@shipfox/api-integration-github 2.0.0

package/dist/api/installation-token-envelope.d.ts

@@ -0,0 +1,36 @@
+import { type IntegrationProviderErrorReason } from '@shipfox/api-integration-core-dto';
+import { GithubIntegrationProviderError } from '#core/errors.js';
+export declare const TOKEN_REFRESH_MARGIN_MS: number;
+export declare const TOKEN_VALIDITY_BUFFER_MS: number;
+export declare const TRANSIENT_BACKOFF_MIN_MS: number;
+export declare const TRANSIENT_BACKOFF_MAX_MS: number;
+export declare const TERMINAL_BACKOFF_MS: number;
+export interface InstallationTokenEnvelope {
+    token?: string | undefined;
+    expiresAt?: Date | undefined;
+    permissions?: Record<string, 'read' | 'write' | 'admin'> | undefined;
+    backoffUntil?: Date | undefined;
+    backoffReason?: IntegrationProviderErrorReason | undefined;
+}
+export type MintErrorClass = 'transient' | 'terminal';
+export interface ClassifiedMintError {
+    class: MintErrorClass;
+    reason: IntegrationProviderErrorReason;
+    retryAfterSeconds?: number | undefined;
+}
+export declare function githubInstallationTokenNamespace(installationId: number): string;
+export declare function encodeInstallationTokenEnvelope(envelope: InstallationTokenEnvelope): string;
+export declare function parseInstallationTokenEnvelope(raw: string): InstallationTokenEnvelope | undefined;
+export declare function usable(envelope: InstallationTokenEnvelope | undefined, now: Date): envelope is InstallationTokenEnvelope & {
+    token: string;
+    expiresAt: Date;
+};
+export declare function needsRefresh(expiresAt: Date, now: Date): boolean;
+export declare function stillValid(expiresAt: Date | undefined, now: Date): boolean;
+export declare function backoffActive(envelope: InstallationTokenEnvelope | undefined, now: Date): boolean;
+export declare function classifyMintError(error: unknown): ClassifiedMintError;
+export declare function mintErrorClassForReason(reason: IntegrationProviderErrorReason): MintErrorClass;
+export declare function backoffMs(classified: ClassifiedMintError): number;
+export declare function providerErrorFromBackoff(reason: IntegrationProviderErrorReason, retryAfterMs: number): GithubIntegrationProviderError;
+export declare function toProviderError(error: unknown): GithubIntegrationProviderError;
+//# sourceMappingURL=installation-token-envelope.d.ts.map

package/dist/api/installation-token-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token-envelope.d.ts","sourceRoot":"","sources":["../../src/api/installation-token-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAC,8BAA8B,EAAC,MAAM,iBAAiB,CAAC;AAE/D,eAAO,MAAM,uBAAuB,QAAgB,CAAC;AACrD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAClD,eAAO,MAAM,wBAAwB,QAAY,CAAC;AAClD,eAAO,MAAM,wBAAwB,QAAgB,CAAC;AACtD,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAqClD,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IACrE,YAAY,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAChC,aAAa,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;CAC5D;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,UAAU,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,cAAc,CAAC;IACtB,MAAM,EAAE,8BAA8B,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM,CAU3F;AAED,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAkBjG;AAED,wBAAgB,MAAM,CACpB,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAC/C,GAAG,EAAE,IAAI,GACR,QAAQ,IAAI,yBAAyB,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAC,CAM1E;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAEhE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,IAAI,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAE1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,yBAAyB,GAAG,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAMjG;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAUrE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,8BAA8B,GAAG,cAAc,CAE9F;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,mBAAmB,GAAG,MAAM,CAKjE;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,8BAA8B,EACtC,YAAY,EAAE,MAAM,GACnB,8BAA8B,CAMhC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAS9E"}

package/dist/api/installation-token-envelope.js

@@ -0,0 +1,123 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+import { z } from 'zod';
+import { GithubIntegrationProviderError } from '#core/errors.js';
+export const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+export const TOKEN_VALIDITY_BUFFER_MS = 60 * 1000;
+export const TRANSIENT_BACKOFF_MIN_MS = 30 * 1000;
+export const TRANSIENT_BACKOFF_MAX_MS = 5 * 60 * 1000;
+export const TERMINAL_BACKOFF_MS = 15 * 60 * 1000;
+const providerErrorReasons = [
+    'repository-not-found',
+    'installation-not-found',
+    'file-not-found',
+    'access-denied',
+    'rate-limited',
+    'timeout',
+    'provider-unavailable',
+    'malformed-provider-response',
+    'content-too-large',
+    'too-many-files'
+];
+const providerErrorReasonSchema = z.enum(providerErrorReasons);
+const terminalMintErrorReasons = new Set([
+    'access-denied',
+    'installation-not-found',
+    'malformed-provider-response'
+]);
+const providerErrorReasonSchemaCoversUnion = {};
+void providerErrorReasonSchemaCoversUnion;
+const installationTokenEnvelopeSchema = z.object({
+    token: z.string().min(1).optional(),
+    expiresAt: z.string().datetime().optional(),
+    permissions: z.record(z.string(), z.enum([
+        'read',
+        'write',
+        'admin'
+    ])).optional(),
+    backoffUntil: z.string().datetime().optional(),
+    backoffReason: providerErrorReasonSchema.optional()
+});
+export function githubInstallationTokenNamespace(installationId) {
+    return `system/github/installation-token/${installationId}`;
+}
+export function encodeInstallationTokenEnvelope(envelope) {
+    return JSON.stringify({
+        ...envelope.token !== undefined && {
+            token: envelope.token
+        },
+        ...envelope.expiresAt !== undefined && {
+            expiresAt: envelope.expiresAt.toISOString()
+        },
+        ...envelope.permissions !== undefined && {
+            permissions: envelope.permissions
+        },
+        ...envelope.backoffUntil !== undefined && {
+            backoffUntil: envelope.backoffUntil.toISOString()
+        },
+        ...envelope.backoffReason !== undefined && {
+            backoffReason: envelope.backoffReason
+        }
+    });
+}
+export function parseInstallationTokenEnvelope(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    } catch  {
+        return undefined;
+    }
+    const result = installationTokenEnvelopeSchema.safeParse(parsed);
+    if (!result.success) return undefined;
+    return {
+        token: result.data.token,
+        expiresAt: result.data.expiresAt ? new Date(result.data.expiresAt) : undefined,
+        permissions: result.data.permissions,
+        backoffUntil: result.data.backoffUntil ? new Date(result.data.backoffUntil) : undefined,
+        backoffReason: result.data.backoffReason
+    };
+}
+export function usable(envelope, now) {
+    return envelope?.token !== undefined && envelope.expiresAt !== undefined && !needsRefresh(envelope.expiresAt, now);
+}
+export function needsRefresh(expiresAt, now) {
+    return expiresAt.getTime() <= now.getTime() + TOKEN_REFRESH_MARGIN_MS;
+}
+export function stillValid(expiresAt, now) {
+    return expiresAt !== undefined && expiresAt.getTime() > now.getTime() + TOKEN_VALIDITY_BUFFER_MS;
+}
+export function backoffActive(envelope, now) {
+    return envelope?.backoffUntil !== undefined && envelope.backoffReason !== undefined && envelope.backoffUntil.getTime() > now.getTime();
+}
+export function classifyMintError(error) {
+    if (error instanceof IntegrationProviderError) {
+        return {
+            reason: error.reason,
+            retryAfterSeconds: error.retryAfterSeconds,
+            class: mintErrorClassForReason(error.reason)
+        };
+    }
+    return {
+        reason: 'provider-unavailable',
+        class: 'transient'
+    };
+}
+export function mintErrorClassForReason(reason) {
+    return terminalMintErrorReasons.has(reason) ? 'terminal' : 'transient';
+}
+export function backoffMs(classified) {
+    if (classified.class === 'terminal') return TERMINAL_BACKOFF_MS;
+    const retryAfterMs = (classified.retryAfterSeconds ?? 0) * 1000;
+    return Math.min(TRANSIENT_BACKOFF_MAX_MS, Math.max(TRANSIENT_BACKOFF_MIN_MS, retryAfterMs));
+}
+export function providerErrorFromBackoff(reason, retryAfterMs) {
+    return new GithubIntegrationProviderError(reason, `GitHub installation token mint is backed off after ${reason}`, Math.max(1, Math.ceil(retryAfterMs / 1000)));
+}
+export function toProviderError(error) {
+    if (error instanceof GithubIntegrationProviderError) return error;
+    if (error instanceof IntegrationProviderError) {
+        return new GithubIntegrationProviderError(error.reason, error.message, error.retryAfterSeconds);
+    }
+    return new GithubIntegrationProviderError('provider-unavailable', error instanceof Error ? error.message : 'GitHub installation token mint failed');
+}
+
+//# sourceMappingURL=installation-token-envelope.js.map

