ["verify"]), webcrypto.subtle.importKey("jwk", saved.privateKey, algorithm, true, ["sign"])]);
-		const challenge = webcrypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
-		const signature = await webcrypto.subtle.sign({
-			name: "ECDSA",
-			hash: "SHA-256"
-		}, privateKey, challenge);
-		if (!await webcrypto.subtle.verify({
-			name: "ECDSA",
-			hash: "SHA-256"
-		}, publicKey, signature, challenge)) throw new Error("The saved UAPKG DPoP public and private keys do not match.");
-		return {
-			publicKey,
-			privateKey
-		};
-	}
-	async delete(reference) {
-		await this.credentials.delete(reference);
-	}
-};
-
-//#endregion
-export { DPoPKeyStore };
-//# sourceMappingURL=DPoPKeyStore.js.map

package/dist/control-plane/DPoPKeyStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"DPoPKeyStore.js","names":[],"sources":["../../src/control-plane/DPoPKeyStore.ts"],"sourcesContent":["import { webcrypto } from 'node:crypto';\nimport type * as oauth from 'oauth4webapi';\nimport type { CredentialStore } from '#cli/control-plane/CredentialStore.ts';\n\ninterface SerializedDPoPKeyPair {\n  readonly algorithm: 'ES256';\n  readonly publicKey: webcrypto.JsonWebKey;\n  readonly privateKey: webcrypto.JsonWebKey;\n}\n\nexport class DPoPKeyStore {\n  public constructor(private readonly credentials: CredentialStore) {}\n\n  public async generate(): Promise<oauth.CryptoKeyPair> {\n    const { generateKeyPair } = await import('oauth4webapi');\n    return generateKeyPair('ES256', { extractable: true });\n  }\n\n  public async save(reference: string, pair: oauth.CryptoKeyPair): Promise<void> {\n    const [publicKey, privateKey] = await Promise.all([\n      webcrypto.subtle.exportKey('jwk', pair.publicKey),\n      webcrypto.subtle.exportKey('jwk', pair.privateKey),\n    ]);\n    const serialized: SerializedDPoPKeyPair = {\n      algorithm: 'ES256',\n      publicKey,\n      privateKey,\n    };\n    await this.credentials.set(reference, JSON.stringify(serialized));\n  }\n\n  public async load(reference: string): Promise<oauth.CryptoKeyPair | undefined> {\n    const raw = await this.credentials.get(reference);\n    if (!raw) return undefined;\n\n    let saved: SerializedDPoPKeyPair;\n    try {\n      saved = JSON.parse(raw) as SerializedDPoPKeyPair;\n    } catch (error) {\n      throw new Error('The saved UAPKG DPoP key is not valid JSON.', { cause: error });\n    }\n    if (saved.algorithm !== 'ES256' || !saved.publicKey || !saved.privateKey) {\n      throw new Error('The saved UAPKG DPoP key has an unsupported format.');\n    }\n\n    const algorithm: webcrypto.EcKeyImportParams = { name: 'ECDSA', namedCurve: 'P-256' };\n    const [publicKey, privateKey] = await Promise.all([\n      webcrypto.subtle.importKey('jwk', saved.publicKey, algorithm, true, ['verify']),\n      webcrypto.subtle.importKey('jwk', saved.privateKey, algorithm, true, ['sign']),\n    ]);\n    const challenge = webcrypto.getRandomValues(new Uint8Array(32));\n    const signature = await webcrypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, challenge);\n    const matches = await webcrypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, publicKey, signature, challenge);\n    if (!matches) {\n      throw new Error('The saved UAPKG DPoP public and private keys do not match.');\n    }\n    return { publicKey, privateKey } as oauth.CryptoKeyPair;\n  }\n\n  public async delete(reference: string): Promise<void> {\n    await this.credentials.delete(reference);\n  }\n}\n"],"mappings":";;;AAUA,IAAa,eAAb,MAA0B;CACY;CAApC,AAAO,YAAY,AAAiB,aAA8B;EAA9B;CAA+B;CAEnE,MAAa,WAAyC;EACpD,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,OAAO,gBAAgB,SAAS,EAAE,aAAa,KAAK,CAAC;CACvD;CAEA,MAAa,KAAK,WAAmB,MAA0C;EAC7E,MAAM,CAAC,WAAW,cAAc,MAAM,QAAQ,IAAI,CAChD,UAAU,OAAO,UAAU,OAAO,KAAK,SAAS,GAChD,UAAU,OAAO,UAAU,OAAO,KAAK,UAAU,CACnD,CAAC;EACD,MAAM,aAAoC;GACxC,WAAW;GACX;GACA;EACF;EACA,MAAM,KAAK,YAAY,IAAI,WAAW,KAAK,UAAU,UAAU,CAAC;CAClE;CAEA,MAAa,KAAK,WAA6D;EAC7E,MAAM,MAAM,MAAM,KAAK,YAAY,IAAI,SAAS;EAChD,IAAI,CAAC,KAAK,OAAO;EAEjB,IAAI;EACJ,IAAI;GACF,QAAQ,KAAK,MAAM,GAAG;EACxB,SAAS,OAAO;GACd,MAAM,IAAI,MAAM,+CAA+C,EAAE,OAAO,MAAM,CAAC;EACjF;EACA,IAAI,MAAM,cAAc,WAAW,CAAC,MAAM,aAAa,CAAC,MAAM,YAC5D,MAAM,IAAI,MAAM,qDAAqD;EAGvE,MAAM,YAAyC;GAAE,MAAM;GAAS,YAAY;EAAQ;EACpF,MAAM,CAAC,WAAW,cAAc,MAAM,QAAQ,IAAI,CAChD,UAAU,OAAO,UAAU,OAAO,MAAM,WAAW,WAAW,MAAM,CAAC,QAAQ,CAAC,GAC9E,UAAU,OAAO,UAAU,OAAO,MAAM,YAAY,WAAW,MAAM,CAAC,MAAM,CAAC,CAC/E,CAAC;EACD,MAAM,YAAY,UAAU,gCAAgB,IAAI,WAAW,EAAE,CAAC;EAC9D,MAAM,YAAY,MAAM,UAAU,OAAO,KAAK;GAAE,MAAM;GAAS,MAAM;EAAU,GAAG,YAAY,SAAS;EAEvG,IAAI,CAAC,MADiB,UAAU,OAAO,OAAO;GAAE,MAAM;GAAS,MAAM;EAAU,GAAG,WAAW,WAAW,SAAS,GAE/G,MAAM,IAAI,MAAM,4DAA4D;EAE9E,OAAO;GAAE;GAAW;EAAW;CACjC;CAEA,MAAa,OAAO,WAAkC;EACpD,MAAM,KAAK,YAAY,OAAO,SAAS;CACzC;AACF"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubActionsOidcCredentialProvider.d.ts","names":[],"sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"mappings":";;KA8BY;;cAiBC,+BAA+B;WAExB,MAAM;WAEN;EAHlB,YACkB,MAAM,4BACtB,iBACgB,6BAChB,UAAU;;UAOG;WACN,eAAe;WACf,SAAS,yBAAyB;WAClC;WACA;WACA;WACA;;;UAIM;WACN;WACA;;cAKE;mBACM;mBACA;mBACA;mBACA;mBACA;mBACA;EAEjB,YAAmB,UAAS;EASrB;EAQM,SAAS,OAAO,eAAe,QAAQ,0BAA0B;UA8FhE;UA2BN;UAMM"}

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js

@@ -1,201 +0,0 @@
-import { ControlPlaneError, UAPKG_CONTROL_PLANE_API, UAPKG_GITHUB_OIDC_AUDIENCE } from "./ControlPlaneTypes.js";
-import { z } from "zod";
-
-//#region src/control-plane/GitHubActionsOidcCredentialProvider.ts
-const DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
-const DEFAULT_MAX_RESPONSE_BYTES = 65536;
-const DEFAULT_MAX_ATTEMPTS = 3;
-const DEFAULT_RETRY_DELAY_MS = 1e3;
-const DEFAULT_MAX_RETRY_DELAY_MS = 3e4;
-const RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-const githubResponseSchema = z.strictObject({ value: z.string().min(1) });
-const exchangeResponseSchema = z.strictObject({
-	ok: z.literal(true),
-	token: z.string().min(1),
