@cursor/july 0.1.1

package/dist/channels/github/api.d.ts

@@ -0,0 +1,101 @@
+/**
+ * GitHub REST helpers backed by `@octokit/rest`.
+ *
+ * Channel hooks should prefer `ctx.github` / `ctx.thread`. Use
+ * {@link createGitHubOctokit} (or `ctx.github.getOctokit()`) when you need
+ * typed Octokit methods directly.
+ */
+import { Octokit } from "@octokit/rest";
+import { type GitHubAuthApiOptions } from "./auth.js";
+import type { GitHubChannelCredentials } from "./types.js";
+export type GitHubJsonObject = Record<string, unknown>;
+export type GitHubApiMethod = "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
+export interface GitHubApiOptions extends GitHubAuthApiOptions {
+}
+export interface GitHubApiResponse<T = unknown> {
+    body: T;
+    ok: boolean;
+    status: number;
+}
+export declare class GitHubApiError extends Error {
+    readonly body: unknown;
+    readonly method: string;
+    readonly path: string;
+    readonly status: number;
+    constructor(input: {
+        body: unknown;
+        method: string;
+        path: string;
+        status: number;
+    });
+}
+export interface GitHubPostedComment {
+    htmlUrl: string | undefined;
+    id: number;
+    raw: unknown;
+    url: string | undefined;
+}
+export type GitHubReactionContent = "+1" | "-1" | "confused" | "eyes" | "heart" | "hooray" | "laugh" | "rocket";
+interface GitHubResourceInput {
+    api?: GitHubApiOptions;
+    credentials?: GitHubChannelCredentials;
+    installationId?: number;
+    owner: string;
+    repo: string;
+}
+/**
+ * Build an authenticated Octokit client.
+ *
+ * Prefer explicit bearer tokens, then GitHub App installation auth (when App
+ * credentials + an installation id are available), then local PAT /
+ * `gh auth token`. App auth uses `@octokit/auth-app` so Octokit refreshes
+ * installation tokens itself.
+ */
+export declare function createGitHubOctokit(input: {
+    api?: GitHubApiOptions;
+    credentials?: GitHubChannelCredentials;
+    installationId?: number;
+}): Promise<Octokit>;
+/**
+ * Call a GitHub REST path with channel auth. Prefer typed Octokit methods via
+ * {@link createGitHubOctokit} / `ctx.github.getOctokit()` when possible.
+ */
+export declare function callGitHubApi<T = unknown>(input: {
+    api?: GitHubApiOptions;
+    body?: GitHubJsonObject;
+    credentials?: GitHubChannelCredentials;
+    installationId?: number;
+    method: GitHubApiMethod;
+    path: string;
+    options?: {
+        auth?: boolean;
+        headers?: Readonly<Record<string, string>>;
+    };
+}): Promise<GitHubApiResponse<T>>;
+/** Create an issue or PR timeline comment. */
+export declare function createGitHubIssueComment(input: GitHubResourceInput & {
+    body: string;
+    issueNumber: number;
+}): Promise<GitHubPostedComment>;
+/** Reply to an inline pull-request review comment thread. */
+export declare function createGitHubReviewCommentReply(input: GitHubResourceInput & {
+    body: string;
+    commentId: number;
+    pullRequestNumber: number;
+}): Promise<GitHubPostedComment>;
+/** Create a reaction on an issue or review comment. */
+export declare function createGitHubReaction(input: GitHubResourceInput & {
+    commentId: number;
+    content: GitHubReactionContent;
+    subject: "issue_comment" | "pull_request_review_comment";
+}): Promise<GitHubApiResponse>;
+/** Create a commit status (legacy `statuses` API). */
+export declare function createGitHubCommitStatus(input: GitHubResourceInput & {
+    sha: string;
+    state: "error" | "failure" | "pending" | "success";
+    context?: string;
+    description?: string;
+    targetUrl?: string;
+}): Promise<GitHubApiResponse>;