package/dist/api/installation-token-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/installation-token-envelope.ts"],"sourcesContent":["import {\n  IntegrationProviderError,\n  type IntegrationProviderErrorReason,\n} from '@shipfox/api-integration-core-dto';\nimport {z} from 'zod';\nimport {GithubIntegrationProviderError} from '#core/errors.js';\n\nexport const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;\nexport const TOKEN_VALIDITY_BUFFER_MS = 60 * 1000;\nexport const TRANSIENT_BACKOFF_MIN_MS = 30 * 1000;\nexport const TRANSIENT_BACKOFF_MAX_MS = 5 * 60 * 1000;\nexport const TERMINAL_BACKOFF_MS = 15 * 60 * 1000;\n\nconst providerErrorReasons = [\n  'repository-not-found',\n  'installation-not-found',\n  'file-not-found',\n  'access-denied',\n  'rate-limited',\n  'timeout',\n  'provider-unavailable',\n  'malformed-provider-response',\n  'content-too-large',\n  'too-many-files',\n] as const satisfies readonly IntegrationProviderErrorReason[];\n\nconst providerErrorReasonSchema = z.enum(providerErrorReasons);\nconst terminalMintErrorReasons = new Set<IntegrationProviderErrorReason>([\n  'access-denied',\n  'installation-not-found',\n  'malformed-provider-response',\n]);\n\ntype MissingProviderErrorReason = Exclude<\n  IntegrationProviderErrorReason,\n  (typeof providerErrorReasons)[number]\n>;\nconst providerErrorReasonSchemaCoversUnion: Record<MissingProviderErrorReason, never> = {};\nvoid providerErrorReasonSchemaCoversUnion;\n\nconst installationTokenEnvelopeSchema = z.object({\n  token: z.string().min(1).optional(),\n  expiresAt: z.string().datetime().optional(),\n  permissions: z.record(z.string(), z.enum(['read', 'write', 'admin'])).optional(),\n  backoffUntil: z.string().datetime().optional(),\n  backoffReason: providerErrorReasonSchema.optional(),\n});\n\nexport interface InstallationTokenEnvelope {\n  token?: string | undefined;\n  expiresAt?: Date | undefined;\n  permissions?: Record<string, 'read' | 'write' | 'admin'> | undefined;\n  backoffUntil?: Date | undefined;\n  backoffReason?: IntegrationProviderErrorReason | undefined;\n}\n\nexport type MintErrorClass = 'transient' | 'terminal';\n\nexport interface ClassifiedMintError {\n  class: MintErrorClass;\n  reason: IntegrationProviderErrorReason;\n  retryAfterSeconds?: number | undefined;\n}\n\nexport function githubInstallationTokenNamespace(installationId: number): string {\n  return `system/github/installation-token/${installationId}`;\n}\n\nexport function encodeInstallationTokenEnvelope(envelope: InstallationTokenEnvelope): string {\n  return JSON.stringify({\n    ...(envelope.token !== undefined && {token: envelope.token}),\n    ...(envelope.expiresAt !== undefined && {expiresAt: envelope.expiresAt.toISOString()}),\n    ...(envelope.permissions !== undefined && {permissions: envelope.permissions}),\n    ...(envelope.backoffUntil !== undefined && {\n      backoffUntil: envelope.backoffUntil.toISOString(),\n    }),\n    ...(envelope.backoffReason !== undefined && {backoffReason: envelope.backoffReason}),\n  });\n}\n\nexport function parseInstallationTokenEnvelope(raw: string): InstallationTokenEnvelope | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    return undefined;\n  }\n\n  const result = installationTokenEnvelopeSchema.safeParse(parsed);\n  if (!result.success) return undefined;\n\n  return {\n    token: result.data.token,\n    expiresAt: result.data.expiresAt ? new Date(result.data.expiresAt) : undefined,\n    permissions: result.data.permissions,\n    backoffUntil: result.data.backoffUntil ? new Date(result.data.backoffUntil) : undefined,\n    backoffReason: result.data.backoffReason,\n  };\n}\n\nexport function usable(\n  envelope: InstallationTokenEnvelope | undefined,\n  now: Date,\n): envelope is InstallationTokenEnvelope & {token: string; expiresAt: Date} {\n  return (\n    envelope?.token !== undefined &&\n    envelope.expiresAt !== undefined &&\n    !needsRefresh(envelope.expiresAt, now)\n  );\n}\n\nexport function needsRefresh(expiresAt: Date, now: Date): boolean {\n  return expiresAt.getTime() <= now.getTime() + TOKEN_REFRESH_MARGIN_MS;\n}\n\nexport function stillValid(expiresAt: Date | undefined, now: Date): boolean {\n  return expiresAt !== undefined && expiresAt.getTime() > now.getTime() + TOKEN_VALIDITY_BUFFER_MS;\n}\n\nexport function backoffActive(envelope: InstallationTokenEnvelope | undefined, now: Date): boolean {\n  return (\n    envelope?.backoffUntil !== undefined &&\n    envelope.backoffReason !== undefined &&\n    envelope.backoffUntil.getTime() > now.getTime()\n  );\n}\n\nexport function classifyMintError(error: unknown): ClassifiedMintError {\n  if (error instanceof IntegrationProviderError) {\n    return {\n      reason: error.reason,\n      retryAfterSeconds: error.retryAfterSeconds,\n      class: mintErrorClassForReason(error.reason),\n    };\n  }\n\n  return {reason: 'provider-unavailable', class: 'transient'};\n}\n\nexport function mintErrorClassForReason(reason: IntegrationProviderErrorReason): MintErrorClass {\n  return terminalMintErrorReasons.has(reason) ? 'terminal' : 'transient';\n}\n\nexport function backoffMs(classified: ClassifiedMintError): number {\n  if (classified.class === 'terminal') return TERMINAL_BACKOFF_MS;\n\n  const retryAfterMs = (classified.retryAfterSeconds ?? 