packtory 0.0.96 → 0.0.98

package/bundle-emitter/registry/oidc-token-exchange.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-token-exchange.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/oidc-token-exchange.ts"],"names":[],"mappings":"AAEA,OAQO,2BAA2B,CAAC;AACnC,OAAsC,4BAA4B,CAAC;AACnE,OAA0C,gCAAgC,CAAC"}
+{"version":3,"file":"oidc-token-exchange.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/oidc-token-exchange.ts"],"names":[],"mappings":"AAEA,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAErB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,0CAA0C,GAAG,MAAM,CAAC;AA8B1D,MAAM,UAAU,wBAAwB,CAAC,YAAuC;IAC5E,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,YAAY,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEnD,SAAS,WAAW,CAAC,WAAmB,EAAE,gBAA4C;QAClF,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;IACvF,CAAC;IAED,SAAS,eAAe,CAAC,QAAgB;QACrC,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;QACzD,IAAI,WAAW,CAAC,SAAS,GAAG,WAAW,GAAG,0CAA0C,EAAE,CAAC;YACnF,OAAO,WAAW,CAAC,KAAK,CAAC;QAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,SAAS,mBAAmB,CAAC,IAAa;QACtC,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,qDAAqD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,eAAe,CAC1B,WAAmB,EACnB,IAAwB;QAExB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAgB;YAC7B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,EAAE,EAAE;SAClD,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAC9C,GAAG,cAAc,wCAAwC,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAC7F,WAAW,CACd,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,mBAAmB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAY,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,UAAU,aAAa,CACxB,WAAmB,EACnB,gBAA4C,EAC5C,IAAwB;QAExB,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3D,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC/B,OAAO,SAAS,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,OAAO;QACH,aAAa;QAEb,KAAK,CAAC,uBAAuB,CAAC,WAAW,EAAE,gBAAgB;YACvD,MAAM,IAAI,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3B,OAAO,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC;YAC5D,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO;gBACH,GAAG,iBAAiB,CAAC,gBAAgB,CAAC;gBACtC,SAAS,EAAE,EAAE,KAAK,EAAE;aACvB,CAAC;QACN,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bundle-emitter/registry/package-metadata-fetcher.js