-	expiresAt: z.number().int().positive()
-});
-const exchangeErrorSchema = z.strictObject({
-	ok: z.literal(false),
-	error: z.strictObject({
-		code: z.string().min(1),
-		message: z.string().min(1),
-		details: z.record(z.string(), z.unknown()).optional()
-	})
-});
-/** Stable local failures from the GitHub Actions OIDC credential flow. */
-var GitHubActionsOidcError = class extends Error {
-	code;
-	status;
-	constructor(code, message, status, options) {
-		super(message, options);
-		this.code = code;
-		this.status = status;
-		this.name = "GitHubActionsOidcError";
-	}
-};
-var GitHubActionsOidcCredentialProvider = class {
-	fetch;
-	sleep;
-	requestTimeoutMs;
-	maxResponseBytes;
-	maxAttempts;
-	maxRetryDelayMs;
-	constructor(options = {}) {
-		this.fetch = options.fetch ?? globalThis.fetch;
-		this.sleep = options.sleep ?? delay;
-		this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);
-		this.maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);
-		this.maxAttempts = positiveInteger(options.maxAttempts, DEFAULT_MAX_ATTEMPTS);
-		this.maxRetryDelayMs = positiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS);
-	}
-	isAvailable() {
-		return Boolean(process.env.GITHUB_ACTIONS === "true" || process.env.ACTIONS_ID_TOKEN_REQUEST_URL || process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN);
-	}
-	async exchange(trust, target) {
-		if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) throw new GitHubActionsOidcError("OIDC_CONTROL_PLANE_UNTRUSTED", `UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`);
-		const packageName = target.packageName.trim();
-		if (target.registryId !== trust.registryId || !packageName) throw new GitHubActionsOidcError("OIDC_EXCHANGE_TARGET_INVALID", "GitHub Actions OIDC requires the exact trusted registry and packaged package name.");
-		const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
-		const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
-		if (!this.isAvailable() || !requestUrl || !requestToken) throw new GitHubActionsOidcError("OIDC_GITHUB_CONTEXT_UNAVAILABLE", "GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.");
-		const url = parseGitHubOidcEndpoint(requestUrl);
-		url.searchParams.set("audience", UAPKG_GITHUB_OIDC_AUDIENCE);
-		const githubResponse = await this.fetchWithRetry(url, { headers: { authorization: `Bearer ${requestToken}` } }, "github");
-		const githubValue = githubResponseSchema.safeParse(await this.readJson(githubResponse, "github"));
-		if (!githubResponse.ok) throw new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_REJECTED", `GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`, githubResponse.status);
-		if (!githubValue.success) throw new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_INVALID", "GitHub Actions returned an invalid OIDC identity-token response.", githubResponse.status);
-		const exchangeResponse = await this.fetchWithRetry(new URL("/v1/oidc/github-actions/exchange", trust.apiBaseUrl), {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				provider: "github_actions",
-				audience: UAPKG_GITHUB_OIDC_AUDIENCE,
-				idToken: githubValue.data.value,
-				target: {
-					registryId: target.registryId,
-					packageName
-				}
-			})
-		}, "exchange");
-		const exchangeValue = await this.readJson(exchangeResponse, "exchange");
-		if (!exchangeResponse.ok) {
-			const error = exchangeErrorSchema.safeParse(exchangeValue);
-			if (error.success) throw new ControlPlaneError(error.data.error.code, error.data.error.message, exchangeResponse.status, error.data.error.details);
-			throw new GitHubActionsOidcError("OIDC_EXCHANGE_REJECTED", `UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`, exchangeResponse.status);
-		}
-		const parsed = exchangeResponseSchema.safeParse(exchangeValue);
-		if (!parsed.success) throw new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_INVALID", "The UAPKG OIDC exchange response was invalid.", exchangeResponse.status);
-		return parsed.data.token;
-	}
-	async fetchWithRetry(url, init, endpoint) {
-		for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {
-			let response;
-			try {
-				response = await this.fetch(url, {
-					...init,
-					redirect: "error",
-					signal: AbortSignal.timeout(this.requestTimeoutMs)
-				});
-			} catch (error) {
-				if (attempt < this.maxAttempts) {
-					await this.sleep(this.retryDelay(void 0, attempt));
-					continue;
-				}
-				throw requestFailure(endpoint, error);
-			}
-			if (!RETRYABLE_STATUS_CODES.has(response.status) || attempt === this.maxAttempts) return response;
-			const retryAfter = response.headers.get("retry-after");
-			await response.body?.cancel().catch(() => void 0);
-			await this.sleep(this.retryDelay(retryAfter, attempt));
-		}
-		throw new Error("OIDC retry loop exhausted unexpectedly.");
-	}
-	retryDelay(retryAfter, attempt) {
-		const parsed = parseRetryAfter(retryAfter);
-		const fallback = DEFAULT_RETRY_DELAY_MS * 2 ** (attempt - 1);
-		return Math.min(parsed ?? fallback, this.maxRetryDelayMs);
-	}
-	async readJson(response, endpoint) {
-		const contentLength = parseContentLength(response.headers.get("content-length"));
-		if (contentLength !== void 0 && contentLength > this.maxResponseBytes) {
-			await response.body?.cancel().catch(() => void 0);
-			throw responseTooLarge(endpoint, response.status);
-		}
-		const chunks = [];
-		let byteLength = 0;
-		if (response.body) {
-			const reader = response.body.getReader();
-			try {
-				while (true) {
-					const { done, value } = await reader.read();
-					if (done) break;
-					byteLength += value.byteLength;
-					if (byteLength > this.maxResponseBytes) {
-						await reader.cancel().catch(() => void 0);
-						throw responseTooLarge(endpoint, response.status);
-					}
-					chunks.push(value);
-				}
-			} finally {
-				reader.releaseLock();
-			}
-		}
-		if (byteLength === 0) return {};
-		const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
