@generacy-ai/generacy-plugin-github-issues 0.0.0-preview-20260304013206

package/dist/auth/github-app.js

@@ -0,0 +1,191 @@
+import { createAppAuth } from '@octokit/auth-app';
+import { Octokit } from '@octokit/rest';
+import { GitHubAppAuthError, GitHubAppErrorCode } from '../utils/errors.js';
+import { TokenCache } from './token-cache.js';
+import * as fs from 'node:fs';
+/**
+ * GitHub App authentication strategy
+ *
+ * Implements the AuthStrategy interface for GitHub App authentication.
+ * Handles JWT generation, installation discovery, and token caching.
+ */
+export class GitHubAppAuthStrategy {
+    type = 'github-app';
+    config;
+    context;
+    tokenCache;
+    installationId = null;
+    octokit = null;
+    authFn = null;
+    constructor(config, context) {
+        this.config = config;
+        this.context = context;
+        this.tokenCache = new TokenCache();
+    }
+    /**
+     * Initialize the GitHub App authentication
+     * - Resolves private key (from file or inline)
+     * - Creates the auth function
+     * - Discovers installation ID if not provided
+     */
+    async initialize() {
+        const privateKey = await this.resolvePrivateKey();
+        const appId = typeof this.config.appId === 'string'
+            ? parseInt(this.config.appId, 10)
+            : this.config.appId;
+        this.authFn = createAppAuth({
+            appId,
+            privateKey,
+        });
+        // If installation ID is provided, use it; otherwise discover it
+        if (this.config.installationId) {
+            this.installationId = this.config.installationId;
+        }
+        else {
+            this.installationId = await this.discoverInstallationId();
+        }
+        // Create Octokit instance with app auth
+        this.octokit = new Octokit({
+            authStrategy: createAppAuth,
+            auth: {
+                appId,
+                privateKey,
+                installationId: this.installationId,
+            },
+            baseUrl: this.context.baseUrl,
+        });
+    }
+    /**
+     * Resolve the private key from file path or inline content
+     */
+    async resolvePrivateKey() {
+        if (this.config.privateKey) {
+            return this.config.privateKey;
+        }
+        if (this.config.privateKeyPath) {
+            try {
+                return fs.readFileSync(this.config.privateKeyPath, 'utf-8');
+            }
+            catch (error) {
+                throw new GitHubAppAuthError(`Failed to read private key from path: ${this.config.privateKeyPath}`, GitHubAppErrorCode.PRIVATE_KEY_NOT_FOUND, error);
+            }
+        }
+        throw new GitHubAppAuthError('No private key provided. Either privateKey or privateKeyPath is required.', GitHubAppErrorCode.INVALID_PRIVATE_KEY);
+    }
+    /**
+     * Discover the installation ID for the configured owner
+     * Uses the GitHub App JWT to list installations and find the matching one
+     */
+    async discoverInstallationId() {
+        if (!this.authFn) {
+            throw new GitHubAppAuthError('Auth function not initialized', GitHubAppErrorCode.JWT_GENERATION_FAILED);
+        }
+        try {
+            // Get app-level auth (JWT) for listing installations
+            const appAuth = await this.authFn({ type: 'app' });
+            // Create a temporary Octokit for installation discovery
+            const tempOctokit = new Octokit({
+                auth: appAuth.token,
+                baseUrl: this.context.baseUrl,
+            });
+            // List all installations
+            const { data: installations } = await tempOctokit.request('GET /app/installations');
+            // Find installation for the configured owner (case-insensitive)
+            const installation = installations.find((inst) => inst.account?.login.toLowerCase() === this.context.owner.toLowerCase());
+            if (!installation) {
+                throw new GitHubAppAuthError(`No installation found for owner: ${this.context.owner}`, GitHubAppErrorCode.INSTALLATION_NOT_FOUND);
+            }
+            return installation.id;
+        }
+        catch (error) {
+            if (error instanceof GitHubAppAuthError) {
+                throw error;
+            }
+            throw new GitHubAppAuthError('Failed to discover installation ID', GitHubAppErrorCode.INSTALLATION_NOT_FOUND, error);
+        }
+    }
+    /**
+     * Get a valid authentication token
+     * Returns cached token if still valid, otherwise generates a new one
+     */
+    async getToken() {
+        if (this.installationId === null) {
+            await this.initialize();
+        }
+        // Check cache first
+        const cached = this.tokenCache.get(this.installationId);
+        if (cached && !this.tokenCache.needsRefresh(this.installationId)) {
+            return cached.token;
+        }
+        // Generate new token
+        return this.generateInstallationToken();
+    }
+    /**
+     * Generate a new installation access token
+     */
+    async generateInstallationToken() {
+        if (!this.authFn || this.installationId === null) {
+            throw new GitHubAppAuthError('GitHub App not initialized', GitHubAppErrorCode.TOKEN_GENERATION_FAILED);
+        }
+        try {
+            const auth = await this.authFn({
+                type: 'installation',
+                installationId: this.installationId,
+            });
+            // Cache the token
+            const cachedToken = {
+                token: auth.token,
+                expiresAt: new Date(auth.expiresAt),
+                installationId: this.installationId,
+                permissions: auth.permissions ?? {},
+                repositorySelection: auth.repositorySelection ?? 'all',
+            };
+            this.tokenCache.set(cachedToken);
+            return auth.token;
+        }
+        catch (error) {
+            throw new GitHubAppAuthError('Failed to generate installation access token', GitHubAppErrorCode.TOKEN_GENERATION_FAILED, error);
+        }
+    }
+    /**
+     * Verify that authentication is working
+     * Returns the authenticated user/bot information
+     */
+    async verify() {
+        const token = await this.getToken();
+        const octokit = new Octokit({
+            auth: token,
+            baseUrl: this.context.baseUrl,
+        });
+        const { data } = await octokit.request('GET /user');
+        return {
+            login: data.login,
+            id: data.id,
+            type: data.type,
+        };
+    }
+    /**
+     * Get the Octokit instance for making API calls
+     */
+    getOctokit() {
+        if (!this.octokit) {
+            throw new GitHubAppAuthError('GitHub App not initialized. Call initialize() first.', GitHubAppErrorCode.JWT_GENERATION_FAILED);
+        }
+        return this.octokit;
+    }
+    /**
+     * Clear the token cache
+     */
+    clearCache() {
+        this.tokenCache.clearAll();
+    }
+}
+/**
+ * Create a new GitHubAppAuthStrategy instance
+ */
+export async function createGitHubAppAuth(config, context) {
+    const strategy = new GitHubAppAuthStrategy(config, context);
+    await strategy.initialize();
+    return strategy;
+}
+//# sourceMappingURL=github-app.js.map