0) * 1000;\n  return Math.min(TRANSIENT_BACKOFF_MAX_MS, Math.max(TRANSIENT_BACKOFF_MIN_MS, retryAfterMs));\n}\n\nexport function providerErrorFromBackoff(\n  reason: IntegrationProviderErrorReason,\n  retryAfterMs: number,\n): GithubIntegrationProviderError {\n  return new GithubIntegrationProviderError(\n    reason,\n    `GitHub installation token mint is backed off after ${reason}`,\n    Math.max(1, Math.ceil(retryAfterMs / 1000)),\n  );\n}\n\nexport function toProviderError(error: unknown): GithubIntegrationProviderError {\n  if (error instanceof GithubIntegrationProviderError) return error;\n  if (error instanceof IntegrationProviderError) {\n    return new GithubIntegrationProviderError(error.reason, error.message, error.retryAfterSeconds);\n  }\n  return new GithubIntegrationProviderError(\n    'provider-unavailable',\n    error instanceof Error ? error.message : 'GitHub installation token mint failed',\n  );\n}\n"],"names":["IntegrationProviderError","z","GithubIntegrationProviderError","TOKEN_REFRESH_MARGIN_MS","TOKEN_VALIDITY_BUFFER_MS","TRANSIENT_BACKOFF_MIN_MS","TRANSIENT_BACKOFF_MAX_MS","TERMINAL_BACKOFF_MS","providerErrorReasons","providerErrorReasonSchema","enum","terminalMintErrorReasons","Set","providerErrorReasonSchemaCoversUnion","installationTokenEnvelopeSchema","object","token","string","min","optional","expiresAt","datetime","permissions","record","backoffUntil","backoffReason","githubInstallationTokenNamespace","installationId","encodeInstallationTokenEnvelope","envelope","JSON","stringify","undefined","toISOString","parseInstallationTokenEnvelope","raw","parsed","parse","result","safeParse","success","data","Date","usable","now","needsRefresh","getTime","stillValid","backoffActive","classifyMintError","error","reason","retryAfterSeconds","class","mintErrorClassForReason","has","backoffMs","classified","retryAfterMs","Math","max","providerErrorFromBackoff","ceil","toProviderError","message","Error"],"mappings":"AAAA,SACEA,wBAAwB,QAEnB,oCAAoC;AAC3C,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,8BAA8B,QAAO,kBAAkB;AAE/D,OAAO,MAAMC,0BAA0B,IAAI,KAAK,KAAK;AACrD,OAAO,MAAMC,2BAA2B,KAAK,KAAK;AAClD,OAAO,MAAMC,2BAA2B,KAAK,KAAK;AAClD,OAAO,MAAMC,2BAA2B,IAAI,KAAK,KAAK;AACtD,OAAO,MAAMC,sBAAsB,KAAK,KAAK,KAAK;AAElD,MAAMC,uBAAuB;IAC3B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMC,4BAA4BR,EAAES,IAAI,CAACF;AACzC,MAAMG,2BAA2B,IAAIC,IAAoC;IACvE;IACA;IACA;CACD;AAMD,MAAMC,uCAAkF,CAAC;AACzF,KAAKA;AAEL,MAAMC,kCAAkCb,EAAEc,MAAM,CAAC;IAC/CC,OAAOf,EAAEgB,MAAM,GAAGC,GAAG,CAAC,GAAGC,QAAQ;IACjCC,WAAWnB,EAAEgB,MAAM,GAAGI,QAAQ,GAAGF,QAAQ;IACzCG,aAAarB,EAAEsB,MAAM,CAACtB,EAAEgB,MAAM,IAAIhB,EAAES,IAAI,CAAC;QAAC;QAAQ;QAAS;KAAQ,GAAGS,QAAQ;IAC9EK,cAAcvB,EAAEgB,MAAM,GAAGI,QAAQ,GAAGF,QAAQ;IAC5CM,eAAehB,0BAA0BU,QAAQ;AACnD;AAkBA,OAAO,SAASO,iCAAiCC,cAAsB;IACrE,OAAO,CAAC,iCAAiC,EAAEA,gBAAgB;AAC7D;AAEA,OAAO,SAASC,gCAAgCC,QAAmC;IACjF,OAAOC,KAAKC,SAAS,CAAC;QACpB,GAAIF,SAASb,KAAK,KAAKgB,aAAa;YAAChB,OAAOa,SAASb,KAAK;QAAA,CAAC;QAC3D,GAAIa,SAAST,SAAS,KAAKY,aAAa;YAACZ,WAAWS,SAAST,SAAS,CAACa,WAAW;QAAE,CAAC;QACrF,GAAIJ,SAASP,WAAW,KAAKU,aAAa;YAACV,aAAaO,SAASP,WAAW;QAAA,CAAC;QAC7E,GAAIO,SAASL,YAAY,KAAKQ,aAAa;YACzCR,cAAcK,SAASL,YAAY,CAACS,WAAW;QACjD,CAAC;QACD,GAAIJ,SAASJ,aAAa,KAAKO,aAAa;YAACP,eAAeI,SAASJ,aAAa;QAAA,CAAC;IACrF;AACF;AAEA,OAAO,SAASS,+BAA+BC,GAAW;IACxD,IAAIC;IACJ,IAAI;QACFA,SAASN,KAAKO,KAAK,CAACF;IACtB,EAAE,OAAM;QACN,OAAOH;IACT;IAEA,MAAMM,SAASxB,gCAAgCyB,SAAS,CAACH;IACzD,IAAI,CAACE,OAAOE,OAAO,EAAE,OAAOR;IAE5B,OAAO;QACLhB,OAAOsB,OAAOG,IAAI,CAACzB,KAAK;QACxBI,WAAWkB,OAAOG,IAAI,CAACrB,SAAS,GAAG,IAAIsB,KAAKJ,OAAOG,IAAI,CAACrB,SAAS,IAAIY;QACrEV,aAAagB,OAAOG,IAAI,CAACnB,WAAW;QACpCE,cAAcc,OAAOG,IAAI,CAACjB,YAAY,GAAG,IAAIkB,KAAKJ,OAAOG,IAAI,CAACjB,YAAY,IAAIQ;QAC9EP,eAAea,OAAOG,IAAI,CAAChB,aAAa;IAC1C;AACF;AAEA,OAAO,SAASkB,OACdd,QAA+C,EAC/Ce,GAAS;IAET,OACEf,UAAUb,UAAUgB,aACpBH,SAAST,SAAS,KAAKY,aACvB,CAACa,aAAahB,SAAST,SAAS,EAAEwB;AAEtC;AAEA,OAAO,SAASC,aAAazB,SAAe,EAAEwB,GAAS;IACrD,OAAOxB,UAAU0B,OAAO,MAAMF,IAAIE,OAAO,KAAK3C;AAChD;AAEA,OAAO,SAAS4C,WAAW3B,SAA2B,EAAEwB,GAAS;IAC/D,OAAOxB,cAAcY,aAAaZ,UAAU0B,OAAO,KAAKF,IAAIE,OAAO,KAAK1C;AAC1E;AAEA,OAAO,SAAS4C,cAAcnB,QAA+C,EAAEe,GAAS;IACtF,OACEf,UAAUL,iBAAiBQ,aAC3BH,SAASJ,aAAa,KAAKO,aAC3BH,SAASL,YAAY,CAACsB,OAAO,KAAKF,IAAIE,OAAO;AAEjD;AAEA,OAAO,SAASG,kBAAkBC,KAAc;IAC9C,IAAIA,iBAAiBlD,0BAA0B;QAC7C,OAAO;YACLmD,QAAQD,MAAMC,MAAM;YACpBC,mBAAmBF,MAAME,iBAAiB;YAC1CC,OAAOC,wBAAwBJ,MAAMC,MAAM;QAC7C;IACF;IAEA,OAAO;QAACA,QAAQ;QAAwBE,OAAO;IAAW;AAC5D;AAEA,OAAO,SAASC,wBAAwBH,MAAsC;IAC5E,OAAOxC,yBAAyB4C,GAAG,CAACJ,UAAU,aAAa;AAC7D;AAEA,OAAO,SAASK,UAAUC,UAA+B;IACvD,IAAIA,WAAWJ,KAAK,KAAK,YAAY,OAAO9C;IAE5C,MAAMmD,eAAe,AAACD,CAAAA,WAAWL,iBAAiB,IAAI,CAAA,IAAK;IAC3D,OAAOO,KAAKzC,GAAG,CAACZ,0BAA0BqD,KAAKC,GAAG,CAACvD,0BAA0BqD;AAC/E;AAEA,OAAO,SAASG,yBACdV,MAAsC,EACtCO,YAAoB;IAEpB,OAAO,IAAIxD,+BACTiD,QACA,CAAC,mDAAmD,EAAEA,QAAQ,EAC9DQ,KAAKC,GAAG,CAAC,GAAGD,KAAKG,IAAI,CAACJ,eAAe;AAEzC;AAEA,OAAO,SAASK,gBAAgBb,KAAc;IAC5C,IAAIA,iBAAiBhD,gCAAgC,OAAOgD;IAC5D,IAAIA,iBAAiBlD,0BAA0B;QAC7C,OAAO,IAAIE,+BAA+BgD,MAAMC,MAAM,EAAED,MAAMc,OAAO,EAAEd,MAAME,iBAAiB;IAChG;IACA,OAAO,IAAIlD,+BACT,wBACAgD,iBAAiBe,QAAQf,MAAMc,OAAO,GAAG;AAE7C"}

