Add backend ids

Read the server url from the environment variable.

.github/CONTRIBUTING.md

@@ -43,7 +43,7 @@ Note that before a PR will be accepted, you must ensure:
 1. In a new branch, create a new Lerna package:
 
 ```console
-$ npm run create-package new-package
+$ npm run new-package [name]
 ```
 
 This will ask you some questions about the new package. Start with `0.0.0` as the first version (look generally at some of the other packages for how the package.json is structured).

.github/workflows/audit.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 

.github/workflows/cache-tests.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/releases.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       package:
         required: true
-        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache'
+        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache, attest'
 
 jobs:
   test:
@@ -13,13 +13,13 @@ jobs:
 
     steps:
       - name: setup repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: verify package exists
         run: ls packages/${{ github.event.inputs.package }}
 
       - name: Set Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
 
@@ -40,7 +40,7 @@ jobs:
         working-directory: packages/${{ github.event.inputs.package }}
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ github.event.inputs.package }}
           path: packages/${{ github.event.inputs.package }}/*.tgz
@@ -49,10 +49,13 @@ jobs:
     runs-on: macos-latest
     needs: test
     environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
     steps:
 
       - name: download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: ${{ github.event.inputs.package }}
 
@@ -62,7 +65,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.TOKEN }}
 
       - name: publish
-        run: npm publish *.tgz
+        run: npm publish --provenance *.tgz
 
       - name: notify slack on failure
         if: failure()

.github/workflows/unit-tests.yml

@@ -23,10 +23,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 

.github/workflows/update-github.yaml

@@ -9,7 +9,7 @@ jobs:
     if: ${{ github.repository_owner == 'actions' }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Update Octokit
       working-directory: packages/github 
       run: |

CODEOWNERS

@@ -2,3 +2,4 @@
 
 /packages/artifact/   @actions/artifacts-actions
 /packages/cache/      @actions/actions-cache
+/packages/attest/      @actions/package-security

README.md

@@ -102,6 +102,15 @@ $ npm install @actions/cache
 ```
 <br/>
 
+:lock_with_ink_pen: [@actions/attest](packages/attest)
+
+Provides functions to write attestations for workflow artifacts. Read more [here](packages/attest)
+
+```bash
+$ npm install @actions/attest
+```
+<br/>
+
 ## Creating an Action with the Toolkit
 
 :question: [Choosing an action type](docs/action-types.md)

docs/action-types.md

@@ -32,7 +32,7 @@ jobs:
         os: [ubuntu-16.04, windows-2019]
     runs-on: ${{matrix.os}}
     actions:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
         version: ${{matrix.node}}
     - run: | 

docs/container-action.md

@@ -18,7 +18,7 @@ e.g. To use https://github.com/actions/setup-node, users will author:
 