package/dist/auth/github-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.js","sourceRoot":"","sources":["../../src/auth/github-app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAW9B;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IAChB,IAAI,GAAG,YAAqB,CAAC;IAE5B,MAAM,CAAkB;IACxB,OAAO,CAAc;IACrB,UAAU,CAAa;IAChC,cAAc,GAAkB,IAAI,CAAC;IACrC,OAAO,GAAmB,IAAI,CAAC;IAC/B,MAAM,GAA4C,IAAI,CAAC;IAE/D,YAAY,MAAuB,EAAE,OAAoB;QACvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;YACjD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAEtB,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;YAC1B,KAAK;YACL,UAAU;SACX,CAAC,CAAC;QAEH,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5D,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC;YACzB,YAAY,EAAE,aAAa;YAC3B,IAAI,EAAE;gBACJ,KAAK;gBACL,UAAU;gBACV,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,yCAAyC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,EACrE,kBAAkB,CAAC,qBAAqB,EACxC,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,IAAI,kBAAkB,CAC1B,2EAA2E,EAC3E,kBAAkB,CAAC,mBAAmB,CACvC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,kBAAkB,CAC1B,+BAA+B,EAC/B,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEnD,wDAAwD;YACxD,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC;gBAC9B,IAAI,EAAE,OAAO,CAAC,KAAK;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;aAC9B,CAAC,CAAC;YAEH,yBAAyB;YACzB,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YAEpF,gEAAgE;YAChE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CACrC,CAAC,IAA2C,EAAE,EAAE,CAC9C,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CACzE,CAAC;YAEF,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,kBAAkB,CAC1B,oCAAoC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EACxD,kBAAkB,CAAC,sBAAsB,CAC1C,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oCAAoC,EACpC,kBAAkB,CAAC,sBAAsB,EACzC,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAe,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,cAAe,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,qBAAqB;QACrB,OAAO,IAAI,CAAC,yBAAyB,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAC1B,4BAA4B,EAC5B,kBAAkB,CAAC,uBAAuB,CAC3C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,cAAc;gBACpB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YAEH,kBAAkB;YAClB,MAAM,WAAW,GAAgB;gBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAU,CAAC;gBACpC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,WAAW,EAAG,IAAiD,CAAC,WAAW,IAAI,EAAE;gBACjF,mBAAmB,EAAI,IAAyC,CAAC,mBAA0C,IAAI,KAAK;aACrH,CAAC;YAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAEjC,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,EAC9C,kBAAkB,CAAC,uBAAuB,EAC1C,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;SAC9B,CAAC,CAAC;QAEH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEpD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAsB;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,kBAAkB,CAC1B,sDAAsD,EACtD,kBAAkB,CAAC,qBAAqB,CACzC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAuB,EACvB,OAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,10 @@
+export type { GitHubAppConfig, AuthStrategy, AuthVerification, CachedToken, ValidatedGitHubAppConfig, } from './types.js';
+export { GitHubAppConfigSchema } from './types.js';
+export { GitHubAppAuthStrategy, createGitHubAppAuth } from './github-app.js';
+export type { AuthContext } from './github-app.js';
+export { PATAuthStrategy, createAuthStrategy } from './auth-factory.js';
+export type { AuthFactoryConfig } from './auth-factory.js';
+export { TokenCache } from './token-cache.js';
+export type { TokenCacheOptions } from './token-cache.js';
+export { readGitHubAppConfigFromEnv, hasGitHubAppEnvConfig, loadPrivateKeyFromPath, ENV_VARS, } from './env.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,wBAAwB,GACzB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,QAAQ,GACT,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,10 @@
+export { GitHubAppConfigSchema } from './types.js';
+// GitHub App authentication
+export { GitHubAppAuthStrategy, createGitHubAppAuth } from './github-app.js';
+// PAT authentication and factory
+export { PATAuthStrategy, createAuthStrategy } from './auth-factory.js';
+// Token cache
+export { TokenCache } from './token-cache.js';
+// Environment variable helpers
+export { readGitHubAppConfigFromEnv, hasGitHubAppEnvConfig, loadPrivateKeyFromPath, ENV_VARS, } from './env.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,4BAA4B;AAC5B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAG7E,iCAAiC;AACjC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGxE,cAAc;AACd,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,+BAA+B;AAC/B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,sBAAsB,EACtB,QAAQ,GACT,MAAM,UAAU,CAAC"}