package/dist/api/installation-token-provider.d.ts

@@ -0,0 +1,23 @@
+import type { GetIntegrationConnectionByIdFn } from '@shipfox/api-integration-core-dto';
+import { type GithubInstallationAccessToken } from './client.js';
+import { type InstallationTokenCache, type InstallationTokenSecretStore, type SharedInstallationTokenCacheOptions } from './shared-installation-token-cache.js';
+export interface GithubInstallationTokenProvider {
+    getInstallationAccessToken(installationId: number): Promise<GithubInstallationAccessToken>;
+}
+export interface GithubInstallationTokenProviderOptions {
+    cache?: InstallationTokenCache | undefined;
+    getIntegrationConnectionById?: GetIntegrationConnectionByIdFn | undefined;
+    secretStore?: InstallationTokenSecretStore | undefined;
+    withLock?: SharedInstallationTokenCacheOptions['withLock'] | undefined;
+    now?: (() => Date) | undefined;
+}
+export declare function createGithubInstallationTokenProvider(options?: GithubInstallationTokenProviderOptions): GithubInstallationTokenProvider;
+export declare function deleteGithubInstallationTokenSecret(params: {
+    workspaceId: string;
+    installationId: number;
+    deleteSecrets: (params: {
+        workspaceId: string;
+        namespace: string;
+    }) => Promise<number>;
+}): Promise<number>;
+//# sourceMappingURL=installation-token-provider.d.ts.map

package/dist/api/installation-token-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-token-provider.d.ts","sourceRoot":"","sources":["../../src/api/installation-token-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,8BAA8B,EAAC,MAAM,mCAAmC,CAAC;AAOtF,OAAO,EAAC,KAAK,6BAA6B,EAAiB,MAAM,aAAa,CAAC;AAK/E,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EAEjC,KAAK,mCAAmC,EACzC,MAAM,sCAAsC,CAAC;AAE9C,MAAM,WAAW,+BAA+B;IAC9C,0BAA0B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,sCAAsC;IACrD,KAAK,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC3C,4BAA4B,CAAC,EAAE,8BAA8B,GAAG,SAAS,CAAC;IAC1E,WAAW,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,EAAE,mCAAmC,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;IACvE,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChC;AAED,wBAAgB,qCAAqC,CACnD,OAAO,GAAE,sCAA2C,GACnD,+BAA+B,CAEjC;AAmLD,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtF,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlB"}

