ghcr-manager 0.0.4 → 0.9.0

package/dist/db/planner/_planner-types.js

@@ -0,0 +1,38 @@
+export const silentPlannerLogger = {
+    trace() { },
+    debug() { }
+};
+export function mapPlanRootRow(row) {
+    return {
+        versionId: row.version_id,
+        digest: row.root_digest,
+        manifestKind: row.root_manifest_kind ?? undefined,
+        reason: row.direct_target_reason,
+        selectionMode: row.selection_mode
+    };
+}
+export function mapPlanTagRows(rows) {
+    return rows.map((row) => row.target_tag);
+}
+export function mapClosureManifestRow(row) {
+    return {
+        sourceVersionId: row.source_version_id,
+        sourceDigest: row.source_digest,
+        memberVersionId: row.member_version_id,
+        memberDigest: row.member_digest,
+        memberManifestKind: row.member_manifest_kind ?? undefined,
+        hopsFromRoot: row.hops_from_root,
+        memberRole: row.member_role
+    };
+}
+export function mapBlockedRootRow(row) {
+    return {
+        blockedVersionId: row.blocked_version_id,
+        blockedDigest: row.blocked_digest,
+        blockingVersionId: row.blocking_version_id,
+        blockingDigest: row.blocking_digest,
+        overlapDigest: row.overlap_digest,
+        overlapManifestKind: row.overlap_manifest_kind ?? undefined,
+        reason: row.block_reason
+    };
+}

package/dist/db/planner/_planner-untagged-targets.d.ts

@@ -0,0 +1,9 @@
+import { PlannerSql } from "./_planner-sql.js";
+import { type DeletePlanRoot, type ScanRow } from "./_planner-types.js";
+export declare class PlannerUntaggedTargets {
+    #private;
+    constructor(sql: PlannerSql);
+    getLatestCompletedScan(owner: string, packageName: string): ScanRow;
+    listDeleteUntaggedDirectTargetRoots(scanId: number, cutoffTimestamp?: string): DeletePlanRoot[];
+    listKeepNUntaggedDirectTargetRoots(scanId: number, keepCount: number, cutoffTimestamp?: string): DeletePlanRoot[];
+}

package/dist/db/planner/_planner-untagged-targets.js

@@ -0,0 +1,91 @@
+import { mapPlanRootRow } from "./_planner-types.js";
+export class PlannerUntaggedTargets {
+    #sql;
+    constructor(sql) {
+        this.#sql = sql;
+    }
+    getLatestCompletedScan(owner, packageName) {
+        const sql = `
+      SELECT scan_id, owner, package_name, scan_completed_at
+      FROM v_latest_scan_per_package
+      WHERE owner = ?
+        AND package_name = ?
+      LIMIT 1
+    `;
+        const row = this.#sql.get(sql, [owner, packageName]);
+        if (!row) {
+            throw new Error(`database does not contain completed package scan for ${owner}/${packageName}`);
+        }
+        return row;
+    }
+    listDeleteUntaggedDirectTargetRoots(scanId, cutoffTimestamp) {
+        const cutoffSql = cutoffTimestamp ? "AND created_at < ?" : "";
+        const sql = `
+      SELECT
+        root_version_id AS version_id,
+        root_digest,
+        root_manifest_kind,
+        'delete-untagged' AS direct_target_reason,
+        'delete-root' AS selection_mode
+      FROM v_scan_root_manifests
+      WHERE scan_id = ?
+        AND is_tagged = 0
+        AND has_ancestor = 0
+        ${cutoffSql}
+      ORDER BY root_digest
+    `;
+        const rows = this.#sql.all(sql, [
+            scanId,
+            ...(cutoffTimestamp ? [cutoffTimestamp] : [])
+        ]);
+        return rows.map(mapPlanRootRow);
+    }
+    listKeepNUntaggedDirectTargetRoots(scanId, keepCount, cutoffTimestamp) {
+        const cutoffSql = cutoffTimestamp ? "AND pv.created_at < ?" : "";
+        const sql = `
+      WITH eligible_untagged_roots AS (
+        SELECT
+          pv.version_id AS version_id,
+          m.digest AS root_digest,
+          m.manifest_kind AS root_manifest_kind,
+          ROW_NUMBER() OVER (
+            ORDER BY pv.created_at DESC, pv.version_id DESC, m.digest DESC
+          ) AS recency_rank
+        FROM package_versions pv
+        JOIN manifests m
+          ON m.scan_id = pv.scan_id
+         AND m.version_id = pv.version_id
+        WHERE pv.scan_id = ?
+          AND NOT EXISTS (
+            SELECT 1
+            FROM tags t
+            WHERE t.scan_id = pv.scan_id
+              AND t.version_id = pv.version_id
+          )
+          AND NOT EXISTS (
+            SELECT 1
+            FROM manifest_reachability mr
+            WHERE mr.scan_id = pv.scan_id
+              AND mr.descendant_digest = m.digest
+              AND mr.min_distance > 0
+          )
+          ${cutoffSql}
+      )
+      SELECT
+        version_id,
+        root_digest,
+        root_manifest_kind,
+        'keep-n-untagged-overflow' AS direct_target_reason,
+        'delete-root' AS selection_mode
+      FROM eligible_untagged_roots
+      WHERE recency_rank > ?
+      ORDER BY root_digest
+    `;
+        const rows = this.#sql.all(sql, [
+            scanId,
+            ...(cutoffTimestamp ? [cutoffTimestamp] : []),
+            keepCount
+        ]);
+        return rows.map(mapPlanRootRow);
+    }
+}