package/dist/auth/token-cache.d.ts

@@ -0,0 +1,70 @@
+import type { CachedToken } from './types.js';
+/**
+ * Configuration options for the TokenCache
+ */
+export interface TokenCacheOptions {
+    /**
+     * Callback when a token needs to be refreshed
+     * Called when getWithRefresh() is invoked and token is within refresh window
+     */
+    onRefreshNeeded?: (installationId: number) => Promise<CachedToken>;
+    /**
+     * Refresh threshold in milliseconds (default: 10 minutes = 600000ms)
+     * Tokens will be proactively refreshed when this much time remains
+     */
+    refreshThresholdMs?: number;
+}
+/**
+ * In-memory token cache with expiry tracking and proactive refresh
+ *
+ * Caches installation access tokens with their expiration times.
+ * Supports proactive refresh when tokens are approaching expiry.
+ */
+export declare class TokenCache {
+    private readonly cache;
+    private readonly options;
+    /** Default refresh threshold: 10 minutes before expiry */
+    private static readonly DEFAULT_REFRESH_THRESHOLD_MS;
+    constructor(options?: TokenCacheOptions);
+    /**
+     * Get a cached token by installation ID
+     * Returns undefined if token doesn't exist or is expired
+     */
+    get(installationId: number): CachedToken | undefined;
+    /**
+     * Get a token with automatic refresh if needed
+     * If the token is within the refresh threshold, calls the refresh callback
+     */
+    getWithRefresh(installationId: number): Promise<CachedToken | undefined>;
+    /**
+     * Store a token in the cache
+     */
+    set(token: CachedToken): void;
+    /**
+     * Check if a token is expired
+     * Returns true if token doesn't exist or is past expiration
+     */
+    isExpired(installationId: number): boolean;
+    /**
+     * Check if a token needs to be refreshed
+     * Returns true if token doesn't exist, is expired, or is within the refresh threshold
+     */
+    needsRefresh(installationId: number): boolean;
+    /**
+     * Remove a token from the cache
+     */
+    clear(installationId: number): void;
+    /**
+     * Remove all tokens from the cache
+     */
+    clearAll(): void;
+    /**
+     * Get the number of cached tokens
+     */
+    get size(): number;
+    /**
+     * Check if a token exists for the given installation (regardless of expiry)
+     */
+    has(installationId: number): boolean;
+}
+//# sourceMappingURL=token-cache.d.ts.map

