@gh-symphony/cli 0.0.18 → 0.0.20

package/dist/{chunk-62L6QQE6.js → chunk-TILHWBP6.js}

@@ -351,6 +351,269 @@ var PROJECT_ITEMS_PAGE_QUERY = `
   }
 `;
 
+// src/github/gh-auth.ts
+import { execFileSync, spawnSync } from "child_process";
+var REQUIRED_GH_SCOPES = ["repo", "read:org", "project"];
+var GhAuthError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "GhAuthError";
+  }
+};
+function ghTokenReadErrorMessage() {
+  return "Failed to read a GitHub token from gh CLI. Run 'gh auth status' and try again.";
+}
+function missingGhScopesMessage(missing) {
+  return `Run 'gh auth refresh --scopes repo,read:org,project'. Missing scopes: ${missing.join(", ")}`;
+}
+function classifyTokenValidationError(error, source) {
+  if (error instanceof GhAuthError) {
+    return error;
+  }
+  if (error instanceof GitHubApiError) {
+    if (error.status === 401) {
+      return new GhAuthError(
+        source === "env" ? "invalid_token" : "token_failed",
+        source === "env" ? "GITHUB_GRAPHQL_TOKEN is invalid or expired." : ghTokenReadErrorMessage()
+      );
+    }
+    const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+  }
+  if (error instanceof Error) {
+    const prefix = source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated" : "gh CLI token could not be validated";
+    return new GhAuthError("token_failed", `${prefix}: ${error.message}`);
+  }
+  return new GhAuthError(
+    "token_failed",
+    source === "env" ? "GITHUB_GRAPHQL_TOKEN could not be validated." : "gh CLI token could not be validated."
+  );
+}
+function getEnvGitHubToken() {
+  const token = process.env.GITHUB_GRAPHQL_TOKEN?.trim();
+  return token ? token : null;
+}
+function checkGhInstalled(opts) {
+  const execImpl = opts?.execImpl ?? execFileSync;
+  try {
+    execImpl("gh", ["--version"], { stdio: "pipe" });
+    return true;
+  } catch (error) {
+    const execError = error;
+    if (execError.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function checkGhAuthenticated(opts) {
+  const spawnImpl = opts?.spawnImpl ?? spawnSync;
+  const result = spawnImpl("gh", ["auth", "status"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  if ((result.status ?? 1) !== 0) {
+    return { authenticated: false };
+  }
+  const login = parseLogin((result.stdout ?? "").toString());
+  return { authenticated: true, login };
+}
+function checkGhScopes(opts) {
+  const spawnImpl = opts?.spawnImpl ?? spawnSync;
+  const result = spawnImpl("gh", ["auth", "status"], {
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"]
+  });
+  const output = (result.stdout ?? "").toString();
+  const scopes = parseScopes(output);
+  if (scopes.length === 0) {
+    return { valid: true, missing: [], scopes: [] };
+  }
+  const normalized = scopes.map((scope) => scope.toLowerCase());
+  const missing = REQUIRED_GH_SCOPES.filter(
+    (scope) => !normalized.includes(scope)
+  );
+  return {
+    valid: missing.length === 0,
+    missing: [...missing],
+    scopes
+  };
+}
+function getGhToken(opts) {
+  const envToken = opts?.allowEnv === false ? null : getEnvGitHubToken();
+  if (envToken) {
+    return envToken;
+  }
+  return getGhTokenWithSource({
+    execImpl: opts?.execImpl,
+    envToken: void 0
+  }).token;
+}
+function getGhTokenWithSource(opts) {
+  const hasExplicitEnvToken = opts !== void 0 && Object.prototype.hasOwnProperty.call(opts, "envToken");
+  const envToken = hasExplicitEnvToken ? opts.envToken?.trim() ?? null : getEnvGitHubToken();
+  if (envToken) {
+    return { token: envToken, source: "env" };
+  }
+  const execImpl = opts?.execImpl ?? execFileSync;
+  try {
+    const token = execImpl("gh", ["auth", "token"], {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).toString().trim();
+    if (!token) {
+      throw new GhAuthError("token_failed", ghTokenReadErrorMessage());
+    }
+    return { token, source: "gh" };
+  } catch (error) {
+    if (error instanceof GhAuthError) {
+      throw error;
+    }
+    throw new GhAuthError("token_failed", ghTokenReadErrorMessage());
+  }
+}
+async function validateGitHubToken(token, source, opts) {
+  const createClientImpl = opts?.createClientImpl ?? createClient;
+  const validateTokenImpl = opts?.validateTokenImpl ?? validateToken;
+  const checkRequiredScopesImpl = opts?.checkRequiredScopesImpl ?? checkRequiredScopes;
+  let viewer;
+  try {
+    const client = createClientImpl(token);
+    viewer = await validateTokenImpl(client);
+  } catch (error) {
+    throw classifyTokenValidationError(error, source);