package/dist/db/planner/index.d.ts

@@ -0,0 +1,2 @@
+export { PlannerRepository } from "./_planner-repository.js";
+export type { DeletePlan, DeletePlanBlockedRoot, DeletePlanClosureManifest, DeletePlanProtectedRoot, DeletePlanRoot, DeletePlanRootDecision } from "./_planner-repository.js";

package/dist/db/planner/index.js

@@ -0,0 +1 @@
+export { PlannerRepository } from "./_planner-repository.js";

package/dist/execute/_http.d.ts

@@ -0,0 +1,7 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch, GitHubPackageFetchResponse } from "./_types.js";
+export { buildHttpErrorMessage } from "../core/index.js";
+export declare function runWithRetry<T>(label: string, logger: DeleteExecutionLogger, run: () => Promise<T>): Promise<T>;
+export declare function isRetryableStatus(status: number): boolean;
+export declare function buildTransportErrorMessage(error: unknown, fallback: string): string;
+export declare function resolveFetch(fetchImpl?: GitHubPackageFetch): GitHubPackageFetch;
+export declare function resolveJsonHeaders(response: GitHubPackageFetchResponse): string | undefined;

package/dist/execute/_http.js

@@ -0,0 +1,48 @@
+import { executeRequestRetryCount, executeRequestRetryDelayMs } from "../config/index.js";
+export { buildHttpErrorMessage } from "../core/index.js";
+const _RETRYABLE_STATUS_CODES = new Set([429, 502, 503, 504]);
+export async function runWithRetry(label, logger, run) {
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await run();
+        }
+        catch (error) {
+            attempt += 1;
+            if (attempt > executeRequestRetryCount || !_shouldRetryError(error)) {
+                throw error;
+            }
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            logger.warn(`${label} failed on attempt ${attempt}/${executeRequestRetryCount + 1}; retrying in ${executeRequestRetryDelayMs}ms - ${errorMessage}`);
+            await sleep(executeRequestRetryDelayMs);
+        }
+    }
+}
+export function isRetryableStatus(status) {
+    return _RETRYABLE_STATUS_CODES.has(status);
+}
+export function buildTransportErrorMessage(error, fallback) {
+    const details = [fallback];
+    if (error instanceof Error && error.message) {
+        details.push(error.message);
+    }
+    else {
+        details.push(String(error));
+    }
+    return details.join(" - ");
+}
+export function resolveFetch(fetchImpl) {
+    return fetchImpl ?? fetch;
+}
+export function resolveJsonHeaders(response) {
+    return response.headers.get("content-type")?.split(";")[0];
+}
+function _shouldRetryError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    return /fetch failed|status 429|status 502|status 503|status 504/.test(error.message);
+}
+function sleep(delayMs) {
+    return new Promise((resolve) => setTimeout(resolve, delayMs));
+}