@@ -1,8 +1,211 @@
-import 'true-myth';
-import "./metadata-auth-retry.js";
-import "./registry-package-path.js";
-import "./registry-auth-config.js";
-import "./registry-response-schemas.js";
-import "./tarball-integrity.js";
-import "./validate-tarball-host.js";
+import { Maybe } from 'true-myth';
+import { retryWithFallbackAuth } from "./metadata-auth-retry.js";
+import { toRegistryPackagePath } from "./registry-package-path.js";
+import { resolveMetadataAuthOptions, resolveStageListingAuthOptions } from "./registry-auth-config.js";
+import { parseAbbreviatedPackageResponse, parseFullPackageResponse } from "./registry-response-schemas.js";
+import { assertTarballIntegrity } from "./tarball-integrity.js";
+import { assertTarballOriginMatchesRegistry } from "./validate-tarball-host.js";
+const notFoundStatusCode = 404;
+const abbreviatedResponseAcceptHeader = 'application/vnd.npm.install-v1+json';
+const maxDownloadedTarballBytes = 268_435_456;
+function isRecord(value) {
+    return value instanceof Object;
+}
+function assertDownloadedTarballSize(size) {
+    if (size > maxDownloadedTarballBytes) {
+        throw new Error(`Refusing to download tarball larger than ${maxDownloadedTarballBytes} bytes`);
+    }
+}
+function assertContentLengthWithinDownloadLimit(response) {
+    assertDownloadedTarballSize(Number(response.headers?.get('content-length')));
+}
+function isMissingPackageError(error) {
+    const statusCode = isRecord(error) ? error.statusCode : undefined;
+    return statusCode === notFoundStatusCode;
+}
+function parseTimestamp(timestamp) {
+    const parsed = new Date(timestamp);
+    if (Number.isNaN(parsed.getTime())) {
+        throw new TypeError(`Version publish time "${timestamp}" is not a valid timestamp`);
+    }
+    return parsed;
+}
+function isNonNegativeInteger(value) {
+    if (!Number.isSafeInteger(value)) {
+        return false;
+    }
+    return Number(value) >= 0;
+}
+function parseStagedPackageListResponse(response) {
+    if (!isRecord(response)) {
+        throw new Error('Got an invalid response from registry stage API');
+    }
+    const { items, total } = response;
+    if (!Array.isArray(items) || !isNonNegativeInteger(total)) {
+        throw new Error('Got an invalid response from registry stage API');
+    }
+    return {
+        items: items.map(function (item) {
+            if (!isRecord(item) || typeof item.version !== 'string') {
+                throw new Error('Got an invalid response from registry stage API');
+            }
+            return { version: item.version };
+        }),
+        total
+    };
+}
+const abbreviatedPackageMetadataRequest = {
+    parsePackageResponse: parseAbbreviatedPackageResponse,
+    headers: { accept: abbreviatedResponseAcceptHeader }
+};
+const fullPackageMetadataRequest = {
+    parsePackageResponse: parseFullPackageResponse,
+    headers: undefined
+};
+const stageListPageSize = 100;
+const maximumStageListPages = 1000;
+async function fetchPackageMetadataResponse(npmFetch, packageName, registrySettings, request) {
+    const auth = resolveMetadataAuthOptions(registrySettings);
+    return retryWithFallbackAuth(registrySettings, auth, async function (options) {
+        return npmFetch.json(`/${toRegistryPackagePath(packageName)}`, {
+            ...options,
+            headers: request.headers
+        });
+    });
+}
+function parsePackageMetadataResponse(response, request) {
+    const result = request.parsePackageResponse(response);
+    if (result === undefined) {
+        throw new Error('Got an invalid response from registry API');
+    }
+    return result;
+}
+async function fetchAndParsePackageMetadata(npmFetch, packageName, registrySettings, request) {
+    try {
+        return Maybe.just(parsePackageMetadataResponse(await fetchPackageMetadataResponse(npmFetch, packageName, registrySettings, request), request));
+    }
+    catch (error) {
+        if (isMissingPackageError(error)) {
+            return Maybe.nothing();
+        }
+        throw error;
+    }
+}
+function readTarballDigestField(value, fieldName, packageName, version) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value === 'string' && value.length > 0) {
+        return value;
+    }
+    throw new Error(`Registry returned invalid ${fieldName} for package "${packageName}" version "${version}"`);
+}
+function readTarballIntegrity(dist, packageName, version) {
+    return {
+        integrity: readTarballDigestField(dist.integrity, 'dist.integrity', packageName, version),
+        shasum: readTarballDigestField(dist.shasum, 'dist.shasum', packageName, version)
+    };
+}
+function extractPackageVersionDetails(packageResponse, packageName, version) {
+    const versionData = packageResponse.versions[version];
+    if (versionData === undefined) {
+        return Maybe.nothing();
+    }
+    return Maybe.just({
+        version,
+        tarballUrl: versionData.dist.tarball,
+        tarballIntegrity: readTarballIntegrity(versionData.dist, packageName, version),
+        gitHead: versionData.gitHead
+    });
+}
+function extractLatestVersionDetails(packageResponse, packageName) {
+    const latestVersion = packageResponse['dist-tags'].latest;
+    if (latestVersion === undefined) {
+        return Maybe.nothing();
+    }
+    const versionDetails = extractPackageVersionDetails(packageResponse, packageName, latestVersion);
+    if (versionDetails.isNothing) {
+        throw new Error(`Version "${latestVersion}" for package "${packageName}" has no entry in the registry response`);
+    }
+    return versionDetails;
+}
+function releaseMetadataFrom(packageResponse, versionDetails) {
+    const publishedAtTimestamp = packageResponse.time?.[versionDetails.version];
+    return {
+        version: versionDetails.version,
+        tarballUrl: versionDetails.tarballUrl,
+        tarballIntegrity: versionDetails.tarballIntegrity,
+        publishedAt: publishedAtTimestamp === undefined ? undefined : parseTimestamp(publishedAtTimestamp),
+        gitHead: versionDetails.gitHead
+    };
+}
+export async function fetchLatestPackageVersion(npmFetch, packageName, registrySettings) {
+    const packageResponse = await fetchAndParsePackageMetadata(npmFetch, packageName, registrySettings, abbreviatedPackageMetadataRequest);
+    if (packageResponse.isNothing) {
+        return Maybe.nothing();
+    }
+    return extractLatestVersionDetails(packageResponse.value, packageName);
+}
+export async function fetchLatestPackageReleaseMetadata(npmFetch, packageName, registrySettings) {
+    const packageResponse = await fetchAndParsePackageMetadata(npmFetch, packageName, registrySettings, fullPackageMetadataRequest);
+    if (packageResponse.isNothing) {
+        return Maybe.nothing();
+    }
+    const latestVersion = extractLatestVersionDetails(packageResponse.value, packageName);
+    if (latestVersion.isNothing) {
+        return Maybe.nothing();
+    }
+    return Maybe.just(releaseMetadataFrom(packageResponse.value, latestVersion.value));
+}
+export async function fetchPackageVersionReleaseMetadata(npmFetch, packageName, version, registrySettings) {
+    const packageResponse = await fetchAndParsePackageMetadata(npmFetch, packageName, registrySettings, fullPackageMetadataRequest);
+    if (packageResponse.isNothing) {
+        return Maybe.nothing();
+    }
+    const versionDetails = extractPackageVersionDetails(packageResponse.value, packageName, version);
+    if (versionDetails.isNothing) {
+        return Maybe.nothing();
+    }
+    return Maybe.just({
+        ...releaseMetadataFrom(packageResponse.value, versionDetails.value),
+        latestVersion: packageResponse.value['dist-tags'].latest
+    });
+}
+async function fetchStagedPackageVersionPage(npmFetch, auth, packageName, page) {
+    const searchParams = new URLSearchParams({
+        package: packageName,
+        page: String(page),
+        perPage: String(stageListPageSize)
+    });
+    return parseStagedPackageListResponse(await npmFetch.json(`/-/stage?${searchParams.toString()}`, auth.options));
+}
+export async function fetchStagedPackageVersions(npmFetch, packageName, registrySettings) {
+    const auth = resolveStageListingAuthOptions(registrySettings);
+    const versions = [];
+    const pages = Array.from({ length: maximumStageListPages }, function (_value, index) {
+        return index;
+    });
+    for (const page of pages) {
+        const response = await fetchStagedPackageVersionPage(npmFetch, auth, packageName, page);
+        versions.push(...response.items.map(function (item) {
+            return item.version;
+        }));
+        if (versions.length >= response.total || response.items.length === 0) {
+            return versions;
+        }
+    }
+    throw new Error(`Staged package listing exceeded ${maximumStageListPages} pages`);
+}
+export async function fetchPackageTarball(npmFetch, tarballUrl, tarballIntegrity, registrySettings) {
+    assertTarballOriginMatchesRegistry(tarballUrl, registrySettings);
+    const auth = resolveMetadataAuthOptions(registrySettings);
+    const response = await retryWithFallbackAuth(registrySettings, auth, async function (options) {
+        return npmFetch(tarballUrl, options);
+    });
+    assertContentLengthWithinDownloadLimit(response);
+    const tarball = await response.buffer();
+    assertDownloadedTarballSize(tarball.length);
+    assertTarballIntegrity(tarball, tarballIntegrity);
+    return tarball;
+}
 //# sourceMappingURL=package-metadata-fetcher.js.map