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/channels/github/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/github/api.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,oBAAoB,EAO1B,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACvD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1E,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;CAAG;AAEjE,MAAM,WAAW,iBAAiB,CAAC,CAAC,GAAG,OAAO;IAC5C,IAAI,EAAE,CAAC,CAAC;IACR,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QACjB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,EASA;CACF;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,MAAM,qBAAqB,GAC7B,IAAI,GACJ,IAAI,GACJ,UAAU,GACV,MAAM,GACN,OAAO,GACP,QAAQ,GACR,OAAO,GACP,QAAQ,CAAC;AAEb,UAAU,mBAAmB;IAC3B,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CA8CnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE;IACtD,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;KAAE,CAAC;CAC1E,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAmBhC;AAqCD,8CAA8C;AAC9C,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACjE,OAAO,CAAC,mBAAmB,CAAC,CAiB9B;AAED,6DAA6D;AAC7D,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,mBAAmB,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GACA,OAAO,CAAC,mBAAmB,CAAC,CAkB9B;AAED,uDAAuD;AACvD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,OAAO,EAAE,eAAe,GAAG,6BAA6B,CAAC;CAC1D,GACA,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAED,sDAAsD;AACtD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,mBAAmB,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,iBAAiB,CAAC,CA0B5B"}

package/dist/channels/github/api.js

@@ -0,0 +1,229 @@
+/**
+ * GitHub REST helpers backed by `@octokit/rest`.
+ *
+ * Channel hooks should prefer `ctx.github` / `ctx.thread`. Use
+ * {@link createGitHubOctokit} (or `ctx.github.getOctokit()`) when you need
+ * typed Octokit methods directly.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createAppAuth } from "@octokit/auth-app";
+import { Octokit } from "@octokit/rest";
+import { hasGitHubAppCredentials, resolveCredentialValue, resolveGitHubAccessToken, resolveGitHubAppId, resolveGitHubInstallationId, resolveGitHubPrivateKey, } from "./auth.js";
+export class GitHubApiError extends Error {
+    constructor(input) {
+        super(`GitHub ${input.method} ${input.path} failed with HTTP ${input.status}.`);
+        this.name = "GitHubApiError";
+        this.body = input.body;
+        this.method = input.method;
+        this.path = input.path;
+        this.status = input.status;
+    }
+}
+/**
+ * Build an authenticated Octokit client.
+ *
+ * Prefer explicit bearer tokens, then GitHub App installation auth (when App
+ * credentials + an installation id are available), then local PAT /
+ * `gh auth token`. App auth uses `@octokit/auth-app` so Octokit refreshes
+ * installation tokens itself.
+ */
+export function createGitHubOctokit(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f;
+        var _g;
+        const requestOptions = ((_a = input.api) === null || _a === void 0 ? void 0 : _a.fetch) === undefined ? undefined : { fetch: input.api.fetch };
+        const baseUrl = (_b = input.api) === null || _b === void 0 ? void 0 : _b.apiBaseUrl;
+        const explicit = (_g = (yield resolveCredentialValue((_c = input.credentials) === null || _c === void 0 ? void 0 : _c.token))) !== null && _g !== void 0 ? _g : (yield resolveCredentialValue((_d = input.credentials) === null || _d === void 0 ? void 0 : _d.installationToken));
+        if (explicit !== undefined) {
+            return new Octokit(Object.assign(Object.assign({ auth: explicit }, (baseUrl === undefined ? {} : { baseUrl })), (requestOptions === undefined ? {} : { request: requestOptions })));
+        }
+        const installationId = yield resolveGitHubInstallationId(input.installationId);
+        if (installationId !== undefined &&
+            (yield hasGitHubAppCredentials(input.credentials))) {
+            const appId = yield resolveGitHubAppId((_e = input.credentials) === null || _e === void 0 ? void 0 : _e.appId);
+            const privateKey = yield resolveGitHubPrivateKey((_f = input.credentials) === null || _f === void 0 ? void 0 : _f.privateKey);
+            return new Octokit(Object.assign(Object.assign({ authStrategy: createAppAuth, auth: {
+                    appId,
+                    privateKey,
+                    installationId,
+                } }, (baseUrl === undefined ? {} : { baseUrl })), (requestOptions === undefined ? {} : { request: requestOptions })));
+        }
+        // Local testing: ambient PAT / `gh auth token` when App creds are unset.