-		if (contentType !== "application/json" && !contentType?.endsWith("+json")) throw responseInvalid(endpoint, response.status);
-		const bytes = new Uint8Array(byteLength);
-		let offset = 0;
-		for (const chunk of chunks) {
-			bytes.set(chunk, offset);
-			offset += chunk.byteLength;
-		}
-		try {
-			return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-		} catch (error) {
-			throw responseInvalid(endpoint, response.status, error);
-		}
-	}
-};
-function parseGitHubOidcEndpoint(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch (error) {
-		throw new GitHubActionsOidcError("OIDC_GITHUB_ENDPOINT_INVALID", "GitHub Actions supplied an unexpected OIDC token endpoint.", void 0, { cause: error });
-	}
-	const hostname = url.hostname.toLowerCase();
-	if (url.protocol !== "https:" || url.username || url.password || url.port || hostname !== "actions.githubusercontent.com" && !hostname.endsWith(".actions.githubusercontent.com")) throw new GitHubActionsOidcError("OIDC_GITHUB_ENDPOINT_INVALID", "GitHub Actions supplied an unexpected OIDC token endpoint.");
-	return url;
-}
-function requestFailure(endpoint, error) {
-	const timedOut = error instanceof DOMException && error.name === "TimeoutError";
-	if (endpoint === "github") return new GitHubActionsOidcError(timedOut ? "OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT" : "OIDC_GITHUB_TOKEN_REQUEST_FAILED", timedOut ? "Timed out while requesting a GitHub Actions OIDC identity token." : "Unable to request a GitHub Actions OIDC identity token.", void 0, { cause: error });
-	return new GitHubActionsOidcError(timedOut ? "OIDC_EXCHANGE_REQUEST_TIMEOUT" : "OIDC_EXCHANGE_REQUEST_FAILED", timedOut ? "Timed out while exchanging the GitHub Actions identity with UAPKG." : "Unable to exchange the GitHub Actions identity with UAPKG.", void 0, { cause: error });
-}
-function responseTooLarge(endpoint, status) {
-	return endpoint === "github" ? new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE", "GitHub Actions returned an oversized OIDC identity-token response.", status) : new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_TOO_LARGE", "The UAPKG OIDC exchange returned an oversized response.", status);
-}
-function responseInvalid(endpoint, status, cause) {
-	return endpoint === "github" ? new GitHubActionsOidcError("OIDC_GITHUB_TOKEN_RESPONSE_INVALID", "GitHub Actions returned an invalid OIDC identity-token response.", status, { cause }) : new GitHubActionsOidcError("OIDC_EXCHANGE_RESPONSE_INVALID", "The UAPKG OIDC exchange response was invalid.", status, { cause });
-}
-function parseContentLength(value) {
-	if (value === null || !/^\d+$/.test(value)) return void 0;
-	const parsed = Number(value);
-	return Number.isSafeInteger(parsed) ? parsed : void 0;
-}
-function parseRetryAfter(value, now = Date.now()) {
-	if (!value) return void 0;
-	if (/^\d+$/.test(value)) return Number(value) * 1e3;
-	const timestamp = Date.parse(value);
-	return Number.isFinite(timestamp) ? Math.max(0, timestamp - now) : void 0;
-}
-function positiveInteger(value, fallback) {
-	return value !== void 0 && Number.isSafeInteger(value) && value > 0 ? value : fallback;
-}
-function delay(milliseconds) {
-	return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-
-//#endregion
-export { GitHubActionsOidcCredentialProvider, GitHubActionsOidcError };
-//# sourceMappingURL=GitHubActionsOidcCredentialProvider.js.map

package/dist/control-plane/GitHubActionsOidcCredentialProvider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"GitHubActionsOidcCredentialProvider.js","names":[],"sources":["../../src/control-plane/GitHubActionsOidcCredentialProvider.ts"],"sourcesContent":["import { z } from 'zod';\nimport {\n  ControlPlaneError,\n  type RegistryTrust,\n  UAPKG_CONTROL_PLANE_API,\n  UAPKG_GITHUB_OIDC_AUDIENCE,\n} from '#cli/control-plane/ControlPlaneTypes.ts';\n\nconst DEFAULT_REQUEST_TIMEOUT_MS = 30_000;\nconst DEFAULT_MAX_RESPONSE_BYTES = 64 * 1024;\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_RETRY_DELAY_MS = 1_000;\nconst DEFAULT_MAX_RETRY_DELAY_MS = 30_000;\nconst RETRYABLE_STATUS_CODES = new Set([429, 503]);\n\nconst githubResponseSchema = z.strictObject({ value: z.string().min(1) });\nconst exchangeResponseSchema = z.strictObject({\n  ok: z.literal(true),\n  token: z.string().min(1),\n  expiresAt: z.number().int().positive(),\n});\nconst exchangeErrorSchema = z.strictObject({\n  ok: z.literal(false),\n  error: z.strictObject({\n    code: z.string().min(1),\n    message: z.string().min(1),\n    details: z.record(z.string(), z.unknown()).optional(),\n  }),\n});\n\nexport type GitHubActionsOidcErrorCode =\n  | 'OIDC_CONTROL_PLANE_UNTRUSTED'\n  | 'OIDC_EXCHANGE_TARGET_INVALID'\n  | 'OIDC_GITHUB_CONTEXT_UNAVAILABLE'\n  | 'OIDC_GITHUB_ENDPOINT_INVALID'\n  | 'OIDC_GITHUB_TOKEN_REQUEST_FAILED'\n  | 'OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT'\n  | 'OIDC_GITHUB_TOKEN_REJECTED'\n  | 'OIDC_GITHUB_TOKEN_RESPONSE_INVALID'\n  | 'OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE'\n  | 'OIDC_EXCHANGE_REQUEST_FAILED'\n  | 'OIDC_EXCHANGE_REQUEST_TIMEOUT'\n  | 'OIDC_EXCHANGE_REJECTED'\n  | 'OIDC_EXCHANGE_RESPONSE_INVALID'\n  | 'OIDC_EXCHANGE_RESPONSE_TOO_LARGE';\n\n/** Stable local failures from the GitHub Actions OIDC credential flow. */\nexport class GitHubActionsOidcError extends Error {\n  public constructor(\n    public readonly code: GitHubActionsOidcErrorCode,\n    message: string,\n    public readonly status?: number,\n    options?: ErrorOptions,\n  ) {\n    super(message, options);\n    this.name = 'GitHubActionsOidcError';\n  }\n}\n\nexport interface GitHubActionsOidcCredentialProviderOptions {\n  readonly fetch?: typeof fetch;\n  readonly sleep?: (milliseconds: number) => Promise<void>;\n  readonly requestTimeoutMs?: number;\n  readonly maxResponseBytes?: number;\n  readonly maxAttempts?: number;\n  readonly maxRetryDelayMs?: number;\n}\n\n/** Package selector bound into every UAPKG OIDC exchange. */\nexport interface GitHubActionsOidcTarget {\n  readonly registryId: string;\n  readonly packageName: string;\n}\n\ntype OidcEndpoint = 'github' | 'exchange';\n\nexport class GitHubActionsOidcCredentialProvider {\n  private readonly fetch: typeof fetch;\n  private readonly sleep: (milliseconds: number) => Promise<void>;\n  private readonly requestTimeoutMs: number;\n  private readonly maxResponseBytes: number;\n  private readonly maxAttempts: number;\n  private readonly maxRetryDelayMs: number;\n\n  public constructor(options: GitHubActionsOidcCredentialProviderOptions = {}) {\n    this.fetch = options.fetch ?? globalThis.fetch;\n    this.sleep = options.sleep ?? delay;\n    this.requestTimeoutMs = positiveInteger(options.