 ```yaml
 steps:
-    using: actions/setup-node@v3
+    using: actions/setup-node@v4
 ```
 
 # Define Metadata

package.json

@@ -13,7 +13,7 @@
     "lint": "eslint packages/**/*.ts",
     "lint-fix": "eslint packages/**/*.ts --fix",
     "new-package": "scripts/create-package",
-    "test": "jest --testTimeout 60000"
+    "test": "jest --testTimeout 70000"
   },
   "devDependencies": {
     "@types/jest": "^29.5.4",
@@ -27,10 +27,24 @@
     "eslint-plugin-prettier": "^5.0.0",
     "flow-bin": "^0.115.0",
     "jest": "^29.6.4",
-    "lerna": "^7.1.4",
+    "lerna": "^6.4.1",
     "nx": "16.6.0",
     "prettier": "^3.0.0",
     "ts-jest": "^29.1.1",
     "typescript": "^5.2.2"
+  },
+  "dependencies": {
+    "@actions/artifact": "^2.1.7",
+    "@actions/attest": "^1.2.1",
+    "@actions/cache": "^3.2.4",
+    "@actions/core": "^1.10.1",
+    "@actions/exec": "^1.1.1",
+    "@actions/github": "^6.0.0",
+    "@actions/glob": "^0.4.0",
+    "@actions/http-client": "^2.2.1",
+    "@actions/io": "^1.1.3",
+    "@actions/tool-cache": "^2.0.1",
+    "tunnel": "^0.0.6",
+    "undici": "^6.18.1"
   }
-}
+}

packages/artifact/RELEASES.md

@@ -1,15 +1,123 @@
 # @actions/artifact Releases
 
-### 0.1.0
+### 2.1.7
 
-- Initial release
+- Update unzip-stream dependency and reverted to using `unzip.Extract()`
 
-### 0.2.0
+### 2.1.6
 
-- Fixes to TCP connections not closing
-- GZip file compression to speed up downloads
-- Improved logging and output
-- Extra documentation
+- Will retry on invalid request responses.
+
+### 2.1.5
+
+- Bumped `archiver` dependency to 7.0.1
+
+### 2.1.4
+
+- Adds info-level logging for zip extraction
+
+### 2.1.3
+
+- Fixes a bug in the extract logic updated in 2.1.2
+
+### 2.1.2
+
+- Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts
+
+### 2.1.1
+
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+
+### 2.1.0
+
+- Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
+- Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)
+
+### 2.0.1
+
+- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
+
+### 2.0.0
+
+- Major release. Supports new Artifact backend for improved speed, reliability and behavior.
+- Numerous API changes, [some breaking](./README.md#breaking-changes).
+
+- [Blog post with more info](https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/)
+
+### 1.1.1
+
+- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
+
+### 1.1.0
+
+- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
+
+### 1.0.2
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 1.0.1
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 1.0.0
+
+- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
+
+### 0.6.1
+
+- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
+
+### 0.6.0
+
+- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
+- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
+- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
+- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
+- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
+- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
+  
+### 0.5.2
+
+- Add HTTP 500 as a retryable status code for artifact upload and download.
+  
+### 0.5.1
+
+- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
+
+### 0.5.0
+
+- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
+
+### 0.4.2
+
+- Improved retry-ability when a partial artifact download is encountered
+
+### 0.4.1
+
+- Update to latest @actions/core version
+
+### 0.4.0
+
+- Add option to specify custom retentions on artifacts
+- 
+### 0.3.5
+
+- Retry in the event of a 413 response
+
+### 0.3.3
+
+- Increase chunk size during upload from 4MB to 8MB
+- Improve user-agent strings during API calls to help internally diagnose issues
+
+### 0.3.2
+
+- Fix to ensure readstreams get correctly reset in the event of a retry
+
+### 0.3.1
+
+- Fix to ensure temporary gzip files get correctly deleted during artifact upload
+- Remove spaces as a forbidden character during upload
 
 ### 0.3.0
 
@@ -20,93 +128,13 @@
 - Clearer error message if storage quota has been reached
 - Improved logging and output during artifact download
 
-### 0.3.1
+### 0.2.0
 
-- Fix to ensure temporary gzip files get correctly deleted during artifact upload
-- Remove spaces as a forbidden character during upload
+- Fixes to TCP connections not closing
+- GZip file compression to speed up downloads
+- Improved logging and output
+- Extra documentation
 
-### 0.3.2
+### 0.1.0
 
-- Fix to ensure readstreams get correctly reset in the event of a retry
-
-### 0.3.3
-
-- Increase chunk size during upload from 4MB to 8MB
-- Improve user-agent strings during API calls to help internally diagnose issues
-
-### 0.3.5
-
-- Retry in the event of a 413 response
-
-### 0.4.0
-
-- Add option to specify custom retentions on artifacts
-
-### 0.4.1
-
-- Update to latest @actions/core version
-
-### 0.4.2
-
-- Improved retry-ability when a partial artifact download is encountered
-
-### 0.5.0
-
-- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
-
-### 0.5.1
-
-- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
-
-### 0.5.2
-
-- Add HTTP 500 as a retryable status code for artifact upload and download.
-
-### 0.6.0
-
-- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
-- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
-- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
-- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
-- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
-- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
-
-### 0.6.1
-
-- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
-
-### 1.0.0
-
-- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
-
-### 1.0.1
-
-- Update to v2.0.0 of `@actions/http-client`
-
-### 1.0.2
-
-- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 1.1.0
-
-- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
-
-### 1.1.1
-
-- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
-
-### 2.0.0
-
-- Major release. Supports new Artifact backend for improved speed, reliability and behavior.
-- Numerous API changes, [some breaking](./README.md#breaking-changes).
-
-- Blog post with more info: TBD
-
-### 2.0.1
-
-- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
-
-### 2.1.0
-
-- Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
-- Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)
+- Initial release

packages/artifact/__tests__/artifact-http-client.test.ts

@@ -116,6 +116,54 @@ describe('artifact-http-client', () => {
     expect(mockPost).toHaveBeenCalledTimes(2)
   })
 
+  it('should retry if invalid body response', async () => {
+    const mockPost = jest
+      .fn(() => {
+        const msgSucceeded = new http.IncomingMessage(new net.Socket())
+        msgSucceeded.statusCode = 200
+        return {
+          message: msgSucceeded,
+          readBody: async () => {
+            return Promise.resolve(
+              `{"ok": true, "signedUploadUrl": "http://localhost:8080/upload"}`
+            )
+          }
+        }
+      })
+      .mockImplementationOnce(() => {
+        const msgFailed = new http.IncomingMessage(new net.Socket())
+        msgFailed.statusCode = 502
+        msgFailed.statusMessage = 'Bad Gateway'
+        return {
+          message: msgFailed,
+          readBody: async () => {
+            return Promise.resolve('💥')
+          }
+        }
+      })
+    const mockHttpClient = (
+      HttpClient as unknown as jest.Mock
+    ).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalArtifactTwirpClient(clientOptions)
+    const artifact = await client.CreateArtifact({
+      workflowRunBackendId: '1234',
+      workflowJobRunBackendId: '5678',
+      name: 'artifact',
+      version: 4
+    })
+
+    expect(mockHttpClient).toHaveBeenCalledTimes(1)
+    expect(artifact).toBeDefined()
+    expect(artifact.ok).toBe(true)
+    expect(artifact.signedUploadUrl).toBe('http://localhost:8080/upload')
+    expect(mockPost).toHaveBeenCalledTimes(2)
+  })
+
   it('should fail if the request fails 5 times', async () => {
     const mockPost = jest.fn(() => {
       const msgFailed = new http.IncomingMessage(new net.Socket())

packages/artifact/__tests__/config.test.ts

@@ -0,0 +1,27 @@
+import * as config from '../src/internal/shared/config'
+
+beforeEach(() => {
+  jest.resetModules()
+})
+
+describe('isGhes', () => {
+  it('should return false when the request domain is github.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain is specific to an enterprise', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+    expect(config.isGhes()).toBe(true)
+  })
+})

packages/artifact/__tests__/download-artifact.test.ts

@@ -121,6 +121,16 @@ const mockGetArtifactFailure = jest.fn(() => {
   }
 })
 
+const mockGetArtifactMalicious = jest.fn(() => {
+  const message = new http.IncomingMessage(new net.Socket())
+  message.statusCode = 200
+  message.push(fs.readFileSync(path.join(__dirname, 'fixtures', 'evil.zip'))) // evil.zip contains files that are formatted x/../../etc/hosts
+  message.push(null)
+  return {
+    message
+  }
+})
+
 describe('download-artifact', () => {
   describe('public', () => {
     beforeEach(setup)
@@ -170,6 +180,59 @@ describe('download-artifact', () => {
       expect(response.downloadPath).toBe(fixtures.workspaceDir)
     })
 
+    it('should not allow path traversal from malicious artifacts', async () => {
+      const downloadArtifactMock = github.getOctokit(fixtures.token).rest
+        .actions.downloadArtifact as MockedDownloadArtifact
+      downloadArtifactMock.mockResolvedValueOnce({
+        headers: {
+          location: fixtures.blobStorageUrl
+        },
+        status: 302,
+        url: '',
+        data: Buffer.from('')
+      })
+
+      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
+        () => {
+          return {
+            get: mockGetArtifactMalicious
+          }
+        }
+      )
+
+      const response = await downloadArtifactPublic(
+        fixtures.artifactID,
+        fixtures.repositoryOwner,
+        fixtures.repositoryName,
+        fixtures.token
+      )
+
+      expect(downloadArtifactMock).toHaveBeenCalledWith({
+        owner: fixtures.repositoryOwner,
+        repo: fixtures.repositoryName,
+        artifact_id: fixtures.artifactID,
+        archive_format: 'zip',
+        request: {
+          redirect: 'manual'
+        }
+      })
+
+      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
+      expect(mockGetArtifactMalicious).toHaveBeenCalledWith(
+        fixtures.blobStorageUrl
+      )
+
+      // ensure path traversal was not possible
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'x/etc/hosts'))
+      ).toBe(true)
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'y/etc/hosts'))
+      ).toBe(true)
+
+      expect(response.downloadPath).toBe(fixtures.workspaceDir)
+    })
+
     it('should successfully download an artifact to user defined path', async () => {
       const customPath = path.join(testDir, 'custom')
 

packages/artifact/__tests__/upload-artifact.test.ts

@@ -8,6 +8,9 @@ import * as blobUpload from '../src/internal/upload/blob-upload'
 import {uploadArtifact} from '../src/internal/upload/upload-artifact'
 import {noopLogs} from './common'
 import {FilesNotFoundError} from '../src/internal/shared/errors'
+import {BlockBlobClient} from '@azure/storage-blob'
+import * as fs from 'fs'
+import * as path from 'path'
 
 describe('upload-artifact', () => {
   beforeEach(() => {
@@ -351,4 +354,94 @@ describe('upload-artifact', () => {
 
     expect(uploadResp).rejects.toThrow()
   })
+
+  it('should throw an error uploading blob chunks get delayed', async () => {
+    const mockDate = new Date('2020-01-01')
+    const dirPath = path.join(__dirname, `plz-upload`)
+    if (!fs.existsSync(dirPath)) {
+      fs.mkdirSync(dirPath, {recursive: true})
+    }
+
+    fs.writeFileSync(path.join(dirPath, 'file1.txt'), 'test file content')
+    fs.writeFileSync(path.join(dirPath, 'file2.txt'), 'test file content')
+
+    fs.writeFileSync(path.join(dirPath, 'file3.txt'), 'test file content')
+
+    jest
+      .spyOn(uploadZipSpecification, 'validateRootDirectory')
+      .mockReturnValue()
+    jest
+      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockReturnValue([
+        {
+          sourcePath: path.join(dirPath, 'file1.txt'),
+          destinationPath: 'file1.txt'
+        },
+        {
+          sourcePath: path.join(dirPath, 'file2.txt'),
+          destinationPath: 'file2.txt'
+        },
+        {
+          sourcePath: path.join(dirPath, 'file3.txt'),
+          destinationPath: 'dir/file3.txt'
+        }
+      ])
+
+    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
+      workflowRunBackendId: '1234',
+      workflowJobRunBackendId: '5678'
+    })
+    jest
+      .spyOn(retention, 'getExpiration')
+      .mockReturnValue(Timestamp.fromDate(mockDate))
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          signedUploadUrl: 'https://signed-upload-url.com'
+        })
+      )
+    jest
+      .spyOn(blobUpload, 'uploadZipToBlobStorage')
+      .mockReturnValue(Promise.reject(new Error('Upload progress stalled.')))
+
+    // ArtifactHttpClient mocks
+    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue('https://test-url.com')
+
+    BlockBlobClient.prototype.uploadStream = jest
+      .fn()
+      .mockImplementation(
+        async (stream, bufferSize, maxConcurrency, options) => {
+          return new Promise<void>(resolve => {
+            // Call the onProgress callback with a progress event
+            options.onProgress({loadedBytes: 0})
+
+            // Wait for 31 seconds before resolving the promise
+            setTimeout(() => {
+              // Call the onProgress callback again to simulate progress
+              options.onProgress({loadedBytes: 100})
+
+              resolve()
+            }, 31000) // Delay longer than your timeout
+          })
+        }
+      )
+
+    jest.mock('fs')
+    const uploadResp = uploadArtifact(
+      'test-artifact',
+      [
+        '/home/user/files/plz-upload/file1.txt',
+        '/home/user/files/plz-upload/file2.txt',
+        '/home/user/files/plz-upload/dir/file3.txt'
+      ],
+      '/home/user/files/plz-upload'
+    )
+
+    expect(uploadResp).rejects.toThrow('Upload progress stalled.')
+  })
 })

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "2.0.1",
+  "version": "2.1.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "2.0.1",
+      "version": "2.1.7",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -18,7 +18,7 @@
         "@octokit/plugin-retry": "^3.0.9",
         "@octokit/request-error": "^5.0.0",
         "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-        "archiver": "^5.3.1",
+        "archiver": "^7.0.1",
         "crypto": "^1.0.1",
         "jwt-decode": "^3.1.2",
         "twirp-ts": "^2.5.0",
@@ -186,6 +186,22 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/@octokit/auth-token": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
@@ -348,6 +364,15 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@protobuf-ts/plugin": {
       "version": "2.9.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.9.1.tgz",
@@ -480,74 +505,120 @@
         "@types/node": "*"
       }
     },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
+      "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
     "node_modules/ansi-sequence-parser": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ansi-sequence-parser/-/ansi-sequence-parser-1.1.1.tgz",
       "integrity": "sha512-vJXt3yiaUL4UU546s3rPXlsry/RnM730G1+HkpKE012AN0sx1eOrxSu95oKDIonskeLTijMgqWZ3uDEe3NFvyg==",
       "dev": true
     },
+    "node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
     "node_modules/archiver": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/archiver/-/archiver-5.3.1.tgz",
-      "integrity": "sha512-8KyabkmbYrH+9ibcTScQ1xCJC/CGcugdVIwB+53f5sZziXgwUh3iXlAlANMxcZyDEfTHMe6+Z5FofV8nopXP7w==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/archiver/-/archiver-7.0.1.tgz",
+      "integrity": "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==",
       "dependencies": {
-        "archiver-utils": "^2.1.0",
-        "async": "^3.2.3",
-        "buffer-crc32": "^0.2.1",
-        "readable-stream": "^3.6.0",
-        "readdir-glob": "^1.0.0",
-        "tar-stream": "^2.2.0",
-        "zip-stream": "^4.1.0"
+        "archiver-utils": "^5.0.2",
+        "async": "^3.2.4",
+        "buffer-crc32": "^1.0.0",
+        "readable-stream": "^4.0.0",
+        "readdir-glob": "^1.1.2",
+        "tar-stream": "^3.0.0",
+        "zip-stream": "^6.0.1"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     },
     "node_modules/archiver-utils": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-2.1.0.tgz",
-      "integrity": "sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-5.0.2.tgz",
+      "integrity": "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==",
       "dependencies": {
-        "glob": "^7.1.4",
+        "glob": "^10.0.0",
         "graceful-fs": "^4.2.0",
+        "is-stream": "^2.0.1",
         "lazystream": "^1.0.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.difference": "^4.5.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.union": "^4.6.0",
+        "lodash": "^4.17.15",
         "normalize-path": "^3.0.0",
-        "readable-stream": "^2.0.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
-    "node_modules/archiver-utils/node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+    "node_modules/archiver-utils/node_modules/brace-expansion": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
       "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
+        "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/archiver-utils/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
-    "node_modules/archiver-utils/node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+    "node_modules/archiver-utils/node_modules/glob": {
+      "version": "10.3.12",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.3.12.tgz",
+      "integrity": "sha512-TCNv8vJ+xz4QiqTpfOJA7HvYv+tNIRHKfUWw/q+v2jdgN4ebz+KY9tGx5J4rHP0o84mNP+ApH66HRX8us3Khqg==",
       "dependencies": {
-        "safe-buffer": "~5.1.0"
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^2.3.6",
+        "minimatch": "^9.0.1",
+        "minipass": "^7.0.4",
+        "path-scurry": "^1.10.2"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/archiver-utils/node_modules/minimatch": {
+      "version": "9.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.4.tgz",
+      "integrity": "sha512-KqWh+VchfxcMNRAJjj2tnsSJdNbHsVgnkBhTNrW7AjVo6OvLtxw8zfT9oLw1JSohlFzJ8jCoTgaoXvJ+kHt6fw==",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/async": {
@@ -560,11 +631,22 @@
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
       "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
     },
+    "node_modules/b4a": {
+      "version": "1.6.6",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.6.6.tgz",
+      "integrity": "sha512-5Tk1HLk6b6ctmjIkAcU/Ujv/1WqiDl0F0JdRCR80VsOcUlHcu7pWeWRlOqQLHfDEsVx9YH/aif5AG4ehoCtTmg=="
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
+    "node_modules/bare-events": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.2.2.tgz",
+      "integrity": "sha512-h7z00dWdG0PYOQEvChhOSWvOfkIKsdZGkWr083FgN/HyoQuebSew/cgirYqh9SCuy/hRvxc5Vy6Fw8xAmYHLkQ==",
+      "optional": true
+    },
     "node_modules/base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -601,16 +683,6 @@
         "node": "*"
       }
     },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/bottleneck": {
       "version": "2.19.5",
       "resolved": "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz",
@@ -626,9 +698,9 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -645,15 +717,15 @@
       ],
       "dependencies": {
         "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "ieee754": "^1.2.1"
       }
     },
     "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-1.0.0.tgz",
+      "integrity": "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==",
       "engines": {
-        "node": "*"
+        "node": ">=8.0.0"
       }
     },
     "node_modules/buffers": {
@@ -684,6 +756,22 @@
         "node": "*"
       }
     },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    },
     "node_modules/combined-stream": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
@@ -704,17 +792,18 @@
       }
     },
     "node_modules/compress-commons": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-4.1.1.tgz",
-      "integrity": "sha512-QLdDLCKNV2dtoTorqgxngQCMA+gWXkM/Nwu7FpeBhk/RdkzimqC3jueb/FDmaZeXh+uby1jkBqE3xArsLBE5wQ==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
+      "integrity": "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==",
       "dependencies": {
-        "buffer-crc32": "^0.2.13",
-        "crc32-stream": "^4.0.2",
+        "crc-32": "^1.2.0",
+        "crc32-stream": "^6.0.0",
+        "is-stream": "^2.0.1",
         "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     },
     "node_modules/concat-map": {
@@ -739,15 +828,28 @@
       }
     },
     "node_modules/crc32-stream": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-4.0.2.tgz",
-      "integrity": "sha512-DxFZ/Hk473b/muq1VJ///PMNLj0ZMnzye9thBpmjpJKCc5eMgB95aK8zCGrGfQ90cWo561Te6HK9D+j4KPdM6w==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-6.0.0.tgz",
+      "integrity": "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==",
       "dependencies": {
         "crc-32": "^1.2.0",
-        "readable-stream": "^3.4.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
       }
     },
     "node_modules/crypto": {
@@ -781,12 +883,22 @@
         "dot-object": "bin/dot-object"
       }
     },
-    "node_modules/end-of-stream": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dependencies": {
-        "once": "^1.4.0"
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "engines": {
+        "node": ">=6"
       }
     },
     "node_modules/events": {
@@ -797,6 +909,26 @@
         "node": ">=0.8.x"
       }
     },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="
+    },
+    "node_modules/foreground-child": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.1.1.tgz",
+      "integrity": "sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==",
+      "dependencies": {
+        "cross-spawn": "^7.0.0",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/form-data": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
