@jant/core 0.6.15 → 0.7.0

package/dist/github-app-BbklkFmU.js

@@ -1,275 +0,0 @@
-import { b as __exportAll } from "./url-BMYO-Zlt.js";
-//#region src/lib/github-app.ts
-var github_app_exports = /* @__PURE__ */ __exportAll({
-	buildInstallUrl: () => buildInstallUrl,
-	createAppJwt: () => createAppJwt,
-	getInstallation: () => getInstallation,
-	getInstallationToken: () => getInstallationToken,
-	listInstallationReposPage: () => listInstallationReposPage,
-	searchInstallationRepos: () => searchInstallationRepos
-});
-/**
-* GitHub App authentication helpers.
-*
-* Implements the App → installation token exchange using Web Crypto so it
-* runs unchanged in Cloudflare Workers and Node 18+.
-*
-* Flow:
-*  1. Sign a short-lived JWT with the App's RSA private key (RS256).
-*  2. Exchange the JWT for a per-installation access token.
-*  3. Cache the installation token in-process until shortly before expiry.
-*
-* The installation token can then be passed to `createGitHubClient` the same
-* way a PAT is — the downstream client is auth-agnostic.
-*/ var GITHUB_API = "https://api.github.com";
-var tokenCache = /* @__PURE__ */ new Map();
-var CACHE_SAFETY_MARGIN_SECONDS = 60;
-function cacheKey(appId, installationId) {
-	return `${appId}:${installationId}`;
-}
-function base64UrlEncode(input) {
-	let bytes;
-	if (typeof input === "string") bytes = new TextEncoder().encode(input);
-	else if (input instanceof Uint8Array) bytes = input;
-	else bytes = new Uint8Array(input);
-	let binary = "";
-	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/**
-* ASN.1 DER length encoding (short form for < 128, long form otherwise).
-* Used to wrap a PKCS#1 key inside a PKCS#8 envelope.
-*/ function encodeDerLength(len) {
-	if (len < 128) return [len];
-	if (len <= 255) return [129, len];
-	if (len <= 65535) return [
-		130,
-		len >> 8 & 255,
-		len & 255
-	];
-	throw new Error("Private key too large to encode");
-}
-/**
-* Wrap a PKCS#1 `RSAPrivateKey` DER blob in a PKCS#8 `PrivateKeyInfo` envelope.
-* Web Crypto's `importKey("pkcs8", ...)` only accepts PKCS#8, but GitHub
-* hands out PKCS#1 PEMs (`-----BEGIN RSA PRIVATE KEY-----`) by default, so
-* we wrap on the fly when we detect that header.
-*/ function wrapPkcs1AsPkcs8(pkcs1) {
-	const rsaAlgorithmIdentifier = [
-		48,
-		13,
-		6,
-		9,
-		42,
-		134,
-		72,
-		134,
-		247,
-		13,
-		1,
-		1,
-		1,
-		5,
-		0
-	];
-	const version = [
-		2,
-		1,
-		0
-	];
-	const octetStringHeader = [4, ...encodeDerLength(pkcs1.length)];
-	const bodyLen = version.length + rsaAlgorithmIdentifier.length + octetStringHeader.length + pkcs1.length;
-	const outerHeader = [48, ...encodeDerLength(bodyLen)];
-	const out = new Uint8Array(outerHeader.length + bodyLen);
-	let off = 0;
-	out.set(outerHeader, off);
-	off += outerHeader.length;
-	out.set(version, off);
-	off += version.length;
-	out.set(rsaAlgorithmIdentifier, off);
-	off += rsaAlgorithmIdentifier.length;
-	out.set(octetStringHeader, off);
-	off += octetStringHeader.length;
-	out.set(pkcs1, off);
-	return out;
-}
-function pemToPkcs8(pem) {
-	const isPkcs1 = /-----BEGIN RSA PRIVATE KEY-----/.test(pem);
-	const cleaned = pem.replace(/-----BEGIN [^-]+-----/g, "").replace(/-----END [^-]+-----/g, "").replace(/\s+/g, "");
-	if (!cleaned) throw new Error("Empty GitHub App private key");
-	const binary = atob(cleaned);
-	const rawDer = new Uint8Array(binary.length);
-	for (let i = 0; i < binary.length; i++) rawDer[i] = binary.charCodeAt(i);
-	const pkcs8 = isPkcs1 ? wrapPkcs1AsPkcs8(rawDer) : rawDer;
-	const out = new ArrayBuffer(pkcs8.byteLength);
-	new Uint8Array(out).set(pkcs8);
-	return out;
-}
-async function importPrivateKey(pem) {
-	return crypto.subtle.importKey("pkcs8", pemToPkcs8(pem), {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-}
-/**
-* Create a JWT signed with the GitHub App's private key.
-*
-* GitHub allows up to 10 minutes; we issue 9 minutes with a 60s backdated `iat`
-* to tolerate clock skew.
-*/ async function createAppJwt(appId, privateKeyPem) {
-	const now = Math.floor(Date.now() / 1e3);
-	const header = {
-		alg: "RS256",
-		typ: "JWT"
-	};
-	const payload = {
-		iat: now - 60,
-		exp: now + 540,
-		iss: appId
-	};
-	const signingInput = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(payload))}`;
-	const key = await importPrivateKey(privateKeyPem);
-	return `${signingInput}.${base64UrlEncode(await crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(signingInput)))}`;
-}
-/**
-* Fetch (or reuse) a short-lived installation access token.
-*
-* Results are cached in-process until `CACHE_SAFETY_MARGIN_SECONDS` before the
-* real expiry so the same token can be reused across a burst of API calls.