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS);\n    this.maxResponseBytes = positiveInteger(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES);\n    this.maxAttempts = positiveInteger(options.maxAttempts, DEFAULT_MAX_ATTEMPTS);\n    this.maxRetryDelayMs = positiveInteger(options.maxRetryDelayMs, DEFAULT_MAX_RETRY_DELAY_MS);\n  }\n\n  public isAvailable(): boolean {\n    return Boolean(\n      process.env.GITHUB_ACTIONS === 'true' ||\n      process.env.ACTIONS_ID_TOKEN_REQUEST_URL ||\n      process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,\n    );\n  }\n\n  public async exchange(trust: RegistryTrust, target: GitHubActionsOidcTarget): Promise<string> {\n    if (trust.apiBaseUrl !== UAPKG_CONTROL_PLANE_API) {\n      throw new GitHubActionsOidcError(\n        'OIDC_CONTROL_PLANE_UNTRUSTED',\n        `UAPKG v1 OIDC exchange is pinned to ${UAPKG_CONTROL_PLANE_API}.`,\n      );\n    }\n    const packageName = target.packageName.trim();\n    if (target.registryId !== trust.registryId || !packageName) {\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_TARGET_INVALID',\n        'GitHub Actions OIDC requires the exact trusted registry and packaged package name.',\n      );\n    }\n    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;\n    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;\n    if (!this.isAvailable() || !requestUrl || !requestToken) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_CONTEXT_UNAVAILABLE',\n        'GitHub Actions OIDC was selected but its identity-token endpoint is unavailable. The workflow must grant `id-token: write`.',\n      );\n    }\n\n    const url = parseGitHubOidcEndpoint(requestUrl);\n    url.searchParams.set('audience', UAPKG_GITHUB_OIDC_AUDIENCE);\n\n    const githubResponse = await this.fetchWithRetry(\n      url,\n      {\n        headers: { authorization: `Bearer ${requestToken}` },\n      },\n      'github',\n    );\n    const githubValue = githubResponseSchema.safeParse(await this.readJson(githubResponse, 'github'));\n    if (!githubResponse.ok) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_REJECTED',\n        `GitHub Actions did not issue an OIDC identity token (HTTP ${githubResponse.status}).`,\n        githubResponse.status,\n      );\n    }\n    if (!githubValue.success) {\n      throw new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_INVALID',\n        'GitHub Actions returned an invalid OIDC identity-token response.',\n        githubResponse.status,\n      );\n    }\n\n    const exchangeResponse = await this.fetchWithRetry(\n      new URL('/v1/oidc/github-actions/exchange', trust.apiBaseUrl),\n      {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          provider: 'github_actions',\n          audience: UAPKG_GITHUB_OIDC_AUDIENCE,\n          idToken: githubValue.data.value,\n          target: {\n            registryId: target.registryId,\n            packageName,\n          },\n        }),\n      },\n      'exchange',\n    );\n    const exchangeValue = await this.readJson(exchangeResponse, 'exchange');\n    if (!exchangeResponse.ok) {\n      const error = exchangeErrorSchema.safeParse(exchangeValue);\n      if (error.success) {\n        throw new ControlPlaneError(\n          error.data.error.code,\n          error.data.error.message,\n          exchangeResponse.status,\n          error.data.error.details,\n        );\n      }\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_REJECTED',\n        `UAPKG rejected the GitHub Actions identity (HTTP ${exchangeResponse.status}).`,\n        exchangeResponse.status,\n      );\n    }\n    const parsed = exchangeResponseSchema.safeParse(exchangeValue);\n    if (!parsed.success) {\n      throw new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_INVALID',\n        'The UAPKG OIDC exchange response was invalid.',\n        exchangeResponse.status,\n      );\n    }\n    return parsed.data.token;\n  }\n\n  private async fetchWithRetry(url: URL, init: RequestInit, endpoint: OidcEndpoint): Promise<Response> {\n    for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {\n      let response: Response;\n      try {\n        response = await this.fetch(url, {\n          ...init,\n          redirect: 'error',\n          signal: AbortSignal.timeout(this.requestTimeoutMs),\n        });\n      } catch (error) {\n        if (attempt < this.maxAttempts) {\n          await this.sleep(this.retryDelay(undefined, attempt));\n          continue;\n        }\n        throw requestFailure(endpoint, error);\n      }\n\n      if (!RETRYABLE_STATUS_CODES.has(response.status) || attempt === this.maxAttempts) return response;\n\n      const retryAfter = response.headers.get('retry-after');\n      await response.body?.cancel().catch(() => undefined);\n      await this.sleep(this.retryDelay(retryAfter, attempt));\n    }\n\n    throw new Error('OIDC retry loop exhausted unexpectedly.');\n  }\n\n  private retryDelay(retryAfter: string | null | undefined, attempt: number): number {\n    const parsed = parseRetryAfter(retryAfter);\n    const fallback = DEFAULT_RETRY_DELAY_MS * 2 ** (attempt - 1);\n    return Math.min(parsed ?? fallback, this.maxRetryDelayMs);\n  }\n\n  private async readJson(response: Response, endpoint: OidcEndpoint): Promise<unknown> {\n    const contentLength = parseContentLength(response.headers.get('content-length'));\n    if (contentLength !