@@ -810,11 +942,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -898,6 +1025,14 @@
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-plain-object": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
@@ -906,11 +1041,44 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/isarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
       "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="
     },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
+    },
+    "node_modules/jackspeak": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-2.3.6.tgz",
+      "integrity": "sha512-N3yCS/NegsOBokc8GAdM8UcmfsKiSS8cipheD/nivzr700H+nsMOxJjQnvwOcRYVuFkdH0wGUvW2WbXGmrZGbQ==",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
     "node_modules/jsonc-parser": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.0.tgz",
@@ -965,31 +1133,6 @@
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
       "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     },
-    "node_modules/lodash.defaults": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
-      "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ=="
-    },
-    "node_modules/lodash.difference": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.difference/-/lodash.difference-4.5.0.tgz",
-      "integrity": "sha512-dS2j+W26TQ7taQBGN8Lbbq04ssV3emRw4NY58WErlTO29pIqS0HmoT5aJ9+TUQ1N3G+JOZSji4eugsWwGp9yPA=="
-    },
-    "node_modules/lodash.flatten": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.flatten/-/lodash.flatten-4.4.0.tgz",
-      "integrity": "sha512-C5N2Z3DgnnKr0LOpv/hKCgKdb7ZZwafIrsesve6lmzvZIRZRGaZ/l6Q8+2W7NaT+ZwO3fFlSCzCzrDCFdJfZ4g=="
-    },
-    "node_modules/lodash.isplainobject": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
-      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA=="
-    },
-    "node_modules/lodash.union": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/lodash.union/-/lodash.union-4.6.0.tgz",
-      "integrity": "sha512-c4pB2CdGrGdjMKYLA+XiRDO7Y0PRQbm/Gzg8qMj+QH+pFVAoTp5sBpO0odL3FjoPCGjK96p6qsP+yQoiLoOBcw=="
-    },
     "node_modules/lower-case": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
@@ -998,6 +1141,14 @@
         "tslib": "^2.0.3"
       }
     },
+    "node_modules/lru-cache": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.2.0.tgz",
+      "integrity": "sha512-2bIM8x+VAf6JT4bKAljS1qUWgMsqZRPGJS6FSahIMPVvctcNhyVp7AJu7quxOW9jwkryBReKZY5tY5JYv2n/7Q==",
+      "engines": {
+        "node": "14 || >=16.14"
+      }
+    },
     "node_modules/lunr": {
       "version": "2.3.9",
       "resolved": "https://registry.npmjs.org/lunr/-/lunr-2.3.9.tgz",
@@ -1054,6 +1205,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.0.4.tgz",
+      "integrity": "sha512-jYofLM5Dam9279rdkWzqHozUo4ybjdZmCsDHePy5V/PbBcVMiSZR97gmAy45aqi8CK1lG2ECd356FU86avfwUQ==",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/mkdirp": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
@@ -1132,6 +1291,29 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.10.2.tgz",
+      "integrity": "sha512-7xTavNy5RQXnsjANvVvMkEjvloOinkAjv/Z6Ildz9v2RinZ4SBKTWFOVRbaF8p0vpHnyjV/UwNDdKuUv6M5qcA==",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/path-to-regexp": {
       "version": "6.2.1",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.2.1.tgz",
@@ -1164,17 +1346,24 @@
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="
     },
+    "node_modules/queue-tick": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/queue-tick/-/queue-tick-1.0.1.tgz",
+      "integrity": "sha512-kJt5qhMxoszgU/62PLP1CJytzd2NKetjSRnyuj31fDd3Rlcz3fzlFdFLD1SItunPwyqEOkca6GbV612BWfaBag=="
+    },
     "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "version": "4.5.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz",
+      "integrity": "sha512-yjavECdqeZ3GLXNgRXgeQEdz9fvDDkNKyHnbHRFtOr7/LcfgBcmct7t/ET+HaCTqfh06OzoAxrkN/IfjJBVe+g==",
       "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
     "node_modules/readdir-glob": {
@@ -1228,6 +1417,25 @@
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
       "integrity": "sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw=="
     },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/shiki": {
       "version": "0.14.5",
       "resolved": "https://registry.npmjs.org/shiki/-/shiki-0.14.5.tgz",
@@ -1240,6 +1448,17 @@
         "vscode-textmate": "^8.0.0"
       }
     },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -1249,6 +1468,18 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/streamx": {
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.16.1.tgz",
+      "integrity": "sha512-m9QYj6WygWyWa3H1YY69amr4nVgy61xfjys7xO7kviL5rfIEc2naf+ewFiOA+aEJD7y0JO3h2GoiUv4TDwEGzQ==",
+      "dependencies": {
+        "fast-fifo": "^1.1.0",
+        "queue-tick": "^1.0.1"
+      },
+      "optionalDependencies": {
+        "bare-events": "^2.2.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -1257,19 +1488,102 @@
         "safe-buffer": "~5.2.0"
       }
     },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
       }
     },
     "node_modules/tr46": {
@@ -1424,9 +1738,9 @@
       "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
     },
     "node_modules/unzip-stream": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.1.tgz",
-      "integrity": "sha512-RzaGXLNt+CW+T41h1zl6pGz3EaeVhYlK+rdAap+7DxW5kqsqePO8kRtWPaCiVqdhZc86EctSPVYNix30YOMzmw==",
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.4.tgz",
+      "integrity": "sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==",
       "dependencies": {
         "binary": "^0.3.0",
         "mkdirp": "^0.5.1"
@@ -1471,12 +1785,110 @@
         "webidl-conversions": "^3.0.0"
       }
     },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/wordwrap": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
       "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==",
       "dev": true
     },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -1511,16 +1923,16 @@
       }
     },
     "node_modules/zip-stream": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-4.1.0.tgz",
-      "integrity": "sha512-zshzwQW7gG7hjpBlgeQP9RuyPGNxvJdzR8SUM3QhxCnLjWN2E7j3dOvpeDcQoETfHx0urRS7EtmVToql7YpU4A==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-6.0.1.tgz",
+      "integrity": "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==",
       "dependencies": {
-        "archiver-utils": "^2.1.0",
-        "compress-commons": "^4.1.0",
-        "readable-stream": "^3.6.0"
+        "archiver-utils": "^5.0.0",
+        "compress-commons": "^6.0.2",
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     }
   }

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.0",
+  "version": "2.1.7",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -49,7 +49,7 @@
     "@octokit/plugin-retry": "^3.0.9",
     "@octokit/request-error": "^5.0.0",
     "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-    "archiver": "^5.3.1",
+    "archiver": "^7.0.1",
     "crypto": "^1.0.1",
     "jwt-decode": "^3.1.2",
     "twirp-ts": "^2.5.0",

packages/artifact/src/internal/shared/artifact-twirp-client.ts

@@ -102,7 +102,6 @@ class ArtifactHttpClient implements Rpc {
       } catch (error) {
         if (error instanceof SyntaxError) {
           debug(`Raw Body: ${rawBody}`)
-          throw error
         }
 
         if (error instanceof UsageError) {

packages/artifact/src/internal/shared/config.ts

@@ -27,7 +27,13 @@ export function isGhes(): boolean {
   const ghUrl = new URL(
     process.env['GITHUB_SERVER_URL'] || 'https://github.com'
   )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost =
+    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost
 }
 
 export function getGitHubWorkspaceDir(): string {

packages/artifact/src/internal/upload/blob-upload.ts

@@ -24,11 +24,30 @@ export async function uploadZipToBlobStorage(
   zipUploadStream: ZipUploadStream
 ): Promise<BlobUploadResponse> {
   let uploadByteCount = 0
+  let lastProgressTime = Date.now()
+  let timeoutId: NodeJS.Timeout | undefined
 
+  const chunkTimer = (timeout: number): NodeJS.Timeout => {
+    // clear the previous timeout
+    if (timeoutId) {
+      clearTimeout(timeoutId)
+    }
+
+    timeoutId = setTimeout(() => {
+      const now = Date.now()
+      // if there's been more than 30 seconds since the
+      // last progress event, then we'll consider the upload stalled
+      if (now - lastProgressTime > timeout) {
+        throw new Error('Upload progress stalled.')
+      }
+    }, timeout)
+    return timeoutId
+  }
   const maxConcurrency = getConcurrency()
   const bufferSize = getUploadChunkSize()
   const blobClient = new BlobClient(authenticatedUploadURL)
   const blockBlobClient = blobClient.getBlockBlobClient()
+  const timeoutDuration = 300000 // 30 seconds
 
   core.debug(
     `Uploading artifact zip to blob storage with maxConcurrency: ${maxConcurrency}, bufferSize: ${bufferSize}`
@@ -37,6 +56,8 @@ export async function uploadZipToBlobStorage(
   const uploadCallback = (progress: TransferProgressEvent): void => {
     core.info(`Uploaded bytes ${progress.loadedBytes}`)
     uploadByteCount = progress.loadedBytes
+    chunkTimer(timeoutDuration)
+    lastProgressTime = Date.now()
   }
 
   const options: BlockBlobUploadStreamOptions = {
@@ -54,6 +75,8 @@ export async function uploadZipToBlobStorage(
   core.info('Beginning upload of artifact content to blob storage')
 
   try {
+    // Start the chunk timer
+    timeoutId = chunkTimer(timeoutDuration)
     await blockBlobClient.uploadStream(
       uploadStream,
       bufferSize,
@@ -64,8 +87,12 @@ export async function uploadZipToBlobStorage(
     if (NetworkError.isNetworkErrorCode(error?.code)) {
       throw new NetworkError(error?.code)
     }
-
     throw error
+  } finally {
+    // clear the timeout whether or not the upload completes
+    if (timeoutId) {
+      clearTimeout(timeoutId)
+    }
   }
 
   core.info('Finished uploading artifact content to blob storage!')
@@ -79,7 +106,6 @@ export async function uploadZipToBlobStorage(
       `No data was uploaded to blob storage. Reported upload byte count is 0.`
     )
   }
-
   return {
     uploadSize: uploadByteCount,
     sha256Hash

packages/attest/LICENSE.md

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright 2024 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

packages/attest/README.md

@@ -0,0 +1,179 @@
+# `@actions/attest`
+
+Functions for generating signed attestations for workflow artifacts.
+
+Attestations bind some subject (a named artifact along with its digest) to a
+predicate (some assertion about that subject) using the [in-toto
+statement](https://github.com/in-toto/attestation/tree/main/spec/v1) format. A
+signature is generated for the attestation using a
+[Sigstore](https://www.sigstore.dev/)-issued signing certificate.
+
+Once the attestation has been created and signed, it will be uploaded to the GH
+attestations API and associated with the repository from which the workflow was
+initiated.
+
+See [Using artifact attestations to establish provenance for builds](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)
+for more information on artifact attestations.
+
+## Usage
+
+### `attest`
+
+The `attest` function takes the supplied subject/predicate pair and generates a
+signed attestation.
+
+```js
+const { attest } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attest({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        predicateType: 'https://in-toto.io/attestation/release',
+        predicate: { . . . },
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attest` function supports the following options:
+
+```typescript
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // URI identifying the content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+```
+
+### `attestProvenance`
+
+The `attestProvenance` function accepts the name and digest of some artifact and
+generates a build provenance attestation over those values.
+
+The attestation is formed by first generating a [SLSA provenance
+predicate](https://slsa.dev/spec/v1.0/provenance) populated with
+[metadata](https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1)
+pulled from the GitHub Actions run.
+
+```js
+const { attestProvenance } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attestProvenance({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attestProvenance` function supports the following options:
+
+```typescript
+export type AttestProvenanceOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+  // Issuer URL responsible for minting the OIDC token from which the
+  // provenance data is read. Defaults to
+  // 'https://token.actions.githubusercontent.com".
+  issuer?: string
+}
+```
+
+### `Attestation`
+
+The `Attestation` returned by `attest`/`attestProvenance` has the following
+fields:
+
+```typescript
+export type Attestation = {
+  /*
+   * JSON-serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation (if
+   * applicable).
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}
+```
+
+For details about the Sigstore bundle format, see the [Bundle protobuf
+specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto).
+
+## Sigstore Instance
+
+When generating the signed attestation there are two different Sigstore
+instances which can be used to issue the signing certificate. By default,
+workflows initiated from public repositories will use the Sigstore public-good
+instance and persist the attestation signature to the public [Rekor transparency
+log](https://docs.sigstore.dev/logging/overview/). Workflows initiated from
+private/internal repositories will use the GitHub-internal Sigstore instance
+which uses a signed timestamp issued by GitHub's timestamp authority in place of
+the public transparency log.
+
+The default Sigstore instance selection can be overridden by passing an explicit
+value of either "public-good" or "github" for the `sigstore` option when calling
+either `attest` or `attestProvenance`.
+
+## Storage
+
+Attestations created by `attest`/`attestProvenance` will be uploaded to the GH
+attestations API and associated with the appropriate repository. Attestation
+storage is only supported for public repositories or repositories which belong
+to a GitHub Enterprise Cloud account.
+
+In order to generate attestations for private, non-Enterprise repositories, the
+`skipWrite` option should be set to `true`.

packages/attest/RELEASES.md

@@ -0,0 +1,20 @@
+# @actions/attest Releases
+
+### 1.2.1
+
+- Retry request on attestation persistence failure
+
+### 1.2.0
+
+- Generate attestations using the v0.3 Sigstore bundle format.
+- Bump @sigstore/bundle from 2.2.0 to 2.3.0.
+- Bump @sigstore/sign from 2.2.3 to 2.3.0.
+- Remove dependency on make-fetch-happen
+
+### 1.1.0
+
+- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement.
+
+### 1.0.0
+
+- Initial release

packages/attest/__tests__/__snapshots__/intoto.test.ts.snap

@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildIntotoStatement returns an intoto statement 1`] = `
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicate": {
+    "key": "value",
+  },
+  "predicateType": "predicatey",
+  "subject": [
+    {
+      "digest": {
+        "sha256": "7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32",
+      },
+      "name": "subjecty",
+    },
+  ],
+}
+`;

packages/attest/__tests__/__snapshots__/provenance.test.ts.snap

@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`provenance functions buildSLSAProvenancePredicate returns a provenance hydrated from an OIDC token 1`] = `
+{
+  "params": {
+    "buildDefinition": {
+      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+      "externalParameters": {
+        "workflow": {
+          "path": ".github/workflows/main.yml",
+          "ref": "main",
+          "repository": "https://github.com/owner/repo",
+        },
+      },
+      "internalParameters": {
+        "github": {
+          "event_name": "push",
+          "repository_id": "repo-id",
+          "repository_owner_id": "owner-id",
+        },
+      },
+      "resolvedDependencies": [
+        {
+          "digest": {
+            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
+          },
+          "uri": "git+https://github.com/owner/repo@refs/heads/main",
+        },
+      ],
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/actions/runner/github-hosted",
+      },
+      "metadata": {
+        "invocationId": "https://github.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+      },
+    },
+  },
+  "type": "https://slsa.dev/provenance/v1",
+}
+`;

packages/attest/__tests__/endpoints.test.ts

@@ -0,0 +1,41 @@
+import {signingEndpoints} from '../src/endpoints'
+
+describe('signingEndpoints', () => {
+  const originalEnv = process.env
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when using github.com', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://github.com'
+      }
+    })
+
+    it('returns expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.githubapp.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.githubapp.com')
+    })
+  })
+
+  describe('when using custom domain', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://foo.bar.com'
+      }
+    })
+
+    it('returns a expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.foo.bar.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.foo.bar.com')
+    })
+  })
+})

packages/attest/__tests__/index.test.ts

@@ -0,0 +1,6 @@
+import {attest, attestProvenance} from '../src'
+
+it('exports functions', () => {
+  expect(attestProvenance).toBeInstanceOf(Function)
+  expect(attest).toBeInstanceOf(Function)
+})

packages/attest/__tests__/intoto.test.ts

@@ -0,0 +1,23 @@
+import {buildIntotoStatement} from '../src/intoto'
+import type {Predicate, Subject} from '../src/shared.types'
+
+describe('buildIntotoStatement', () => {
+  const subject: Subject = {
+    name: 'subjecty',
+    digest: {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+  }
+
+  const predicate: Predicate = {
+    type: 'predicatey',
+    params: {
+      key: 'value'
+    }
+  }
+
+  it('returns an intoto statement', () => {
+    const statement = buildIntotoStatement(subject, predicate)
+    expect(statement).toMatchSnapshot()
+  })
+})

packages/attest/__tests__/oidc.test.ts

@@ -0,0 +1,147 @@
+import * as jose from 'jose'
+import nock from 'nock'
+import {getIDTokenClaims} from '../src/oidc'
+
+describe('getIDTokenClaims', () => {
+  const originalEnv = process.env
+  const issuer = 'https://example.com'
+  const audience = 'nobody'
+  const requestToken = 'token'
+  const openidConfigPath = '/.well-known/openid-configuration'
+  const jwksPath = '/.well-known/jwks.json'
+  const tokenPath = '/token'
+  const openIDConfig = {jwks_uri: `${issuer}${jwksPath}`}
+
+  /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+  let key: any
+
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: requestToken
+    }
+
+    // Generate JWT signing key
+    key = await jose.generateKeyPair('PS256')
+
+    // Create JWK and JWKS
+    const jwk = await jose.exportJWK(key.publicKey)
+    const jwks = {keys: [jwk]}
+
+    nock(issuer).get(openidConfigPath).reply(200, openIDConfig)
+    nock(issuer).get(jwksPath).reply(200, jwks)
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when ID token is valid', () => {
+    const claims = {
+      iss: issuer,
+      aud: audience,
+      ref: 'ref',
+      sha: 'sha',
+      repository: 'repo',
+      event_name: 'push',
+      workflow_ref: 'main',
+      repository_id: '1',
+      repository_owner_id: '1',
+      runner_environment: 'github-hosted',
+      run_id: '1',
+      run_attempt: '1'
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('returns the ID token claims', async () => {
+      const result = await getIDTokenClaims(issuer)
+      expect(result).toEqual(claims)
+    })
+  })
+
+  describe('when ID token is missing required claims', () => {
+    const claims = {
+      iss: issuer,
+      aud: audience
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/missing claims/i)
+    })
+  })
+
+  describe('when ID has the wrong issuer', () => {
+    const claims = {foo: 'bar', iss: 'foo', aud: 'nobody'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/issuer invalid/)
+    })
+  })
+
+  describe('when ID has the wrong audience', () => {
+    const claims = {foo: 'bar', iss: issuer, aud: 'bar'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throw an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/audience invalid/)
+    })
+  })
+
+  describe('when openid config cannot be retrieved', () => {
+    const claims = {foo: 'bar', iss: issuer, aud: 'nobody'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+
+      // Disable the openid config endpoint
+      nock.removeInterceptor({
+        proto: 'https',
+        hostname: 'example.com',
+        port: '443',
+        method: 'GET',
+        path: openidConfigPath
+      })
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(
+        /failed to get id/i
+      )
+    })
+  })
+})

packages/attest/__tests__/provenance.test.ts

@@ -0,0 +1,252 @@
+import * as github from '@actions/github'
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import * as jose from 'jose'
+import nock from 'nock'
+import {MockAgent, setGlobalDispatcher} from 'undici'
+import {SIGSTORE_PUBLIC_GOOD, signingEndpoints} from '../src/endpoints'
+import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
+
+describe('provenance functions', () => {
+  const originalEnv = process.env
+  const issuer = 'https://example.com'
+  const audience = 'nobody'
+  const jwksPath = '/.well-known/jwks.json'
+  const tokenPath = '/token'
+
+  // MockAgent for mocking @actions/github
+  const mockAgent = new MockAgent()
+  setGlobalDispatcher(mockAgent)
+
+  const claims = {
+    iss: issuer,
+    aud: 'nobody',
+    repository: 'owner/repo',
+    ref: 'refs/heads/main',
+    sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+    workflow_ref: 'owner/repo/.github/workflows/main.yml@main',
+    event_name: 'push',
+    repository_id: 'repo-id',
+    repository_owner_id: 'owner-id',
+    run_id: 'run-id',
+    run_attempt: 'run-attempt',
+    runner_environment: 'github-hosted'
+  }
+
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
+      GITHUB_SERVER_URL: 'https://github.com',
+      GITHUB_REPOSITORY: claims.repository
+    }