+  }
+  const scopeCheck = checkRequiredScopesImpl(viewer.scopes);
+  if (!scopeCheck.valid) {
+    if (source === "env") {
+      throw new GhAuthError(
+        "missing_scopes",
+        `GITHUB_GRAPHQL_TOKEN is missing required scopes: ${scopeCheck.missing.join(", ")}`
+      );
+    }
+    throw new GhAuthError(
+      "missing_scopes",
+      missingGhScopesMessage(scopeCheck.missing)
+    );
+  }
+  return {
+    source,
+    token,
+    login: viewer.login,
+    scopes: viewer.scopes
+  };
+}
+async function resolveGitHubAuth(opts) {
+  const envToken = getEnvGitHubToken();
+  let envError = null;
+  if (envToken) {
+    try {
+      return await validateGitHubToken(envToken, "env", opts);
+    } catch (error) {
+      if (error instanceof GhAuthError) {
+        envError = error;
+      } else {
+        throw error;
+      }
+    }
+  }
+  try {
+    const auth = ensureGhAuth(opts);
+    return await validateGitHubToken(auth.token, "gh", opts);
+  } catch (error) {
+    if (envError && error instanceof GhAuthError) {
+      throw envError;
+    }
+    throw error;
+  }
+}
+function ensureGhAuth(opts) {
+  const execImpl = opts?.execImpl ?? execFileSync;
+  const spawnImpl = opts?.spawnImpl ?? spawnSync;
+  if (!checkGhInstalled({ execImpl })) {
+    throw new GhAuthError(
+      "not_installed",
+      "gh CLI is not installed. Install it from https://cli.github.com or set GITHUB_GRAPHQL_TOKEN."
+    );
+  }
+  const auth = checkGhAuthenticated({ spawnImpl });
+  if (!auth.authenticated) {
+    throw new GhAuthError(
+      "not_authenticated",
+      "Run 'gh auth login --scopes repo,read:org,project' or set GITHUB_GRAPHQL_TOKEN."
+    );
+  }
+  const scopeCheck = checkGhScopes({ spawnImpl });
+  if (!scopeCheck.valid) {
+    throw new GhAuthError(
+      "missing_scopes",
+      missingGhScopesMessage(scopeCheck.missing)
+    );
+  }
+  const { token } = getGhTokenWithSource({
+    execImpl,
+    envToken: void 0
+  });
+  return { login: auth.login ?? "unknown", token, source: "gh" };
+}
+function isInteractiveTerminal() {
+  return process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+function runGhAuthCommand(mode, opts) {
+  const spawnImpl = opts?.spawnImpl ?? spawnSync;
+  const command = `gh auth ${mode} --scopes ${REQUIRED_GH_SCOPES.join(",")}`;
+  const interactive = opts?.interactive ?? isInteractiveTerminal();
+  if (!interactive) {
+    return {
+      mode,
+      status: "manual",
+      command,
+      summary: `Interactive terminal not available. Run '${command}' manually.`
+    };
+  }
+  const result = spawnImpl(
+    "gh",
+    ["auth", mode, "--scopes", REQUIRED_GH_SCOPES.join(",")],
+    {
+      stdio: "inherit"
+    }
+  );
+  if ((result.status ?? 1) === 0) {
+    return {
+      mode,
+      status: "applied",
+      command,
+      summary: `Executed '${command}'.`
+    };
+  }
+  return {
+    mode,
+    status: "manual",
+    command,
+    summary: `Failed to complete '${command}' automatically. Re-run it manually.`
+  };
+}
+function runGhAuthLogin(opts) {
+  return runGhAuthCommand("login", opts);
+}
+function runGhAuthRefresh(opts) {
+  return runGhAuthCommand("refresh", opts);
+}
+function parseLogin(output) {
+  const matched = output.match(
+    /Logged in to github\.com account\s+\*?\*?([A-Za-z0-9_-]+)\*?\*?/i
+  );
+  return matched?.[1];
+}
+function parseScopes(output) {
+  const matched = output.match(/Token scopes:\s*(.+)/i);
+  if (!matched) {
+    return [];
+  }
+  return matched[1].split(",").map((scope) => scope.trim().replace(/^'+|'+$/g, "")).filter((scope) => scope.length > 0);
+}
+
 export {
   GitHubApiError,
   GitHubScopeError,
@@ -358,5 +621,18 @@ export {
   validateToken,
   checkRequiredScopes,
   listUserProjects,
-  getProjectDetail
+  getProjectDetail,
+  REQUIRED_GH_SCOPES,
+  GhAuthError,
+  getEnvGitHubToken,
+  checkGhInstalled,
+  checkGhAuthenticated,
+  checkGhScopes,
+  getGhToken,
+  getGhTokenWithSource,
+  validateGitHubToken,
+  resolveGitHubAuth,
+  ensureGhAuth,
+  runGhAuthLogin,
+  runGhAuthRefresh
 };

package/dist/{config-cmd-AZ7POMAA.js → config-cmd-DNXNL26Z.js}

@@ -28,7 +28,9 @@ var config_cmd_default = handler;
 async function configShow(options) {
   const config = await loadGlobalConfig(options.configDir);
   if (!config) {
-    process.stderr.write("No configuration found. Run 'gh-symphony init'.\n");
+    process.stderr.write(
+      "No configuration found. Run 'gh-symphony workflow init'.\n"
+    );
     process.exitCode = 1;
     return;
   }