@oomol-lab/open-connector 1.9.0 → 1.9.2

package/src/providers/fundable/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const credentialValidators: CredentialValidators;
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;

package/src/providers/fundable/executors.js

@@ -0,0 +1,74 @@
+import { optionalRecord, optionalString } from "../../core/cast.js";
+import { requiredResponseRecord, runProviderRequest, ProviderRequestError, providerInputError, defineApiKeyProviderExecutors, defineProviderProxy, } from "../provider-runtime.js";
+import { fundableActions } from "./actions.js";
+import { fundableRoutes } from "./actions.js";
+const fundableApiBaseUrl = "https://www.tryfundable.ai/api/v1";
+async function requestFundable(path, method, parameters, apiKey, fetcher, validating = false, parentSignal) {
+    const url = new URL(`${fundableApiBaseUrl}${path}`);
+    if (method === "GET") {
+        for (const [key, value] of Object.entries(parameters)) {
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        }
+    }
+    return runProviderRequest({ label: "fundable", signal: parentSignal }, async (signal) => {
+        const headers = new Headers({ accept: "application/json", authorization: `Bearer ${apiKey}` });
+        if (method === "POST")
+            headers.set("content-type", "application/json");
+        const response = await fetcher(url.toString(), {
+            method,
+            headers,
+            body: method === "POST" ? JSON.stringify(parameters) : undefined,
+            signal,
+        });
+        const text = await response.text();
+        let payload;
+        try {
+            payload = JSON.parse(text);
+        }
+        catch {
+            throw new ProviderRequestError(response.ok ? 502 : response.status, response.ok ? "fundable returned malformed JSON" : `fundable request failed (${response.status})`, undefined, "provider_error");
+        }
+        const object = optionalRecord(payload);
+        if (!response.ok || object?.success === false || object?.error != null) {
+            const error = optionalRecord(object?.error);
+            const code = optionalString(error?.code);
+            const message = optionalString(error?.message) ??
+                optionalString(object?.error) ??
+                optionalString(object?.message) ??
+                `fundable request failed (${response.status})`;
+            const detail = code ? `${code}: ${message}` : message;
+            if (code === "INVALID_API_KEY" || code === "INACTIVE_API_KEY") {
+                throw new ProviderRequestError(validating ? 400 : 409, detail, undefined, validating ? "invalid_input" : "authorization_failed");
+            }
+            throw new ProviderRequestError(response.ok ? 502 : response.status, detail, undefined, "provider_error");
+        }
+        return requiredResponseRecord(payload, "Fundable response");
+    });
+}
+async function execute(actionName, values, context) {
+    const { apiKey, fetcher } = context;
+    const route = fundableRoutes[actionName];
+    if (!route)
+        throw providerInputError("Unknown action route");
+    const path = route.path.replace("{id}", encodeURIComponent(String(values.id)));
+    const parameters = { ...values };
+    if (route.path.includes("{id}"))
+        delete parameters.id;
+    return requestFundable(path, route.method, parameters, apiKey, fetcher, undefined, context.signal);
+}
+export const credentialValidators = {
+    async apiKey(input, { fetcher, signal }) {
+        await requestFundable("/industry/search", "GET", { name: "software" }, input.apiKey, fetcher, true, signal);
+        return { profile: { displayName: "Fundable API Key" }, grantedScopes: [], metadata: {} };
+    },
+};
+export const executors = defineApiKeyProviderExecutors("fundable", Object.fromEntries(fundableActions.map((action) => [action.name, (values, context) => execute(action.name, values, context)])));
+export const proxy = defineProviderProxy({
+    service: "fundable",
+    baseUrl: fundableApiBaseUrl,
+    auth: { type: "api_key_authorization", prefix: "Bearer " },
+    customizeRequest({ headers }) {
+        headers.set("accept", "application/json");
+    },
+});