+
+    // Generate JWT signing key
+    const key = await jose.generateKeyPair('PS256')
+
+    // Create JWK, JWKS, and JWT
+    const jwk = await jose.exportJWK(key.publicKey)
+    const jwks = {keys: [jwk]}
+    const jwt = await new jose.SignJWT(claims)
+      .setProtectedHeader({alg: 'PS256'})
+      .sign(key.privateKey)
+
+    // Mock OpenID configuration and JWKS endpoints
+    nock(issuer)
+      .get('/.well-known/openid-configuration')
+      .reply(200, {jwks_uri: `${issuer}${jwksPath}`})
+    nock(issuer).get(jwksPath).reply(200, jwks)
+
+    // Mock OIDC token endpoint for populating the provenance
+    nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('buildSLSAProvenancePredicate', () => {
+    it('returns a provenance hydrated from an OIDC token', async () => {
+      const predicate = await buildSLSAProvenancePredicate(issuer)
+      expect(predicate).toMatchSnapshot()
+    })
+  })
+
+  describe('attestProvenance', () => {
+    // Subject to attest
+    const subjectName = 'subjective'
+    const subjectDigest = {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+
+    // Fake an OIDC token
+    const oidcPayload = {sub: 'foo@bar.com', iss: ''}
+    const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+      'base64'
+    )}.}`
+
+    const attestationID = '1234567890'
+
+    beforeEach(async () => {
+      nock(issuer)
+        .get(tokenPath)
+        .query({audience: 'sigstore'})
+        .reply(200, {value: oidcToken})
+    })
+
+    describe('when using the github Sigstore instance', () => {
+      const {fulcioURL, tsaServerURL} = signingEndpoints('github')
+
+      beforeEach(async () => {
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockTSA({baseURL: tsaServerURL})
+
+        mockAgent
+          .get('https://api.github.com')
+          .intercept({
+            path: /^\/repos\/.*\/.*\/attestations$/,
+            method: 'post'
+          })
+          .reply(201, {id: attestationID})
+      })
+
+      describe('when the sigstore instance is explicitly set', () => {
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            sigstore: 'github',
+            issuer
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeUndefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+
+      describe('when the sigstore instance is inferred from the repo visibility', () => {
+        const savedRepository = github.context.payload.repository
+
+        beforeEach(() => {
+          /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+          github.context.payload.repository = {visibility: 'private'} as any
+        })
+
+        afterEach(() => {
+          github.context.payload.repository = savedRepository
+        })
+
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            issuer
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeUndefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+    })
+
+    describe('when using the public-good Sigstore instance', () => {
+      const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+
+      beforeEach(async () => {
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockRekor({baseURL: rekorURL})
+
+        // Mock GH attestations API
+        mockAgent
+          .get('https://api.github.com')
+          .intercept({
+            path: /^\/repos\/.*\/.*\/attestations$/,
+            method: 'post'
+          })
+          .reply(201, {id: attestationID})
+      })
+
+      describe('when the sigstore instance is explicitly set', () => {
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            sigstore: 'public-good',
+            issuer
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeDefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+
+      describe('when the sigstore instance is inferred from the repo visibility', () => {
+        const savedRepository = github.context.payload.repository
+
+        beforeEach(() => {
+          /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+          github.context.payload.repository = {visibility: 'public'} as any
+        })
+
+        afterEach(() => {
+          github.context.payload.repository = savedRepository
+        })
+
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            issuer
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeDefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+    })
+
+    describe('when skipWrite is set to true', () => {
+      const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+      beforeEach(async () => {
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockRekor({baseURL: rekorURL})
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'public-good',
+          skipWrite: true,
+          issuer
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBeUndefined()
+      })
+    })
+  })
+})

packages/attest/__tests__/sign.test.ts

@@ -0,0 +1,101 @@
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {Payload, signPayload} from '../src/sign'
+
+describe('signProvenance', () => {
+  const originalEnv = process.env
+
+  // Fake an OIDC token
+  const subject = 'foo@bar.com'
+  const oidcPayload = {sub: subject, iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  // Dummy provenance to be signed
+  const provenance = {
+    _type: 'https://in-toto.io/Statement/v1',
+    subject: {
+      name: 'subjective',
+      digest: {
+        sha256:
+          '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+      }
+    }
+  }
+
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(provenance)),
+    type: 'application/vnd.in-toto+json'
+  }
+
+  const fulcioURL = 'https://fulcio.url'
+  const rekorURL = 'https://rekor.url'
+  const tsaServerURL = 'https://tsa.url'
+
+  beforeEach(() => {
+    // Mock OIDC token endpoint
+    const tokenURL = 'https://token.url'
+
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when visibility is public', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, rekorURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle.v0.3+json'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual('certificate')
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(1)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(0)
+    })
+  })
+
+  describe('when visibility is private', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, tsaServerURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle.v0.3+json'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual('certificate')
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(0)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(1)
+    })
+  })
+})

packages/attest/__tests__/store.test.ts

@@ -0,0 +1,90 @@
+import {MockAgent, setGlobalDispatcher} from 'undici'
+import {writeAttestation} from '../src/store'
+
+describe('writeAttestation', () => {
+  const originalEnv = process.env
+  const attestation = {foo: 'bar '}
+  const token = 'token'
+
+  const mockAgent = new MockAgent()
+  setGlobalDispatcher(mockAgent)
+
+  beforeEach(() => {
+    process.env = {
+      ...originalEnv,
+      GITHUB_REPOSITORY: 'foo/bar'
+    }
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when the api call is successful', () => {
+    beforeEach(() => {
+      mockAgent
+        .get('https://api.github.com')
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(201, {id: '123'})
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+    })
+  })
+
+  describe('when the api call fails', () => {
+    beforeEach(() => {
+      mockAgent
+        .get('https://api.github.com')
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(500, 'oops')
+    })
+
+    it('throws an error', async () => {
+      await expect(
+        writeAttestation(attestation, token, {retry: 0})
+      ).rejects.toThrow(/oops/)
+    })
+  })
+
+  describe('when the api call fails but succeeds on retry', () => {
+    beforeEach(() => {
+      const pool = mockAgent.get('https://api.github.com')
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(500, 'oops')
+        .times(1)
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(201, {id: '123'})
+        .times(1)
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+    })
+  })
+})

packages/attest/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@actions/attest",
+  "version": "1.2.1",
+  "description": "Actions attestation lib",
+  "keywords": [
+    "github",
+    "actions",
+    "attestation"
+  ],
+  "homepage": "https://github.com/actions/toolkit/tree/main/packages/attest",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "directories": {
+    "lib": "lib",
+    "test": "__tests__"
+  },
+  "files": [
+    "lib"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/toolkit.git",
+    "directory": "packages/attest"
+  },
+  "scripts": {
+    "test": "echo \"Error: run tests from root\" && exit 1",
+    "tsc": "tsc"
+  },
+  "bugs": {
+    "url": "https://github.com/actions/toolkit/issues"
+  },
+  "devDependencies": {
+    "@sigstore/mock": "^0.6.5",
+    "@sigstore/rekor-types": "^2.0.0",
+    "@types/jsonwebtoken": "^9.0.6",
+    "jose": "^5.2.3",
+    "nock": "^13.5.1",
+    "undici": "^5.28.4"
+  },
+  "dependencies": {
+    "@actions/core": "^1.10.1",
+    "@actions/github": "^6.0.0",
+    "@actions/http-client": "^2.2.1",
+    "@octokit/plugin-retry": "^6.0.1",
+    "@sigstore/bundle": "^2.3.0",
+    "@sigstore/sign": "^2.3.0",
+    "jsonwebtoken": "^9.0.2",
+    "jwks-rsa": "^3.1.0"
+  },
+  "overrides": {
+    "@octokit/plugin-retry": {
+      "@octokit/core": "^5.2.0"
+    }
+  }
+}

packages/attest/src/attest.ts

@@ -0,0 +1,97 @@
+import {bundleToJSON} from '@sigstore/bundle'
+import {X509Certificate} from 'crypto'
+import {SigstoreInstance, signingEndpoints} from './endpoints'
+import {buildIntotoStatement} from './intoto'
+import {Payload, signPayload} from './sign'
+import {writeAttestation} from './store'
+
+import type {Bundle} from '@sigstore/sign'
+import type {Attestation, Predicate, Subject} from './shared.types'
+
+const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
+
+/**
+ * Options for attesting a subject / predicate.
+ */
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // Content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: SigstoreInstance
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+
+/**
+ * Generates an attestation for the given subject and predicate. The subject and
+ * predicate are combined into an in-toto statement, which is then signed using
+ * the identified Sigstore instance and stored as an attestation.
+ * @param options - The options for attestation.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attest(options: AttestOptions): Promise<Attestation> {
+  const subject: Subject = {
+    name: options.subjectName,
+    digest: options.subjectDigest
+  }
+  const predicate: Predicate = {
+    type: options.predicateType,
+    params: options.predicate
+  }
+  const statement = buildIntotoStatement(subject, predicate)
+
+  // Sign the provenance statement
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(statement)),
+    type: INTOTO_PAYLOAD_TYPE
+  }
+  const endpoints = signingEndpoints(options.sigstore)
+  const bundle = await signPayload(payload, endpoints)
+
+  // Store the attestation
+  let attestationID: string | undefined
+  if (options.skipWrite !== true) {
+    attestationID = await writeAttestation(bundleToJSON(bundle), options.token)
+  }
+
+  return toAttestation(bundle, attestationID)
+}
+
+function toAttestation(bundle: Bundle, attestationID?: string): Attestation {
+  let certBytes: Buffer
+  switch (bundle.verificationMaterial.content.$case) {
+    case 'x509CertificateChain':
+      certBytes =
+        bundle.verificationMaterial.content.x509CertificateChain.certificates[0]
+          .rawBytes
+      break
+    case 'certificate':
+      certBytes = bundle.verificationMaterial.content.certificate.rawBytes
+      break
+    default:
+      throw new Error('Bundle must contain an x509 certificate')
+  }
+
+  const signingCert = new X509Certificate(certBytes)
+
+  // Collect transparency log ID if available
+  const tlogEntries = bundle.verificationMaterial.tlogEntries
+  const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined
+
+  return {
+    bundle: bundleToJSON(bundle),
+    certificate: signingCert.toString(),
+    tlogID,
+    attestationID
+  }
+}

packages/attest/src/endpoints.ts

@@ -0,0 +1,55 @@
+import * as github from '@actions/github'
+
+const PUBLIC_GOOD_ID = 'public-good'
+const GITHUB_ID = 'github'
+
+const FULCIO_PUBLIC_GOOD_URL = 'https://fulcio.sigstore.dev'
+const REKOR_PUBLIC_GOOD_URL = 'https://rekor.sigstore.dev'
+
+export type SigstoreInstance = typeof PUBLIC_GOOD_ID | typeof GITHUB_ID
+
+export type Endpoints = {
+  fulcioURL: string
+  rekorURL?: string
+  tsaServerURL?: string
+}
+
+export const SIGSTORE_PUBLIC_GOOD: Endpoints = {
+  fulcioURL: FULCIO_PUBLIC_GOOD_URL,
+  rekorURL: REKOR_PUBLIC_GOOD_URL
+}
+
+export const signingEndpoints = (sigstore?: SigstoreInstance): Endpoints => {
+  let instance: SigstoreInstance
+
+  // An explicitly set instance type takes precedence, but if not set, use the
+  // repository's visibility to determine the instance type.
+  if (sigstore && [PUBLIC_GOOD_ID, GITHUB_ID].includes(sigstore)) {
+    instance = sigstore
+  } else {
+    instance =
+      github.context.payload.repository?.visibility === 'public'
+        ? PUBLIC_GOOD_ID
+        : GITHUB_ID
+  }
+
+  switch (instance) {
+    case PUBLIC_GOOD_ID:
+      return SIGSTORE_PUBLIC_GOOD
+    case GITHUB_ID:
+      return buildGitHubEndpoints()
+  }
+}
+
+function buildGitHubEndpoints(): Endpoints {
+  const serverURL = process.env.GITHUB_SERVER_URL || 'https://github.com'
+  let host = new URL(serverURL).hostname
+
+  if (host === 'github.com') {
+    host = 'githubapp.com'
+  }
+  return {
+    fulcioURL: `https://fulcio.${host}`,
+    tsaServerURL: `https://timestamp.${host}`
+  }
+}

packages/attest/src/index.ts

@@ -0,0 +1,9 @@
+export {AttestOptions, attest} from './attest'
+export {
+  AttestProvenanceOptions,
+  attestProvenance,
+  buildSLSAProvenancePredicate
+} from './provenance'
+
+export type {SerializedBundle} from '@sigstore/bundle'
+export type {Attestation, Predicate, Subject} from './shared.types'

packages/attest/src/intoto.ts

@@ -0,0 +1,32 @@
+import {Predicate, Subject} from './shared.types'
+
+const INTOTO_STATEMENT_V1_TYPE = 'https://in-toto.io/Statement/v1'
+
+/**
+ * An in-toto statement.
+ * https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+ */
+export type InTotoStatement = {
+  _type: string
+  subject: Subject[]
+  predicateType: string
+  predicate: object
+}
+
+/**
+ * Assembles the given subject and predicate into an in-toto statement.
+ * @param subject - The subject of the statement.
+ * @param predicate - The predicate of the statement.
+ * @returns The constructed in-toto statement.
+ */
+export const buildIntotoStatement = (
+  subject: Subject,
+  predicate: Predicate
+): InTotoStatement => {
+  return {
+    _type: INTOTO_STATEMENT_V1_TYPE,
+    subject: [subject],
+    predicateType: predicate.type,
+    predicate: predicate.params
+  }
+}

packages/attest/src/oidc.ts

@@ -0,0 +1,102 @@
+import {getIDToken} from '@actions/core'
+import {HttpClient} from '@actions/http-client'
+import * as jwt from 'jsonwebtoken'
+import jwks from 'jwks-rsa'
+
+const OIDC_AUDIENCE = 'nobody'
+
+const REQUIRED_CLAIMS = [
+  'iss',
+  'ref',
+  'sha',
+  'repository',
+  'event_name',
+  'workflow_ref',
+  'repository_id',
+  'repository_owner_id',
+  'runner_environment',
+  'run_id',
+  'run_attempt'
+] as const
+
+export type ClaimSet = {[K in (typeof REQUIRED_CLAIMS)[number]]: string}
+
+type OIDCConfig = {
+  jwks_uri: string
+}
+
+export const getIDTokenClaims = async (issuer: string): Promise<ClaimSet> => {
+  try {
+    const token = await getIDToken(OIDC_AUDIENCE)
+    const claims = await decodeOIDCToken(token, issuer)
+    assertClaimSet(claims)
+    return claims
+  } catch (error) {
+    throw new Error(`Failed to get ID token: ${error.message}`)
+  }
+}
+
+const decodeOIDCToken = async (
+  token: string,
+  issuer: string
+): Promise<jwt.JwtPayload> => {
+  // Verify and decode token
+  return new Promise((resolve, reject) => {
+    jwt.verify(
+      token,
+      getPublicKey(issuer),
+      {audience: OIDC_AUDIENCE, issuer},
+      (err, decoded) => {
+        if (err) {
+          reject(err)
+        } else if (!decoded || typeof decoded === 'string') {
+          reject(new Error('No decoded token'))
+        } else {
+          resolve(decoded)
+        }
+      }
+    )
+  })
+}
+
+// Returns a callback to locate the public key for the given JWT header. This
+// involves two calls:
+// 1. Fetch the OpenID configuration to get the JWKS URI.
+// 2. Fetch the public key from the JWKS URI.
+const getPublicKey =
+  (issuer: string): jwt.GetPublicKeyOrSecret =>
+  (header: jwt.JwtHeader, callback: jwt.SigningKeyCallback) => {
+    // Look up the JWKS URI from the issuer's OpenID configuration
+    new HttpClient('actions/attest')
+      .getJson<OIDCConfig>(`${issuer}/.well-known/openid-configuration`)
+      .then(data => {
+        if (!data.result) {
+          callback(new Error('No OpenID configuration found'))
+        } else {
+          // Fetch the public key from the JWKS URI
+          jwks({jwksUri: data.result.jwks_uri}).getSigningKey(
+            header.kid,
+            (err, key) => {
+              callback(err, key?.getPublicKey())
+            }
+          )
+        }
+      })
+      .catch(err => {
+        callback(err)
+      })
+  }
+
+function assertClaimSet(claims: jwt.JwtPayload): asserts claims is ClaimSet {
+  const missingClaims: string[] = []
+
+  for (const claim of REQUIRED_CLAIMS) {
+    if (!(claim in claims)) {
+      missingClaims.push(claim)
+    }
+  }
+
+  if (missingClaims.length > 0) {
+    throw new Error(`Missing claims: ${missingClaims.join(', ')}`)
+  }
+}

packages/attest/src/provenance.ts

@@ -0,0 +1,99 @@
+import {attest, AttestOptions} from './attest'
+import {getIDTokenClaims} from './oidc'
+import type {Attestation, Predicate} from './shared.types'
+
+const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
+
+const GITHUB_BUILDER_ID_PREFIX = 'https://github.com/actions/runner'
+const GITHUB_BUILD_TYPE =
+  'https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1'
+
+const DEFAULT_ISSUER = 'https://token.actions.githubusercontent.com'
+
+export type AttestProvenanceOptions = Omit<
+  AttestOptions,
+  'predicate' | 'predicateType'
+> & {
+  issuer?: string
+}
+
+/**
+ * Builds an SLSA (Supply Chain Levels for Software Artifacts) provenance
+ * predicate using the GitHub Actions Workflow build type.
+ * https://slsa.dev/spec/v1.0/provenance
+ * https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1
+ * @param issuer - URL for the OIDC issuer. Defaults to the GitHub Actions token
+ * issuer.
+ * @returns The SLSA provenance predicate.
+ */
+export const buildSLSAProvenancePredicate = async (
+  issuer: string = DEFAULT_ISSUER
+): Promise<Predicate> => {
+  const serverURL = process.env.GITHUB_SERVER_URL
+  const claims = await getIDTokenClaims(issuer)
+
+  // Split just the path and ref from the workflow string.
+  // owner/repo/.github/workflows/main.yml@main =>
+  //   .github/workflows/main.yml, main
+  const [workflowPath, workflowRef] = claims.workflow_ref
+    .replace(`${claims.repository}/`, '')
+    .split('@')
+
+  return {
+    type: SLSA_PREDICATE_V1_TYPE,
+    params: {
+      buildDefinition: {
+        buildType: GITHUB_BUILD_TYPE,
+        externalParameters: {
+          workflow: {
+            ref: workflowRef,
+            repository: `${serverURL}/${claims.repository}`,
+            path: workflowPath
+          }
+        },
+        internalParameters: {
+          github: {
+            event_name: claims.event_name,
+            repository_id: claims.repository_id,
+            repository_owner_id: claims.repository_owner_id
+          }
+        },
+        resolvedDependencies: [
+          {
+            uri: `git+${serverURL}/${claims.repository}@${claims.ref}`,
+            digest: {
+              gitCommit: claims.sha
+            }
+          }
+        ]
+      },
+      runDetails: {
+        builder: {
+          id: `${GITHUB_BUILDER_ID_PREFIX}/${claims.runner_environment}`
+        },
+        metadata: {
+          invocationId: `${serverURL}/${claims.repository}/actions/runs/${claims.run_id}/attempts/${claims.run_attempt}`
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Attests the build provenance of the provided subject. Generates the SLSA
+ * build provenance predicate, assembles it into an in-toto statement, and
+ * attests it.
+ *
+ * @param options - The options for attesting the provenance.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attestProvenance(
+  options: AttestProvenanceOptions
+): Promise<Attestation> {
+  const predicate = await buildSLSAProvenancePredicate(options.issuer)
+  return attest({
+    ...options,
+    predicateType: predicate.type,
+    predicate: predicate.params
+  })
+}

packages/attest/src/shared.types.ts

@@ -0,0 +1,52 @@
+import type {SerializedBundle} from '@sigstore/bundle'
+
+/*
+ * The subject of an attestation.
+ */
+export type Subject = {
+  /*
+   * Name of the subject.
+   */
+  name: string
+  /*
+   * Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
+   */
+  digest: Record<string, string>
+}
+
+/*
+ * The predicate of an attestation.
+ */
+export type Predicate = {
+  /*
+   * URI identifying the content type of the predicate.
+   */
+  type: string
+  /*
+   * Predicate parameters.
+   */
+  params: object
+}
+
+/*
+ * Artifact attestation.
+ */
+export type Attestation = {
+  /*
+   * Serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation.
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}

packages/attest/src/sign.ts

@@ -0,0 +1,109 @@
+import {
+  Bundle,
+  BundleBuilder,
+  CIContextProvider,
+  DSSEBundleBuilder,
+  FulcioSigner,
+  RekorWitness,
+  TSAWitness,
+  Witness
+} from '@sigstore/sign'
+
+const OIDC_AUDIENCE = 'sigstore'
+const DEFAULT_TIMEOUT = 10000
+const DEFAULT_RETRIES = 3
+
+/**
+ * The payload to be signed (body) and its media type (type).
+ */
+export type Payload = {
+  body: Buffer
+  type: string
+}
+
+/**
+ * Options for signing a document.
+ */
+export type SignOptions = {
+  /**
+   * The URL of the Fulcio service.
+   */
+  fulcioURL: string
+  /**
+   * The URL of the Rekor service.
+   */