-*/ async function getInstallationToken(app, installationId) {
-	const key = cacheKey(app.appId, installationId);
-	const cached = tokenCache.get(key);
-	const nowSec = Math.floor(Date.now() / 1e3);
-	if (cached && cached.expiresAt > nowSec) return cached.token;
-	const jwt = await createAppJwt(app.appId, app.privateKey);
-	const res = await fetch(`${GITHUB_API}/app/installations/${installationId}/access_tokens`, {
-		method: "POST",
-		headers: {
-			Accept: "application/vnd.github+json",
-			Authorization: `Bearer ${jwt}`,
-			"User-Agent": "jant-github-sync",
-			"X-GitHub-Api-Version": "2022-11-28"
-		}
-	});
-	if (!res.ok) {
-		const body = await res.text();
-		throw new Error(`GitHub App token exchange failed (${res.status}): ${body}`);
-	}
-	const data = await res.json();
-	const expiresAt = Math.floor(new Date(data.expires_at).getTime() / 1e3) - CACHE_SAFETY_MARGIN_SECONDS;
-	tokenCache.set(key, {
-		token: data.token,
-		expiresAt
-	});
-	return data.token;
-}
-/**
-* Build the URL users visit to install the GitHub App on their account/org.
-*
-* `state` is a CSRF token the caller should verify on the redirect back.
-*/ function buildInstallUrl(slug, state) {
-	const params = new URLSearchParams({ state });
-	return `https://github.com/apps/${encodeURIComponent(slug)}/installations/new?${params.toString()}`;
-}
-/**
-* Fetch metadata for a given installation, including the account it's
-* installed on. Uses an App JWT because the target endpoint is
-* `/app/installations/{id}`, which is App-scoped, not installation-scoped.
-*/ async function getInstallation(app, installationId) {
-	const jwt = await createAppJwt(app.appId, app.privateKey);
-	const res = await fetch(`${GITHUB_API}/app/installations/${encodeURIComponent(installationId)}`, { headers: {
-		Accept: "application/vnd.github+json",
-		Authorization: `Bearer ${jwt}`,
-		"User-Agent": "jant-github-sync",
-		"X-GitHub-Api-Version": "2022-11-28"
-	} });
-	if (!res.ok) {
-		const body = await res.text();
-		throw new Error(`Fetching installation failed (${res.status}): ${body}`);
-	}
-	const data = await res.json();
-	const type = data.account.type === "Organization" ? "Organization" : "User";
-	return { account: {
-		login: data.account.login,
-		type,
-		avatarUrl: data.account.avatar_url ?? ""
-	} };
-}
-/**
-* Fetch a single page of installation repositories.
-*
-* Used by the picker for lazy-loading. Callers can either stop after the
-* first page (UI does local filtering) or keep paging for larger accounts.
-* For search, prefer `searchInstallationRepos` — this endpoint does not
-* support a query parameter.
-*/ async function listInstallationReposPage(app, installationId, page, perPage = 100) {
-	const token = await getInstallationToken(app, installationId);
-	const res = await fetch(`${GITHUB_API}/installation/repositories?per_page=${perPage}&page=${page}`, { headers: {
-		Accept: "application/vnd.github+json",
-		Authorization: `Bearer ${token}`,
-		"User-Agent": "jant-github-sync",
-		"X-GitHub-Api-Version": "2022-11-28"
-	} });
-	if (!res.ok) {
-		const body = await res.text();
-		throw new Error(`Listing installation repos failed: ${res.status} ${body}`);
-	}
-	const data = await res.json();
-	const repos = data.repositories.slice().sort((a, b) => {
-		const at = Date.parse(a.updated_at ?? a.created_at ?? "") || 0;
-		return (Date.parse(b.updated_at ?? b.created_at ?? "") || 0) - at;
-	}).map((r) => ({
-		fullName: r.full_name,
-		name: r.name,
-		private: r.private,
-		defaultBranch: r.default_branch
-	}));
-	const hasMore = repos.length === perPage;
-	return {
-		repos,
-		totalCount: data.total_count,
-		hasMore,
-		nextPage: hasMore ? page + 1 : null
-	};
-}
-/**
-* Search the installation's repositories via `GET /search/repositories`.
-*
-* GitHub's Search API doesn't scope automatically to an installation, so
-* we filter server-side by the installation's account login. This keeps
-* results relevant while still covering repos past the first 100.
-*
-* The `q` string is wrapped (caller passes raw user input, we add the
-* scope qualifier). Uses the installation token for auth.
-*/ async function searchInstallationRepos(app, installationId, accountLogin, q, perPage = 30) {
-	const token = await getInstallationToken(app, installationId);
-	const fullQuery = `${q} in:name user:${accountLogin} fork:true`;
-	const params = new URLSearchParams({
-		q: fullQuery,
-		per_page: String(perPage),
-		sort: "updated",
-		order: "desc"
-	});
-	const res = await fetch(`${GITHUB_API}/search/repositories?${params.toString()}`, { headers: {
-		Accept: "application/vnd.github+json",
-		Authorization: `Bearer ${token}`,
-		"User-Agent": "jant-github-sync",
-		"X-GitHub-Api-Version": "2022-11-28"
-	} });
-	if (!res.ok) {
-		const body = await res.text();
-		throw new Error(`Searching repos failed: ${res.status} ${body}`);
-	}
-	const data = await res.json();
-	return {
-		repos: data.items.map((r) => ({
-			fullName: r.full_name,
-			name: r.name,
-			private: r.private,
-			defaultBranch: r.default_branch
-		})),
-		totalCount: data.total_count
-	};
-}
-//#endregion
-export { listInstallationReposPage as a, github_app_exports as i, getInstallation as n, searchInstallationRepos as o, getInstallationToken as r, buildInstallUrl as t };