package/src/providers/fusion-api/operations.js

@@ -1,4 +1,41 @@
 export const fusionApiOperations = [
+    {
+        actionName: "oomol_ocr_submit",
+        operationType: "write",
+        method: "POST",
+        path: "/v1/oomol-ocr/submit",
+        tag: "oomol-ocr",
+        description: "Recognize image text and suggest corrections for Chinese typos",
+        successStatuses: [200],
+        pathParams: [],
+        inputFields: [
+            {
+                name: "imageURL",
+                kind: "string",
+                required: true,
+                description: "Publicly accessible image URL.",
+                format: "uri",
+            },
+            {
+                name: "correct",
+                kind: "boolean",
+                required: false,
+                description: "Generate Chinese typo correction suggestions after text recognition.",
+                defaultValue: true,
+            },
+        ],
+    },
+    {
+        actionName: "oomol_ocr_result",
+        operationType: "read",
+        method: "GET",
+        path: "/v1/oomol-ocr/result/{sessionID}",
+        tag: "oomol-ocr",
+        description: "Get image text recognition and Chinese typo correction results",
+        successStatuses: [200, 202, 404],
+        pathParams: ["sessionID"],
+        inputFields: [{ name: "sessionID", kind: "string", required: true, description: "Session ID" }],
+    },
     {
         actionName: "cphone_nano_banana_result",
         operationType: "read",

package/src/providers/fxbaogao/actions.d.ts

@@ -0,0 +1,2 @@
+import type { ActionDefinition } from "../../core/types.ts";
+export declare const fxbaogaoActions: ActionDefinition[];

package/src/providers/fxbaogao/actions.js

@@ -0,0 +1,74 @@
+import { jsonSchema as s } from "../../core/json-schema.js";
+import { defineProviderAction } from "../../core/provider-definition.js";
+const reportId = s.integer("Report ID returned by search_reports.");
+const raw = s.looseObject("Original upstream response, including additional fields.", {});
+const paragraph = s.looseObject("A matching report paragraph.", {
+    content: s.string("Paragraph text, possibly containing highlight markup."),
+    pageNum: s.integer("Page number within the report."),
+});
+export const fxbaogaoActions = [
+    defineProviderAction("fxbaogao", {
+        name: "search_reports",
+        description: "Search research reports by keywords, institutions, and publication time. Provide keywords or at least one institution; pages range from 1 to 10.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: {
+            ...s.object("Report search filters.", {
+                keywords: s.nonEmptyString("Search keywords; required unless orgNames contains an institution."),
+                orgNames: s.array("Institution names; required unless keywords is provided.", s.nonEmptyString("Institution name.")),
+                startTime: s.string("Start time as a millisecond timestamp string or last3day, last7day, last1mon, last3mon, last1year."),
+                endTime: s.string("End time as a millisecond timestamp string."),
+                pageNum: s.integer("Result page from 1 to 10; defaults to 1.", { minimum: 1, maximum: 10 }),
+            }, { required: [] }),
+            anyOf: [{ required: ["keywords"] }, { required: ["orgNames"], properties: { orgNames: { minItems: 1 } } }],
+        },
+        outputSchema: s.requiredObject("Search results with the original response retained.", {
+            reports: s.array("Matching research reports.", s.looseObject("Report metadata with upstream extension fields preserved.", {
+                reportId,
+                title: s.string("Report title, possibly containing highlight markup."),
+                orgName: s.string("Publishing institution, possibly containing highlight markup."),
+                pubTime: s.unknown("Publication timestamp as returned by the provider."),
+                pubTimeStr: s.string("Formatted publication date."),
+                industryName: s.string("Industry name."),
+                pageNum: s.integer("Number of pages in the report."),
+                paragraphs: s.array("Matching text excerpts.", paragraph),
+                reportUrl: s.string("Official report reading URL."),
+            })),
+            raw,
+        }),
+    }),
+    defineProviderAction("fxbaogao", {
+        name: "get_paragraphs",
+        description: "Read a report's summary and matching paragraphs. Use the PDF for full reading and original-source citations.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: s.object("Report and optional context keyword.", {
+            reportId,
+            keyword: s.string("Keyword used to locate relevant context within the report."),
+        }, { optional: ["keyword"] }),
+        outputSchema: s.object("Original report paragraph response.", {
+            code: s.integer("Upstream result code; zero indicates success."),
+            msg: s.string("Upstream message."),
+            data: s.looseObject("Report summary and matching passages.", {
+                title: s.string("Report title."),
+                summary: s.string("Report summary."),
+                paragraphs: s.array("Matching report paragraphs.", paragraph),
+            }),
+        }, { required: ["code", "data"], additionalProperties: true }),
+    }),
+    defineProviderAction("fxbaogao", {
+        name: "get_pdf_url",
+        description: "Get downloadable PDF URLs for a report without transferring binary content through the action response.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: s.requiredObject("Report to download.", { reportId }),
+        outputSchema: s.requiredObject("PDF resources and original upstream response.", {
+            reportId,
+            resources: s.array("Available PDF resources; empty when upstream returns no download URL.", s.requiredObject("A PDF resource.", {
+                field: s.string("Upstream field containing this resource."),
+                url: s.string("Absolute PDF download URL; it may expire."),
+            })),
+            raw,
+        }),
+    }),
+];