+  rekorURL?: string
+  /**
+   * The URL of the TSA (Time Stamping Authority) server.
+   */
+  tsaServerURL?: string
+  /**
+   * The timeout duration in milliseconds when communicating with Sigstore
+   * services.
+   */
+  timeout?: number
+  /**
+   * The number of retry attempts.
+   */
+  retry?: number
+}
+
+/**
+ * Signs the provided payload with a Sigstore-issued certificate and returns the
+ * signature bundle.
+ * @param payload Payload to be signed.
+ * @param options Signing options.
+ * @returns A promise that resolves to the Sigstore signature bundle.
+ */
+export const signPayload = async (
+  payload: Payload,
+  options: SignOptions
+): Promise<Bundle> => {
+  const artifact = {
+    data: payload.body,
+    type: payload.type
+  }
+
+  // Sign the artifact and build the bundle
+  return initBundleBuilder(options).create(artifact)
+}
+
+// Assembles the Sigstore bundle builder with the appropriate options
+const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
+  const identityProvider = new CIContextProvider(OIDC_AUDIENCE)
+  const timeout = opts.timeout || DEFAULT_TIMEOUT
+  const retry = opts.retry || DEFAULT_RETRIES
+  const witnesses: Witness[] = []
+
+  const signer = new FulcioSigner({
+    identityProvider,
+    fulcioBaseURL: opts.fulcioURL,
+    timeout,
+    retry
+  })
+
+  if (opts.rekorURL) {
+    witnesses.push(
+      new RekorWitness({
+        rekorBaseURL: opts.rekorURL,
+        entryType: 'dsse',
+        timeout,
+        retry
+      })
+    )
+  }
+
+  if (opts.tsaServerURL) {
+    witnesses.push(
+      new TSAWitness({
+        tsaBaseURL: opts.tsaServerURL,
+        timeout,
+        retry
+      })
+    )
+  }
+
+  // Build the bundle with the singleCertificate option which will
+  // trigger the creation of v0.3 DSSE bundles
+  return new DSSEBundleBuilder({signer, witnesses, singleCertificate: true})
+}

packages/attest/src/store.ts

@@ -0,0 +1,41 @@
+import * as github from '@actions/github'
+import {retry} from '@octokit/plugin-retry'
+
+const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
+const DEFAULT_RETRY_COUNT = 5
+
+export type WriteOptions = {
+  retry?: number
+}
+/**
+ * Writes an attestation to the repository's attestations endpoint.
+ * @param attestation - The attestation to write.
+ * @param token - The GitHub token for authentication.
+ * @returns The ID of the attestation.
+ * @throws Error if the attestation fails to persist.
+ */
+export const writeAttestation = async (
+  attestation: unknown,
+  token: string,
+  options: WriteOptions = {}
+): Promise<string> => {
+  const retries = options.retry ?? DEFAULT_RETRY_COUNT
+  const octokit = github.getOctokit(token, {retry: {retries}}, retry)
+
+  try {
+    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
+      owner: github.context.repo.owner,
+      repo: github.context.repo.repo,
+      data: {bundle: attestation}
+    })
+
+    const data =
+      typeof response.data == 'string'
+        ? JSON.parse(response.data)
+        : response.data
+    return data?.id
+  } catch (err) {
+    const message = err instanceof Error ? err.message : err
+    throw new Error(`Failed to persist attestation: ${message}`)
+  }
+}

packages/attest/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "outDir": "./lib",
+    "declaration": true,
+    "rootDir": "./src"
+  },
+  "include": [
+    "./src"
+  ]
+}

packages/cache/RELEASES.md

@@ -1,16 +1,154 @@
 # @actions/cache Releases
 
-### 0.1.0
+### 3.2.4
 
-- Initial release
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+  
+### 3.2.3
 
-### 0.2.0
+- Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)
 
-- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+### 3.2.2
 
-### 0.2.1
+- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
 
-- Fix to await async function getCompressionMethod
+### 3.2.1
+
+- Updated @azure/storage-blob to `v12.13.0`
+
+### 3.2.0
+
+- Add `lookupOnly` to cache restore `DownloadOptions`.
+
+### 3.1.4
+
+- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
+
+### 3.1.3
+
+- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
+
+### 3.1.2
+
+- Fix issue with symlink restoration on windows.
+
+### 3.1.1
+
+- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
+- Added support for verbose logging about cache version during cache miss.
+
+### 3.1.0
+
+- Update actions/cache on windows to use gnu tar and zstd by default
+- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.1.0-beta.3
+
+- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
+
+### 3.1.0-beta.2
+
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.0.6
+
+- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
+
+### 3.0.5
+
+- Update `@actions/cache` to use `@actions/core@^1.10.0`
+
+### 3.0.4
+
+- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
+- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
+
+### 3.0.3
+
+- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.2
+
+- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.1
+
+- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
+- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
+
+### 3.0.0
+
+- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
+
+### 2.0.6
+
+- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
+
+### 2.0.5
+
+- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
+
+### 2.0.4
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 2.0.3
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 2.0.0
+
+- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
+
+### 1.0.11
+
+- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
+
+### 1.0.10
+
+- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
+
+### 1.0.9
+
+- Use @azure/ms-rest-js v2.6.0
+- Use @azure/storage-blob v12.8.0
+
+### 1.0.8
+
+- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
+
+### 1.0.7
+
+- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
+
+### 1.0.6
+
+- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
+- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
+
+### 1.0.5
+
+- Fix to ensure Windows cache paths get resolved correctly
+
+### 1.0.4
+
+- Use @actions/core v1.2.6
+- Fixes uploadChunk to throw an error if any unsuccessful response code is received
+
+### 1.0.3
+
+- Use http-client v1.0.9
+- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
+- Adds 5 second delay between retry attempts
+
+### 1.0.2
+
+- Use posix archive format to add support for some tools
+
+### 1.0.1
+
+- Fix bug in downloading large files (> 2 GBs) with the Azure SDK
 
 ### 1.0.0
 
@@ -19,152 +157,14 @@
 - Includes changes that break compatibility with earlier versions, including:
   - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`
 
-### 1.0.1
+### 0.2.1
 
-- Fix bug in downloading large files (> 2 GBs) with the Azure SDK
+- Fix to await async function getCompressionMethod
+  
+### 0.2.0
 
-### 1.0.2
+- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+  
+### 0.1.0
 
-- Use posix archive format to add support for some tools
-
-### 1.0.3
-
-- Use http-client v1.0.9
-- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
-- Adds 5 second delay between retry attempts
-
-### 1.0.4
-
-- Use @actions/core v1.2.6
-- Fixes uploadChunk to throw an error if any unsuccessful response code is received
-
-### 1.0.5
-
-- Fix to ensure Windows cache paths get resolved correctly
-
-### 1.0.6
-
-- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
-- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
-
-### 1.0.7
-
-- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
-
-### 1.0.8
-
-- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
-
-### 1.0.9
-
-- Use @azure/ms-rest-js v2.6.0
-- Use @azure/storage-blob v12.8.0
-
-### 1.0.10
-
-- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
-
-### 1.0.11
-
-- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
-
-### 2.0.0
-
-- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
-
-### 2.0.3
-
-- Update to v2.0.0 of `@actions/http-client`
-
-### 2.0.4
-
-- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 2.0.5
-
-- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
-
-### 2.0.6
-
-- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
-
-### 3.0.0
-
-- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
-
-### 3.0.1
-
-- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
-- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
-
-### 3.0.2
-
-- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.3
-
-- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.4
-
-- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
-- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
-
-### 3.0.5
-
-- Update `@actions/cache` to use `@actions/core@^1.10.0`
-
-### 3.0.6
-
-- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
-
-### 3.1.0-beta.1
-
-- Update actions/cache on windows to use gnu tar and zstd by default and fallback to bsdtar and zstd if gnu tar is not available. ([issue](https://github.com/actions/cache/issues/984))
-
-### 3.1.0-beta.2
-
-- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.0-beta.3
-
-- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
-
-### 3.1.0
-
-- Update actions/cache on windows to use gnu tar and zstd by default
-- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
-- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.1
-
-- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
-- Added support for verbose logging about cache version during cache miss.
-
-### 3.1.2
-
-- Fix issue with symlink restoration on windows.
-
-### 3.1.3
-
-- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
-
-### 3.1.4
-
-- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
-
-### 3.2.0
-
-- Add `lookupOnly` to cache restore `DownloadOptions`.
-
-### 3.2.1
-
-- Updated @azure/storage-blob to `v12.13.0`
-
-### 3.2.2
-
-- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
-
-### 3.2.3
-
-- Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)
+- Initial release

packages/cache/__tests__/cacheHttpClient.test.ts

@@ -5,6 +5,12 @@ import {DownloadOptions, getDownloadOptions} from '../src/options'
 
 jest.mock('../src/internal/downloadUtils')
 
+test('getCacheVersion does not mutate arguments', async () => {
+  const paths = ['node_modules']
+  getCacheVersion(paths, undefined, true)
+  expect(paths).toEqual(['node_modules'])
+})
+
 test('getCacheVersion with one path returns version', async () => {
   const paths = ['node_modules']
   const result = getCacheVersion(paths, undefined, true)

packages/cache/__tests__/cacheUtils.test.ts

@@ -2,6 +2,10 @@ import {promises as fs} from 'fs'
 import * as path from 'path'
 import * as cacheUtils from '../src/internal/cacheUtils'
 
+beforeEach(() => {
+  jest.resetModules()
+})
+
 test('getArchiveFileSizeInBytes returns file size', () => {
   const filePath = path.join(__dirname, '__fixtures__', 'helloWorld.txt')
 
@@ -38,3 +42,23 @@ test('resolvePaths works on github workspace directory', async () => {
   const paths = await cacheUtils.resolvePaths([workspace])
   expect(paths.length).toBeGreaterThan(0)
 })
+
+test('isGhes returns false for github.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://github.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns false for ghe.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://somedomain.ghe.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns true for enterprise URL', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+  expect(cacheUtils.isGhes()).toBe(true)
+})
+
+test('isGhes returns false for ghe.localhost', () => {
+  process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+  expect(cacheUtils.isGhes()).toBe(false)
+})

packages/cache/__tests__/saveCache.test.ts

@@ -2,10 +2,14 @@ import * as core from '@actions/core'
 import * as path from 'path'
 import {saveCache} from '../src/cache'
 import * as cacheHttpClient from '../src/internal/cacheHttpClient'
+import * as cacheTwirpClient from '../src/internal/cacheTwirpClient'
+import {GetCacheBlobUploadURLResponse} from '../src/generated/results/api/v1/blobcache'
+import {BlobCacheServiceClientJSON} from '../src/generated/results/api/v1/blobcache.twirp'
 import * as cacheUtils from '../src/internal/cacheUtils'
 import {CacheFilename, CompressionMethod} from '../src/internal/constants'
 import * as tar from '../src/internal/tar'
 import {TypedResponse} from '@actions/http-client/lib/interfaces'
+import * as uploadCache from '../src/internal/v2/upload-cache'
 import {
   ReserveCacheResponse,
   ITypedResponseWithError
@@ -327,3 +331,74 @@ test('save with non existing path should not save cache', async () => {
     `Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`
   )
 })
+
+test('throwaway test', async () => {
+  const filePath = 'node_modules'
+  const primaryKey = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const cachePaths = [path.resolve(filePath)]
+
+  const cacheSignedURL = 'https://container.blob.core.windows.net/cache/${primaryKey}?sig=1234'
+  const getCacheBlobUploadURL: GetCacheBlobUploadURLResponse = {
+    urls: [
+      {
+        key: primaryKey,
+        url: cacheSignedURL,
+      },
+    ]
+  }
+
+  const cacheId = 4
+  const reserveCacheMock = jest
+    .spyOn(cacheHttpClient, 'reserveCache')
+    .mockImplementation(async () => {
+      const response: TypedResponse<ReserveCacheResponse> = {
+        statusCode: 500,
+        result: {cacheId},
+        headers: {}
+      }
+      return response
+    })
+
+  const getCacheBlobUploadURLMock = jest
+  .spyOn(BlobCacheServiceClientJSON.prototype, 'GetCacheBlobUploadURL')
+  .mockResolvedValue(getCacheBlobUploadURL)
+
+  const uploadCacheMock = jest
+  .spyOn(uploadCache, 'UploadCacheFile')
+  .mockImplementation(async () => {
+    return {
+      status: 200    
+    }
+  })
+
+  const createTarMock = jest.spyOn(tar, 'createTar')
+
+  const saveCacheMock = jest.spyOn(cacheHttpClient, 'saveCache')
+  const compression = CompressionMethod.Zstd
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValue(Promise.resolve(compression))
+  
+  await uploadCache.UploadCacheFile(getCacheBlobUploadURL, cachePaths[0])
+  await saveCache([filePath], primaryKey)
+
+  expect(reserveCacheMock).toHaveBeenCalledTimes(1)
+  expect(reserveCacheMock).toHaveBeenCalledWith(primaryKey, [filePath], {
+    cacheSize: undefined,
+    compressionMethod: compression,
+    enableCrossOsArchive: false
+  })
+  expect (getCacheBlobUploadURLMock).toHaveBeenCalledTimes(1)
+  const archiveFolder = '/foo/bar'
+  const archiveFile = path.join(archiveFolder, CacheFilename.Zstd)
+  expect(createTarMock).toHaveBeenCalledTimes(1)
+  expect(createTarMock).toHaveBeenCalledWith(
+    archiveFolder,
+    cachePaths,
+    compression
+  )
+  expect(uploadCacheMock).toHaveBeenCalledTimes(2)
+  expect(saveCacheMock).toHaveBeenCalledTimes(1)
+  expect(saveCacheMock).toHaveBeenCalledWith(cacheId, archiveFile, undefined)
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+})

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "3.2.3",
+  "version": "3.2.4",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -38,6 +38,7 @@
   },
   "dependencies": {
     "@actions/core": "^1.10.0",
+    "@actions/artifact": "^2.1.7",
     "@actions/exec": "^1.0.1",
     "@actions/glob": "^0.1.0",
     "@actions/http-client": "^2.1.1",

packages/cache/src/cache.ts

@@ -1,9 +1,25 @@
 import * as core from '@actions/core'
 import * as path from 'path'
 import * as utils from './internal/cacheUtils'
+import {CacheServiceVersion, CacheUrl} from './internal/constants'
 import * as cacheHttpClient from './internal/cacheHttpClient'
+import * as cacheTwirpClient from './internal/cacheTwirpClient'
 import {createTar, extractTar, listTar} from './internal/tar'
 import {DownloadOptions, UploadOptions} from './options'
+import {
+  GetCacheBlobUploadURLRequest,
+  GetCacheBlobUploadURLResponse,
+  GetCachedBlobRequest,
+  GetCachedBlobResponse
+} from './generated/results/api/v1/blobcache'
+import {UploadCacheStream} from './internal/v2/upload-cache'
+import {StreamExtract} from './internal/v2/download-cache'
+import {
+  UploadZipSpecification,
+  getUploadZipSpecification
+} from '@actions/artifact/lib/internal/upload/upload-zip-specification'
+import {createZipUploadStream} from '@actions/artifact/lib/internal/upload/zip'
+import {getBackendIdsFromToken, BackendIds} from '@actions/artifact/lib/internal/shared/util'
 
 export class ValidationError extends Error {
   constructor(message: string) {
@@ -50,7 +66,7 @@ function checkKey(key: string): void {
  */
 
 export function isFeatureAvailable(): boolean {
-  return !!process.env['ACTIONS_CACHE_URL']
+  return !!CacheUrl
 }
 
 /**
@@ -72,6 +88,23 @@ export async function restoreCache(
 ): Promise<string | undefined> {
   checkPaths(paths)
 
+  console.debug(`Cache Service Version: ${CacheServiceVersion}`)
+  switch (CacheServiceVersion) {
+    case "v2":
+      return await restoreCachev2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive)
+    case "v1":
+    default:
+      return await restoreCachev1(paths, primaryKey, restoreKeys, options, enableCrossOsArchive)
+  }
+}
+
+async function restoreCachev1(
+  paths: string[],
+  primaryKey: string,
+  restoreKeys?: string[],
+  options?: DownloadOptions,
+  enableCrossOsArchive = false
+) {
   restoreKeys = restoreKeys || []
   const keys = [primaryKey, ...restoreKeys]
 
@@ -153,6 +186,58 @@ export async function restoreCache(
   return undefined
 }
 
+async function restoreCachev2(
+  paths: string[],
+  primaryKey: string,
+  restoreKeys?: string[],
+  options?: DownloadOptions,
+  enableCrossOsArchive = false
+) {
+  
+  restoreKeys = restoreKeys || []
+  const keys = [primaryKey, ...restoreKeys]
+
+  core.debug('Resolved Keys:')
+  core.debug(JSON.stringify(keys))
+
+  if (keys.length > 10) {
+    throw new ValidationError(
+      `Key Validation Error: Keys are limited to a maximum of 10.`
+    )
+  }
+  for (const key of keys) {
+    checkKey(key)
+  }
+
+  try {
+    // BackendIds are retrieved form the signed JWT
+    const backendIds: BackendIds = getBackendIdsFromToken()
+    const twirpClient = cacheTwirpClient.internalBlobCacheTwirpClient()
+    const getSignedDownloadURLRequest: GetCachedBlobRequest = {
+      workflowRunBackendId: backendIds.workflowRunBackendId,
+      workflowJobRunBackendId: backendIds.workflowJobRunBackendId,
+      keys: keys,
+    }
+    const signedDownloadURL: GetCachedBlobResponse = await twirpClient.GetCachedBlob(getSignedDownloadURLRequest)
+    core.info(`GetCachedBlobResponse: ${JSON.stringify(signedDownloadURL)}`)
+
+    if (signedDownloadURL.blobs.length === 0) {
+      // Cache not found
+      core.warning(`Cache not found for keys: ${keys.join(', ')}`)
+      return undefined
+    }
+
+    core.info(`Cache hit for: ${signedDownloadURL.blobs[0].key}`)
+    core.info(`Starting download of artifact to: ${paths[0]}`)
+    await StreamExtract(signedDownloadURL.blobs[0].signedUrl, path.dirname(paths[0]))
+    core.info(`Artifact download completed successfully.`)
+
+    return keys[0]
+  } catch (error) {
+    throw new Error(`Unable to download and extract cache: ${error.message}`)
+  }
+}
+
 /**
  * Saves a list of files with the specified key
  *
@@ -170,7 +255,23 @@ export async function saveCache(
 ): Promise<number> {
   checkPaths(paths)
   checkKey(key)
+  
+  console.debug(`Cache Service Version: ${CacheServiceVersion}`)
+  switch (CacheServiceVersion) {
+    case "v2":
+      return await saveCachev2(paths, key, options, enableCrossOsArchive)
+    case "v1":
+    default:
+      return await saveCachev1(paths, key, options, enableCrossOsArchive)
+  }
+}
 
+async function saveCachev1(
+  paths: string[],
+  key: string,
+  options?: UploadOptions,
+  enableCrossOsArchive = false
+): Promise<number> {
   const compressionMethod = await utils.getCompressionMethod()
   let cacheId = -1
 
@@ -258,3 +359,51 @@ export async function saveCache(
 
   return cacheId
 }
+
+async function saveCachev2(
+  paths: string[],
+  key: string,
+  options?: UploadOptions,
+  enableCrossOsArchive = false
+): Promise<number> {
+  // BackendIds are retrieved form the signed JWT
+  const backendIds: BackendIds = getBackendIdsFromToken()
+  const twirpClient = cacheTwirpClient.internalBlobCacheTwirpClient()
+  const getSignedUploadURL: GetCacheBlobUploadURLRequest = {
+    workflowRunBackendId: backendIds.workflowRunBackendId,
+    workflowJobRunBackendId: backendIds.workflowJobRunBackendId,
+    organization: "github",
+    keys: [key],
+  }
+  const signedUploadURL: GetCacheBlobUploadURLResponse = await twirpClient.GetCacheBlobUploadURL(getSignedUploadURL)
+  core.info(`GetCacheBlobUploadURLResponse: ${JSON.stringify(signedUploadURL)}`)
+
+  // Archive
+  // We're going to handle 1 path fow now. This needs to be fixed to handle all 
+  // paths passed in.
+  const rootDir = path.dirname(paths[0])
+  const zipSpecs: UploadZipSpecification[] = getUploadZipSpecification(paths, rootDir)
+  if (zipSpecs.length === 0) {
+    throw new Error(
+      `Error with zip specs: ${zipSpecs.flatMap(s => (s.sourcePath ? [s.sourcePath] : [])).join(', ')}`
+    )
+  }
+
+  // 0: No compression
+  // 1: Best speed
+  // 6: Default compression (same as GNU Gzip)
+  // 9: Best compression Higher levels will result in better compression, but will take longer to complete. For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+  const zipUploadStream = await createZipUploadStream(
+    zipSpecs,
+    6
+  )
+
+  // Cache v2 upload
+  // inputs:
+  // - getSignedUploadURL
+  // - archivePath
+  core.info(`Saving Cache v2: ${paths[0]}`)
+  await UploadCacheStream(signedUploadURL.urls[0].url, zipUploadStream)
+
+  return 0
+}

packages/cache/src/generated/google/protobuf/timestamp.ts

@@ -0,0 +1,290 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "google/protobuf/timestamp.proto" (package "google.protobuf", syntax proto3)
+// tslint:disable
+//
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { typeofJsonValue } from "@protobuf-ts/runtime";
+import type { JsonValue } from "@protobuf-ts/runtime";
+import type { JsonReadOptions } from "@protobuf-ts/runtime";
+import type { JsonWriteOptions } from "@protobuf-ts/runtime";
+import { PbLong } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+/**
+ * A Timestamp represents a point in time independent of any time zone or local
+ * calendar, encoded as a count of seconds and fractions of seconds at
+ * nanosecond resolution. The count is relative to an epoch at UTC midnight on