package/bundle-emitter/registry/package-metadata-fetcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-metadata-fetcher.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/package-metadata-fetcher.ts"],"names":[],"mappings":"AACA,OAAsB,WAAW,CAAC;AAElC,OAAsC,0BAA0B,CAAC;AACjE,OAAsC,4BAA4B,CAAC;AACnE,OAKO,2BAA2B,CAAC;AACnC,OAKO,gCAAgC,CAAC;AACxC,OAA8D,wBAAwB,CAAC;AACvF,OAAmD,4BAA4B,CAAC"}
+{"version":3,"file":"package-metadata-fetcher.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/package-metadata-fetcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EACH,0BAA0B,EAC1B,8BAA8B,EAGjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACH,+BAA+B,EAC/B,wBAAwB,EAG3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAyB,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAEhF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AAC9E,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAqB9C,SAAS,QAAQ,CAAC,KAAc;IAC5B,OAAO,KAAK,YAAY,MAAM,CAAC;AACnC,CAAC;AAOD,SAAS,2BAA2B,CAAC,IAAY;IAC7C,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4CAA4C,yBAAyB,QAAQ,CAAC,CAAC;IACnG,CAAC;AACL,CAAC;AAED,SAAS,sCAAsC,CAAC,QAAkC;IAC9E,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,OAAO,UAAU,KAAK,kBAAkB,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,SAAS,CAAC,yBAAyB,SAAS,4BAA4B,CAAC,CAAC;IACxF,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IACxC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,8BAA8B,CAAC,QAAiB;IACrD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACH,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI;YAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC,CAAC;QACF,KAAK;KACR,CAAC;AACN,CAAC;AAYD,MAAM,iCAAiC,GAAuD;IAC1F,oBAAoB,EAAE,+BAA+B;IACrD,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;CACvD,CAAC;AAEF,MAAM,0BAA0B,GAAgD;IAC5E,oBAAoB,EAAE,wBAAwB;IAC9C,OAAO,EAAE,SAAS;CACrB,CAAC;AAWF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAQnC,KAAK,UAAU,4BAA4B,CACvC,QAAkB,EAClB,WAAmB,EACnB,gBAA4C,EAC5C,OAAiD;IAEjD,MAAM,IAAI,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAC1D,OAAO,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,WAAW,OAAO;QACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,EAAE;YAC3D,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,4BAA4B,CACjC,QAAiB,EACjB,OAAiD;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,4BAA4B,CACvC,QAAkB,EAClB,WAAmB,EACnB,gBAA4C,EAC5C,OAAiD;IAEjD,IAAI,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CACb,4BAA4B,CACxB,MAAM,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,CAAC,EACpF,OAAO,CACV,CACJ,CAAC;IACN,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,EAAoB,CAAC;QAC7C,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAC3B,KAAc,EACd,SAA2C,EAC3C,WAAmB,EACnB,OAAe;IAEf,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,iBAAiB,WAAW,cAAc,OAAO,GAAG,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB,EAAE,WAAmB,EAAE,OAAe;IACxF,OAAO;QACH,SAAS,EAAE,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC;QACzF,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC;KACnF,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CACjC,eAA2C,EAC3C,WAAmB,EACnB,OAAe;IAEf,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC;QACd,OAAO;QACP,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO;QACpC,gBAAgB,EAAE,oBAAoB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC;QAC9E,OAAO,EAAE,WAAW,CAAC,OAAO;KAC/B,CAAC,CAAC;AACP,CAAC;AAED,SAAS,2BAA2B,CAChC,eAA2C,EAC3C,WAAmB;IAEnB,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IACjG,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACX,YAAY,aAAa,kBAAkB,WAAW,yCAAyC,CAClG,CAAC;IACN,CAAC;IAED,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED,SAAS,mBAAmB,CACxB,eAAoC,EACpC,cAAqC;IAErC,MAAM,oBAAoB,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAE5E,OAAO;QACH,OAAO,EAAE,cAAc,CAAC,OAAO;QAC/B,UAAU,EAAE,cAAc,CAAC,UAAU;QACrC,gBAAgB,EAAE,cAAc,CAAC,gBAAgB;QACjD,WAAW,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC;QAClG,OAAO,EAAE,cAAc,CAAC,OAAO;KAClC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,QAAkB,EAClB,WAAmB,EACnB,gBAA4C;IAE5C,MAAM,eAAe,GAAG,MAAM,4BAA4B,CACtD,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,iCAAiC,CACpC,CAAC;IACF,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,2BAA2B,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACnD,QAAkB,EAClB,WAAmB,EACnB,gBAA4C;IAE5C,MAAM,eAAe,GAAG,MAAM,4BAA4B,CACtD,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,0BAA0B,CAC7B,CAAC;IACF,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,aAAa,GAAG,2BAA2B,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACtF,IAAI,aAAa,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACpD,QAAkB,EAClB,WAAmB,EACnB,OAAe,EACf,gBAA4C;IAE5C,MAAM,eAAe,GAAG,MAAM,4BAA4B,CACtD,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,0BAA0B,CAC7B,CAAC;IACF,IAAI,eAAe,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACjG,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC;QACd,GAAG,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;QACnE,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM;KAC3D,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,6BAA6B,CACxC,QAAkB,EAClB,IAAoB,EACpB,WAAmB,EACnB,IAAY;IAEZ,MAAM,YAAY,GAAG,IAAI,eAAe,CAAC;QACrC,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC,iBAAiB,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,8BAA8B,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC5C,QAAkB,EAClB,WAAmB,EACnB,gBAA4C;IAE5C,MAAM,IAAI,GAAG,8BAA8B,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE,UAAU,MAAM,EAAE,KAAK;QAC/E,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAExF,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,IAAI;YAC9C,OAAO,IAAI,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC,CAAC,CAAC;QAEJ,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,QAAQ,CAAC;QACpB,CAAC;IACL,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,mCAAmC,qBAAqB,QAAQ,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,QAAkB,EAClB,UAAkB,EAClB,gBAAkC,EAClC,gBAA4C;IAE5C,kCAAkC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,WAAW,OAAO;QACxF,OAAO,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,sCAAsC,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxC,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/bundle-emitter/registry/publish-settings-bridge.js