== undefined && contentLength > this.maxResponseBytes) {\n      await response.body?.cancel().catch(() => undefined);\n      throw responseTooLarge(endpoint, response.status);\n    }\n\n    const chunks: Uint8Array[] = [];\n    let byteLength = 0;\n    if (response.body) {\n      const reader = response.body.getReader();\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          byteLength += value.byteLength;\n          if (byteLength > this.maxResponseBytes) {\n            await reader.cancel().catch(() => undefined);\n            throw responseTooLarge(endpoint, response.status);\n          }\n          chunks.push(value);\n        }\n      } finally {\n        reader.releaseLock();\n      }\n    }\n\n    if (byteLength === 0) return {};\n    const contentType = response.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase();\n    if (contentType !== 'application/json' && !contentType?.endsWith('+json')) {\n      throw responseInvalid(endpoint, response.status);\n    }\n\n    const bytes = new Uint8Array(byteLength);\n    let offset = 0;\n    for (const chunk of chunks) {\n      bytes.set(chunk, offset);\n      offset += chunk.byteLength;\n    }\n    try {\n      return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes)) as unknown;\n    } catch (error) {\n      throw responseInvalid(endpoint, response.status, error);\n    }\n  }\n}\n\nfunction parseGitHubOidcEndpoint(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch (error) {\n    throw new GitHubActionsOidcError(\n      'OIDC_GITHUB_ENDPOINT_INVALID',\n      'GitHub Actions supplied an unexpected OIDC token endpoint.',\n      undefined,\n      { cause: error },\n    );\n  }\n  const hostname = url.hostname.toLowerCase();\n  if (\n    url.protocol !== 'https:' ||\n    url.username ||\n    url.password ||\n    url.port ||\n    (hostname !== 'actions.githubusercontent.com' && !hostname.endsWith('.actions.githubusercontent.com'))\n  ) {\n    throw new GitHubActionsOidcError(\n      'OIDC_GITHUB_ENDPOINT_INVALID',\n      'GitHub Actions supplied an unexpected OIDC token endpoint.',\n    );\n  }\n  return url;\n}\n\nfunction requestFailure(endpoint: OidcEndpoint, error: unknown): GitHubActionsOidcError {\n  const timedOut = error instanceof DOMException && error.name === 'TimeoutError';\n  if (endpoint === 'github') {\n    return new GitHubActionsOidcError(\n      timedOut ? 'OIDC_GITHUB_TOKEN_REQUEST_TIMEOUT' : 'OIDC_GITHUB_TOKEN_REQUEST_FAILED',\n      timedOut\n        ? 'Timed out while requesting a GitHub Actions OIDC identity token.'\n        : 'Unable to request a GitHub Actions OIDC identity token.',\n      undefined,\n      { cause: error },\n    );\n  }\n  return new GitHubActionsOidcError(\n    timedOut ? 'OIDC_EXCHANGE_REQUEST_TIMEOUT' : 'OIDC_EXCHANGE_REQUEST_FAILED',\n    timedOut\n      ? 'Timed out while exchanging the GitHub Actions identity with UAPKG.'\n      : 'Unable to exchange the GitHub Actions identity with UAPKG.',\n    undefined,\n    { cause: error },\n  );\n}\n\nfunction responseTooLarge(endpoint: OidcEndpoint, status: number): GitHubActionsOidcError {\n  return endpoint === 'github'\n    ? new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_TOO_LARGE',\n        'GitHub Actions returned an oversized OIDC identity-token response.',\n        status,\n      )\n    : new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_TOO_LARGE',\n        'The UAPKG OIDC exchange returned an oversized response.',\n        status,\n      );\n}\n\nfunction responseInvalid(endpoint: OidcEndpoint, status: number, cause?: unknown): GitHubActionsOidcError {\n  return endpoint === 'github'\n    ? new GitHubActionsOidcError(\n        'OIDC_GITHUB_TOKEN_RESPONSE_INVALID',\n        'GitHub Actions returned an invalid OIDC identity-token response.',\n        status,\n        { cause },\n      )\n    : new GitHubActionsOidcError(\n        'OIDC_EXCHANGE_RESPONSE_INVALID',\n        'The UAPKG OIDC exchange response was invalid.',\n        status,\n        { cause },\n      );\n}\n\nfunction parseContentLength(value: string | null): number | undefined {\n  if (value === null || !/^\\d+$/.test(value)) return undefined;\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) ? parsed : undefined;\n}\n\nfunction parseRetryAfter(value: string | null | undefined, now = Date.now()): number | undefined {\n  if (!value) return undefined;\n  if (/^\\d+$/.test(value)) return Number(value) * 1_000;\n  const timestamp = Date.parse(value);\n  return Number.isFinite(timestamp) ? Math.max(0, timestamp - now) : undefined;\n}\n\nfunction positiveInteger(value: number | undefined, fallback: number): number {\n  return value !== undefined && Number.isSafeInteger(value) && value > 0 ? value : fallback;\n}\n\nfunction delay(milliseconds: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, milliseconds));\n}\n"],"mappings":";;;;AAQA,MAAM,6BAA6B;AACnC,MAAM,6BAA6B;AACnC,MAAM,uBAAuB;AAC7B,MAAM,yBAAyB;AAC/B,MAAM,6BAA6B;AACnC,MAAM,yCAAyB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAEjD,MAAM,uBAAuB,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,MAAM,yBAAyB,EAAE,aAAa;CAC5C,IAAI,EAAE,QAAQ,IAAI;CAClB,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AACvC,CAAC;AACD,MAAM,sBAAsB,EAAE,aAAa;CACzC,IAAI,EAAE,QAAQ,KAAK;CACnB,OAAO,EAAE,aAAa;EACpB,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACzB,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;CACtD,CAAC;AACH,CAAC;;AAmBD,IAAa,yBAAb,cAA4C,MAAM;CAE9B;CAEA;CAHlB,AAAO,YACL,AAAgB,MAChB,SACA,AAAgB,QAChB,SACA;EACA,MAAM,SAAS,OAAO;EALN;EAEA;EAIhB,KAAK,OAAO;CACd;AACF;AAmBA,IAAa,sCAAb,MAAiD;CAC/C,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,AAAO,YAAY,UAAsD,CAAC,GAAG;EAC3E,KAAK,QAAQ,QAAQ,SAAS,WAAW;EACzC