+        const token = yield resolveGitHubAccessToken(input);
+        return new Octokit(Object.assign(Object.assign({ auth: token }, (baseUrl === undefined ? {} : { baseUrl })), (requestOptions === undefined ? {} : { request: requestOptions })));
+    });
+}
+/**
+ * Call a GitHub REST path with channel auth. Prefer typed Octokit methods via
+ * {@link createGitHubOctokit} / `ctx.github.getOctokit()` when possible.
+ */
+export function callGitHubApi(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        if (((_a = input.options) === null || _a === void 0 ? void 0 : _a.auth) === false) {
+            const octokit = new Octokit(Object.assign(Object.assign({}, (((_b = input.api) === null || _b === void 0 ? void 0 : _b.apiBaseUrl) === undefined
+                ? {}
+                : { baseUrl: input.api.apiBaseUrl })), (((_c = input.api) === null || _c === void 0 ? void 0 : _c.fetch) === undefined
+                ? {}
+                : { request: { fetch: input.api.fetch } })));
+            return requestWithOctokit(octokit, input);
+        }
+        const octokit = yield createGitHubOctokit({
+            api: input.api,
+            credentials: input.credentials,
+            installationId: input.installationId,
+        });
+        return requestWithOctokit(octokit, input);
+    });
+}
+function requestWithOctokit(octokit, input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        var _c;
+        try {
+            const route = `${input.method} ${normalizeRequestPath(input.path)}`;
+            const response = yield octokit.request(route, Object.assign(Object.assign({}, ((_c = input.body) !== null && _c !== void 0 ? _c : {})), (((_a = input.options) === null || _a === void 0 ? void 0 : _a.headers) === undefined
+                ? {}
+                : { headers: input.options.headers })));
+            return {
+                body: response.data,
+                ok: true,
+                status: response.status,
+            };
+        }
+        catch (error) {
+            if (isOctokitRequestError(error)) {
+                throw new GitHubApiError({
+                    body: (_b = error.response) === null || _b === void 0 ? void 0 : _b.data,
+                    method: input.method,
+                    path: input.path,
+                    status: error.status,
+                });
+            }
+            throw error;
+        }
+    });
+}
+/** Create an issue or PR timeline comment. */
+export function createGitHubIssueComment(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const octokit = yield createGitHubOctokit(input);
+        try {
+            const response = yield octokit.rest.issues.createComment({
+                owner: input.owner,
+                repo: input.repo,
+                issue_number: input.issueNumber,
+                body: input.body,
+            });
+            return toPostedComment(response.data);
+        }
+        catch (error) {
+            throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/issues/${input.issueNumber}/comments`);
+        }
+    });
+}
+/** Reply to an inline pull-request review comment thread. */
+export function createGitHubReviewCommentReply(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const octokit = yield createGitHubOctokit(input);
+        try {
+            const response = yield octokit.rest.pulls.createReplyForReviewComment({
+                owner: input.owner,
+                repo: input.repo,
+                pull_number: input.pullRequestNumber,
+                comment_id: input.commentId,
+                body: input.body,
+            });
+            return toPostedComment(response.data);
+        }
+        catch (error) {
+            throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/pulls/${input.pullRequestNumber}/comments/${input.commentId}/replies`);
+        }
+    });
+}
+/** Create a reaction on an issue or review comment. */
+export function createGitHubReaction(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const octokit = yield createGitHubOctokit(input);
+        try {
+            const response = input.subject === "issue_comment"