package/dist/execute/_manifest-detach.d.ts

@@ -0,0 +1,4 @@
+export declare function buildDetachedManifestClone(rawManifestJson: string, mediaType: string, options: {
+    detachedTag: string;
+    sourceDigest: string;
+}): string;

package/dist/execute/_manifest-detach.js

@@ -0,0 +1,31 @@
+const _OCI_MEDIA_TYPES = new Set([
+    "application/vnd.oci.artifact.manifest.v1+json",
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.oci.image.manifest.v1+json"
+]);
+const _DETACH_ANNOTATION_KEY = "io.github.ghcr-manager.detached-tag";
+export function buildDetachedManifestClone(rawManifestJson, mediaType, options) {
+    const parsed = JSON.parse(rawManifestJson);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`manifest ${options.sourceDigest} is not a JSON object`);
+    }
+    const clone = structuredClone(parsed);
+    if (_OCI_MEDIA_TYPES.has(mediaType)) {
+        const annotations = _cloneAnnotations(clone.annotations);
+        annotations[_DETACH_ANNOTATION_KEY] = `${options.detachedTag} ${options.sourceDigest}`;
+        clone.annotations = annotations;
+    }
+    return `${JSON.stringify(clone, null, 2)}\n`;
+}
+function _cloneAnnotations(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return {};
+    }
+    const annotations = {};
+    for (const [key, annotationValue] of Object.entries(value)) {
+        if (typeof annotationValue === "string") {
+            annotations[key] = annotationValue;
+        }
+    }
+    return annotations;
+}

package/dist/execute/_package-version-delete-client.d.ts

@@ -0,0 +1,4 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export declare function deletePackageVersion(owner: string, packageName: string, versionId: number, token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<void>;

package/dist/execute/_package-version-delete-client.js

@@ -0,0 +1,34 @@
+import { githubApiBaseUrl, githubApiVersion } from "../config/index.js";
+import { getOwnerURIComponent } from "../core/index.js";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, runWithRetry } from "./_http.js";
+export async function deletePackageVersion(owner, packageName, versionId, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const ownerURIComponent = await getOwnerURIComponent(fetchImpl, owner, token, logger);
+    const url = new URL(`/${ownerURIComponent}/packages/container/${encodeURIComponent(packageName)}/versions/${versionId}`, githubApiBaseUrl).toString();
+    let response;
+    try {
+        response = await runWithRetry(`GitHub package delete request for version ${versionId}`, logger, async () => {
+            const deleteResponse = await fetchImpl(url, {
+                method: "DELETE",
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    Authorization: `Bearer ${token}`,
+                    "User-Agent": "ghcr-manager",
+                    "X-GitHub-Api-Version": githubApiVersion
+                }
+            });
+            if (!deleteResponse.ok && isRetryableStatus(deleteResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(deleteResponse, `GitHub package delete request failed for version ${versionId}`));
+            }
+            return deleteResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GitHub package delete request failed for version ${versionId}`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GitHub package delete request failed for version ${versionId}`));
+    }
+}

package/dist/execute/_package-version-page-client.d.ts

@@ -0,0 +1,14 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export interface GitHubPackageVersionPageItem {
+    id: number;
+    name?: string;
+    metadata?: {
+        container?: {
+            tags?: string[];
+        };
+    };
+}
+export declare function findPackageVersionByDigestAndTag(owner: string, packageName: string, digest: string, tag: string, token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<number>;
+export declare function loadPackageVersionPage(owner: string, packageName: string, page: number, token: string, logger: DeleteExecutionLogger, fetchImpl: GitHubPackageFetch): Promise<GitHubPackageVersionPageItem[]>;