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,mBAAmB,gBAAgB,QAAQ,kBAAkB,0BAA0B;EAC5F,KAAK,mBAAmB,gBAAgB,QAAQ,kBAAkB,0BAA0B;EAC5F,KAAK,cAAc,gBAAgB,QAAQ,aAAa,oBAAoB;EAC5E,KAAK,kBAAkB,gBAAgB,QAAQ,iBAAiB,0BAA0B;CAC5F;CAEA,AAAO,cAAuB;EAC5B,OAAO,QACL,QAAQ,IAAI,mBAAmB,UAC/B,QAAQ,IAAI,gCACZ,QAAQ,IAAI,8BACd;CACF;CAEA,MAAa,SAAS,OAAsB,QAAkD;EAC5F,IAAI,MAAM,eAAe,yBACvB,MAAM,IAAI,uBACR,gCACA,uCAAuC,wBAAwB,EACjE;EAEF,MAAM,cAAc,OAAO,YAAY,KAAK;EAC5C,IAAI,OAAO,eAAe,MAAM,cAAc,CAAC,aAC7C,MAAM,IAAI,uBACR,gCACA,oFACF;EAEF,MAAM,aAAa,QAAQ,IAAI;EAC/B,MAAM,eAAe,QAAQ,IAAI;EACjC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,cAAc,CAAC,cACzC,MAAM,IAAI,uBACR,mCACA,6HACF;EAGF,MAAM,MAAM,wBAAwB,UAAU;EAC9C,IAAI,aAAa,IAAI,YAAY,0BAA0B;EAE3D,MAAM,iBAAiB,MAAM,KAAK,eAChC,KACA,EACE,SAAS,EAAE,eAAe,UAAU,eAAe,EACrD,GACA,QACF;EACA,MAAM,cAAc,qBAAqB,UAAU,MAAM,KAAK,SAAS,gBAAgB,QAAQ,CAAC;EAChG,IAAI,CAAC,eAAe,IAClB,MAAM,IAAI,uBACR,8BACA,6DAA6D,eAAe,OAAO,KACnF,eAAe,MACjB;EAEF,IAAI,CAAC,YAAY,SACf,MAAM,IAAI,uBACR,sCACA,oEACA,eAAe,MACjB;EAGF,MAAM,mBAAmB,MAAM,KAAK,eAClC,IAAI,IAAI,oCAAoC,MAAM,UAAU,GAC5D;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IACnB,UAAU;IACV,UAAU;IACV,SAAS,YAAY,KAAK;IAC1B,QAAQ;KACN,YAAY,OAAO;KACnB;IACF;GACF,CAAC;EACH,GACA,UACF;EACA,MAAM,gBAAgB,MAAM,KAAK,SAAS,kBAAkB,UAAU;EACtE,IAAI,CAAC,iBAAiB,IAAI;GACxB,MAAM,QAAQ,oBAAoB,UAAU,aAAa;GACzD,IAAI,MAAM,SACR,MAAM,IAAI,kBACR,MAAM,KAAK,MAAM,MACjB,MAAM,KAAK,MAAM,SACjB,iBAAiB,QACjB,MAAM,KAAK,MAAM,OACnB;GAEF,MAAM,IAAI,uBACR,0BACA,oDAAoD,iBAAiB,OAAO,KAC5E,iBAAiB,MACnB;EACF;EACA,MAAM,SAAS,uBAAuB,UAAU,aAAa;EAC7D,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,uBACR,kCACA,iDACA,iBAAiB,MACnB;EAEF,OAAO,OAAO,KAAK;CACrB;CAEA,MAAc,eAAe,KAAU,MAAmB,UAA2C;EACnG,KAAK,IAAI,UAAU,GAAG,WAAW,KAAK,aAAa,WAAW,GAAG;GAC/D,IAAI;GACJ,IAAI;IACF,WAAW,MAAM,KAAK,MAAM,KAAK;KAC/B,GAAG;KACH,UAAU;KACV,QAAQ,YAAY,QAAQ,KAAK,gBAAgB;IACnD,CAAC;GACH,SAAS,OAAO;IACd,IAAI,UAAU,KAAK,aAAa;KAC9B,MAAM,KAAK,MAAM,KAAK,WAAW,QAAW,OAAO,CAAC;KACpD;IACF;IACA,MAAM,eAAe,UAAU,KAAK;GACtC;GAEA,IAAI,CAAC,uBAAuB,IAAI,SAAS,MAAM,KAAK,YAAY,KAAK,aAAa,OAAO;GAEzF,MAAM,aAAa,SAAS,QAAQ,IAAI,aAAa;GACrD,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,MAAS;GACnD,MAAM,KAAK,MAAM,KAAK,WAAW,YAAY,OAAO,CAAC;EACvD;EAEA,MAAM,IAAI,MAAM,yCAAyC;CAC3D;CAEA,AAAQ,WAAW,YAAuC,SAAyB;EACjF,MAAM,SAAS,gBAAgB,UAAU;EACzC,MAAM,WAAW,yBAAyB,MAAM,UAAU;EAC1D,OAAO,KAAK,IAAI,UAAU,UAAU,KAAK,eAAe;CAC1D;CAEA,MAAc,SAAS,UAAoB,UAA0C;EACnF,MAAM,gBAAgB,mBAAmB,SAAS,QAAQ,IAAI,gBAAgB,CAAC;EAC/E,IAAI,kBAAkB,UAAa,gBAAgB,KAAK,kBAAkB;GACxE,MAAM,SAAS,MAAM,OAAO,CAAC,CAAC,YAAY,MAAS;GACnD,MAAM,iBAAiB,UAAU,SAAS,MAAM;EAClD;EAEA,MAAM,SAAuB,CAAC;EAC9B,IAAI,aAAa;EACjB,IAAI,SAAS,MAAM;GACjB,MAAM,SAAS,SAAS,KAAK,UAAU;GACvC,IAAI;IACF,OAAO,MAAM;KACX,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;KAC1C,IAAI,MAAM;KACV,cAAc,MAAM;KACpB,IAAI,aAAa,KAAK,kBAAkB;MACtC,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,MAAS;MAC3C,MAAM,iBAAiB,UAAU,SAAS,MAAM;KAClD;KACA,OAAO,KAAK,KAAK;IACnB;GACF,UAAU;IACR,OAAO,YAAY;GACrB;EACF;EAEA,IAAI,eAAe,GAAG,OAAO,CAAC;EAC9B,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY;EAC/F,IAAI,gBAAgB,sBAAsB,CAAC,aAAa,SAAS,OAAO,GACtE,MAAM,gBAAgB,UAAU,SAAS,MAAM;EAGjD,MAAM,QAAQ,IAAI,WAAW,UAAU;EACvC,IAAI,SAAS;EACb,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,IAAI,OAAO,MAAM;GACvB,UAAU,MAAM;EAClB;EACA,IAAI;GACF,OAAO,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;EAC3E,SAAS,OAAO;GACd,MAAM,gBAAgB,UAAU,SAAS,QAAQ,KAAK;EACxD;CACF;AACF;AAEA,SAAS,wBAAwB,OAAoB;CACnD,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAI,uBACR,gCACA,8DACA,QACA,EAAE,OAAO,MAAM,CACjB;CACF;CACA,MAAM,WAAW,IAAI,SAAS,YAAY;CAC1C,IACE,IAAI,aAAa,YACjB,IAAI,YACJ,IAAI,YACJ,IAAI,QACH,aAAa,mCAAmC,CAAC,SAAS,SAAS,gCAAgC,GAEpG,MAAM,IAAI,uBACR,gCACA,4DACF;CAEF,OAAO;AACT;AAEA,SAAS,eAAe,UAAwB,OAAwC;CACtF,MAAM,WAAW,iBAAiB,gBAAgB,MAAM,SAAS;CACjE,IAAI,aAAa,UACf,OAAO,IAAI,uBACT,WAAW,sCAAsC,oCACjD,WACI,qEACA,2DACJ,QACA,EAAE,OAAO,MAAM,CACjB;CAEF,OAAO,IAAI,uBACT,WAAW,kCAAkC,gCAC7C,WACI,uEACA,8DACJ,QACA,EAAE,OAAO,MAAM,CACjB;AACF;AAEA,SAAS,iBAAiB,UAAwB,QAAwC;CACxF,OAAO,aAAa,WAChB,IAAI,uBACF,wCACA,sEACA,MACF,IACA,IAAI,uBACF,oCACA,2DACA,MACF;AACN;AAEA,SAAS,gBAAgB,UAAwB,QAAgB,OAAyC;CACxG,OAAO,aAAa,WAChB,IAAI,uBACF,sCACA,oEACA,QACA,EAAE,MAAM,CACV,IACA,IAAI,uBACF,kCACA,iDACA,QACA,EAAE,MAAM,CACV;AACN;AAEA,SAAS,mBAAmB,OAA0C;CACpE,IAAI,UAAU,QAAQ,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACnD,MAAM,SAAS,OAAO,KAAK;CAC3B,OAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,SAAS,gBAAgB,OAAkC,MAAM,KAAK,IAAI,GAAuB;CAC/F,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,QAAQ,KAAK,KAAK,GAAG,OAAO,OAAO,KAAK,IAAI;CAChD,MAAM,YAAY,KAAK,MAAM,KAAK;CAClC,OAAO,OAAO,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,YAAY,GAAG,IAAI;AACrE;AAEA,SAAS,gBAAgB,OAA2B,UAA0B;CAC5E,OAAO,UAAU,UAAa,OAAO,cAAc,KAAK,KAAK,QAAQ,IAAI,QAAQ;AACnF;AAEA,SAAS,MAAM,cAAqC;CAClD,OAAO,IAAI,SAAS,YAAY,WAAW,SAAS,YAAY,CAAC;AACnE"}

package/dist/control-plane/PublishIdempotencyStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PublishIdempotencyStore.d.ts","names":[],"sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"mappings":";UAkBiB;WACN;WACA;WACA;WACA;;;;;;;;iBASK,yCACd,aAAa,iCACb,cAAa,OAAO;;;;;;;;cA2BT;mBACM;EAEjB,YAAmB;;SAKL,iBAAiB,mBAAmB;EAI3C,YAAY,gBAAgB,sBAAsB;EAYlD,MAAM,gBAAgB;UAQrB;UAyBA"}

package/dist/control-plane/PublishIdempotencyStore.js

@@ -1,100 +0,0 @@
-import { resolveActiveUapkgProfileRoot } from "@uapkg/common";
-import { dirname, join } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { sha256OfCanonicalJson } from "@uapkg/package-claims";
-
-//#region src/control-plane/PublishIdempotencyStore.ts
-const STORE_FILE_NAME = "publish-idempotency.json";
-const MAX_ENTRY_AGE_MS = 6048e5;
-/**
-* Stable, non-secret key for one GitHub Actions publish job. A rerun keeps the
-* same run ID and job name but changes GITHUB_RUN_ATTEMPT, so the attempt is
-* deliberately excluded. Renewing an OIDC session therefore cannot change
-* the request identity.