+ * January 1, 1970, in the proleptic Gregorian calendar which extends the
+ * Gregorian calendar backwards to year one.
+ *
+ * All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
+ * second table is needed for interpretation, using a [24-hour linear
+ * smear](https://developers.google.com/time/smear).
+ *
+ * The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
+ * restricting to that range, we ensure that we can convert to and from [RFC
+ * 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
+ *
+ * # Examples
+ *
+ * Example 1: Compute Timestamp from POSIX `time()`.
+ *
+ *     Timestamp timestamp;
+ *     timestamp.set_seconds(time(NULL));
+ *     timestamp.set_nanos(0);
+ *
+ * Example 2: Compute Timestamp from POSIX `gettimeofday()`.
+ *
+ *     struct timeval tv;
+ *     gettimeofday(&tv, NULL);
+ *
+ *     Timestamp timestamp;
+ *     timestamp.set_seconds(tv.tv_sec);
+ *     timestamp.set_nanos(tv.tv_usec * 1000);
+ *
+ * Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
+ *
+ *     FILETIME ft;
+ *     GetSystemTimeAsFileTime(&ft);
+ *     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+ *
+ *     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+ *     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+ *     Timestamp timestamp;
+ *     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+ *     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+ *
+ * Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
+ *
+ *     long millis = System.currentTimeMillis();
+ *
+ *     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+ *         .setNanos((int) ((millis % 1000) * 1000000)).build();
+ *
+ *
+ * Example 5: Compute Timestamp from Java `Instant.now()`.
+ *
+ *     Instant now = Instant.now();
+ *
+ *     Timestamp timestamp =
+ *         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+ *             .setNanos(now.getNano()).build();
+ *
+ *
+ * Example 6: Compute Timestamp from current time in Python.
+ *
+ *     timestamp = Timestamp()
+ *     timestamp.GetCurrentTime()
+ *
+ * # JSON Mapping
+ *
+ * In JSON format, the Timestamp type is encoded as a string in the
+ * [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+ * format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+ * where {year} is always expressed using four digits while {month}, {day},
+ * {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+ * seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+ * are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+ * is required. A proto3 JSON serializer should always use UTC (as indicated by
+ * "Z") when printing the Timestamp type and a proto3 JSON parser should be
+ * able to accept both UTC and other timezones (as indicated by an offset).
+ *
+ * For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+ * 01:30 UTC on January 15, 2017.
+ *
+ * In JavaScript, one can convert a Date object to this format using the
+ * standard
+ * [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
+ * method. In Python, a standard `datetime.datetime` object can be converted
+ * to this format using
+ * [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
+ * the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
+ * the Joda Time's [`ISODateTimeFormat.dateTime()`](
+ * http://www.joda.org/joda-time/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime%2D%2D
+ * ) to obtain a formatter capable of generating timestamps in this format.
+ *
+ *
+ *
+ * @generated from protobuf message google.protobuf.Timestamp
+ */
+export interface Timestamp {
+    /**
+     * Represents seconds of UTC time since Unix epoch
+     * 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+     * 9999-12-31T23:59:59Z inclusive.
+     *
+     * @generated from protobuf field: int64 seconds = 1;
+     */
+    seconds: string;
+    /**
+     * Non-negative fractions of a second at nanosecond resolution. Negative
+     * second values with fractions must still have non-negative nanos values
+     * that count forward in time. Must be from 0 to 999,999,999
+     * inclusive.
+     *
+     * @generated from protobuf field: int32 nanos = 2;
+     */
+    nanos: number;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class Timestamp$Type extends MessageType<Timestamp> {
+    constructor() {
+        super("google.protobuf.Timestamp", [
+            { no: 1, name: "seconds", kind: "scalar", T: 3 /*ScalarType.INT64*/ },
+            { no: 2, name: "nanos", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+        ]);
+    }
+    /**
+     * Creates a new `Timestamp` for the current time.
+     */
+    now(): Timestamp {
+        const msg = this.create();
+        const ms = Date.now();
+        msg.seconds = PbLong.from(Math.floor(ms / 1000)).toString();
+        msg.nanos = (ms % 1000) * 1000000;
+        return msg;
+    }
+    /**
+     * Converts a `Timestamp` to a JavaScript Date.
+     */
+    toDate(message: Timestamp): Date {
+        return new Date(PbLong.from(message.seconds).toNumber() * 1000 + Math.ceil(message.nanos / 1000000));
+    }
+    /**
+     * Converts a JavaScript Date to a `Timestamp`.
+     */
+    fromDate(date: Date): Timestamp {
+        const msg = this.create();
+        const ms = date.getTime();
+        msg.seconds = PbLong.from(Math.floor(ms / 1000)).toString();
+        msg.nanos = (ms % 1000) * 1000000;
+        return msg;
+    }
+    /**
+     * In JSON format, the `Timestamp` type is encoded as a string
+     * in the RFC 3339 format.
+     */
+    internalJsonWrite(message: Timestamp, options: JsonWriteOptions): JsonValue {
+        let ms = PbLong.from(message.seconds).toNumber() * 1000;
+        if (ms < Date.parse("0001-01-01T00:00:00Z") || ms > Date.parse("9999-12-31T23:59:59Z"))
+            throw new Error("Unable to encode Timestamp to JSON. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.");
+        if (message.nanos < 0)
+            throw new Error("Unable to encode invalid Timestamp to JSON. Nanos must not be negative.");
+        let z = "Z";
+        if (message.nanos > 0) {
+            let nanosStr = (message.nanos + 1000000000).toString().substring(1);
+            if (nanosStr.substring(3) === "000000")
+                z = "." + nanosStr.substring(0, 3) + "Z";
+            else if (nanosStr.substring(6) === "000")
+                z = "." + nanosStr.substring(0, 6) + "Z";
+            else
+                z = "." + nanosStr + "Z";
+        }
+        return new Date(ms).toISOString().replace(".000Z", z);
+    }
+    /**
+     * In JSON format, the `Timestamp` type is encoded as a string
+     * in the RFC 3339 format.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: Timestamp): Timestamp {
+        if (typeof json !== "string")
+            throw new Error("Unable to parse Timestamp from JSON " + typeofJsonValue(json) + ".");
+        let matches = json.match(/^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})(?:Z|\.([0-9]{3,9})Z|([+-][0-9][0-9]:[0-9][0-9]))$/);
+        if (!matches)
+            throw new Error("Unable to parse Timestamp from JSON. Invalid format.");
+        let ms = Date.parse(matches[1] + "-" + matches[2] + "-" + matches[3] + "T" + matches[4] + ":" + matches[5] + ":" + matches[6] + (matches[8] ? matches[8] : "Z"));
+        if (Number.isNaN(ms))
+            throw new Error("Unable to parse Timestamp from JSON. Invalid value.");
+        if (ms < Date.parse("0001-01-01T00:00:00Z") || ms > Date.parse("9999-12-31T23:59:59Z"))
+            throw new globalThis.Error("Unable to parse Timestamp from JSON. Must be from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z inclusive.");
+        if (!target)
+            target = this.create();
+        target.seconds = PbLong.from(ms / 1000).toString();
+        target.nanos = 0;
+        if (matches[7])
+            target.nanos = (parseInt("1" + matches[7] + "0".repeat(9 - matches[7].length)) - 1000000000);
+        return target;
+    }
+    create(value?: PartialMessage<Timestamp>): Timestamp {
+        const message = { seconds: "0", nanos: 0 };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<Timestamp>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Timestamp): Timestamp {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int64 seconds */ 1:
+                    message.seconds = reader.int64().toString();
+                    break;
+                case /* int32 nanos */ 2:
+                    message.nanos = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Timestamp, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int64 seconds = 1; */
+        if (message.seconds !== "0")
+            writer.tag(1, WireType.Varint).int64(message.seconds);
+        /* int32 nanos = 2; */
+        if (message.nanos !== 0)
+            writer.tag(2, WireType.Varint).int32(message.nanos);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.Timestamp
+ */
+export const Timestamp = new Timestamp$Type();

packages/cache/src/generated/google/protobuf/wrappers.ts

@@ -0,0 +1,753 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "google/protobuf/wrappers.proto" (package "google.protobuf", syntax proto3)
+// tslint:disable
+//
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+//
+// Wrappers for primitive (non-message) types. These types are useful
+// for embedding primitives in the `google.protobuf.Any` type and for places
+// where we need to distinguish between the absence of a primitive
+// typed field and its default value.
+//
+// These wrappers have no meaningful use within repeated fields as they lack
+// the ability to detect presence on individual elements.
+// These wrappers have no meaningful use within a map or a oneof since
+// individual entries of a map or fields of a oneof can already detect presence.
+//
+import { ScalarType } from "@protobuf-ts/runtime";
+import { LongType } from "@protobuf-ts/runtime";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import type { JsonValue } from "@protobuf-ts/runtime";
+import type { JsonReadOptions } from "@protobuf-ts/runtime";
+import type { JsonWriteOptions } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+/**
+ * Wrapper message for `double`.
+ *
+ * The JSON representation for `DoubleValue` is JSON number.
+ *
+ * @generated from protobuf message google.protobuf.DoubleValue
+ */
+export interface DoubleValue {
+    /**
+     * The double value.
+     *
+     * @generated from protobuf field: double value = 1;
+     */
+    value: number;
+}
+/**
+ * Wrapper message for `float`.
+ *
+ * The JSON representation for `FloatValue` is JSON number.
+ *
+ * @generated from protobuf message google.protobuf.FloatValue
+ */
+export interface FloatValue {
+    /**
+     * The float value.
+     *
+     * @generated from protobuf field: float value = 1;
+     */
+    value: number;
+}
+/**
+ * Wrapper message for `int64`.
+ *
+ * The JSON representation for `Int64Value` is JSON string.
+ *
+ * @generated from protobuf message google.protobuf.Int64Value
+ */
+export interface Int64Value {
+    /**
+     * The int64 value.
+     *
+     * @generated from protobuf field: int64 value = 1;
+     */
+    value: string;
+}
+/**
+ * Wrapper message for `uint64`.
+ *
+ * The JSON representation for `UInt64Value` is JSON string.
+ *
+ * @generated from protobuf message google.protobuf.UInt64Value
+ */
+export interface UInt64Value {
+    /**
+     * The uint64 value.
+     *
+     * @generated from protobuf field: uint64 value = 1;
+     */
+    value: string;
+}
+/**
+ * Wrapper message for `int32`.
+ *
+ * The JSON representation for `Int32Value` is JSON number.
+ *
+ * @generated from protobuf message google.protobuf.Int32Value
+ */
+export interface Int32Value {
+    /**
+     * The int32 value.
+     *
+     * @generated from protobuf field: int32 value = 1;
+     */
+    value: number;
+}
+/**
+ * Wrapper message for `uint32`.
+ *
+ * The JSON representation for `UInt32Value` is JSON number.
+ *
+ * @generated from protobuf message google.protobuf.UInt32Value
+ */
+export interface UInt32Value {
+    /**
+     * The uint32 value.
+     *
+     * @generated from protobuf field: uint32 value = 1;
+     */
+    value: number;
+}
+/**
+ * Wrapper message for `bool`.
+ *
+ * The JSON representation for `BoolValue` is JSON `true` and `false`.
+ *
+ * @generated from protobuf message google.protobuf.BoolValue
+ */
+export interface BoolValue {
+    /**
+     * The bool value.
+     *
+     * @generated from protobuf field: bool value = 1;
+     */
+    value: boolean;
+}
+/**
+ * Wrapper message for `string`.
+ *
+ * The JSON representation for `StringValue` is JSON string.
+ *
+ * @generated from protobuf message google.protobuf.StringValue
+ */
+export interface StringValue {
+    /**
+     * The string value.
+     *
+     * @generated from protobuf field: string value = 1;
+     */
+    value: string;
+}
+/**
+ * Wrapper message for `bytes`.
+ *
+ * The JSON representation for `BytesValue` is JSON string.
+ *
+ * @generated from protobuf message google.protobuf.BytesValue
+ */
+export interface BytesValue {
+    /**
+     * The bytes value.
+     *
+     * @generated from protobuf field: bytes value = 1;
+     */
+    value: Uint8Array;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class DoubleValue$Type extends MessageType<DoubleValue> {
+    constructor() {
+        super("google.protobuf.DoubleValue", [
+            { no: 1, name: "value", kind: "scalar", T: 1 /*ScalarType.DOUBLE*/ }
+        ]);
+    }
+    /**
+     * Encode `DoubleValue` to JSON number.
+     */
+    internalJsonWrite(message: DoubleValue, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(2, message.value, "value", false, true);
+    }
+    /**
+     * Decode `DoubleValue` from JSON number.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: DoubleValue): DoubleValue {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 1, undefined, "value") as number;
+        return target;
+    }
+    create(value?: PartialMessage<DoubleValue>): DoubleValue {
+        const message = { value: 0 };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DoubleValue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DoubleValue): DoubleValue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* double value */ 1:
+                    message.value = reader.double();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DoubleValue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* double value = 1; */
+        if (message.value !== 0)
+            writer.tag(1, WireType.Bit64).double(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.DoubleValue
+ */
+export const DoubleValue = new DoubleValue$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class FloatValue$Type extends MessageType<FloatValue> {
+    constructor() {
+        super("google.protobuf.FloatValue", [
+            { no: 1, name: "value", kind: "scalar", T: 2 /*ScalarType.FLOAT*/ }
+        ]);
+    }
+    /**
+     * Encode `FloatValue` to JSON number.
+     */
+    internalJsonWrite(message: FloatValue, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(1, message.value, "value", false, true);
+    }
+    /**
+     * Decode `FloatValue` from JSON number.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: FloatValue): FloatValue {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 1, undefined, "value") as number;
+        return target;
+    }
+    create(value?: PartialMessage<FloatValue>): FloatValue {
+        const message = { value: 0 };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<FloatValue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FloatValue): FloatValue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* float value */ 1:
+                    message.value = reader.float();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: FloatValue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* float value = 1; */
+        if (message.value !== 0)
+            writer.tag(1, WireType.Bit32).float(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.FloatValue
+ */
+export const FloatValue = new FloatValue$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class Int64Value$Type extends MessageType<Int64Value> {
+    constructor() {
+        super("google.protobuf.Int64Value", [
+            { no: 1, name: "value", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    /**
+     * Encode `Int64Value` to JSON string.
+     */
+    internalJsonWrite(message: Int64Value, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(ScalarType.INT64, message.value, "value", false, true);
+    }
+    /**
+     * Decode `Int64Value` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: Int64Value): Int64Value {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, ScalarType.INT64, LongType.STRING, "value") as any;
+        return target;
+    }
+    create(value?: PartialMessage<Int64Value>): Int64Value {
+        const message = { value: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<Int64Value>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Int64Value): Int64Value {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int64 value */ 1:
+                    message.value = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Int64Value, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int64 value = 1; */
+        if (message.value !== "0")
+            writer.tag(1, WireType.Varint).int64(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.Int64Value
+ */
+export const Int64Value = new Int64Value$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UInt64Value$Type extends MessageType<UInt64Value> {
+    constructor() {
+        super("google.protobuf.UInt64Value", [
+            { no: 1, name: "value", kind: "scalar", T: 4 /*ScalarType.UINT64*/ }
+        ]);
+    }
+    /**
+     * Encode `UInt64Value` to JSON string.
+     */
+    internalJsonWrite(message: UInt64Value, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(ScalarType.UINT64, message.value, "value", false, true);
+    }
+    /**
+     * Decode `UInt64Value` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: UInt64Value): UInt64Value {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, ScalarType.UINT64, LongType.STRING, "value") as any;
+        return target;
+    }
+    create(value?: PartialMessage<UInt64Value>): UInt64Value {
+        const message = { value: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<UInt64Value>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UInt64Value): UInt64Value {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* uint64 value */ 1:
+                    message.value = reader.uint64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UInt64Value, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* uint64 value = 1; */
+        if (message.value !== "0")
+            writer.tag(1, WireType.Varint).uint64(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.UInt64Value
+ */
+export const UInt64Value = new UInt64Value$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class Int32Value$Type extends MessageType<Int32Value> {
+    constructor() {
+        super("google.protobuf.Int32Value", [
+            { no: 1, name: "value", kind: "scalar", T: 5 /*ScalarType.INT32*/ }
+        ]);
+    }
+    /**
+     * Encode `Int32Value` to JSON string.
+     */
+    internalJsonWrite(message: Int32Value, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(5, message.value, "value", false, true);
+    }
+    /**
+     * Decode `Int32Value` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: Int32Value): Int32Value {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 5, undefined, "value") as number;
+        return target;
+    }
+    create(value?: PartialMessage<Int32Value>): Int32Value {
+        const message = { value: 0 };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<Int32Value>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Int32Value): Int32Value {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int32 value */ 1:
+                    message.value = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Int32Value, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int32 value = 1; */
+        if (message.value !== 0)
+            writer.tag(1, WireType.Varint).int32(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.Int32Value
+ */
+export const Int32Value = new Int32Value$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UInt32Value$Type extends MessageType<UInt32Value> {
+    constructor() {
+        super("google.protobuf.UInt32Value", [
+            { no: 1, name: "value", kind: "scalar", T: 13 /*ScalarType.UINT32*/ }
+        ]);
+    }
+    /**
+     * Encode `UInt32Value` to JSON string.
+     */
+    internalJsonWrite(message: UInt32Value, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(13, message.value, "value", false, true);
+    }
+    /**
+     * Decode `UInt32Value` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: UInt32Value): UInt32Value {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 13, undefined, "value") as number;
+        return target;
+    }
+    create(value?: PartialMessage<UInt32Value>): UInt32Value {
+        const message = { value: 0 };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<UInt32Value>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UInt32Value): UInt32Value {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* uint32 value */ 1:
+                    message.value = reader.uint32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UInt32Value, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* uint32 value = 1; */
+        if (message.value !== 0)
+            writer.tag(1, WireType.Varint).uint32(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.UInt32Value
+ */
+export const UInt32Value = new UInt32Value$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class BoolValue$Type extends MessageType<BoolValue> {
+    constructor() {
+        super("google.protobuf.BoolValue", [
+            { no: 1, name: "value", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    /**
+     * Encode `BoolValue` to JSON bool.
+     */
+    internalJsonWrite(message: BoolValue, options: JsonWriteOptions): JsonValue {
+        return message.value;
+    }
+    /**
+     * Decode `BoolValue` from JSON bool.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: BoolValue): BoolValue {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 8, undefined, "value") as boolean;
+        return target;
+    }