+                ? yield octokit.rest.reactions.createForIssueComment({
+                    owner: input.owner,
+                    repo: input.repo,
+                    comment_id: input.commentId,
+                    content: input.content,
+                })
+                : yield octokit.rest.reactions.createForPullRequestReviewComment({
+                    owner: input.owner,
+                    repo: input.repo,
+                    comment_id: input.commentId,
+                    content: input.content,
+                });
+            return {
+                body: response.data,
+                ok: true,
+                status: response.status,
+            };
+        }
+        catch (error) {
+            const segment = input.subject === "issue_comment" ? "issues/comments" : "pulls/comments";
+            throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/${segment}/${input.commentId}/reactions`);
+        }
+    });
+}
+/** Create a commit status (legacy `statuses` API). */
+export function createGitHubCommitStatus(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const octokit = yield createGitHubOctokit(input);
+        try {
+            const response = yield octokit.rest.repos.createCommitStatus(Object.assign(Object.assign(Object.assign({ owner: input.owner, repo: input.repo, sha: input.sha, state: input.state }, (input.context === undefined ? {} : { context: input.context })), (input.description === undefined
+                ? {}
+                : { description: input.description })), (input.targetUrl === undefined ? {} : { target_url: input.targetUrl })));
+            return {
+                body: response.data,
+                ok: true,
+                status: response.status,
+            };
+        }
+        catch (error) {
+            throw wrapOctokitError(error, "POST", `/repos/${input.owner}/${input.repo}/statuses/${input.sha}`);
+        }
+    });
+}
+function toPostedComment(raw) {
+    return {
+        htmlUrl: typeof raw.html_url === "string" ? raw.html_url : undefined,
+        id: typeof raw.id === "number" ? raw.id : 0,
+        raw,
+        url: typeof raw.url === "string" ? raw.url : undefined,
+    };
+}
+function normalizeRequestPath(path) {
+    return path.startsWith("/") ? path : `/${path}`;
+}
+function isOctokitRequestError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "status" in error &&
+        typeof error.status === "number");
+}
+function wrapOctokitError(error, method, path) {
+    var _a;
+    if (isOctokitRequestError(error)) {
+        return new GitHubApiError({
+            body: (_a = error.response) === null || _a === void 0 ? void 0 : _a.data,
+            method,
+            path,
+            status: error.status,
+        });
+    }
+    return error instanceof Error ? error : new Error(String(error));
+}

package/dist/channels/github/auth.d.ts

@@ -0,0 +1,67 @@
+/**
+ * GitHub API token resolution for the channel pack.
+ *
+ * Resolution order for authenticated REST calls:
+ * 1. `credentials.token` / `credentials.installationToken` (explicit)
+ * 2. GitHub App JWT → installation access token (when App creds + installation
+ *    id are available — webhook `installation.id` or `GITHUB_APP_INSTALLATION_ID`)
+ * 3. `GITHUB_TOKEN` / `GH_TOKEN` env (local PAT / fine-grained token)
+ * 4. `gh auth token` (local CLI session)
+ *
+ * Production should set App credentials and omit ambient PATs. Local testing
+ * can keep using a PAT or `gh auth login` when App creds are unset.
+ */
+import type { GitHubChannelCredentials, GitHubCredentialValue } from "./types.js";
+export interface GitHubAuthApiOptions {
+    apiBaseUrl?: string;
+    fetch?: typeof fetch;
+}
+/** Resolve a credential value (literal or lazy). */
+export declare function resolveCredentialValue(value: GitHubCredentialValue | undefined): Promise<string | undefined>;
+/** True when App id + private key are configured (credentials or env). */
+export declare function hasGitHubAppCredentials(credentials?: GitHubChannelCredentials): Promise<boolean>;
+/**
+ * Resolve an installation id from the call site, then
+ * `GITHUB_APP_INSTALLATION_ID` (host / non-webhook GitHub calls).