-*/
-function createGitHubActionsPublishIdempotencyKey(coordinates, environment = process.env) {
-	const githubRunId = environment.GITHUB_RUN_ID?.trim();
-	const githubJob = environment.GITHUB_JOB?.trim();
-	if (!githubRunId || !githubJob) throw new Error("GitHub Actions OIDC publishing requires GITHUB_RUN_ID and GITHUB_JOB to derive a stable idempotency key.");
-	return `gha-${sha256OfCanonicalJson({
-		schemaVersion: 1,
-		registryId: coordinates.registryId,
-		packageName: coordinates.packageName,
-		packageVersion: coordinates.packageVersion,
-		artifactSha256: coordinates.artifactSha256,
-		githubRunId,
-		githubJob
-	})}`;
-}
-/**
-* Persisted idempotency keys for logical registry-operation submissions.
-* One logical submission (operation + registry + payload) keeps one key
-* across retries, so a re-run after a network fault or crash replays the
-* original request instead of creating a duplicate. Keys are cleared once
-* the request reaches a terminal state.
-*/
-var PublishIdempotencyStore = class {
-	filePath;
-	constructor(filePath) {
-		this.filePath = filePath ?? join(resolveActiveUapkgProfileRoot(), STORE_FILE_NAME);
-	}
-	/** Stable digest identifying one logical submission. */
-	static submissionDigest(operation, submission) {
-		return sha256OfCanonicalJson({
-			operation,
-			submission
-		});
-	}
-	getOrCreate(digest, newKey, now = Date.now()) {
-		const store = this.read(now);
-		const existing = store.entries[digest];
-		if (existing) return existing.key;
-		const key = newKey();
-		this.write({
-			schemaVersion: 1,
-			entries: {
-				...store.entries,
-				[digest]: {
-					key,
-					createdAt: now
-				}
-			}
-		});
-		return key;
-	}
-	clear(digest, now = Date.now()) {
-		const store = this.read(now);
-		if (!(digest in store.entries)) return;
-		const entries = { ...store.entries };
-		delete entries[digest];
-		this.write({
-			schemaVersion: 1,
-			entries
-		});
-	}
-	read(now) {
-		let parsed;
-		try {
-			const raw = readFileSync(this.filePath, "utf8");
-			const candidate = JSON.parse(raw);
-			if (candidate.schemaVersion === 1 && candidate.entries && typeof candidate.entries === "object") parsed = {
-				schemaVersion: 1,
-				entries: candidate.entries
-			};
-		} catch {}
-		const entries = {};
-		for (const [digest, entry] of Object.entries(parsed?.entries ?? {})) if (entry && typeof entry.key === "string" && typeof entry.createdAt === "number" && now - entry.createdAt <= MAX_ENTRY_AGE_MS) entries[digest] = entry;
-		return {
-			schemaVersion: 1,
-			entries
-		};
-	}
-	write(store) {
-		mkdirSync(dirname(this.filePath), { recursive: true });
-		writeFileSync(this.filePath, `${JSON.stringify(store, null, 2)}\n`, "utf8");
-	}
-};
-
-//#endregion
-export { PublishIdempotencyStore, createGitHubActionsPublishIdempotencyKey };
-//# sourceMappingURL=PublishIdempotencyStore.js.map

package/dist/control-plane/PublishIdempotencyStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PublishIdempotencyStore.js","names":[],"sources":["../../src/control-plane/PublishIdempotencyStore.ts"],"sourcesContent":["import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { resolveActiveUapkgProfileRoot } from '@uapkg/common';\nimport { sha256OfCanonicalJson } from '@uapkg/package-claims';\n\nconst STORE_FILE_NAME = 'publish-idempotency.json';\nconst MAX_ENTRY_AGE_MS = 7 * 24 * 60 * 60 * 1000;\n\ninterface StoredEntry {\n  readonly key: string;\n  readonly createdAt: number;\n}\n\ninterface StoreFile {\n  readonly schemaVersion: 1;\n  readonly entries: Readonly<Record<string, StoredEntry>>;\n}\n\nexport interface GitHubActionsPublishCoordinates {\n  readonly registryId: string;\n  readonly packageName: string;\n  readonly packageVersion: string;\n  readonly artifactSha256: string;\n}\n\n/**\n * Stable, non-secret key for one GitHub Actions publish job. A rerun keeps the\n * same run ID and job name but changes GITHUB_RUN_ATTEMPT, so the attempt is\n * deliberately excluded. Renewing an OIDC session therefore cannot change\n * the request identity.\n */\nexport function createGitHubActionsPublishIdempotencyKey(\n  coordinates: GitHubActionsPublishCoordinates,\n  environment: NodeJS.ProcessEnv = process.env,\n): string {\n  const githubRunId = environment.GITHUB_RUN_ID?.trim();\n  const githubJob = environment.GITHUB_JOB?.trim();\n  if (!githubRunId || !githubJob) {\n    throw new Error(\n      'GitHub Actions OIDC publishing requires GITHUB_RUN_ID and GITHUB_JOB to derive a stable idempotency key.',\n    );\n  }\n  return `gha-${sha256OfCanonicalJson({\n    schemaVersion: 1,\n    registryId: coordinates.registryId,\n    packageName: coordinates.packageName,\n    packageVersion: coordinates.packageVersion,\n    artifactSha256: coordinates.artifactSha256,\n    githubRunId,\n    githubJob,\n  })}`;\n}\n\n/**\n * Persisted idempotency keys for logical registry-operation submissions.