@@ -1,4 +1,35 @@
-import "../publish-error/auto-mode-error-matching.js";
-import "../publish-error/error-shape-helpers.js";
-import "../publish-error/file-mode-error-matching.js";
+import { matchAutoModeError } from "../publish-error/auto-mode-error-matching.js";
+import { ensureError } from "../publish-error/error-shape-helpers.js";
+import { matchFileModeError } from "../publish-error/file-mode-error-matching.js";
+export function buildPublishOptionsForPublishSettings(publishSettings) {
+    if (publishSettings.access === 'restricted') {
+        return { access: 'restricted' };
+    }
+    if (publishSettings.provenance?.type === 'auto') {
+        return { access: 'public', provenance: true };
+    }
+    if (publishSettings.provenance?.type === 'file') {
+        return { access: 'public', provenanceFile: publishSettings.provenance.path };
+    }
+    return { access: 'public' };
+}
+function getProvenanceFilePath(publishSettings) {
+    return publishSettings.access === 'public' && publishSettings.provenance?.type === 'file'
+        ? publishSettings.provenance.path
+        : undefined;
+}
+export function remapPublishError(error, publishSettings) {
+    const autoModeError = matchAutoModeError(error);
+    if (autoModeError !== undefined) {
+        return autoModeError;
+    }
+    const filePath = getProvenanceFilePath(publishSettings);
+    if (filePath !== undefined) {
+        const fileModeError = matchFileModeError(error, filePath);
+        if (fileModeError !== undefined) {
+            return fileModeError;
+        }
+    }
+    return ensureError(error);
+}
 //# sourceMappingURL=publish-settings-bridge.js.map

package/bundle-emitter/registry/publish-settings-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-settings-bridge.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/publish-settings-bridge.ts"],"names":[],"mappings":"AACA,OAAmC,8CAA8C,CAAC;AAClF,OAA4B,yCAAyC,CAAC;AACtE,OAAmC,8CAA8C,CAAC"}
+{"version":3,"file":"publish-settings-bridge.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/publish-settings-bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8CAA8C,CAAC;AAQlF,MAAM,UAAU,qCAAqC,CACjD,eAA0C;IAE1C,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,eAA0C;IACrE,OAAO,eAAe,CAAC,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM;QACrF,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI;QACjC,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,eAA0C;IACxF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC;QACzB,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/bundle-emitter/registry/registry-auth-config.js