package/dist/auth/token-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.d.ts","sourceRoot":"","sources":["../../src/auth/token-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8E;IAEtG,0DAA0D;IAC1D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAkB;gBAE1D,OAAO,GAAE,iBAAsB;IAO3C;;;OAGG;IACH,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAepD;;;OAGG;IACG,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAuB9E;;OAEG;IACH,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI;IAI7B;;;OAGG;IACH,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAQ1C;;;OAGG;IACH,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAU7C;;OAEG;IACH,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAInC;;OAEG;IACH,QAAQ,IAAI,IAAI;IAIhB;;OAEG;IACH,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;;OAEG;IACH,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;CAGrC"}

package/dist/auth/token-cache.js

@@ -0,0 +1,112 @@
+/**
+ * In-memory token cache with expiry tracking and proactive refresh
+ *
+ * Caches installation access tokens with their expiration times.
+ * Supports proactive refresh when tokens are approaching expiry.
+ */
+export class TokenCache {
+    cache = new Map();
+    options;
+    /** Default refresh threshold: 10 minutes before expiry */
+    static DEFAULT_REFRESH_THRESHOLD_MS = 10 * 60 * 1000;
+    constructor(options = {}) {
+        this.options = {
+            refreshThresholdMs: options.refreshThresholdMs ?? TokenCache.DEFAULT_REFRESH_THRESHOLD_MS,
+            onRefreshNeeded: options.onRefreshNeeded,
+        };
+    }
+    /**
+     * Get a cached token by installation ID
+     * Returns undefined if token doesn't exist or is expired
+     */
+    get(installationId) {
+        const token = this.cache.get(installationId);
+        if (!token) {
+            return undefined;
+        }
+        // Return undefined if expired
+        if (this.isExpired(installationId)) {
+            this.cache.delete(installationId);
+            return undefined;
+        }
+        return token;
+    }
+    /**
+     * Get a token with automatic refresh if needed
+     * If the token is within the refresh threshold, calls the refresh callback
+     */
+    async getWithRefresh(installationId) {
+        const token = this.get(installationId);
+        // If no token or no callback, just return what we have
+        if (!token || !this.options.onRefreshNeeded) {
+            return token;
+        }
+        // Check if we need to refresh
+        if (this.needsRefresh(installationId)) {
+            try {
+                const newToken = await this.options.onRefreshNeeded(installationId);
+                this.set(newToken);
+                return newToken;
+            }
+            catch {
+                // If refresh fails, return existing token if still valid
+                return token;
+            }
+        }
+        return token;
+    }
+    /**
+     * Store a token in the cache
+     */
+    set(token) {
+        this.cache.set(token.installationId, token);
+    }
+    /**
+     * Check if a token is expired
+     * Returns true if token doesn't exist or is past expiration
+     */
+    isExpired(installationId) {
+        const token = this.cache.get(installationId);
+        if (!token) {
+            return true;
+        }
+        return token.expiresAt.getTime() <= Date.now();
+    }
+    /**
+     * Check if a token needs to be refreshed
+     * Returns true if token doesn't exist, is expired, or is within the refresh threshold
+     */
+    needsRefresh(installationId) {
+        const token = this.cache.get(installationId);
+        if (!token) {
+            return true;
+        }
+        const timeUntilExpiry = token.expiresAt.getTime() - Date.now();
+        return timeUntilExpiry <= this.options.refreshThresholdMs;
+    }
+    /**
+     * Remove a token from the cache
+     */
+    clear(installationId) {
+        this.cache.delete(installationId);
+    }
+    /**
+     * Remove all tokens from the cache
+     */
+    clearAll() {
+        this.cache.clear();
+    }
+    /**
+     * Get the number of cached tokens
+     */
+    get size() {
+        return this.cache.size;
+    }
+    /**
+     * Check if a token exists for the given installation (regardless of expiry)
+     */
+    has(installationId) {
+        return this.cache.has(installationId);
+    }
+}
+//# sourceMappingURL=token-cache.js.map