\n * One logical submission (operation + registry + payload) keeps one key\n * across retries, so a re-run after a network fault or crash replays the\n * original request instead of creating a duplicate. Keys are cleared once\n * the request reaches a terminal state.\n */\nexport class PublishIdempotencyStore {\n  private readonly filePath: string;\n\n  public constructor(filePath?: string) {\n    this.filePath = filePath ?? join(resolveActiveUapkgProfileRoot(), STORE_FILE_NAME);\n  }\n\n  /** Stable digest identifying one logical submission. */\n  public static submissionDigest(operation: string, submission: unknown): string {\n    return sha256OfCanonicalJson({ operation, submission });\n  }\n\n  public getOrCreate(digest: string, newKey: () => string, now = Date.now()): string {\n    const store = this.read(now);\n    const existing = store.entries[digest];\n    if (existing) return existing.key;\n    const key = newKey();\n    this.write({\n      schemaVersion: 1,\n      entries: { ...store.entries, [digest]: { key, createdAt: now } },\n    });\n    return key;\n  }\n\n  public clear(digest: string, now = Date.now()): void {\n    const store = this.read(now);\n    if (!(digest in store.entries)) return;\n    const entries = { ...store.entries };\n    delete entries[digest];\n    this.write({ schemaVersion: 1, entries });\n  }\n\n  private read(now: number): StoreFile {\n    let parsed: StoreFile | undefined;\n    try {\n      const raw = readFileSync(this.filePath, 'utf8');\n      const candidate = JSON.parse(raw) as Partial<StoreFile>;\n      if (candidate.schemaVersion === 1 && candidate.entries && typeof candidate.entries === 'object') {\n        parsed = { schemaVersion: 1, entries: candidate.entries };\n      }\n    } catch {\n      // Missing or corrupt store starts fresh; keys are best-effort retry aids.\n    }\n    const entries: Record<string, StoredEntry> = {};\n    for (const [digest, entry] of Object.entries(parsed?.entries ?? {})) {\n      if (\n        entry &&\n        typeof entry.key === 'string' &&\n        typeof entry.createdAt === 'number' &&\n        now - entry.createdAt <= MAX_ENTRY_AGE_MS\n      ) {\n        entries[digest] = entry;\n      }\n    }\n    return { schemaVersion: 1, entries };\n  }\n\n  private write(store: StoreFile): void {\n    mkdirSync(dirname(this.filePath), { recursive: true });\n    writeFileSync(this.filePath, `${JSON.stringify(store, null, 2)}\\n`, 'utf8');\n  }\n}\n"],"mappings":";;;;;;AAKA,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;;;;;;AAyBzB,SAAgB,yCACd,aACA,cAAiC,QAAQ,KACjC;CACR,MAAM,cAAc,YAAY,eAAe,KAAK;CACpD,MAAM,YAAY,YAAY,YAAY,KAAK;CAC/C,IAAI,CAAC,eAAe,CAAC,WACnB,MAAM,IAAI,MACR,0GACF;CAEF,OAAO,OAAO,sBAAsB;EAClC,eAAe;EACf,YAAY,YAAY;EACxB,aAAa,YAAY;EACzB,gBAAgB,YAAY;EAC5B,gBAAgB,YAAY;EAC5B;EACA;CACF,CAAC;AACH;;;;;;;;AASA,IAAa,0BAAb,MAAqC;CACnC,AAAiB;CAEjB,AAAO,YAAY,UAAmB;EACpC,KAAK,WAAW,YAAY,KAAK,8BAA8B,GAAG,eAAe;CACnF;;CAGA,OAAc,iBAAiB,WAAmB,YAA6B;EAC7E,OAAO,sBAAsB;GAAE;GAAW;EAAW,CAAC;CACxD;CAEA,AAAO,YAAY,QAAgB,QAAsB,MAAM,KAAK,IAAI,GAAW;EACjF,MAAM,QAAQ,KAAK,KAAK,GAAG;EAC3B,MAAM,WAAW,MAAM,QAAQ;EAC/B,IAAI,UAAU,OAAO,SAAS;EAC9B,MAAM,MAAM,OAAO;EACnB,KAAK,MAAM;GACT,eAAe;GACf,SAAS;IAAE,GAAG,MAAM;KAAU,SAAS;KAAE;KAAK,WAAW;IAAI;GAAE;EACjE,CAAC;EACD,OAAO;CACT;CAEA,AAAO,MAAM,QAAgB,MAAM,KAAK,IAAI,GAAS;EACnD,MAAM,QAAQ,KAAK,KAAK,GAAG;EAC3B,IAAI,EAAE,UAAU,MAAM,UAAU;EAChC,MAAM,UAAU,EAAE,GAAG,MAAM,QAAQ;EACnC,OAAO,QAAQ;EACf,KAAK,MAAM;GAAE,eAAe;GAAG;EAAQ,CAAC;CAC1C;CAEA,AAAQ,KAAK,KAAwB;EACnC,IAAI;EACJ,IAAI;GACF,MAAM,MAAM,aAAa,KAAK,UAAU,MAAM;GAC9C,MAAM,YAAY,KAAK,MAAM,GAAG;GAChC,IAAI,UAAU,kBAAkB,KAAK,UAAU,WAAW,OAAO,UAAU,YAAY,UACrF,SAAS;IAAE,eAAe;IAAG,SAAS,UAAU;GAAQ;EAE5D,QAAQ,CAER;EACA,MAAM,UAAuC,CAAC;EAC9C,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAChE,IACE,SACA,OAAO,MAAM,QAAQ,YACrB,OAAO,MAAM,cAAc,YAC3B,MAAM,MAAM,aAAa,kBAEzB,QAAQ,UAAU;EAGtB,OAAO;GAAE,eAAe;GAAG;EAAQ;CACrC;CAEA,AAAQ,MAAM,OAAwB;EACpC,UAAU,QAAQ,KAAK,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACrD,cAAc,KAAK,UAAU,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;CAC5E;AACF"}

package/dist/control-plane/PublishRequestErrorMapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"PublishRequestErrorMapper.d.ts","names":[],"sources":["../../src/control-plane/PublishRequestErrorMapper.ts"],"mappings":";;UA+FiB;WACN;WACA;WACA;WACA;WACA;WACA;WACA;WACA;;KAGN;UAUK;WACC;WACA;WACA,iBAAiB;WACjB,qBAAqB;WACrB;;UAGD;EACR,MAAM,kBAAkB,SAAS,6BAA6B;;;;;;;cAuQnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgWD,0CAA0C;iBAEtC,iCACd,gBACA,SAAS,6BACR"}