+ */
+export declare function resolveGitHubInstallationId(installationId?: number): Promise<number | undefined>;
+/**
+ * Resolve a bearer token for GitHub REST calls. Prefer explicit credentials,
+ * then App installation tokens when configured, then local PAT / `gh auth`.
+ */
+export declare function resolveGitHubAccessToken(input: {
+    api?: GitHubAuthApiOptions;
+    credentials?: GitHubChannelCredentials;
+    installationId?: number;
+}): Promise<string>;
+/** Soft resolve — returns undefined instead of throwing. */
+export declare function tryResolveGitHubAccessToken(input: {
+    api?: GitHubAuthApiOptions;
+    credentials?: GitHubChannelCredentials;
+    installationId?: number;
+}): Promise<string | undefined>;
+/** Read `gh auth token` when the CLI is logged in. Cached briefly. */
+export declare function tryResolveGhAuthToken(): Promise<string | undefined>;
+export declare function resolveGitHubAppId(appId?: GitHubCredentialValue | number): Promise<string>;
+export declare function resolveGitHubPrivateKey(privateKey?: GitHubCredentialValue): Promise<string>;
+/**
+ * Mint an installation access token via `@octokit/auth-app`.
+ * Prefer {@link createGitHubOctokit} for normal API work — this is for
+ * callers that only need the raw token string.
+ */
+export declare function createGitHubInstallationToken(input: {
+    api?: GitHubAuthApiOptions;
+    appId?: GitHubCredentialValue | number;
+    installationId: number;
+    privateKey?: GitHubCredentialValue;
+}): Promise<string>;
+/**
+ * Export the resolved host GitHub token as `process.env.GH_TOKEN` so
+ * subprocesses that shell out to `gh` work on App-credential hosts (corp
+ * agent-serve). Intended for serve warmup when auth source is `app`.
+ * Returns whether `GH_TOKEN` was written; refreshes on an interval.
+ */
+export declare function ensureGhCliTokenEnv(): Promise<boolean>;
+/** Clears in-memory caches. Intended for tests. */
+export declare function clearGitHubAuthCaches(): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/channels/github/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/channels/github/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AAIpB,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AASD,oDAAoD;AACpD,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,0EAA0E;AAC1E,wBAAsB,uBAAuB,CAC3C,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkB7B;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,GAAG,CAAC,EAAE,oBAAoB,CAAC;IAC3B,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsClB;AAED,4DAA4D;AAC5D,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,GAAG,CAAC,EAAE,oBAAoB,CAAC;IAC3B,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAM9B;AAED,sEAAsE;AACtE,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqBzE;AAED,wBAAsB,kBAAkB,CACtC,KAAK,CAAC,EAAE,qBAAqB,GAAG,MAAM,GACrC,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,uBAAuB,CAC3C,UAAU,CAAC,EAAE,qBAAqB,GACjC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,GAAG,CAAC,EAAE,oBAAoB,CAAC;IAC3B,KAAK,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,qBAAqB,CAAC;CACpC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAc5D;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,IAAI,IAAI,CAM5C"}

package/dist/channels/github/auth.js

@@ -0,0 +1,239 @@
+/**
+ * GitHub API token resolution for the channel pack.