+    create(value?: PartialMessage<BoolValue>): BoolValue {
+        const message = { value: false };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<BoolValue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BoolValue): BoolValue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool value */ 1:
+                    message.value = reader.bool();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: BoolValue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool value = 1; */
+        if (message.value !== false)
+            writer.tag(1, WireType.Varint).bool(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.BoolValue
+ */
+export const BoolValue = new BoolValue$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class StringValue$Type extends MessageType<StringValue> {
+    constructor() {
+        super("google.protobuf.StringValue", [
+            { no: 1, name: "value", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    /**
+     * Encode `StringValue` to JSON string.
+     */
+    internalJsonWrite(message: StringValue, options: JsonWriteOptions): JsonValue {
+        return message.value;
+    }
+    /**
+     * Decode `StringValue` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: StringValue): StringValue {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 9, undefined, "value") as string;
+        return target;
+    }
+    create(value?: PartialMessage<StringValue>): StringValue {
+        const message = { value: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<StringValue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: StringValue): StringValue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string value */ 1:
+                    message.value = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: StringValue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string value = 1; */
+        if (message.value !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.StringValue
+ */
+export const StringValue = new StringValue$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class BytesValue$Type extends MessageType<BytesValue> {
+    constructor() {
+        super("google.protobuf.BytesValue", [
+            { no: 1, name: "value", kind: "scalar", T: 12 /*ScalarType.BYTES*/ }
+        ]);
+    }
+    /**
+     * Encode `BytesValue` to JSON string.
+     */
+    internalJsonWrite(message: BytesValue, options: JsonWriteOptions): JsonValue {
+        return this.refJsonWriter.scalar(12, message.value, "value", false, true);
+    }
+    /**
+     * Decode `BytesValue` from JSON string.
+     */
+    internalJsonRead(json: JsonValue, options: JsonReadOptions, target?: BytesValue): BytesValue {
+        if (!target)
+            target = this.create();
+        target.value = this.refJsonReader.scalar(json, 12, undefined, "value") as Uint8Array;
+        return target;
+    }
+    create(value?: PartialMessage<BytesValue>): BytesValue {
+        const message = { value: new Uint8Array(0) };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<BytesValue>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: BytesValue): BytesValue {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bytes value */ 1:
+                    message.value = reader.bytes();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: BytesValue, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bytes value = 1; */
+        if (message.value.length)
+            writer.tag(1, WireType.LengthDelimited).bytes(message.value);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message google.protobuf.BytesValue
+ */
+export const BytesValue = new BytesValue$Type();

packages/cache/src/generated/results/api/v1/blobcache.ts

@@ -0,0 +1,513 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "results/api/v1/blobcache.proto" (package "github.actions.results.api.v1", syntax proto3)
+// tslint:disable
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { Timestamp } from "../../../google/protobuf/timestamp";
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobRequest
+ */
+export interface GetCachedBlobRequest {
+    /**
+     * Workflow run backend ID
+     *
+     * @generated from protobuf field: string workflow_run_backend_id = 1;
+     */
+    workflowRunBackendId: string;
+    /**
+     * Workflow job run backend ID
+     *
+     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
+     */
+    workflowJobRunBackendId: string;
+    /**
+     * Key(s) of te blob(s) to be retrieved
+     *
+     * @generated from protobuf field: repeated string keys = 3;
+     */
+    keys: string[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobResponse
+ */
+export interface GetCachedBlobResponse {
+    /**
+     * List of blobs that match the requested keys
+     *
+     * @generated from protobuf field: repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs = 1;
+     */
+    blobs: GetCachedBlobResponse_Blob[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobResponse.Blob
+ */
+export interface GetCachedBlobResponse_Blob {
+    /**
+     * Key of the blob
+     *
+     * @generated from protobuf field: string key = 1;
+     */
+    key: string;
+    /**
+     * Download url for the cached blob
+     *
+     * @generated from protobuf field: string signed_url = 2;
+     */
+    signedUrl: string;
+    /**
+     * Version of the cached blob entry
+     *
+     * @generated from protobuf field: int32 version = 3;
+     */
+    version: number;
+    /**
+     * Checksum of the blob
+     *
+     * @generated from protobuf field: string checksum = 4;
+     */
+    checksum: string;
+    /**
+     * Timestamp for when the blob cache entry expires
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp expires_at = 5;
+     */
+    expiresAt?: Timestamp;
+    /**
+     * Timestamp for when the blob cache entry was created
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 6;
+     */
+    createdAt?: Timestamp;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLRequest
+ */
+export interface GetCacheBlobUploadURLRequest {
+    /**
+     * Workflow run backend ID
+     *
+     * @generated from protobuf field: string workflow_run_backend_id = 1;
+     */
+    workflowRunBackendId: string;
+    /**
+     * Workflow job run backend ID
+     *
+     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
+     */
+    workflowJobRunBackendId: string;
+    /**
+     * / Owner of the blob(s) to be retrieved
+     *
+     * @generated from protobuf field: string organization = 3;
+     */
+    organization: string;
+    /**
+     * Key(s) of te blob(s) to be retrieved
+     *
+     * @generated from protobuf field: repeated string keys = 4;
+     */
+    keys: string[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse
+ */
+export interface GetCacheBlobUploadURLResponse {
+    /**
+     * List of upload URLs that match the requested keys
+     *
+     * @generated from protobuf field: repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls = 1;
+     */
+    urls: GetCacheBlobUploadURLResponse_Url[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url
+ */
+export interface GetCacheBlobUploadURLResponse_Url {
+    /**
+     * Key of the blob
+     *
+     * @generated from protobuf field: string key = 1;
+     */
+    key: string;
+    /**
+     * URL to the blob
+     *
+     * @generated from protobuf field: string url = 2;
+     */
+    url: string;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCachedBlobRequest$Type extends MessageType<GetCachedBlobRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCachedBlobRequest", [
+            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetCachedBlobRequest>): GetCachedBlobRequest {
+        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", keys: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCachedBlobRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobRequest): GetCachedBlobRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string workflow_run_backend_id */ 1:
+                    message.workflowRunBackendId = reader.string();
+                    break;
+                case /* string workflow_job_run_backend_id */ 2:
+                    message.workflowJobRunBackendId = reader.string();
+                    break;
+                case /* repeated string keys */ 3:
+                    message.keys.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCachedBlobRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string workflow_run_backend_id = 1; */
+        if (message.workflowRunBackendId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
+        /* string workflow_job_run_backend_id = 2; */
+        if (message.workflowJobRunBackendId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
+        /* repeated string keys = 3; */
+        for (let i = 0; i < message.keys.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.keys[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobRequest
+ */
+export const GetCachedBlobRequest = new GetCachedBlobRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCachedBlobResponse$Type extends MessageType<GetCachedBlobResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCachedBlobResponse", [
+            { no: 1, name: "blobs", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => GetCachedBlobResponse_Blob }
+        ]);
+    }
+    create(value?: PartialMessage<GetCachedBlobResponse>): GetCachedBlobResponse {
+        const message = { blobs: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCachedBlobResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobResponse): GetCachedBlobResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs */ 1:
+                    message.blobs.push(GetCachedBlobResponse_Blob.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCachedBlobResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs = 1; */
+        for (let i = 0; i < message.blobs.length; i++)
+            GetCachedBlobResponse_Blob.internalBinaryWrite(message.blobs[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobResponse
+ */
+export const GetCachedBlobResponse = new GetCachedBlobResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCachedBlobResponse_Blob$Type extends MessageType<GetCachedBlobResponse_Blob> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCachedBlobResponse.Blob", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "signed_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "version", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 4, name: "checksum", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "expires_at", kind: "message", T: () => Timestamp },
+            { no: 6, name: "created_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<GetCachedBlobResponse_Blob>): GetCachedBlobResponse_Blob {
+        const message = { key: "", signedUrl: "", version: 0, checksum: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCachedBlobResponse_Blob>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobResponse_Blob): GetCachedBlobResponse_Blob {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string key */ 1:
+                    message.key = reader.string();
+                    break;
+                case /* string signed_url */ 2:
+                    message.signedUrl = reader.string();
+                    break;
+                case /* int32 version */ 3:
+                    message.version = reader.int32();
+                    break;
+                case /* string checksum */ 4:
+                    message.checksum = reader.string();
+                    break;
+                case /* google.protobuf.Timestamp expires_at */ 5:
+                    message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 6:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCachedBlobResponse_Blob, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string key = 1; */
+        if (message.key !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.key);
+        /* string signed_url = 2; */
+        if (message.signedUrl !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.signedUrl);
+        /* int32 version = 3; */
+        if (message.version !== 0)
+            writer.tag(3, WireType.Varint).int32(message.version);
+        /* string checksum = 4; */
+        if (message.checksum !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.checksum);
+        /* google.protobuf.Timestamp expires_at = 5; */
+        if (message.expiresAt)
+            Timestamp.internalBinaryWrite(message.expiresAt, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp created_at = 6; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobResponse.Blob
+ */
+export const GetCachedBlobResponse_Blob = new GetCachedBlobResponse_Blob$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCacheBlobUploadURLRequest$Type extends MessageType<GetCacheBlobUploadURLRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCacheBlobUploadURLRequest", [
+            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "organization", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetCacheBlobUploadURLRequest>): GetCacheBlobUploadURLRequest {
+        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", organization: "", keys: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCacheBlobUploadURLRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLRequest): GetCacheBlobUploadURLRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string workflow_run_backend_id */ 1:
+                    message.workflowRunBackendId = reader.string();
+                    break;
+                case /* string workflow_job_run_backend_id */ 2:
+                    message.workflowJobRunBackendId = reader.string();
+                    break;
+                case /* string organization */ 3:
+                    message.organization = reader.string();
+                    break;
+                case /* repeated string keys */ 4:
+                    message.keys.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCacheBlobUploadURLRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string workflow_run_backend_id = 1; */
+        if (message.workflowRunBackendId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
+        /* string workflow_job_run_backend_id = 2; */
+        if (message.workflowJobRunBackendId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
+        /* string organization = 3; */
+        if (message.organization !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.organization);
+        /* repeated string keys = 4; */
+        for (let i = 0; i < message.keys.length; i++)
+            writer.tag(4, WireType.LengthDelimited).string(message.keys[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLRequest
+ */
+export const GetCacheBlobUploadURLRequest = new GetCacheBlobUploadURLRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCacheBlobUploadURLResponse$Type extends MessageType<GetCacheBlobUploadURLResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCacheBlobUploadURLResponse", [
+            { no: 1, name: "urls", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => GetCacheBlobUploadURLResponse_Url }
+        ]);
+    }
+    create(value?: PartialMessage<GetCacheBlobUploadURLResponse>): GetCacheBlobUploadURLResponse {
+        const message = { urls: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCacheBlobUploadURLResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLResponse): GetCacheBlobUploadURLResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls */ 1:
+                    message.urls.push(GetCacheBlobUploadURLResponse_Url.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCacheBlobUploadURLResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls = 1; */
+        for (let i = 0; i < message.urls.length; i++)
+            GetCacheBlobUploadURLResponse_Url.internalBinaryWrite(message.urls[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse
+ */
+export const GetCacheBlobUploadURLResponse = new GetCacheBlobUploadURLResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCacheBlobUploadURLResponse_Url$Type extends MessageType<GetCacheBlobUploadURLResponse_Url> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "url", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetCacheBlobUploadURLResponse_Url>): GetCacheBlobUploadURLResponse_Url {
+        const message = { key: "", url: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCacheBlobUploadURLResponse_Url>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLResponse_Url): GetCacheBlobUploadURLResponse_Url {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string key */ 1:
+                    message.key = reader.string();
+                    break;
+                case /* string url */ 2:
+                    message.url = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCacheBlobUploadURLResponse_Url, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string key = 1; */
+        if (message.key !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.key);
+        /* string url = 2; */
+        if (message.url !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.url);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url
+ */
+export const GetCacheBlobUploadURLResponse_Url = new GetCacheBlobUploadURLResponse_Url$Type();
+/**
+ * @generated ServiceType for protobuf service github.actions.results.api.v1.BlobCacheService
+ */
+export const BlobCacheService = new ServiceType("github.actions.results.api.v1.BlobCacheService", [
+    { name: "GetCachedBlob", options: {}, I: GetCachedBlobRequest, O: GetCachedBlobResponse },
+    { name: "GetCacheBlobUploadURL", options: {}, I: GetCacheBlobUploadURLRequest, O: GetCacheBlobUploadURLResponse }
+]);

packages/cache/src/generated/results/api/v1/blobcache.twirp.ts

@@ -0,0 +1,433 @@
+import {
+  TwirpContext,
+  TwirpServer,
+  RouterEvents,
+  TwirpError,
+  TwirpErrorCode,
+  Interceptor,
+  TwirpContentType,
+  chainInterceptors,
+} from "twirp-ts";
+import {
+  GetCachedBlobRequest,
+  GetCachedBlobResponse,
+  GetCacheBlobUploadURLRequest,
+  GetCacheBlobUploadURLResponse,
+} from "./blobcache";
+
+//==================================//
+//          Client Code             //
+//==================================//
+
+interface Rpc {
+  request(
+    service: string,
+    method: string,
+    contentType: "application/json" | "application/protobuf",
+    data: object | Uint8Array
+  ): Promise<object | Uint8Array>;
+}
+
+export interface BlobCacheServiceClient {
+  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse>;
+  GetCacheBlobUploadURL(
+    request: GetCacheBlobUploadURLRequest
+  ): Promise<GetCacheBlobUploadURLResponse>;
+}
+
+export class BlobCacheServiceClientJSON implements BlobCacheServiceClient {
+  private readonly rpc: Rpc;
+  constructor(rpc: Rpc) {
+    this.rpc = rpc;
+    this.GetCachedBlob.bind(this);
+    this.GetCacheBlobUploadURL.bind(this);
+  }
+  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse> {
+    const data = GetCachedBlobRequest.toJson(request, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    });
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.BlobCacheService",
+      "GetCachedBlob",
+      "application/json",
+      data as object
+    );
+    return promise.then((data) =>
+      GetCachedBlobResponse.fromJson(data as any, { ignoreUnknownFields: true })
+    );
+  }
+
+  GetCacheBlobUploadURL(
+    request: GetCacheBlobUploadURLRequest
+  ): Promise<GetCacheBlobUploadURLResponse> {
+    const data = GetCacheBlobUploadURLRequest.toJson(request, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    });
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.BlobCacheService",
+      "GetCacheBlobUploadURL",
+      "application/json",
+      data as object
+    );
+    return promise.then((data) =>
+      GetCacheBlobUploadURLResponse.fromJson(data as any, {
+        ignoreUnknownFields: true,
+      })
+    );
+  }
+}
+
+export class BlobCacheServiceClientProtobuf implements BlobCacheServiceClient {
+  private readonly rpc: Rpc;
+  constructor(rpc: Rpc) {
+    this.rpc = rpc;
+    this.GetCachedBlob.bind(this);
+    this.GetCacheBlobUploadURL.bind(this);
+  }
+  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse> {
+    const data = GetCachedBlobRequest.toBinary(request);
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.BlobCacheService",
+      "GetCachedBlob",
+      "application/protobuf",
+      data
+    );
+    return promise.then((data) =>
+      GetCachedBlobResponse.fromBinary(data as Uint8Array)
+    );
+  }
+
+  GetCacheBlobUploadURL(
+    request: GetCacheBlobUploadURLRequest
+  ): Promise<GetCacheBlobUploadURLResponse> {
+    const data = GetCacheBlobUploadURLRequest.toBinary(request);
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.BlobCacheService",
+      "GetCacheBlobUploadURL",
+      "application/protobuf",
+      data
+    );
+    return promise.then((data) =>
+      GetCacheBlobUploadURLResponse.fromBinary(data as Uint8Array)
+    );
+  }
+}
+
+//==================================//
+//          Server Code             //
+//==================================//
+
+export interface BlobCacheServiceTwirp<T extends TwirpContext = TwirpContext> {
+  GetCachedBlob(
+    ctx: T,
+    request: GetCachedBlobRequest
+  ): Promise<GetCachedBlobResponse>;
+  GetCacheBlobUploadURL(
+    ctx: T,
+    request: GetCacheBlobUploadURLRequest
+  ): Promise<GetCacheBlobUploadURLResponse>;
+}
+
+export enum BlobCacheServiceMethod {
+  GetCachedBlob = "GetCachedBlob",
+  GetCacheBlobUploadURL = "GetCacheBlobUploadURL",
+}
+
+export const BlobCacheServiceMethodList = [
+  BlobCacheServiceMethod.GetCachedBlob,
+  BlobCacheServiceMethod.GetCacheBlobUploadURL,
+];
+
+export function createBlobCacheServiceServer<
+  T extends TwirpContext = TwirpContext
+>(service: BlobCacheServiceTwirp<T>) {
+  return new TwirpServer<BlobCacheServiceTwirp, T>({
+    service,
+    packageName: "github.actions.results.api.v1",
+    serviceName: "BlobCacheService",
+    methodList: BlobCacheServiceMethodList,
+    matchRoute: matchBlobCacheServiceRoute,
+  });
+}
+
+function matchBlobCacheServiceRoute<T extends TwirpContext = TwirpContext>(
+  method: string,
+  events: RouterEvents<T>
+) {
+  switch (method) {
+    case "GetCachedBlob":
+      return async (
+        ctx: T,
+        service: BlobCacheServiceTwirp,
+        data: Buffer,
+        interceptors?: Interceptor<
+          T,
+          GetCachedBlobRequest,
+          GetCachedBlobResponse