package/src/providers/fxbaogao/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const credentialValidators: CredentialValidators;
+export declare const proxy: ProviderProxyExecutor;

package/src/providers/fxbaogao/executors.js

@@ -0,0 +1,155 @@
+import { optionalRecord, optionalRawString, optionalNumber } from "../../core/cast.js";
+import { requiredInputString, requiredResponseRecord, ProviderRequestError, runProviderRequest, defineApiKeyProviderExecutors, defineProviderProxy, mapProviderActionHandlers, readProviderProxyErrorMessage, withRetryAfterSeconds, } from "../provider-runtime.js";
+import { fxbaogaoActions } from "./actions.js";
+const baseUrl = "https://api.fxbaogao.com";
+const defaultHeaders = { accept: "application/json", "content-type": "application/json" };
+const routes = {
+    search_reports: "/mofoun/agent/search",
+    get_paragraphs: "/mofoun/agent/paragraph",
+    get_pdf_url: "/mofoun/agent/download",
+};
+async function request({ route, input, apiKey, fetcher, parentSignal }) {
+    try {
+        return await runProviderRequest({ signal: parentSignal, label: "Fxbaogao" }, async (signal) => {
+            const download = route === routes.get_pdf_url;
+            const url = new URL(`${baseUrl}${route}`);
+            if (download)
+                url.searchParams.set("reportId", String(input.reportId));
+            const response = await fetcher(url.toString(), {
+                method: download ? "GET" : "POST",
+                headers: { ...defaultHeaders, authorization: `Bearer ${apiKey}` },
+                body: download ? undefined : JSON.stringify(input),
+                signal,
+            });
+            const text = await response.text();
+            let payload;
+            try {
+                payload = JSON.parse(text);
+            }
+            catch {
+                payload = undefined;
+            }
+            const body = optionalRecord(payload);
+            if (!response.ok || (body?.code != null && body.code !== 0)) {
+                const detail = [
+                    optionalRawString(body?.code) ?? optionalNumber(body?.code),
+                    optionalRawString(body?.msg) ?? optionalRawString(body?.message),
+                ]
+                    .filter((value) => value != null && value !== "")
+                    .join(": ") || `HTTP ${response.status}`;
+                throw new ProviderRequestError(response.ok ? 502 : response.status, `Fxbaogao request failed: ${detail}`, undefined, response.status === 429 ? "rate_limited" : "provider_error");
+            }
+            return requiredResponseRecord(payload, "Fxbaogao response");
+        });
+    }
+    catch (error) {
+        if (error instanceof ProviderRequestError)
+            error.message = error.message.split(apiKey).join("[REDACTED]");
+        throw error;
+    }
+}
+function extractPdfResources(payload) {
+    const resources = [];
+    const seen = new Set();
+    const urlKeys = new Set(["pdfurl", "url", "fileurl", "downloadurl"]);
+    function walk(value) {
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item);
+            return;
+        }
+        const object = optionalRecord(value);
+        if (!object)
+            return;
+        for (const [field, child] of Object.entries(object)) {
+            if (typeof child !== "string") {
+                walk(child);
+                continue;
+            }
+            const key = field.toLowerCase();
+            const reference = child.trim();