package/dist/api/installation-token-provider.js

@@ -0,0 +1,130 @@
+import { App, Octokit } from 'octokit';
+import { config, normalizedGithubApiBaseUrl, normalizedGithubPrivateKey } from '#config.js';
+import { GithubIntegrationProviderError } from '#core/errors.js';
+import { withInstallationTokenLock } from '#db/installation-token-lock.js';
+import { getGithubInstallationByInstallationId } from '#db/installations.js';
+import { recordInstallationTokenLookup } from '#metrics/index.js';
+import { mapGithubError } from './client.js';
+import { githubInstallationTokenNamespace, TOKEN_REFRESH_MARGIN_MS } from './installation-token-envelope.js';
+import { SharedInstallationTokenCache } from './shared-installation-token-cache.js';
+export function createGithubInstallationTokenProvider(options = {}) {
+    return new OctokitGithubInstallationTokenProvider(createInstallationTokenCache(options));
+}
+let OctokitGithubInstallationTokenProvider = class OctokitGithubInstallationTokenProvider {
+    constructor(cache = new InMemoryInstallationTokenCache()){
+        this.cache = cache;
+    }
+    getInstallationAccessToken(installationId) {
+        return this.cache.getOrMint(installationId, ()=>this.mintInstallationAccessToken(installationId));
+    }
+    async mintInstallationAccessToken(installationId) {
+        const response = await mapGithubError(()=>this.getApp().octokit.rest.apps.createInstallationAccessToken({
+                installation_id: installationId
+            }), 'installation-not-found');
+        if (typeof response.data.token !== 'string') {
+            throw new GithubIntegrationProviderError('malformed-provider-response', 'GitHub installation access token response did not include a token');
+        }
+        const expiresAt = new Date(response.data.expires_at);
+        if (Number.isNaN(expiresAt.getTime())) {
+            throw new GithubIntegrationProviderError('malformed-provider-response', 'GitHub installation access token response did not include a valid expiry');
+        }
+        return {
+            token: response.data.token,
+            expiresAt,
+            ...response.data.permissions === undefined ? {} : {
+                permissions: response.data.permissions
+            }
+        };
+    }
+    getApp() {
+        if (!this.app) {
+            this.app = new App({
+                appId: config.GITHUB_APP_ID,
+                privateKey: normalizedGithubPrivateKey(),
+                Octokit: Octokit.defaults({
+                    baseUrl: normalizedGithubApiBaseUrl(),
+                    throttle: {
+                        onRateLimit: (_retryAfter, _options, _octokit, retryCount)=>retryCount === 0,
+                        onSecondaryRateLimit: (_retryAfter, _options, _octokit, retryCount)=>retryCount === 0
+                    }
+                })
+            });
+        }
+        return this.app;
+    }
+};
+let InMemoryInstallationTokenCache = class InMemoryInstallationTokenCache {
+    constructor(options = {
+        refreshMarginMs: TOKEN_REFRESH_MARGIN_MS,
+        now: ()=>new Date()
+    }){
+        this.options = options;
+        this.tokens = new Map();
+        this.inFlightMints = new Map();
+    }
+    getOrMint(installationId, mint) {
+        const cached = this.tokens.get(installationId);
+        if (cached && !this.isInsideRefreshMargin(cached.expiresAt)) {
+            recordInstallationTokenLookup('ram-hit');
+            return Promise.resolve(cached);
+        }
+        const inFlightMint = this.inFlightMints.get(installationId);
+        if (inFlightMint) return inFlightMint;
+        const freshToken = mint().then((token)=>{
+            this.tokens.set(installationId, token);
+            return token;
+        }).finally(()=>{
+            this.inFlightMints.delete(installationId);
+        });
+        this.inFlightMints.set(installationId, freshToken);
+        return freshToken;
+    }
+    isInsideRefreshMargin(expiresAt) {
+        return expiresAt.getTime() <= this.options.now().getTime() + this.options.refreshMarginMs;
+    }
+};
+let TieredInstallationTokenCache = class TieredInstallationTokenCache {
+    constructor(ram, shared){
+        this.ram = ram;
+        this.shared = shared;
+    }
+    getOrMint(installationId, mint) {
+        return this.ram.getOrMint(installationId, ()=>this.shared.getOrMint(installationId, mint));
+    }
+};
+function createInstallationTokenCache(options) {
+    if (options.cache) return options.cache;
+    const ram = new InMemoryInstallationTokenCache({
+        refreshMarginMs: TOKEN_REFRESH_MARGIN_MS,
+        now: options.now ?? (()=>new Date())
+    });
+    if (!options.getIntegrationConnectionById || !options.secretStore) return ram;
+    const shared = new SharedInstallationTokenCache({
+        secretStore: options.secretStore,
+        withLock: options.withLock ?? withInstallationTokenLock,
+        resolveWorkspaceId: createGithubInstallationWorkspaceResolver(options.getIntegrationConnectionById),
+        now: options.now
+    });
+    return new TieredInstallationTokenCache(ram, shared);
+}
+function createGithubInstallationWorkspaceResolver(getIntegrationConnectionById) {
+    return async (installationId)=>{
+        const installation = await getGithubInstallationByInstallationId(String(installationId));
+        if (!installation) {
+            throw new GithubIntegrationProviderError('installation-not-found', `GitHub installation not found: ${installationId}`);
+        }
+        const connection = await getIntegrationConnectionById(installation.connectionId);
+        if (!connection) {
+            throw new GithubIntegrationProviderError('installation-not-found', `GitHub installation connection not found: ${installation.connectionId}`);
+        }
+        return connection.workspaceId;
+    };
+}
+export function deleteGithubInstallationTokenSecret(params) {
+    return params.deleteSecrets({
+        workspaceId: params.workspaceId,
+        namespace: githubInstallationTokenNamespace(params.installationId)
+    });
+}
+
+//# sourceMappingURL=installation-token-provider.js.map