package/dist/execute/_package-version-page-client.js

@@ -0,0 +1,64 @@
+import { githubApiBaseUrl, githubApiVersion } from "../config/index.js";
+import { getOwnerURIComponent } from "../core/index.js";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, runWithRetry } from "./_http.js";
+export async function findPackageVersionByDigestAndTag(owner, packageName, digest, tag, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    for (let attempt = 1; attempt <= 5; attempt += 1) {
+        const versionId = await _findPackageVersionByDigestAndTagOnce(owner, packageName, digest, tag, token, logger, fetchImpl);
+        if (versionId !== undefined) {
+            return versionId;
+        }
+        if (attempt < 5) {
+            logger.warn(`Temporary package version for ${owner}/${packageName}:${tag} (${digest}) not visible yet; retrying lookup ${attempt}/5`);
+            await new Promise((resolve) => setTimeout(resolve, 1000));
+        }
+    }
+    throw new Error(`could not find temporary package version for ${owner}/${packageName}:${tag} (${digest})`);
+}
+export async function loadPackageVersionPage(owner, packageName, page, token, logger, fetchImpl) {
+    const ownerURIComponent = await getOwnerURIComponent(fetchImpl, owner, token, logger);
+    const url = new URL(`/${ownerURIComponent}/packages/container/${encodeURIComponent(packageName)}/versions`, githubApiBaseUrl);
+    url.searchParams.set("per_page", "100");
+    url.searchParams.set("page", String(page));
+    let response;
+    try {
+        response = await runWithRetry(`GitHub Packages request for page ${page}`, logger, async () => {
+            const pageResponse = await fetchImpl(url.toString(), {
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    Authorization: `Bearer ${token}`,
+                    "User-Agent": "ghcr-manager",
+                    "X-GitHub-Api-Version": githubApiVersion
+                }
+            });
+            if (!pageResponse.ok && isRetryableStatus(pageResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(pageResponse, `GitHub Packages request for page ${page} failed`));
+            }
+            return pageResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GitHub Packages request for page ${page} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GitHub Packages request for page ${page} failed`));
+    }
+    return (await response.json());
+}
+async function _findPackageVersionByDigestAndTagOnce(owner, packageName, digest, tag, token, logger, fetchImpl) {
+    for (let page = 1;; page += 1) {
+        const items = await loadPackageVersionPage(owner, packageName, page, token, logger, fetchImpl);
+        if (items.length === 0) {
+            return undefined;
+        }
+        const match = items.find((item) => item.name === digest && item.metadata?.container?.tags?.includes(tag));
+        if (match) {
+            return match.id;
+        }
+        if (items.length < 100) {
+            return undefined;
+        }
+    }
+}

package/dist/execute/_package-version-tag-source-client.d.ts

@@ -0,0 +1,12 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export interface GitHubPackageVersionTagSource {
+    tag: string;
+    sourceVersionId: number;
+    sourceDigest: string;
+}
+export declare function listPresentPackageVersionIds(owner: string, packageName: string, versionIds: number[], token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<number[]>;
+export declare function listPackageVersionTagSources(owner: string, packageName: string, tags: string[], token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<GitHubPackageVersionTagSource[]>;