+            if (!reference ||
+                !(urlKeys.has(key) ||
+                    (key === "data" &&
+                        (reference.startsWith("http://") ||
+                            reference.startsWith("https://") ||
+                            reference.startsWith("/") ||
+                            reference.toLowerCase().includes(".pdf")))))
+                continue;
+            try {
+                const url = new URL(reference, "https://dr.fxbaogao.com/");
+                if ((url.protocol === "https:" || url.protocol === "http:") && !seen.has(url.href)) {
+                    seen.add(url.href);
+                    resources.push({ field, url: url.href });
+                }
+            }
+            catch {
+                /* 忽略上游不可解析的下载地址。 */
+            }
+        }
+    }
+    walk(payload);
+    return resources;
+}
+const handlers = mapProviderActionHandlers("fxbaogao", fxbaogaoActions, (action) => async (dataInput, context) => {
+    const route = routes[action.name];
+    const query = dataInput;
+    const body = action.name === "search_reports"
+        ? {
+            ...query,
+            keywords: query.keywords ?? "",
+            orgNames: query.orgNames ?? [],
+            pageNum: query.pageNum ?? 1,
+        }
+        : query;
+    const raw = await request({
+        route: route,
+        input: body,
+        apiKey: context.apiKey,
+        fetcher: context.fetcher,
+        parentSignal: context.signal,
+    });
+    if (action.name === "search_reports") {
+        const reports = Array.isArray(raw.data) ? raw.data : optionalRecord(raw.data)?.dataList;
+        if (!Array.isArray(reports))
+            throw new ProviderRequestError(502, "Fxbaogao search response is missing its report list", undefined, "provider_error");
+        return {
+            reports: reports.map((value) => {
+                const report = optionalRecord(value);
+                if (!report || report.reportId == null)
+                    return value;
+                return {
+                    ...report,
+                    reportUrl: `https://www.fxbaogao.com/view?id=${encodeURIComponent(String(report.reportId))}`,
+                };
+            }),
+            raw,
+        };
+    }
+    if (action.name === "get_pdf_url")
+        return { reportId: query.reportId, resources: extractPdfResources(raw), raw };
+    return raw;
+});
+export const executors = defineApiKeyProviderExecutors("fxbaogao", handlers, {
+    skipDnsValidation: true,
+});
+export const credentialValidators = {
+    async apiKey(input) {
+        requiredInputString(input.apiKey, "API Key");
+        return { profile: { displayName: "Fxbaogao API Key" }, grantedScopes: [], metadata: { apiBaseUrl: baseUrl } };
+    },
+};
+export const proxy = defineProviderProxy({
+    service: "fxbaogao",
+    baseUrl,
+    auth: { type: "api_key_authorization", prefix: "Bearer " },
+    skipDnsValidation: true,
+    customizeRequest({ headers }) {
+        for (const [name, value] of Object.entries({ accept: "application/json", "content-type": "application/json" }))
+            if (!headers.has(name))
+                headers.set(name, value);
+    },
+    async readError(response) {
+        return new ProviderRequestError(response.status, await readProviderProxyErrorMessage(response, "Provider request failed"), withRetryAfterSeconds(response), response.status === 429 ? "rate_limited" : "provider_error");
+    },
+});