@@ -1 +1,107 @@
+export const npmRegistryUrl = 'https://registry.npmjs.org/';
+function isSplitRegistryAuth(auth) {
+    return Object.hasOwn(auth, 'publish');
+}
+export function resolveRegistryUrl(registrySettings) {
+    return registrySettings.registryUrl;
+}
+export function isNpmRegistry(registry) {
+    const resolvedRegistryUrl = new URL(registry ?? npmRegistryUrl);
+    return resolvedRegistryUrl.href === npmRegistryUrl;
+}
+const publishAuthRequiredErrorMessage = 'registrySettings.auth must be configured to publish; this code path should be unreachable when auth is missing.';
+export function resolvePublishAuth(registrySettings) {
+    if (registrySettings.auth === undefined) {
+        throw new Error(publishAuthRequiredErrorMessage);
+    }
+    return isSplitRegistryAuth(registrySettings.auth) ? registrySettings.auth.publish : registrySettings.auth;
+}
+export function createBaseOptions(registrySettings) {
+    return {
+        alwaysAuth: true,
+        registry: resolveRegistryUrl(registrySettings)
+    };
+}
+export function buildAuthOptions(auth, registrySettings) {
+    const registry = resolveRegistryUrl(registrySettings);
+    const options = createBaseOptions(registrySettings);
+    if (auth.type === 'bearer-token') {
+        return {
+            allowsAutomaticRetry: false,
+            registry,
+            options: {
+                ...options,
+                forceAuth: {
+                    token: auth.token
+                }
+            }
+        };
+    }
+    return {
+        allowsAutomaticRetry: false,
+        registry,
+        options: {
+            ...options,
+            forceAuth: {
+                _auth: Buffer.from(`${auth.username}:${auth.password}`).toString('base64')
+            },
+            ...auth.email === undefined ? undefined : { email: auth.email }
+        }
+    };
+}
+function createAnonymousAuthResolution(registrySettings) {
+    return {
+        allowsAutomaticRetry: false,
+        registry: resolveRegistryUrl(registrySettings),
+        options: createBaseOptions(registrySettings)
+    };
+}
+function createAutomaticRetryAuthResolution(registrySettings) {
+    return {
+        ...createAnonymousAuthResolution(registrySettings),
+        allowsAutomaticRetry: true
+    };
+}
+function resolveInheritedMetadataAuth(publishAuth, registrySettings) {
+    return publishAuth.type === 'npm-oidc'
+        ? createAnonymousAuthResolution(registrySettings)
+        : buildAuthOptions(publishAuth, registrySettings);
+}
+function resolveMetadataAuthFromMode(metadataMode, publishAuth, registrySettings) {
+    if (metadataMode === 'auto') {
+        return createAutomaticRetryAuthResolution(registrySettings);
+    }
+    if (metadataMode === 'anonymous') {
+        return createAnonymousAuthResolution(registrySettings);
+    }
+    if (typeof metadataMode === 'object') {
+        return buildAuthOptions(metadataMode, registrySettings);
+    }
+    return resolveInheritedMetadataAuth(publishAuth, registrySettings);
+}
+export function resolveMetadataAuthOptions(registrySettings) {
+    if (registrySettings.auth === undefined) {
+        return createAnonymousAuthResolution(registrySettings);
+    }
+    if (isSplitRegistryAuth(registrySettings.auth)) {
+        return resolveMetadataAuthFromMode(registrySettings.auth.metadata, registrySettings.auth.publish, registrySettings);
+    }
+    return resolveInheritedMetadataAuth(registrySettings.auth, registrySettings);
+}
+const stagedVersionLookupRequiresTokenAuthMessage = 'npm staged publishing with automatic versioning requires token-based metadata auth ' +
+    'when publish auth uses npm-oidc';
+export function resolveStageListingAuthOptions(registrySettings) {
+    const { auth } = registrySettings;
+    if (auth === undefined) {
+        throw new Error(publishAuthRequiredErrorMessage);
+    }
+    const publishAuth = isSplitRegistryAuth(auth) ? auth.publish : auth;
+    if (isSplitRegistryAuth(auth) && typeof auth.metadata === 'object') {
+        return buildAuthOptions(auth.metadata, registrySettings);
+    }
+    if (publishAuth.type === 'npm-oidc') {
+        throw new Error(stagedVersionLookupRequiresTokenAuthMessage);
+    }
+    return buildAuthOptions(publishAuth, registrySettings);
+}
 //# sourceMappingURL=registry-auth-config.js.map