+ *
+ * Resolution order for authenticated REST calls:
+ * 1. `credentials.token` / `credentials.installationToken` (explicit)
+ * 2. GitHub App JWT → installation access token (when App creds + installation
+ *    id are available — webhook `installation.id` or `GITHUB_APP_INSTALLATION_ID`)
+ * 3. `GITHUB_TOKEN` / `GH_TOKEN` env (local PAT / fine-grained token)
+ * 4. `gh auth token` (local CLI session)
+ *
+ * Production should set App credentials and omit ambient PATs. Local testing
+ * can keep using a PAT or `gh auth login` when App creds are unset.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createAppAuth } from "@octokit/auth-app";
+const execFileAsync = promisify(execFile);
+let ghAuthTokenCache = null;
+const GH_AUTH_CACHE_MS = 5 * 60000;
+/** Refresh exported `GH_TOKEN` before installation tokens expire (~60m). */
+const GH_CLI_TOKEN_REFRESH_MS = 50 * 60000;
+let ghCliTokenRefreshTimer = null;
+/** Resolve a credential value (literal or lazy). */
+export function resolveCredentialValue(value) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (value === undefined) {
+            return undefined;
+        }
+        const resolved = typeof value === "function" ? yield value() : value;
+        if (typeof resolved !== "string") {
+            return undefined;
+        }
+        const trimmed = resolved.trim();
+        return trimmed === "" ? undefined : trimmed;
+    });
+}
+/** True when App id + private key are configured (credentials or env). */
+export function hasGitHubAppCredentials(credentials) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            yield resolveGitHubAppId(credentials === null || credentials === void 0 ? void 0 : credentials.appId);
+            yield resolveGitHubPrivateKey(credentials === null || credentials === void 0 ? void 0 : credentials.privateKey);
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+/**
+ * Resolve an installation id from the call site, then
+ * `GITHUB_APP_INSTALLATION_ID` (host / non-webhook GitHub calls).
+ */
+export function resolveGitHubInstallationId(installationId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (installationId !== undefined &&
+            Number.isInteger(installationId) &&
+            installationId > 0) {
+            return installationId;
+        }
+        const fromEnv = yield resolveCredentialValue(process.env.GITHUB_APP_INSTALLATION_ID);
+        if (fromEnv === undefined) {
+            return undefined;
+        }
+        if (!/^[1-9][0-9]*$/u.test(fromEnv)) {
+            return undefined;
+        }
+        return Number(fromEnv);
+    });
+}
+/**
+ * Resolve a bearer token for GitHub REST calls. Prefer explicit credentials,
+ * then App installation tokens when configured, then local PAT / `gh auth`.
+ */
+export function resolveGitHubAccessToken(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        var _e, _f;
+        const explicit = (_e = (yield resolveCredentialValue((_a = input.credentials) === null || _a === void 0 ? void 0 : _a.token))) !== null && _e !== void 0 ? _e : (yield resolveCredentialValue((_b = input.credentials) === null || _b === void 0 ? void 0 : _b.installationToken));
+        if (explicit !== undefined) {
+            return explicit;
+        }
+        const installationId = yield resolveGitHubInstallationId(input.installationId);
+        if (installationId !== undefined &&
+            (yield hasGitHubAppCredentials(input.credentials))) {
+            return createGitHubInstallationToken({
+                api: input.api,
+                appId: (_c = input.credentials) === null || _c === void 0 ? void 0 : _c.appId,
+                installationId,
+                privateKey: (_d = input.credentials) === null || _d === void 0 ? void 0 : _d.privateKey,
+            });
+        }
+        const fromEnv = (_f = (yield resolveCredentialValue(process.env.GITHUB_TOKEN))) !== null && _f !== void 0 ? _f : (yield resolveCredentialValue(process.env.GH_TOKEN));
+        if (fromEnv !== undefined) {
+            return fromEnv;
+        }
+        const fromGh = yield tryResolveGhAuthToken();
+        if (fromGh !== undefined) {
+            return fromGh;
+        }
+        throw new Error("githubChannel: no GitHub token available (set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY + installation id, or GITHUB_TOKEN / GH_TOKEN, or run `gh auth login`).");
+    });
+}
+/** Soft resolve — returns undefined instead of throwing. */
+export function tryResolveGitHubAccessToken(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            return yield resolveGitHubAccessToken(input);