+        >[]
+      ) => {
+        ctx = { ...ctx, methodName: "GetCachedBlob" };
+        await events.onMatch(ctx);
+        return handleBlobCacheServiceGetCachedBlobRequest(
+          ctx,
+          service,
+          data,
+          interceptors
+        );
+      };
+    case "GetCacheBlobUploadURL":
+      return async (
+        ctx: T,
+        service: BlobCacheServiceTwirp,
+        data: Buffer,
+        interceptors?: Interceptor<
+          T,
+          GetCacheBlobUploadURLRequest,
+          GetCacheBlobUploadURLResponse
+        >[]
+      ) => {
+        ctx = { ...ctx, methodName: "GetCacheBlobUploadURL" };
+        await events.onMatch(ctx);
+        return handleBlobCacheServiceGetCacheBlobUploadURLRequest(
+          ctx,
+          service,
+          data,
+          interceptors
+        );
+      };
+    default:
+      events.onNotFound();
+      const msg = `no handler found`;
+      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
+  }
+}
+
+function handleBlobCacheServiceGetCachedBlobRequest<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
+): Promise<string | Uint8Array> {
+  switch (ctx.contentType) {
+    case TwirpContentType.JSON:
+      return handleBlobCacheServiceGetCachedBlobJSON<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    case TwirpContentType.Protobuf:
+      return handleBlobCacheServiceGetCachedBlobProtobuf<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    default:
+      const msg = "unexpected Content-Type";
+      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
+  }
+}
+
+function handleBlobCacheServiceGetCacheBlobUploadURLRequest<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<
+    T,
+    GetCacheBlobUploadURLRequest,
+    GetCacheBlobUploadURLResponse
+  >[]
+): Promise<string | Uint8Array> {
+  switch (ctx.contentType) {
+    case TwirpContentType.JSON:
+      return handleBlobCacheServiceGetCacheBlobUploadURLJSON<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    case TwirpContentType.Protobuf:
+      return handleBlobCacheServiceGetCacheBlobUploadURLProtobuf<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    default:
+      const msg = "unexpected Content-Type";
+      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
+  }
+}
+async function handleBlobCacheServiceGetCachedBlobJSON<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
+) {
+  let request: GetCachedBlobRequest;
+  let response: GetCachedBlobResponse;
+
+  try {
+    const body = JSON.parse(data.toString() || "{}");
+    request = GetCachedBlobRequest.fromJson(body, {
+      ignoreUnknownFields: true,
+    });
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the json request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      GetCachedBlobRequest,
+      GetCachedBlobResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.GetCachedBlob(ctx, inputReq);
+    });
+  } else {
+    response = await service.GetCachedBlob(ctx, request!);
+  }
+
+  return JSON.stringify(
+    GetCachedBlobResponse.toJson(response, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    }) as string
+  );
+}
+
+async function handleBlobCacheServiceGetCacheBlobUploadURLJSON<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<
+    T,
+    GetCacheBlobUploadURLRequest,
+    GetCacheBlobUploadURLResponse
+  >[]
+) {
+  let request: GetCacheBlobUploadURLRequest;
+  let response: GetCacheBlobUploadURLResponse;
+
+  try {
+    const body = JSON.parse(data.toString() || "{}");
+    request = GetCacheBlobUploadURLRequest.fromJson(body, {
+      ignoreUnknownFields: true,
+    });
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the json request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      GetCacheBlobUploadURLRequest,
+      GetCacheBlobUploadURLResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.GetCacheBlobUploadURL(ctx, inputReq);
+    });
+  } else {
+    response = await service.GetCacheBlobUploadURL(ctx, request!);
+  }
+
+  return JSON.stringify(
+    GetCacheBlobUploadURLResponse.toJson(response, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    }) as string
+  );
+}
+async function handleBlobCacheServiceGetCachedBlobProtobuf<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
+) {
+  let request: GetCachedBlobRequest;
+  let response: GetCachedBlobResponse;
+
+  try {
+    request = GetCachedBlobRequest.fromBinary(data);
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the protobuf request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      GetCachedBlobRequest,
+      GetCachedBlobResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.GetCachedBlob(ctx, inputReq);
+    });
+  } else {
+    response = await service.GetCachedBlob(ctx, request!);
+  }
+
+  return Buffer.from(GetCachedBlobResponse.toBinary(response));
+}
+
+async function handleBlobCacheServiceGetCacheBlobUploadURLProtobuf<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: BlobCacheServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<
+    T,
+    GetCacheBlobUploadURLRequest,
+    GetCacheBlobUploadURLResponse
+  >[]
+) {
+  let request: GetCacheBlobUploadURLRequest;
+  let response: GetCacheBlobUploadURLResponse;
+
+  try {
+    request = GetCacheBlobUploadURLRequest.fromBinary(data);
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the protobuf request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      GetCacheBlobUploadURLRequest,
+      GetCacheBlobUploadURLResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.GetCacheBlobUploadURL(ctx, inputReq);
+    });
+  } else {
+    response = await service.GetCacheBlobUploadURL(ctx, request!);
+  }
+
+  return Buffer.from(GetCacheBlobUploadURLResponse.toBinary(response));
+}

packages/cache/src/internal/cacheHttpClient.ts

@@ -36,11 +36,12 @@ import {
   retryHttpClientResponse,
   retryTypedResponse
 } from './requestUtils'
+import {CacheUrl} from './constants'
 
 const versionSalt = '1.0'
 
 function getCacheApiUrl(resource: string): string {
-  const baseUrl: string = process.env['ACTIONS_CACHE_URL'] || ''
+  const baseUrl: string = CacheUrl || ''
   if (!baseUrl) {
     throw new Error('Cache Service Url not found, unable to restore cache.')
   }
@@ -111,6 +112,7 @@ export async function getCacheEntry(
     options?.compressionMethod,
     options?.enableCrossOsArchive
   )
+  
   const resource = `cache?keys=${encodeURIComponent(
     keys.join(',')
   )}&version=${version}`

packages/cache/src/internal/cacheTwirpClient.ts

@@ -0,0 +1,197 @@
+import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
+import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
+import {info, debug} from '@actions/core'
+import {BlobCacheServiceClientJSON} from '../generated/results/api/v1/blobcache.twirp'
+import {CacheUrl} from './constants'
+import {getRuntimeToken} from './config'
+// import {getUserAgentString} from './user-agent'
+// import {NetworkError, UsageError} from './errors'
+
+// The twirp http client must implement this interface
+interface Rpc {
+  request(
+    service: string,
+    method: string,
+    contentType: 'application/json' | 'application/protobuf',
+    data: object | Uint8Array
+  ): Promise<object | Uint8Array>
+}
+
+class BlobCacheServiceClient implements Rpc {
+  private httpClient: HttpClient
+  private baseUrl: string
+  private maxAttempts = 5
+  private baseRetryIntervalMilliseconds = 3000
+  private retryMultiplier = 1.5
+
+  constructor(
+    userAgent: string,
+    maxAttempts?: number,
+    baseRetryIntervalMilliseconds?: number,
+    retryMultiplier?: number
+  ) {
+    const token = getRuntimeToken()
+    this.baseUrl = CacheUrl
+    if (maxAttempts) {
+      this.maxAttempts = maxAttempts
+    }
+    if (baseRetryIntervalMilliseconds) {
+      this.baseRetryIntervalMilliseconds = baseRetryIntervalMilliseconds
+    }
+    if (retryMultiplier) {
+      this.retryMultiplier = retryMultiplier
+    }
+
+    this.httpClient = new HttpClient(userAgent, [
+      new BearerCredentialHandler(token)
+    ])
+  }
+
+  // This function satisfies the Rpc interface. It is compatible with the JSON
+  // JSON generated client.
+  async request(
+    service: string,
+    method: string,
+    contentType: 'application/json' | 'application/protobuf',
+    data: object | Uint8Array
+  ): Promise<object | Uint8Array> {
+    const url = new URL(`/twirp/${service}/${method}`, this.baseUrl).href
+    debug(`[Request] ${method} ${url}`)
+    const headers = {
+      'Content-Type': contentType
+    }
+    try {
+      const {body} = await this.retryableRequest(async () =>
+        this.httpClient.post(url, JSON.stringify(data), headers)
+      )
+
+      return body
+    } catch (error) {
+      throw new Error(`Failed to ${method}: ${error.message}`)
+    }
+  }
+
+  async retryableRequest(
+    operation: () => Promise<HttpClientResponse>
+  ): Promise<{response: HttpClientResponse; body: object}> {
+    let attempt = 0
+    let errorMessage = ''
+    let rawBody = ''
+    while (attempt < this.maxAttempts) {
+      let isRetryable = false
+
+      try {
+        const response = await operation()
+        const statusCode = response.message.statusCode
+        rawBody = await response.readBody()
+        debug(`[Response] - ${response.message.statusCode}`)
+        debug(`Headers: ${JSON.stringify(response.message.headers, null, 2)}`)
+        const body = JSON.parse(rawBody)
+        debug(`Body: ${JSON.stringify(body, null, 2)}`)
+        if (this.isSuccessStatusCode(statusCode)) {
+          return {response, body}
+        }
+        isRetryable = this.isRetryableHttpStatusCode(statusCode)
+        errorMessage = `Failed request: (${statusCode}) ${response.message.statusMessage}`
+        if (body.msg) {
+        //   if (UsageError.isUsageErrorMessage(body.msg)) {
+        //     throw new UsageError()
+        //   }
+
+          errorMessage = `${errorMessage}: ${body.msg}`
+        }
+      } catch (error) {
+        if (error instanceof SyntaxError) {
+          debug(`Raw Body: ${rawBody}`)
+        }
+
+        // if (error instanceof UsageError) {
+        //   throw error
+        // }
+
+        // if (NetworkError.isNetworkErrorCode(error?.code)) {
+        //   throw new NetworkError(error?.code)
+        // }
+
+        isRetryable = true
+        errorMessage = error.message
+      }
+
+      if (!isRetryable) {
+        throw new Error(`Received non-retryable error: ${errorMessage}`)
+      }
+
+      if (attempt + 1 === this.maxAttempts) {
+        throw new Error(
+          `Failed to make request after ${this.maxAttempts} attempts: ${errorMessage}`
+        )
+      }
+
+      const retryTimeMilliseconds =
+        this.getExponentialRetryTimeMilliseconds(attempt)
+      info(
+        `Attempt ${attempt + 1} of ${
+          this.maxAttempts
+        } failed with error: ${errorMessage}. Retrying request in ${retryTimeMilliseconds} ms...`
+      )
+      await this.sleep(retryTimeMilliseconds)
+      attempt++
+    }
+
+    throw new Error(`Request failed`)
+  }
+
+  isSuccessStatusCode(statusCode?: number): boolean {
+    if (!statusCode) return false
+    return statusCode >= 200 && statusCode < 300
+  }
+
+  isRetryableHttpStatusCode(statusCode?: number): boolean {
+    if (!statusCode) return false
+
+    const retryableStatusCodes = [
+      HttpCodes.BadGateway,
+      HttpCodes.GatewayTimeout,
+      HttpCodes.InternalServerError,
+      HttpCodes.ServiceUnavailable,
+      HttpCodes.TooManyRequests
+    ]
+
+    return retryableStatusCodes.includes(statusCode)
+  }
+
+  async sleep(milliseconds: number): Promise<void> {
+    return new Promise(resolve => setTimeout(resolve, milliseconds))
+  }
+
+  getExponentialRetryTimeMilliseconds(attempt: number): number {
+    if (attempt < 0) {
+      throw new Error('attempt should be a positive integer')
+    }
+
+    if (attempt === 0) {
+      return this.baseRetryIntervalMilliseconds
+    }
+
+    const minTime =
+      this.baseRetryIntervalMilliseconds * this.retryMultiplier ** attempt
+    const maxTime = minTime * this.retryMultiplier
+
+    // returns a random number between minTime and maxTime (exclusive)
+    return Math.trunc(Math.random() * (maxTime - minTime) + minTime)
+  }
+}
+
+export function internalBlobCacheTwirpClient(options?: {
+  maxAttempts?: number
+  retryIntervalMs?: number
+  retryMultiplier?: number
+}): BlobCacheServiceClientJSON {
+  const client = new BlobCacheServiceClient(
+    'actions/cache',
+    options?.maxAttempts,
+    options?.retryIntervalMs,
+    options?.retryMultiplier
+  )
+  return new BlobCacheServiceClientJSON(client)
+}

packages/cache/src/internal/cacheUtils.ts

@@ -135,5 +135,11 @@ export function isGhes(): boolean {
   const ghUrl = new URL(
     process.env['GITHUB_SERVER_URL'] || 'https://github.com'
   )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost =
+    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost
 }

packages/cache/src/internal/config.ts

@@ -0,0 +1,7 @@
+export function getRuntimeToken(): string {
+  const token = process.env['ACTIONS_RUNTIME_TOKEN']
+  if (!token) {
+    throw new Error('Unable to get the ACTIONS_RUNTIME_TOKEN env variable')
+  }
+  return token
+}

packages/cache/src/internal/constants.ts

@@ -36,3 +36,7 @@ export const SystemTarPathOnWindows = `${process.env['SYSTEMDRIVE']}\\Windows\\S
 export const TarFilename = 'cache.tar'
 
 export const ManifestFilename = 'manifest.txt'
+
+// Cache Service Metadata
+export const CacheUrl = `${process.env['ACTIONS_CACHE_URL_NEXT']} || ${process.env['ACTIONS_CACHE_URL']}`
+export const CacheServiceVersion = `${process.env['ACTIONS_CACHE_URL_NEXT'] ? 'v2' : 'v1'}`

packages/cache/src/internal/v2/download-cache.ts

@@ -0,0 +1,68 @@
+import * as core from '@actions/core'
+import * as httpClient from '@actions/http-client'
+import unzip from 'unzip-stream'
+const packageJson = require('../../../package.json')
+
+export async function StreamExtract(url: string, directory: string): Promise<void> {
+    let retryCount = 0
+    while (retryCount < 5) {
+      try {
+        await streamExtractExternal(url, directory)
+        return
+      } catch (error) {
+        retryCount++
+        core.info(
+          `Failed to download cache after ${retryCount} retries due to ${error.message}. Retrying in 5 seconds...`
+        )
+        // wait 5 seconds before retrying
+        await new Promise(resolve => setTimeout(resolve, 5000))
+      }
+    }
+
+    throw new Error(`Cache download failed after ${retryCount} retries.`)
+}
+
+export async function streamExtractExternal(
+    url: string,
+    directory: string
+  ): Promise<void> {
+    const client = new httpClient.HttpClient(`@actions/cache-${packageJson.version}`)
+    const response = await client.get(url)
+    if (response.message.statusCode !== 200) {
+      core.info(`Failed to download cache. HTTP status code: ${response.message.statusCode}`)
+      throw new Error(
+        `Unexpected HTTP response from blob storage: ${response.message.statusCode} ${response.message.statusMessage}`
+      )
+    }
+  
+    const timeout = 30 * 1000 // 30 seconds
+  
+    return new Promise((resolve, reject) => {
+      const timerFn = (): void => {
+        response.message.destroy(
+          new Error(`Blob storage chunk did not respond in ${timeout}ms`)
+        )
+      }
+      const timer = setTimeout(timerFn, timeout)
+  
+      response.message
+        .on('data', () => {
+          timer.refresh()
+        })
+        .on('error', (error: Error) => {
+          core.info(
+            `response.message: Cache download failed: ${error.message}`
+          )
+          clearTimeout(timer)
+          reject(error)
+        })
+        .pipe(unzip.Extract({path: directory}))
+        .on('close', () => {
+          clearTimeout(timer)
+          resolve()
+        })
+        .on('error', (error: Error) => {
+          reject(error)
+        })
+    })
+  }

packages/cache/src/internal/v2/upload-cache.ts

@@ -0,0 +1,130 @@
+import * as core from '@actions/core'
+import {GetCacheBlobUploadURLResponse} from '../../generated/results/api/v1/blobcache'
+import {ZipUploadStream} from '@actions/artifact/lib/internal/upload/zip'
+import {NetworkError} from '@actions/artifact/'
+import {TransferProgressEvent} from '@azure/core-http'
+import * as stream from 'stream'
+import * as crypto from 'crypto'
+import {
+  BlobClient, 
+  BlockBlobClient, 
+  BlockBlobUploadStreamOptions,
+  BlockBlobParallelUploadOptions
+} from '@azure/storage-blob'
+
+export async function UploadCacheStream(
+  signedUploadURL: string,
+  zipUploadStream: ZipUploadStream
+): Promise<{}> {
+  let uploadByteCount = 0
+  let lastProgressTime = Date.now()
+  let timeoutId: NodeJS.Timeout | undefined
+
+  const chunkTimer = (timeout: number): NodeJS.Timeout => {
+    // clear the previous timeout
+    if (timeoutId) {
+      clearTimeout(timeoutId)
+    }
+
+    timeoutId = setTimeout(() => {
+      const now = Date.now()
+      // if there's been more than 30 seconds since the
+      // last progress event, then we'll consider the upload stalled
+      if (now - lastProgressTime > timeout) {
+        throw new Error('Upload progress stalled.')
+      }
+    }, timeout)
+    return timeoutId
+  }
+
+  const maxConcurrency = 32
+  const bufferSize = 8 * 1024 * 1024 // 8 MB Chunks
+  const blobClient = new BlobClient(signedUploadURL)
+  const blockBlobClient = blobClient.getBlockBlobClient()
+  const timeoutDuration = 300000 // 30 seconds
+
+  core.debug(
+    `Uploading cache zip to blob storage with maxConcurrency: ${maxConcurrency}, bufferSize: ${bufferSize}`
+  )
+
+  const uploadCallback = (progress: TransferProgressEvent): void => {
+    core.info(`Uploaded bytes ${progress.loadedBytes}`)
+    uploadByteCount = progress.loadedBytes
+    chunkTimer(timeoutDuration)
+    lastProgressTime = Date.now()
+  }
+
+  const options: BlockBlobUploadStreamOptions = {
+    blobHTTPHeaders: {blobContentType: 'zip'},
+    onProgress: uploadCallback
+  }
+
+  let sha256Hash: string | undefined = undefined
+  const uploadStream = new stream.PassThrough()
+  const hashStream = crypto.createHash('sha256')
+
+  zipUploadStream.pipe(uploadStream) // This stream is used for the upload
+  zipUploadStream.pipe(hashStream).setEncoding('hex') // This stream is used to compute a hash of the zip content that gets used. Integrity check
+
+  core.info('Beginning upload of cache to blob storage')
+  try {
+    // Start the chunk timer
+    timeoutId = chunkTimer(timeoutDuration)
+    await blockBlobClient.uploadStream(
+      uploadStream,
+      bufferSize,
+      maxConcurrency,
+      options
+    )
+  } catch (error) {
+    if (NetworkError.isNetworkErrorCode(error?.code)) {
+      throw new NetworkError(error?.code)
+    }
+    throw error
+  } finally {
+    // clear the timeout whether or not the upload completes
+    if (timeoutId) {
+      clearTimeout(timeoutId)
+    }
+  }
+
+  core.info('Finished uploading cache content to blob storage!')
+  
+  hashStream.end()
+  sha256Hash = hashStream.read() as string
+  core.info(`SHA256 hash of uploaded artifact zip is ${sha256Hash}`)
+  core.info(`Uploaded: ${uploadByteCount} bytes`)
+
+  if (uploadByteCount === 0) {
+    core.error(
+      `No data was uploaded to blob storage. Reported upload byte count is 0.`
+    )
+  }
+  return {
+    uploadSize: uploadByteCount,
+    sha256Hash
+  }
+}
+
+export async function UploadCacheFile(
+  uploadURL: GetCacheBlobUploadURLResponse,
+  archivePath: string,
+): Promise<{}> {
+  core.info(`Uploading ${archivePath} to: ${JSON.stringify(uploadURL)}`)
+  
+  // Specify data transfer options
+  const uploadOptions: BlockBlobParallelUploadOptions = {
+    blockSize: 4 * 1024 * 1024, // 4 MiB max block size
+    concurrency: 2, // maximum number of parallel transfer workers
+    maxSingleShotSize: 8 * 1024 * 1024, // 8 MiB initial transfer size
+  };
+
+  // const blobClient: BlobClient = new BlobClient(uploadURL.urls[0])
+  const blobClient: BlobClient = new BlobClient(uploadURL.urls[0].url)
+  const blockBlobClient: BlockBlobClient = blobClient.getBlockBlobClient()
+
+  core.info(`BlobClient: ${JSON.stringify(blobClient)}`)
+  core.info(`blockBlobClient: ${JSON.stringify(blockBlobClient)}`)
+
+  return blockBlobClient.uploadFile(archivePath, uploadOptions);
+}

packages/http-client/__tests__/keepalive.test.ts

@@ -11,6 +11,12 @@ describe('basics', () => {
     _http.dispose()
   })
 
+  it.each([true, false])('creates Agent with keepAlive %s', keepAlive => {
+    const http = new httpm.HttpClient('http-client-tests', [], {keepAlive})
+    const agent = http.getAgent('http://postman-echo.com')
+    expect(agent).toHaveProperty('keepAlive', keepAlive)
+  })
+
   it('does basic http get request with keepAlive true', async () => {
     const res: httpm.HttpClientResponse = await _http.get(
       'http://postman-echo.com/get'

packages/http-client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/http-client",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/http-client",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",

packages/http-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/http-client",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Actions Http Client",
   "keywords": [
     "github",
@@ -48,4 +48,4 @@
     "tunnel": "^0.0.6",
     "undici": "^5.25.4"
   }
-}
+}

packages/http-client/src/index.ts

@@ -649,7 +649,7 @@ export class HttpClient {
       agent = this._proxyAgent
     }
 
-    if (this._keepAlive && !useProxy) {
+    if (!useProxy) {
       agent = this._agent
     }
 
@@ -690,18 +690,13 @@ export class HttpClient {
       this._proxyAgent = agent
     }
 
-    // if reusing agent across request and tunneling agent isn't assigned create a new agent
-    if (this._keepAlive && !agent) {
+    // if tunneling agent isn't assigned create a new agent
+    if (!agent) {
       const options = {keepAlive: this._keepAlive, maxSockets}
       agent = usingSsl ? new https.Agent(options) : new http.Agent(options)
       this._agent = agent
     }
 
-    // if not using private agent and tunnel agent isn't setup then use global agent
-    if (!agent) {
-      agent = usingSsl ? https.globalAgent : http.globalAgent
-    }
-
     if (usingSsl && this._ignoreSslError) {
       // we don't want to set NODE_TLS_REJECT_UNAUTHORIZED=0 since that will affect request for entire process
       // http.RequestOptions doesn't expose a way to modify RequestOptions.agent.options