package/bundle-emitter/registry/registry-auth-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-auth-config.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-auth-config.ts"],"names":[],"mappings":""}
+{"version":3,"file":"registry-auth-config.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-auth-config.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAa5D,SAAS,mBAAmB,CAAC,IAAkB;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,gBAA4C;IAC3E,OAAO,gBAAgB,CAAC,WAAW,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,QAA4B;IACtD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC;IAChE,OAAO,mBAAmB,CAAC,IAAI,KAAK,cAAc,CAAC;AACvD,CAAC;AAED,MAAM,+BAA+B,GACjC,iHAAiH,CAAC;AAEtH,MAAM,UAAU,kBAAkB,CAAC,gBAA4C;IAC3E,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC;AAC9G,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,gBAA4C;IAC1E,OAAO;QACH,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;KACjD,CAAC;AACN,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC5B,IAA0B,EAC1B,gBAA4C;IAE5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAEpD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO;YACH,oBAAoB,EAAE,KAAK;YAC3B,QAAQ;YACR,OAAO,EAAE;gBACL,GAAG,OAAO;gBACV,SAAS,EAAE;oBACP,KAAK,EAAE,IAAI,CAAC,KAAK;iBACpB;aACJ;SACJ,CAAC;IACN,CAAC;IAED,OAAO;QACH,oBAAoB,EAAE,KAAK;QAC3B,QAAQ;QACR,OAAO,EAAE;YACL,GAAG,OAAO;YACV,SAAS,EAAE;gBACP,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC7E;YACD,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAClE;KACJ,CAAC;AACN,CAAC;AAED,SAAS,6BAA6B,CAAC,gBAA4C;IAC/E,OAAO;QACH,oBAAoB,EAAE,KAAK;QAC3B,QAAQ,EAAE,kBAAkB,CAAC,gBAAgB,CAAC;QAC9C,OAAO,EAAE,iBAAiB,CAAC,gBAAgB,CAAC;KAC/C,CAAC;AACN,CAAC;AAED,SAAS,kCAAkC,CAAC,gBAA4C;IACpF,OAAO;QACH,GAAG,6BAA6B,CAAC,gBAAgB,CAAC;QAClD,oBAAoB,EAAE,IAAI;KAC7B,CAAC;AACN,CAAC;AAED,SAAS,4BAA4B,CACjC,WAAgC,EAChC,gBAA4C;IAE5C,OAAO,WAAW,CAAC,IAAI,KAAK,UAAU;QAClC,CAAC,CAAC,6BAA6B,CAAC,gBAAgB,CAAC;QACjD,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,2BAA2B,CAChC,YAA0C,EAC1C,WAAgC,EAChC,gBAA4C;IAE5C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,4BAA4B,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,gBAA4C;IACnF,IAAI,gBAAgB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,6BAA6B,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,OAAO,2BAA2B,CAC9B,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAC9B,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAC7B,gBAAgB,CACnB,CAAC;IACN,CAAC;IACD,OAAO,4BAA4B,CAAC,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,2CAA2C,GAC7C,qFAAqF;IACrF,iCAAiC,CAAC;AAEtC,MAAM,UAAU,8BAA8B,CAAC,gBAA4C;IACvF,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC"}

package/bundle-emitter/registry/registry-client.js

@@ -1,5 +1,75 @@
-import "../publication-outcome.js";
-import "./oidc-token-exchange.js";
-import "./package-metadata-fetcher.js";
-import "./publish-settings-bridge.js";
+import { publishedToRegistry, stagedForApproval } from "../publication-outcome.js";
+import { createOidcTokenExchanger } from "./oidc-token-exchange.js";
+import { fetchLatestPackageReleaseMetadata, fetchPackageTarball, fetchLatestPackageVersion, fetchPackageVersionReleaseMetadata, fetchStagedPackageVersions } from "./package-metadata-fetcher.js";
+import { buildPublishOptionsForPublishSettings, remapPublishError } from "./publish-settings-bridge.js";
+function isStageIdRecord(response) {
+    return (typeof response === 'object' &&
+        response !== null &&
+        Object.hasOwn(response, 'stageId'));
+}
+function hasStageId(response) {
+    return isStageIdRecord(response) && typeof response.stageId === 'string' && response.stageId.length > 0;
+}
+function readStageId(response) {
+    if (!hasStageId(response)) {
+        throw new Error('npm staged publish succeeded without returning a stage ID');
+    }
+    return response.stageId;
+}
+async function readPublishedPublicationOutcome(publishPromise) {
+    await publishPromise;
+    return publishedToRegistry;
+}
+async function readStagedPublicationOutcome(publishPromise) {
+    return stagedForApproval(readStageId(await publishPromise));
+}
+async function readPublicationOutcome(publishPromise, readOutcome, publishSettings) {
+    try {
+        return await readOutcome(publishPromise);
+    }
+    catch (error) {
+        throw remapPublishError(error, publishSettings);
+    }
+}
+export function createRegistryClient(dependencies) {
+    const { npmFetch, publish, fetch: fetchImplementation, clock, promptForOneTimePassword, resolveIdToken } = dependencies;
+    const oidcExchanger = createOidcTokenExchanger({ fetch: fetchImplementation, clock, resolveIdToken });
+    return {
+        async fetchTarball(tarballUrl, tarballIntegrity, registrySettings) {
+            return fetchPackageTarball(npmFetch, tarballUrl, tarballIntegrity, registrySettings);
+        },
+        async publishPackage(...[manifest, tarData, registrySettings, publishSettings, stage]) {
+            const authOptions = await oidcExchanger.resolveWriteAuthOptions(manifest.name, registrySettings);
+            const publishOptionsFromSettings = buildPublishOptionsForPublishSettings(publishSettings);
+            const publishOptions = {
+                defaultTag: 'latest',
+                ...authOptions,
+                ...publishOptionsFromSettings,
+                ...stage ? { stage: true } : {}
+            };
+            const publishOptionsWithOneTimePassword = {
+                ...publishOptions,
+                otpPrompt: promptForOneTimePassword
+            };
+            const publishOptionsForOneTimePassword = promptForOneTimePassword === undefined
+                ? publishOptions
+                : publishOptionsWithOneTimePassword;
+            const publishPromise = publish(manifest, tarData, publishOptionsForOneTimePassword);
+            const readOutcome = stage ? readStagedPublicationOutcome : readPublishedPublicationOutcome;
+            return readPublicationOutcome(publishPromise, readOutcome, publishSettings);
+        },
+        async fetchLatestVersion(packageName, registrySettings) {
+            return fetchLatestPackageVersion(npmFetch, packageName, registrySettings);
+        },
+        async fetchStagedVersions(packageName, registrySettings) {
+            return fetchStagedPackageVersions(npmFetch, packageName, registrySettings);
+        },
+        async fetchLatestReleaseMetadata(packageName, registrySettings) {
+            return fetchLatestPackageReleaseMetadata(npmFetch, packageName, registrySettings);
+        },
+        async fetchVersionReleaseMetadata(packageName, version, registrySettings) {
+            return fetchPackageVersionReleaseMetadata(npmFetch, packageName, version, registrySettings);
+        }
+    };
+}
 //# sourceMappingURL=registry-client.js.map