package/dist/execute/_package-version-tag-source-client.js

@@ -0,0 +1,65 @@
+import { resolveFetch } from "./_http.js";
+import { loadPackageVersionPage } from "./_package-version-page-client.js";
+export async function listPresentPackageVersionIds(owner, packageName, versionIds, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const requestedVersionIds = [...new Set(versionIds)];
+    if (requestedVersionIds.length === 0) {
+        return [];
+    }
+    const requestedVersionIdSet = new Set(requestedVersionIds);
+    const matches = new Set();
+    for (let page = 1;; page += 1) {
+        const items = await loadPackageVersionPage(owner, packageName, page, token, logger, fetchImpl);
+        if (items.length === 0) {
+            break;
+        }
+        for (const item of items) {
+            if (!requestedVersionIdSet.has(item.id)) {
+                continue;
+            }
+            matches.add(item.id);
+        }
+        if (matches.size === requestedVersionIds.length || items.length < 100) {
+            break;
+        }
+    }
+    return requestedVersionIds.filter((versionId) => matches.has(versionId));
+}
+export async function listPackageVersionTagSources(owner, packageName, tags, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const requestedTags = [...new Set(tags)];
+    if (requestedTags.length === 0) {
+        return [];
+    }
+    const requestedTagSet = new Set(requestedTags);
+    const matches = new Map();
+    for (let page = 1;; page += 1) {
+        const items = await loadPackageVersionPage(owner, packageName, page, token, logger, fetchImpl);
+        if (items.length === 0) {
+            break;
+        }
+        for (const item of items) {
+            const itemTags = item.metadata?.container?.tags;
+            if (!Array.isArray(itemTags) || typeof item.name !== "string") {
+                continue;
+            }
+            for (const tag of itemTags) {
+                if (!requestedTagSet.has(tag) || matches.has(tag)) {
+                    continue;
+                }
+                matches.set(tag, {
+                    tag,
+                    sourceVersionId: item.id,
+                    sourceDigest: item.name
+                });
+            }
+        }
+        if (matches.size === requestedTags.length || items.length < 100) {
+            break;
+        }
+    }
+    return requestedTags.flatMap((tag) => {
+        const match = matches.get(tag);
+        return match ? [match] : [];
+    });
+}

package/dist/execute/_plan-executor.d.ts

@@ -0,0 +1,3 @@
+import type { DeletePlan } from "../db/index.js";
+import { type DeleteExecutionOptions, type DeleteExecutionSummary } from "./_types.js";
+export declare function executeDeletePlan(plan: DeletePlan, options: DeleteExecutionOptions): Promise<DeleteExecutionSummary>;

package/dist/execute/_plan-executor.js

@@ -0,0 +1,47 @@
+import { deletePackageVersion } from "./_package-version-delete-client.js";
+import { untagRootTags } from "./_untag-client.js";
+export async function executeDeletePlan(plan, options) {
+    const deletedPackageVersions = [];
+    const untaggedTags = [];
+    const directTargetTagSet = new Set(plan.directTargetTags);
+    for (const decision of plan.rootDecisions) {
+        if (decision.validationStatus !== "untag-only") {
+            continue;
+        }
+        if (!options.listRootTags) {
+            throw new Error(`execution requires listRootTags support for untag-only root ${decision.digest}`);
+        }
+        const selectedTags = options
+            .listRootTags({
+            owner: plan.owner,
+            packageName: plan.packageName,
+            versionId: decision.versionId,
+            digest: decision.digest
+        })
+            .filter((tag) => directTargetTagSet.has(tag));
+        if (selectedTags.length === 0) {
+            throw new Error(`no selected tags resolved for untag-only root ${decision.digest}`);
+        }
+        untaggedTags.push(...(await untagRootTags(plan.owner, plan.packageName, decision.versionId, decision.digest, selectedTags, options)));
+    }
+    for (const root of plan.fullyDeletableRoots) {
+        options.logger.info(`Deleting package version ${root.versionId} for ${plan.owner}/${plan.packageName} (${root.digest})`);
+        await deletePackageVersion(plan.owner, plan.packageName, root.versionId, options.token, options.logger, {
+            fetchImpl: options.fetchImpl
+        });
+        deletedPackageVersions.push({
+            versionId: root.versionId,
+            digest: root.digest
+        });
+    }
+    return {
+        owner: plan.owner,
+        packageName: plan.packageName,
+        scanCompletedAt: plan.scanCompletedAt,
+        plannerInputs: plan.plannerInputs,
+        deletedPackageVersions,
+        untaggedTags,
+        blockedRoots: plan.blockedRoots,
+        unsupportedUntagRoots: []
+    };
+}

package/dist/execute/_registry-manifest-client.d.ts

@@ -0,0 +1,12 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export interface LoadedRegistryManifest {
+    digest: string;
+    mediaType: string;
+    rawJson: string;
+}
+export declare function loadRegistryManifestByDigest(owner: string, packageName: string, digest: string, registryToken: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<LoadedRegistryManifest>;
+export declare function putRegistryManifestForTag(owner: string, packageName: string, tag: string, mediaType: string, manifestJson: string, registryToken: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<string>;