package/dist/api/installation-token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/api/installation-token-provider.ts"],"sourcesContent":["import type {GetIntegrationConnectionByIdFn} from '@shipfox/api-integration-core-dto';\nimport {App, Octokit} from 'octokit';\nimport {config, normalizedGithubApiBaseUrl, normalizedGithubPrivateKey} from '#config.js';\nimport {GithubIntegrationProviderError} from '#core/errors.js';\nimport {withInstallationTokenLock} from '#db/installation-token-lock.js';\nimport {getGithubInstallationByInstallationId} from '#db/installations.js';\nimport {recordInstallationTokenLookup} from '#metrics/index.js';\nimport {type GithubInstallationAccessToken, mapGithubError} from './client.js';\nimport {\n  githubInstallationTokenNamespace,\n  TOKEN_REFRESH_MARGIN_MS,\n} from './installation-token-envelope.js';\nimport {\n  type InstallationTokenCache,\n  type InstallationTokenSecretStore,\n  SharedInstallationTokenCache,\n  type SharedInstallationTokenCacheOptions,\n} from './shared-installation-token-cache.js';\n\nexport interface GithubInstallationTokenProvider {\n  getInstallationAccessToken(installationId: number): Promise<GithubInstallationAccessToken>;\n}\n\nexport interface GithubInstallationTokenProviderOptions {\n  cache?: InstallationTokenCache | undefined;\n  getIntegrationConnectionById?: GetIntegrationConnectionByIdFn | undefined;\n  secretStore?: InstallationTokenSecretStore | undefined;\n  withLock?: SharedInstallationTokenCacheOptions['withLock'] | undefined;\n  now?: (() => Date) | undefined;\n}\n\nexport function createGithubInstallationTokenProvider(\n  options: GithubInstallationTokenProviderOptions = {},\n): GithubInstallationTokenProvider {\n  return new OctokitGithubInstallationTokenProvider(createInstallationTokenCache(options));\n}\n\nclass OctokitGithubInstallationTokenProvider implements GithubInstallationTokenProvider {\n  private app: App | undefined;\n\n  constructor(\n    private readonly cache: InstallationTokenCache = new InMemoryInstallationTokenCache(),\n  ) {}\n\n  getInstallationAccessToken(installationId: number): Promise<GithubInstallationAccessToken> {\n    return this.cache.getOrMint(installationId, () =>\n      this.mintInstallationAccessToken(installationId),\n    );\n  }\n\n  private async mintInstallationAccessToken(\n    installationId: number,\n  ): Promise<GithubInstallationAccessToken> {\n    const response = await mapGithubError(\n      () =>\n        this.getApp().octokit.rest.apps.createInstallationAccessToken({\n          installation_id: installationId,\n        }),\n      'installation-not-found',\n    );\n\n    if (typeof response.data.token !== 'string') {\n      throw new GithubIntegrationProviderError(\n        'malformed-provider-response',\n        'GitHub installation access token response did not include a token',\n      );\n    }\n\n    const expiresAt = new Date(response.data.expires_at);\n    if (Number.isNaN(expiresAt.getTime())) {\n      throw new GithubIntegrationProviderError(\n        'malformed-provider-response',\n        'GitHub installation access token response did not include a valid expiry',\n      );\n    }\n\n    return {\n      token: response.data.token,\n      expiresAt,\n      ...(response.data.permissions === undefined ? {} : {permissions: response.data.permissions}),\n    };\n  }\n\n  private getApp(): App {\n    if (!this.app) {\n      this.app = new App({\n        appId: config.GITHUB_APP_ID,\n        privateKey: normalizedGithubPrivateKey(),\n        Octokit: Octokit.defaults({\n          baseUrl: normalizedGithubApiBaseUrl(),\n          throttle: {\n            onRateLimit: (\n              _retryAfter: number,\n              _options: unknown,\n              _octokit: unknown,\n              retryCount: number,\n            ) => retryCount === 0,\n            onSecondaryRateLimit: (\n              _retryAfter: number,\n              _options: unknown,\n              _octokit: unknown,\n              retryCount: number,\n            ) => retryCount === 0,\n          },\n        }),\n      });\n    }\n    return this.app;\n  }\n}\n\nclass InMemoryInstallationTokenCache implements InstallationTokenCache {\n  private readonly tokens = new Map<number, GithubInstallationAccessToken>();\n  private readonly inFlightMints = new Map<number, Promise<GithubInstallationAccessToken>>();\n\n  constructor(\n    private readonly options: {\n      refreshMarginMs: number;\n      now: () => Date;\n    } = {\n      refreshMarginMs: TOKEN_REFRESH_MARGIN_MS,\n      now: () => new Date(),\n    },\n  ) {}\n\n  getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    const cached = this.tokens.get(installationId);\n    if (cached && !this.isInsideRefreshMargin(cached.expiresAt)) {\n      recordInstallationTokenLookup('ram-hit');\n      return Promise.resolve(cached);\n    }\n\n    const inFlightMint = this.inFlightMints.get(installationId);\n    if (inFlightMint) return inFlightMint;\n\n    const freshToken = mint()\n      .then((token) => {\n        this.tokens.set(installationId, token);\n        return token;\n      })\n      .finally(() => {\n        this.inFlightMints.delete(installationId);\n      });\n    this.inFlightMints.set(installationId, freshToken);\n    return freshToken;\n  }\n\n  private isInsideRefreshMargin(expiresAt: Date): boolean {\n    return expiresAt.getTime() <= this.options.now().getTime() + this.options.refreshMarginMs;\n  }\n}\n\nclass TieredInstallationTokenCache implements InstallationTokenCache {\n  constructor(\n    private readonly ram: InstallationTokenCache,\n    private readonly shared: InstallationTokenCache,\n  ) {}\n\n  getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    return this.ram.getOrMint(installationId, () => this.shared.getOrMint(installationId, mint));\n  }\n}\n\nfunction createInstallationTokenCache(\n  options: GithubInstallationTokenProviderOptions,\n): InstallationTokenCache {\n  if (options.cache) return options.cache;\n\n  const ram = new InMemoryInstallationTokenCache({\n    refreshMarginMs: TOKEN_REFRESH_MARGIN_MS,\n    now: options.now ?? (() => new Date()),\n  });\n  if (!options.getIntegrationConnectionById || !options.secretStore) return ram;\n\n  const shared = new SharedInstallationTokenCache({\n    secretStore: options.secretStore,\n    withLock: options.withLock ?? withInstallationTokenLock,\n    resolveWorkspaceId: createGithubInstallationWorkspaceResolver(\n      options.getIntegrationConnectionById,\n    ),\n    now: options.now,\n  });\n  return new TieredInstallationTokenCache(ram, shared);\n}\n\nfunction createGithubInstallationWorkspaceResolver(\n  getIntegrationConnectionById: GetIntegrationConnectionByIdFn,\n) {\n  return async (installationId: number): Promise<string> => {\n    const installation = await getGithubInstallationByInstallationId(String(installationId));\n    if (!installation) {\n      throw new GithubIntegrationProviderError(\n        'installation-not-found',\n        `GitHub installation not found: ${installationId}`,\n      );\n    }\n\n    const connection = await getIntegrationConnectionById(installation.connectionId);\n    if (!connection) {\n      throw new GithubIntegrationProviderError(\n        'installation-not-found',\n        `GitHub installation connection not found: ${installation.connectionId}`,\n      );\n    }\n    return connection.workspaceId;\n  };\n}\n\nexport function deleteGithubInstallationTokenSecret(params: {\n  workspaceId: string;\n  installationId: number;\n  deleteSecrets: (params: {workspaceId: string; namespace: string}) => Promise<number>;\n}): Promise<number> {\n  return params.deleteSecrets({\n    workspaceId: params.workspaceId,\n    namespace: githubInstallationTokenNamespace(params.installationId),\n  });\n}\n"],"names":["App","Octokit","config","normalizedGithubApiBaseUrl","normalizedGithubPrivateKey","GithubIntegrationProviderError","withInstallationTokenLock","getGithubInstallationByInstallationId","recordInstallationTokenLookup","mapGithubError","githubInstallationTokenNamespace","TOKEN_REFRESH_MARGIN_MS","SharedInstallationTokenCache","createGithubInstallationTokenProvider","options","OctokitGithubInstallationTokenProvider","createInstallationTokenCache","cache","InMemoryInstallationTokenCache","getInstallationAccessToken","installationId","getOrMint","mintInstallationAccessToken","response","getApp","octokit","rest","apps","createInstallationAccessToken","installation_id","data","token","expiresAt","Date","expires_at","Number","isNaN","getTime","permissions","undefined","app","appId","GITHUB_APP_ID","privateKey","defaults","baseUrl","throttle","onRateLimit","_retryAfter","_options","_octokit","retryCount","onSecondaryRateLimit","refreshMarginMs","now","tokens","Map","inFlightMints","mint","cached","get","isInsideRefreshMargin","Promise","resolve","inFlightMint","freshToken","then","set","finally","delete","TieredInstallationTokenCache","ram","shared","getIntegrationConnectionById","secretStore","withLock","resolveWorkspaceId","createGithubInstallationWorkspaceResolver","installation","String","connection","connectionId","workspaceId","deleteGithubInstallationTokenSecret","params","deleteSecrets","namespace"],"mappings":"AACA,SAAQA,GAAG,EAAEC,OAAO,QAAO,UAAU;AACrC,SAAQC,MAAM,EAAEC,0BAA0B,EAAEC,0BAA0B,QAAO,aAAa;AAC1F,SAAQC,8BAA8B,QAAO,kBAAkB;AAC/D,SAAQC,yBAAyB,QAAO,iCAAiC;AACzE,SAAQC,qCAAqC,QAAO,uBAAuB;AAC3E,SAAQC,6BAA6B,QAAO,oBAAoB;AAChE,SAA4CC,cAAc,QAAO,cAAc;AAC/E,SACEC,gCAAgC,EAChCC,uBAAuB,QAClB,mCAAmC;AAC1C,SAGEC,4BAA4B,QAEvB,uCAAuC;AAc9C,OAAO,SAASC,sCACdC,UAAkD,CAAC,CAAC;IAEpD,OAAO,IAAIC,uCAAuCC,6BAA6BF;AACjF;AAEA,IAAA,AAAMC,yCAAN,MAAMA;IAGJ,YACE,AAAiBE,QAAgC,IAAIC,gCAAgC,CACrF;aADiBD,QAAAA;IAChB;IAEHE,2BAA2BC,cAAsB,EAA0C;QACzF,OAAO,IAAI,CAACH,KAAK,CAACI,SAAS,CAACD,gBAAgB,IAC1C,IAAI,CAACE,2BAA2B,CAACF;IAErC;IAEA,MAAcE,4BACZF,cAAsB,EACkB;QACxC,MAAMG,WAAW,MAAMd,eACrB,IACE,IAAI,CAACe,MAAM,GAAGC,OAAO,CAACC,IAAI,CAACC,IAAI,CAACC,6BAA6B,CAAC;gBAC5DC,iBAAiBT;YACnB,IACF;QAGF,IAAI,OAAOG,SAASO,IAAI,CAACC,KAAK,KAAK,UAAU;YAC3C,MAAM,IAAI1B,+BACR,+BACA;QAEJ;QAEA,MAAM2B,YAAY,IAAIC,KAAKV,SAASO,IAAI,CAACI,UAAU;QACnD,IAAIC,OAAOC,KAAK,CAACJ,UAAUK,OAAO,KAAK;YACrC,MAAM,IAAIhC,+BACR,+BACA;QAEJ;QAEA,OAAO;YACL0B,OAAOR,SAASO,IAAI,CAACC,KAAK;YAC1BC;YACA,GAAIT,SAASO,IAAI,CAACQ,WAAW,KAAKC,YAAY,CAAC,IAAI;gBAACD,aAAaf,SAASO,IAAI,CAACQ,WAAW;YAAA,CAAC;QAC7F;IACF;IAEQd,SAAc;QACpB,IAAI,CAAC,IAAI,CAACgB,GAAG,EAAE;YACb,IAAI,CAACA,GAAG,GAAG,IAAIxC,IAAI;gBACjByC,OAAOvC,OAAOwC,aAAa;gBAC3BC,YAAYvC;gBACZH,SAASA,QAAQ2C,QAAQ,CAAC;oBACxBC,SAAS1C;oBACT2C,UAAU;wBACRC,aAAa,CACXC,aACAC,UACAC,UACAC,aACGA,eAAe;wBACpBC,sBAAsB,CACpBJ,aACAC,UACAC,UACAC,aACGA,eAAe;oBACtB;gBACF;YACF;QACF;QACA,OAAO,IAAI,CAACX,GAAG;IACjB;AACF;AAEA,IAAA,AAAMtB,iCAAN,MAAMA;IAIJ,YACE,AAAiBJ,UAGb;QACFuC,iBAAiB1C;QACjB2C,KAAK,IAAM,IAAIrB;IACjB,CAAC,CACD;aAPiBnB,UAAAA;aAJFyC,SAAS,IAAIC;aACbC,gBAAgB,IAAID;IAUlC;IAEHnC,UACED,cAAsB,EACtBsC,IAAkD,EACV;QACxC,MAAMC,SAAS,IAAI,CAACJ,MAAM,CAACK,GAAG,CAACxC;QAC/B,IAAIuC,UAAU,CAAC,IAAI,CAACE,qBAAqB,CAACF,OAAO3B,SAAS,GAAG;YAC3DxB,8BAA8B;YAC9B,OAAOsD,QAAQC,OAAO,CAACJ;QACzB;QAEA,MAAMK,eAAe,IAAI,CAACP,aAAa,CAACG,GAAG,CAACxC;QAC5C,IAAI4C,cAAc,OAAOA;QAEzB,MAAMC,aAAaP,OAChBQ,IAAI,CAAC,CAACnC;YACL,IAAI,CAACwB,MAAM,CAACY,GAAG,CAAC/C,gBAAgBW;YAChC,OAAOA;QACT,GACCqC,OAAO,CAAC;YACP,IAAI,CAACX,aAAa,CAACY,MAAM,CAACjD;QAC5B;QACF,IAAI,CAACqC,aAAa,CAACU,GAAG,CAAC/C,gBAAgB6C;QACvC,OAAOA;IACT;IAEQJ,sBAAsB7B,SAAe,EAAW;QACtD,OAAOA,UAAUK,OAAO,MAAM,IAAI,CAACvB,OAAO,CAACwC,GAAG,GAAGjB,OAAO,KAAK,IAAI,CAACvB,OAAO,CAACuC,eAAe;IAC3F;AACF;AAEA,IAAA,AAAMiB,+BAAN,MAAMA;IACJ,YACE,AAAiBC,GAA2B,EAC5C,AAAiBC,MAA8B,CAC/C;aAFiBD,MAAAA;aACAC,SAAAA;IAChB;IAEHnD,UACED,cAAsB,EACtBsC,IAAkD,EACV;QACxC,OAAO,IAAI,CAACa,GAAG,CAAClD,SAAS,CAACD,gBAAgB,IAAM,IAAI,CAACoD,MAAM,CAACnD,SAAS,CAACD,gBAAgBsC;IACxF;AACF;AAEA,SAAS1C,6BACPF,OAA+C;IAE/C,IAAIA,QAAQG,KAAK,EAAE,OAAOH,QAAQG,KAAK;IAEvC,MAAMsD,MAAM,IAAIrD,+BAA+B;QAC7CmC,iBAAiB1C;QACjB2C,KAAKxC,QAAQwC,GAAG,IAAK,CAAA,IAAM,IAAIrB,MAAK;IACtC;IACA,IAAI,CAACnB,QAAQ2D,4BAA4B,IAAI,CAAC3D,QAAQ4D,WAAW,EAAE,OAAOH;IAE1E,MAAMC,SAAS,IAAI5D,6BAA6B;QAC9C8D,aAAa5D,QAAQ4D,WAAW;QAChCC,UAAU7D,QAAQ6D,QAAQ,IAAIrE;QAC9BsE,oBAAoBC,0CAClB/D,QAAQ2D,4BAA4B;QAEtCnB,KAAKxC,QAAQwC,GAAG;IAClB;IACA,OAAO,IAAIgB,6BAA6BC,KAAKC;AAC/C;AAEA,SAASK,0CACPJ,4BAA4D;IAE5D,OAAO,OAAOrD;QACZ,MAAM0D,eAAe,MAAMvE,sCAAsCwE,OAAO3D;QACxE,IAAI,CAAC0D,cAAc;YACjB,MAAM,IAAIzE,+BACR,0BACA,CAAC,+BAA+B,EAAEe,gBAAgB;QAEtD;QAEA,MAAM4D,aAAa,MAAMP,6BAA6BK,aAAaG,YAAY;QAC/E,IAAI,CAACD,YAAY;YACf,MAAM,IAAI3E,+BACR,0BACA,CAAC,0CAA0C,EAAEyE,aAAaG,YAAY,EAAE;QAE5E;QACA,OAAOD,WAAWE,WAAW;IAC/B;AACF;AAEA,OAAO,SAASC,oCAAoCC,MAInD;IACC,OAAOA,OAAOC,aAAa,CAAC;QAC1BH,aAAaE,OAAOF,WAAW;QAC/BI,WAAW5E,iCAAiC0E,OAAOhE,cAAc;IACnE;AACF"}