package/bundle-emitter/registry/registry-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAKA,OAAgF,2BAA2B,CAAC;AAC5G,OAAyC,0BAA0B,CAAC;AACpE,OASO,+BAA+B,CAAC;AACvC,OAAyE,8BAA8B,CAAC"}
+{"version":3,"file":"registry-client.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-client.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAA2B,MAAM,2BAA2B,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACH,iCAAiC,EACjC,mBAAmB,EACnB,yBAAyB,EACzB,kCAAkC,EAClC,0BAA0B,EAI7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,qCAAqC,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAgDxG,SAAS,eAAe,CAAC,QAAiB;IACtC,OAAO,CACH,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,KAAK,IAAI;QACjB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CACrC,CAAC;AACN,CAAC;AAED,SAAS,UAAU,CAAC,QAAiB;IACjC,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,WAAW,CAAC,QAAiB;IAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,cAA8B;IACzE,MAAM,cAAc,CAAC;IACrB,OAAO,mBAAmB,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,cAA8B;IACtE,OAAO,iBAAiB,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACjC,cAA8B,EAC9B,WAA4E,EAC5E,eAAgC;IAEhC,IAAI,CAAC;QACD,OAAO,MAAM,WAAW,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,iBAAiB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAAkD;IACnF,MAAM,EACF,QAAQ,EACR,OAAO,EACP,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EACL,wBAAwB,EACxB,cAAc,EACjB,GAAG,YAAY,CAAC;IACjB,MAAM,aAAa,GAAG,wBAAwB,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtG,OAAO;QACH,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,gBAAgB,EAAE,gBAAgB;YAC7D,OAAO,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACzF,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,GAAG,CAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,CAAE;YACnF,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACjG,MAAM,0BAA0B,GAAG,qCAAqC,CAAC,eAAe,CAAC,CAAC;YAC1F,MAAM,cAAc,GAA6B;gBAC7C,UAAU,EAAE,QAAQ;gBACpB,GAAG,WAAW;gBACd,GAAG,0BAA0B;gBAC7B,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;aAClC,CAAC;YACF,MAAM,iCAAiC,GAAsC;gBACzE,GAAG,cAAc;gBACjB,SAAS,EAAE,wBAAwB;aACtC,CAAC;YACF,MAAM,gCAAgC,GAAG,wBAAwB,KAAK,SAAS;gBAC3E,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,iCAAiC,CAAC;YACxC,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,gCAAgC,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,+BAA+B,CAAC;YAE3F,OAAO,sBAAsB,CAAC,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,WAAW,EAAE,gBAAgB;YAClD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,WAAW,EAAE,gBAAgB;YACnD,OAAO,0BAA0B,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,0BAA0B,CAAC,WAAW,EAAE,gBAAgB;YAC1D,OAAO,iCAAiC,CAAC,QAAQ,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACtF,CAAC;QAED,KAAK,CAAC,2BAA2B,CAAC,WAAW,EAAE,OAAO,EAAE,gBAAgB;YACpE,OAAO,kCAAkC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QAChG,CAAC;KACJ,CAAC;AACN,CAAC"}

package/bundle-emitter/registry/registry-package-path.js

@@ -1 +1,4 @@
+export function toRegistryPackagePath(packageName) {
+    return packageName.replace('/', '%2F');
+}
 //# sourceMappingURL=registry-package-path.js.map

package/bundle-emitter/registry/registry-package-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-package-path.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-package-path.ts"],"names":[],"mappings":""}
+{"version":3,"file":"registry-package-path.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-package-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACrD,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/bundle-emitter/registry/registry-response-schemas.js