package/dist/auth/token-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.js","sourceRoot":"","sources":["../../src/auth/token-cache.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACJ,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,OAAO,CAA8E;IAEtG,0DAA0D;IAClD,MAAM,CAAU,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtE,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,OAAO,GAAG;YACb,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,UAAU,CAAC,4BAA4B;YACzF,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,cAAsB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,cAAsB;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEvC,uDAAuD;QACvD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;gBACpE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnB,OAAO,QAAQ,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,yDAAyD;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,KAAkB;QACpB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,cAAsB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,cAAsB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,OAAO,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAsB;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,cAAsB;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,119 @@
+import { z } from 'zod';
+/**
+ * Zod schema for GitHub App configuration validation
+ */
+export declare const GitHubAppConfigSchema: z.ZodEffects<z.ZodObject<{
+    /** GitHub App ID */
+    appId: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    /** Private key in PEM format */
+    privateKey: z.ZodOptional<z.ZodString>;
+    /** Path to private key PEM file */
+    privateKeyPath: z.ZodOptional<z.ZodString>;
+    /** Optional installation ID (auto-discovered if not provided) */
+    installationId: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}>, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}>;
+/**
+ * GitHub App configuration for authentication
+ */
+export interface GitHubAppConfig {
+    /** GitHub App ID */
+    appId: number | string;
+    /** Private key in PEM format */
+    privateKey?: string;
+    /** Path to private key PEM file */
+    privateKeyPath?: string;
+    /** Optional installation ID (auto-discovered if not provided) */
+    installationId?: number;
+}
+/**
+ * Result of authentication verification
+ */
+export interface AuthVerification {
+    /** GitHub login/username */
+    login: string;
+    /** GitHub user/bot ID */
+    id: number;
+    /** Account type */
+    type: 'User' | 'Bot';
+}
+/**
+ * Authentication strategy interface
+ */
+export interface AuthStrategy {
+    /** Get a valid authentication token */
+    getToken(): Promise<string>;
+    /** Verify that authentication is working */
+    verify(): Promise<AuthVerification>;
+    /** Authentication type for logging purposes */
+    readonly type: 'pat' | 'github-app';
+}
+/**
+ * Cached installation access token
+ */
+export interface CachedToken {
+    /** The access token */
+    token: string;
+    /** Token expiration time */
+    expiresAt: Date;
+    /** Installation ID the token is for */
+    installationId: number;
+    /** Permissions granted to this token */
+    permissions: Record<string, string>;
+    /** Repository selection mode */
+    repositorySelection: 'all' | 'selected';
+}
+/**
+ * Inferred type from GitHubAppConfigSchema
+ */
+export declare const ValidatedGitHubAppConfig: z.ZodEffects<z.ZodObject<{
+    /** GitHub App ID */
+    appId: z.ZodUnion<[z.ZodNumber, z.ZodString]>;
+    /** Private key in PEM format */
+    privateKey: z.ZodOptional<z.ZodString>;
+    /** Path to private key PEM file */
+    privateKeyPath: z.ZodOptional<z.ZodString>;
+    /** Optional installation ID (auto-discovered if not provided) */
+    installationId: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}>, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}, {
+    appId: string | number;
+    privateKey?: string | undefined;
+    privateKeyPath?: string | undefined;
+    installationId?: number | undefined;
+}>;
+export type ValidatedGitHubAppConfig = z.infer<typeof GitHubAppConfigSchema>;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,qBAAqB;IAE9B,oBAAoB;;IAKpB,gCAAgC;;IAEhC,mCAAmC;;IAEnC,iEAAiE;;;;;;;;;;;;;;;;;;;;;;EAMjE,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oBAAoB;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,gCAAgC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,4CAA4C;IAC5C,MAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpC,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,YAAY,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,uCAAuC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,gCAAgC;IAChC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB;IA1EjC,oBAAoB;;IAKpB,gCAAgC;;IAEhC,mCAAmC;;IAEnC,iEAAiE;;;;;;;;;;;;;;;;;;;;;;EAiER,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/auth/types.js

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+/**
+ * Zod schema for GitHub App configuration validation
+ */
+export const GitHubAppConfigSchema = z
+    .object({
+    /** GitHub App ID */
+    appId: z.union([
+        z.number().positive('App ID must be a positive number'),
+        z.string().regex(/^\d+$/, 'App ID must be a numeric string'),
+    ]),
+    /** Private key in PEM format */
+    privateKey: z.string().optional(),
+    /** Path to private key PEM file */
+    privateKeyPath: z.string().optional(),
+    /** Optional installation ID (auto-discovered if not provided) */
+    installationId: z.number().positive('Installation ID must be positive').optional(),
+})
+    .refine((data) => data.privateKey !== undefined || data.privateKeyPath !== undefined, {
+    message: 'Either privateKey or privateKeyPath must be provided',
+    path: ['privateKey'],
+});
+/**
+ * Inferred type from GitHubAppConfigSchema
+ */
+export const ValidatedGitHubAppConfig = GitHubAppConfigSchema;
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,oBAAoB;IACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QACb,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QACvD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,iCAAiC,CAAC;KAC7D,CAAC;IACF,gCAAgC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,mCAAmC;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,iEAAiE;IACjE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC,QAAQ,EAAE;CACnF,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE;IACpF,OAAO,EAAE,sDAAsD;IAC/D,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC,CAAC;AAwDL;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC"}