package/src/providers/github/app-installation.d.ts

@@ -0,0 +1,37 @@
+export interface GitHubAppInstallationCredential {
+    appId: string;
+    installationId: string;
+    /** PKCS#8 PEM, converted from the PKCS#1 PEM GitHub downloads when needed. */
+    privateKey: string;
+}
+interface GitHubInstallationToken {
+    token: string;
+    /** ISO timestamp from GitHub; tokens live one hour. */
+    expiresAt: string;
+    permissions: Record<string, string>;
+    repositorySelection: string | undefined;
+}
+interface GitHubAppInstallation {
+    id: number;
+    account: Record<string, unknown>;
+    permissions: Record<string, string>;
+    repository_selection: string;
+    [key: string]: unknown;
+}
+export declare function readGitHubAppInstallationCredential(values: Record<string, string>): GitHubAppInstallationCredential;
+/**
+ * Wrap a PKCS#1 RSAPrivateKey in the PKCS#8 PrivateKeyInfo structure WebCrypto
+ * imports. The wrapper is fixed for RSA: version 0, the rsaEncryption algorithm
+ * identifier with a NULL parameter, then the PKCS#1 DER as an OCTET STRING.
+ */
+export declare function pkcs1ToPkcs8Pem(pkcs1Pem: string): string;
+/** Sign the App JWT GitHub's App endpoints and the token mint take as bearer. */
+export declare function signGitHubAppJwt(credential: GitHubAppInstallationCredential): Promise<string>;
+/** Describe the installation the credential names, authenticated as the App. */
+export declare function fetchGitHubAppInstallation(credential: GitHubAppInstallationCredential, fetcher: typeof fetch, signal?: AbortSignal): Promise<GitHubAppInstallation>;
+/** Mint an installation access token with the App's full granted permissions. */
+export declare function mintGitHubInstallationToken(credential: GitHubAppInstallationCredential, fetcher: typeof fetch, signal?: AbortSignal): Promise<GitHubInstallationToken>;
+export declare function clearGitHubInstallationTokenCache(): void;
+/** Resolve installation tokens without letting one caller cancel a shared mint. */
+export declare function createGitHubInstallationTokenResolver(values: Record<string, string>, fetcher: typeof fetch): (signal?: AbortSignal) => Promise<string>;
+export {};