package/dist/execute/_registry-manifest-client.js

@@ -0,0 +1,79 @@
+import { ghcrRegistryBaseUrl } from "../config/index.js";
+import { createHash } from "node:crypto";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, resolveJsonHeaders, runWithRetry } from "./_http.js";
+const _ACCEPTED_MANIFEST_MEDIA_TYPES = [
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.oci.artifact.manifest.v1+json"
+].join(", ");
+export async function loadRegistryManifestByDigest(owner, packageName, digest, registryToken, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const url = new URL(`/v2/${owner}/${packageName}/manifests/${digest}`, ghcrRegistryBaseUrl);
+    let response;
+    try {
+        response = await runWithRetry(`GHCR manifest request for ${digest}`, logger, async () => {
+            const manifestResponse = await fetchImpl(url.toString(), {
+                headers: {
+                    Accept: _ACCEPTED_MANIFEST_MEDIA_TYPES,
+                    Authorization: `Bearer ${registryToken}`,
+                    "User-Agent": "ghcr-manager"
+                }
+            });
+            if (!manifestResponse.ok && isRetryableStatus(manifestResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(manifestResponse, `GHCR manifest request for ${digest} failed`));
+            }
+            return manifestResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GHCR manifest request for ${digest} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GHCR manifest request for ${digest} failed`));
+    }
+    const document = (await response.json());
+    const mediaType = document.mediaType ?? resolveJsonHeaders(response);
+    if (!mediaType) {
+        throw new Error(`manifest response for ${digest} did not include a media type`);
+    }
+    return {
+        digest,
+        mediaType,
+        rawJson: JSON.stringify(document)
+    };
+}
+export async function putRegistryManifestForTag(owner, packageName, tag, mediaType, manifestJson, registryToken, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const url = new URL(`/v2/${owner}/${packageName}/manifests/${encodeURIComponent(tag)}`, ghcrRegistryBaseUrl);
+    let response;
+    try {
+        response = await runWithRetry(`GHCR manifest put request for tag ${tag}`, logger, async () => {
+            const putResponse = await fetchImpl(url.toString(), {
+                method: "PUT",
+                headers: {
+                    Authorization: `Bearer ${registryToken}`,
+                    "Content-Type": mediaType,
+                    "User-Agent": "ghcr-manager"
+                },
+                body: manifestJson
+            });
+            if (!putResponse.ok && isRetryableStatus(putResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(putResponse, `GHCR manifest put request for tag ${tag} failed`));
+            }
+            return putResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GHCR manifest put request for tag ${tag} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GHCR manifest put request for tag ${tag} failed`));
+    }
+    return `sha256:${createHash("sha256").update(manifestJson).digest("hex")}`;
+}

package/dist/execute/_registry-token-client.d.ts

@@ -0,0 +1,4 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export declare function loadRegistryPushToken(owner: string, packageName: string, token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<string>;

package/dist/execute/_registry-token-client.js

@@ -0,0 +1,37 @@
+import { ghcrRegistryBaseUrl } from "../config/index.js";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, runWithRetry } from "./_http.js";
+export async function loadRegistryPushToken(owner, packageName, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const registryUrl = new URL(ghcrRegistryBaseUrl);
+    const tokenUrl = new URL("/token", registryUrl);
+    tokenUrl.searchParams.set("service", registryUrl.host);
+    tokenUrl.searchParams.set("scope", `repository:${owner}/${packageName}:pull,push`);
+    let response;
+    try {
+        response = await runWithRetry("GHCR token request", logger, async () => {
+            const tokenResponse = await fetchImpl(tokenUrl.toString(), {
+                headers: {
+                    "User-Agent": "ghcr-manager",
+                    Authorization: `Basic ${Buffer.from(`${owner}:${token}`).toString("base64")}`
+                }
+            });
+            if (!tokenResponse.ok && isRetryableStatus(tokenResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(tokenResponse, "GHCR token request failed"));
+            }
+            return tokenResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, "GHCR token request failed"), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, "GHCR token request failed"));
+    }
+    const body = (await response.json());
+    if (!body.token) {
+        throw new Error("GHCR token response did not include a token");
+    }
+    return body.token;
+}