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
+/** Read `gh auth token` when the CLI is logged in. Cached briefly. */
+export function tryResolveGhAuthToken() {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (ghAuthTokenCache !== null && Date.now() < ghAuthTokenCache.expiresAtMs) {
+            return ghAuthTokenCache.token;
+        }
+        try {
+            const { stdout } = yield execFileAsync("gh", ["auth", "token"], {
+                timeout: 5000,
+                env: process.env,
+            });
+            const token = stdout.trim();
+            if (token === "") {
+                return undefined;
+            }
+            ghAuthTokenCache = {
+                token,
+                expiresAtMs: Date.now() + GH_AUTH_CACHE_MS,
+            };
+            return token;
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
+export function resolveGitHubAppId(appId) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const source = appId !== null && appId !== void 0 ? appId : (process.env.GITHUB_APP_ID !== undefined && process.env.GITHUB_APP_ID !== ""
+            ? process.env.GITHUB_APP_ID
+            : undefined);
+        if (source === undefined) {
+            throw new Error("githubChannel: GITHUB_APP_ID is required.");
+        }
+        if (typeof source === "number") {
+            return String(source);
+        }
+        const value = yield resolveCredentialValue(source);
+        if (value === undefined) {
+            throw new Error("githubChannel: GITHUB_APP_ID is required.");
+        }
+        return value;
+    });
+}
+export function resolveGitHubPrivateKey(privateKey) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const source = privateKey !== null && privateKey !== void 0 ? privateKey : (process.env.GITHUB_APP_PRIVATE_KEY !== undefined &&
+            process.env.GITHUB_APP_PRIVATE_KEY !== ""
+            ? process.env.GITHUB_APP_PRIVATE_KEY
+            : undefined);
+        if (source === undefined) {
+            throw new Error("githubChannel: GITHUB_APP_PRIVATE_KEY is required.");
+        }
+        const value = yield resolveCredentialValue(source);
+        if (value === undefined) {
+            throw new Error("githubChannel: GITHUB_APP_PRIVATE_KEY is required.");
+        }
+        return value.replace(/\\n/gu, "\n");
+    });
+}
+/**
+ * Mint an installation access token via `@octokit/auth-app`.
+ * Prefer {@link createGitHubOctokit} for normal API work — this is for
+ * callers that only need the raw token string.
+ */
+export function createGitHubInstallationToken(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const appId = yield resolveGitHubAppId(input.appId);
+        const privateKey = yield resolveGitHubPrivateKey(input.privateKey);
+        // Prefer createGitHubOctokit for API work — this path only mints a raw
+        // token. Custom fetch belongs on the Octokit client, not createAppAuth
+        // (StrategyOptions.request expects a full RequestInterface).
+        const auth = createAppAuth(Object.assign({ appId,
+            privateKey }, (((_a = input.api) === null || _a === void 0 ? void 0 : _a.apiBaseUrl) === undefined
+            ? {}
+            : { baseUrl: input.api.apiBaseUrl })));
+        const result = yield auth({
+            type: "installation",
+            installationId: input.installationId,
+        });
+        return result.token;
+    });
+}
+/**
+ * Export the resolved host GitHub token as `process.env.GH_TOKEN` so
+ * subprocesses that shell out to `gh` work on App-credential hosts (corp
+ * agent-serve). Intended for serve warmup when auth source is `app`.
+ * Returns whether `GH_TOKEN` was written; refreshes on an interval.
+ */
+export function ensureGhCliTokenEnv() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const token = yield tryResolveGitHubAccessToken({});
+        if (token === undefined) {
+            return false;
+        }
+        process.env.GH_TOKEN = token;
+        if (ghCliTokenRefreshTimer === null) {
+            const timer = setInterval(() => {
+                void ensureGhCliTokenEnv();
+            }, GH_CLI_TOKEN_REFRESH_MS);
+            (_a = timer.unref) === null || _a === void 0 ? void 0 : _a.call(timer);
+            ghCliTokenRefreshTimer = timer;
+        }
+        return true;
+    });
+}
+/** Clears in-memory caches. Intended for tests. */
+export function clearGitHubAuthCaches() {
+    ghAuthTokenCache = null;
+    if (ghCliTokenRefreshTimer !== null) {
+        clearInterval(ghCliTokenRefreshTimer);
+        ghCliTokenRefreshTimer = null;
+    }
+}