package/src/providers/github/app-installation.js

@@ -0,0 +1,233 @@
+import { importPKCS8, SignJWT } from "jose";
+import { sha256Hex } from "../../core/aws-sigv4.js";
+import { base64Bytes, optionalRecord, optionalString, stringRecord } from "../../core/cast.js";
+import { ProviderRequestError, requiredInputString, runProviderRequest } from "../provider-runtime.js";
+import { githubRequestJson } from "./runtime-shared.js";
+/**
+ * GitHub App installation credentials.
+ *
+ * A GitHub App authenticates in two steps: the App's private key signs a short
+ * RS256 JWT that identifies the App, and that JWT is exchanged for an
+ * installation access token scoped to one installation (an account that
+ * installed the App and the repositories it selected). Installation tokens are
+ * what the REST API accepts on repository endpoints; they expire after one hour
+ * and cannot be refreshed, only minted again.
+ *
+ * The stored credential therefore holds the three inputs of that exchange —
+ * `appId`, `installationId`, `privateKey` — and the runtime mints tokens on
+ * demand, reusing one across calls until shortly before it expires.
+ */
+/** GitHub refuses an App JWT older than ten minutes; nine leaves room for clock skew. */
+const appJwtLifetimeSeconds = 9 * 60;
+/** Issued-at is backdated so a runtime clock slightly ahead of GitHub's still validates. */
+const appJwtClockSkewSeconds = 60;
+/** A cached installation token is replaced this long before GitHub expires it. */
+const installationTokenRenewalMarginMs = 5 * 60 * 1000;
+const pkcs8Marker = "-----BEGIN PRIVATE KEY-----";
+const pkcs1Marker = "-----BEGIN RSA PRIVATE KEY-----";
+export function readGitHubAppInstallationCredential(values) {
+    const appId = requiredInputString(values.appId, "appId").trim();
+    if (!/^\d+$/u.test(appId)) {
+        throw new ProviderRequestError(400, "appId must be the numeric App ID shown on the GitHub App's settings page");
+    }
+    const installationId = requiredInputString(values.installationId, "installationId").trim();
+    if (!/^\d+$/u.test(installationId)) {
+        throw new ProviderRequestError(400, "installationId must be the numeric installation id from the installation's settings URL or the post-install redirect");
+    }
+    return { appId, installationId, privateKey: normalizePrivateKey(values.privateKey) };
+}
+/**
+ * Accept the key as GitHub downloads it (PKCS#1, `BEGIN RSA PRIVATE KEY`) or
+ * already converted to PKCS#8, with literal or escaped line breaks.
+ */
+function normalizePrivateKey(value) {
+    const pem = requiredInputString(value, "privateKey").replaceAll("\\n", "\n").trim();
+    if (pem.includes(pkcs8Marker)) {
+        return pem;
+    }
+    if (pem.includes(pkcs1Marker)) {
+        return pkcs1ToPkcs8Pem(pem);
+    }
+    throw new ProviderRequestError(400, "privateKey must be the PEM contents of the GitHub App private key (.pem) file, starting with -----BEGIN RSA PRIVATE KEY-----");
+}
+/**
+ * Wrap a PKCS#1 RSAPrivateKey in the PKCS#8 PrivateKeyInfo structure WebCrypto
+ * imports. The wrapper is fixed for RSA: version 0, the rsaEncryption algorithm
+ * identifier with a NULL parameter, then the PKCS#1 DER as an OCTET STRING.
+ */
+export function pkcs1ToPkcs8Pem(pkcs1Pem) {
+    const base64 = pkcs1Pem.replace(pkcs1Marker, "").replace("-----END RSA PRIVATE KEY-----", "").replace(/\s+/gu, "");
+    const pkcs1 = base64ToBytes(base64);
+    const algorithm = Uint8Array.from([
+        0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00,
+    ]);
+    const version = Uint8Array.from([0x02, 0x01, 0x00]);
+    const keyOctets = derTlv(0x04, pkcs1);
+    const body = concatBytes(version, algorithm, keyOctets);
+    const pkcs8 = derTlv(0x30, body);
+    const lines = bytesToBase64(pkcs8).match(/.{1,64}/gu) ?? [];
+    return `${pkcs8Marker}\n${lines.join("\n")}\n-----END PRIVATE KEY-----`;
+}
+function derTlv(tag, value) {
+    return concatBytes(Uint8Array.from([tag]), derLength(value.byteLength), value);
+}
+function derLength(length) {
+    if (length < 0x80) {
+        return Uint8Array.from([length]);
+    }
+    const bytes = [];
+    for (let remaining = length; remaining > 0; remaining = Math.floor(remaining / 0x100)) {
+        bytes.unshift(remaining % 0x100);
+    }
+    return Uint8Array.from([0x80 | bytes.length, ...bytes]);
+}
+function concatBytes(...parts) {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.byteLength;
+    }
+    return out;
+}
+function base64ToBytes(base64) {
+    return base64Bytes(base64, "privateKey", () => new ProviderRequestError(400, "privateKey is not a valid PEM: its body is not base64"));
+}
+/**
+ * Encode DER bytes for a PEM body. These are key bytes assembled one at a
+ * time, so the binary string is Latin-1 by construction; the `btoa` fallback
+ * is the same shape the provider source guard allowlists for gitea and
+ * pi_hole, and it never sees a credential string.
+ */
+function bytesToBase64(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
+    }
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+/** Sign the App JWT GitHub's App endpoints and the token mint take as bearer. */
+export async function signGitHubAppJwt(credential) {
+    let signingKey;
+    try {
+        signingKey = await importPKCS8(credential.privateKey, "RS256");