@@ -1,3 +1,51 @@
-import 'zod/mini';
-import "../../common/schema-validation.js";
+import { z } from 'zod/mini';
+import { safeParse } from "../../common/schema-validation.js";
+const packageVersionDetailsSchema = z.object({
+    dist: z.object({
+        tarball: z.string(),
+        integrity: z.optional(z.unknown()),
+        shasum: z.optional(z.unknown())
+    }),
+    gitHead: z.optional(z.string())
+});
+const abbreviatedPackageResponseSchema = z.object({
+    name: z.string(),
+    'dist-tags': z.object({
+        latest: z.optional(z.string())
+    }),
+    versions: z.record(z.string(), packageVersionDetailsSchema)
+});
+const fullPackageResponseSchema = z.object({
+    name: z.string(),
+    'dist-tags': z.object({
+        latest: z.optional(z.string())
+    }),
+    time: z.optional(z.record(z.string(), z.string())),
+    versions: z.record(z.string(), packageVersionDetailsSchema)
+});
+const oidcExchangeResponseSchema = z.object({
+    token: z.string(),
+    expires: z.coerce.date()
+});
+function isRecord(response) {
+    return typeof response === 'object' && response !== null && !Array.isArray(response);
+}
+export function parseAbbreviatedPackageResponse(response) {
+    const result = abbreviatedPackageResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+export function parseFullPackageResponse(response) {
+    const result = fullPackageResponseSchema.safeParse(response);
+    return result.success ? result.data : undefined;
+}
+export function parseOidcExchangeResponse(response) {
+    if (!isRecord(response)) {
+        return { success: false, issues: ['expected object'] };
+    }
+    const result = safeParse(oidcExchangeResponseSchema, response);
+    if (result.success) {
+        return { success: true, data: result.data };
+    }
+    return { success: false, issues: result.error.issues };
+}
 //# sourceMappingURL=registry-response-schemas.js.map

package/bundle-emitter/registry/registry-response-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry-response-schemas.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-response-schemas.ts"],"names":[],"mappings":"AAAA,OAAkB,UAAU,CAAC;AAC7B,OAA0B,mCAAmC,CAAC"}
+{"version":3,"file":"registry-response-schemas.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/registry-response-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,UAAU,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAE9D,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KAClC,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;CAC9D,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;CAC9D,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;CAC3B,CAAC,CAAC;AAqDH,SAAS,QAAQ,CAAC,QAAiB;IAC/B,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,QAAiB;IAC7D,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiB;IACtD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAE,iBAAiB,CAAE,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3D,CAAC"}

package/bundle-emitter/registry/tarball-integrity.js

@@ -1,2 +1,32 @@
-import 'ssri';
+import ssri from 'ssri';
+const sha1HexPattern = /^[a-f0-9]{40}$/u;
+function assertIntegrityMetadataMatches(tarball, integrity) {
+    try {
+        ssri.checkData(tarball, integrity, { strict: true, error: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Downloaded tarball failed dist.integrity verification: ${message}`, { cause: error });
+    }
+}
+function assertShasumMetadataMatches(tarball, shasum) {
+    if (!sha1HexPattern.test(shasum)) {
+        throw new Error(`Registry returned invalid dist.shasum "${shasum}"`);
+    }
+    try {
+        ssri.checkData(tarball, ssri.fromHex(shasum, 'sha1'), { error: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Downloaded tarball failed dist.shasum verification: ${message}`, { cause: error });
+    }
+}
+export function assertTarballIntegrity(tarball, tarballIntegrity) {
+    if (tarballIntegrity.integrity !== undefined) {
+        assertIntegrityMetadataMatches(tarball, tarballIntegrity.integrity);
+    }
+    if (tarballIntegrity.shasum !== undefined) {
+        assertShasumMetadataMatches(tarball, tarballIntegrity.shasum);
+    }
+}
 //# sourceMappingURL=tarball-integrity.js.map

package/bundle-emitter/registry/tarball-integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"tarball-integrity.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAAA,OAAiB,MAAM,CAAC;AAOD"}
+{"version":3,"file":"tarball-integrity.js","sourceRoot":"","sources":["../../../../../source/bundle-emitter/registry/tarball-integrity.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAOxB,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC,SAAS,8BAA8B,CAAC,OAAe,EAAE,SAAiB;IACtE,IAAI,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,0DAA0D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3G,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAe,EAAE,MAAc;IAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxG,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,gBAAkC;IACtF,IAAI,gBAAgB,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC3C,8BAA8B,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;AACL,CAAC"}

package/bundle-emitter/registry/validate-tarball-host.js

@@ -1,2 +1,27 @@
-import "./registry-auth-config.js";
+import { npmRegistryUrl } from "./registry-auth-config.js";
+function resolveConfiguredOrigin(registrySettings) {
+    const configuredUrl = new URL(registrySettings.registryUrl ?? npmRegistryUrl);
+    return configuredUrl.origin;
+}
+function parseTarballOrigin(tarballUrl) {
+    try {
+        const parsedUrl = new URL(tarballUrl);
+        return parsedUrl.origin;
+    }
+    catch {
+        throw new TypeError(`Registry returned an invalid tarball URL: "${tarballUrl}"`);
+    }
+}
+function buildMismatchMessage(tarballOrigin, configuredOrigin) {
+    return (`Refusing to download tarball from "${tarballOrigin}" because it differs from the configured registry origin ` +
+        `"${configuredOrigin}". A tampered registry response could redirect the request and exfiltrate ` +
+        'publish credentials.');
+}
+export function assertTarballOriginMatchesRegistry(tarballUrl, registrySettings) {
+    const tarballOrigin = parseTarballOrigin(tarballUrl);
+    const configuredOrigin = resolveConfiguredOrigin(registrySettings);
+    if (tarballOrigin !== configuredOrigin) {
+        throw new Error(buildMismatchMessage(tarballOrigin, configuredOrigin));
+    }
+}
 //# sourceMappingURL=validate-tarball-host.js.map