+    }
+    catch {
+        throw new ProviderRequestError(400, "privateKey must be an RSA private key in PEM format, as downloaded from the GitHub App's settings page");
+    }
+    const now = Math.floor(Date.now() / 1000);
+    return new SignJWT({})
+        .setProtectedHeader({ alg: "RS256", typ: "JWT" })
+        .setIssuer(credential.appId)
+        .setIssuedAt(now - appJwtClockSkewSeconds)
+        .setExpirationTime(now - appJwtClockSkewSeconds + appJwtLifetimeSeconds)
+        .sign(signingKey);
+}
+/** Describe the installation the credential names, authenticated as the App. */
+export async function fetchGitHubAppInstallation(credential, fetcher, signal) {
+    return runProviderRequest({ label: "GitHub installation", signal }, async (signal) => githubRequestJson({
+        path: `/app/installations/${encodeURIComponent(credential.installationId)}`,
+        accessToken: await signGitHubAppJwt(credential),
+        fetcher,
+        signal,
+    }));
+}
+/** Mint an installation access token with the App's full granted permissions. */
+export async function mintGitHubInstallationToken(credential, fetcher, signal) {
+    return runProviderRequest({ label: "GitHub installation token", signal }, async (signal) => {
+        const minted = await githubRequestJson({
+            method: "POST",
+            path: `/app/installations/${encodeURIComponent(credential.installationId)}/access_tokens`,
+            body: {},
+            accessToken: await signGitHubAppJwt(credential),
+            fetcher,
+            signal,
+        });
+        const token = optionalString(minted.token);
+        const expiresAt = optionalString(minted.expires_at);
+        if (!token || !expiresAt) {
+            throw new ProviderRequestError(500, "GitHub returned an installation token without a token or expiry", 502);
+        }
+        return {
+            token,
+            expiresAt,
+            permissions: stringRecord(optionalRecord(minted.permissions) ?? {}),
+            repositorySelection: optionalString(minted.repository_selection),
+        };
+    });
+}
+/**
+ * Installation tokens shared across action runs in this process, keyed by App,
+ * installation and private-key digest. A token is reused until five minutes before GitHub expires
+ * it; a failed mint evicts itself so the next run retries instead of inheriting
+ * the rejection.
+ */
+const installationTokens = new Map();
+export function clearGitHubInstallationTokenCache() {
+    installationTokens.clear();
+}
+function cachedInstallationToken(credential, fetcher) {
+    const key = `${credential.appId}:${credential.installationId}:${sha256Hex(credential.privateKey)}`;
+    const cached = installationTokens.get(key);
+    if (!cached) {
+        return refreshInstallationToken(key, credential, fetcher);
+    }
+    // No rejection handler, deliberately. A caller that joined an in-flight mint
+    // is told that the mint failed; the eviction in `refreshInstallationToken`
+    // has already made the NEXT call start over, so retrying here would turn one
+    // failure into a burst of one retry per waiting caller.
+    return cached.then((token) => {
+        if (isFresh(token)) {
+            return token;
+        }
+        // Stale. Another caller may already have started the replacement while
+        // this one was waiting on the old promise; join it rather than minting a
+        // second token for the same installation.
+        const latest = installationTokens.get(key);
+        return latest && latest !== cached ? latest : refreshInstallationToken(key, credential, fetcher);
+    });
+}
+function refreshInstallationToken(key, credential, fetcher) {
+    const current = installationTokens.get(key);
+    const minting = mintGitHubInstallationToken(credential, fetcher);
+    installationTokens.set(key, minting);
+    void minting.catch(() => {
+        if (installationTokens.get(key) === minting) {
+            if (current) {
+                installationTokens.set(key, current);
+            }
+            else {
+                installationTokens.delete(key);
+            }
+        }
+    });
+    return minting;
+}
+function isFresh(token) {
+    const expiresAt = Date.parse(token.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt - Date.now() > installationTokenRenewalMarginMs;
+}
+/** Resolve installation tokens without letting one caller cancel a shared mint. */
+export function createGitHubInstallationTokenResolver(values, fetcher) {
+    const credential = readGitHubAppInstallationCredential(values);
+    return async (signal) => {
+        signal?.throwIfAborted();
+        const pending = cachedInstallationToken(credential, fetcher);
+        if (!signal)
+            return (await pending).token;
+        return new Promise((resolve, reject) => {
+            const abort = () => reject(signal.reason);
+            signal.addEventListener("abort", abort, { once: true });
+            void pending.then((token) => {
+                signal.removeEventListener("abort", abort);
+                resolve(token.token);
+            }, (error) => {
+                signal.removeEventListener("abort", abort);
+                reject(error);
+            });
+        });
+    };
+}