package/dist/api/shared-installation-token-cache.d.ts

@@ -0,0 +1,43 @@
+import type { GithubInstallationAccessToken } from './client.js';
+import { type InstallationTokenEnvelope } from './installation-token-envelope.js';
+export interface InstallationTokenCache {
+    getOrMint(installationId: number, mint: () => Promise<GithubInstallationAccessToken>): Promise<GithubInstallationAccessToken>;
+}
+export type InstallationTokenLockResult<T> = {
+    acquired: true;
+    value: T;
+} | {
+    acquired: false;
+};
+export interface InstallationTokenSecretStore {
+    read(workspaceId: string, installationId: number): Promise<string | null>;
+    write(workspaceId: string, installationId: number, envelope: InstallationTokenEnvelope): Promise<void>;
+}
+export interface SharedInstallationTokenCacheOptions {
+    secretStore: InstallationTokenSecretStore;
+    withLock: <T>(installationId: number, fn: () => Promise<T>) => Promise<InstallationTokenLockResult<T>>;
+    resolveWorkspaceId: (installationId: number) => Promise<string>;
+    now?: (() => Date) | undefined;
+    sleep?: ((ms: number) => Promise<void>) | undefined;
+    pollDelaysMs?: number[] | undefined;
+    workspaceCacheTtlMs?: number | undefined;
+    mintTimeoutMs?: number | undefined;
+}
+export declare class SharedInstallationTokenCache implements InstallationTokenCache {
+    private readonly options;
+    private readonly workspaceIds;
+    private readonly now;
+    private readonly sleep;
+    private readonly pollDelaysMs;
+    private readonly workspaceCacheTtlMs;
+    private readonly mintTimeoutMs;
+    constructor(options: SharedInstallationTokenCacheOptions);
+    getOrMint(installationId: number, mint: () => Promise<GithubInstallationAccessToken>): Promise<GithubInstallationAccessToken>;
+    private mintUnderLock;
+    private serveStaleOrPoll;
+    private recordMint;
+    private readEnvelope;
+    private writeEnvelope;
+    private resolveWorkspaceId;
+}
+//# sourceMappingURL=shared-installation-token-cache.d.ts.map

package/dist/api/shared-installation-token-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-installation-token-cache.d.ts","sourceRoot":"","sources":["../../src/api/shared-installation-token-cache.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,6BAA6B,EAAC,MAAM,aAAa,CAAC;AAC/D,OAAO,EAIL,KAAK,yBAAyB,EAO/B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CACP,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAE5F,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,4BAA4B,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,EACV,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACjB,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAMD,qBAAa,4BAA6B,YAAW,sBAAsB;IAQ7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiE;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAEV,OAAO,EAAE,mCAAmC;IAQnE,SAAS,CACb,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC;YAgB3B,aAAa;YAkGb,gBAAgB;YA0ChB,UAAU;YAcV,YAAY;YAcZ,aAAa;YAQb,kBAAkB;CAYjC"}

package/dist/api/shared-installation-token-cache.js

@@ -0,0 +1,224 @@
+import { setTimeout as sleepTimeout } from 'node:timers/promises';
+import { logger } from '@shipfox/node-opentelemetry';
+import { GithubIntegrationProviderError } from '#core/errors.js';
+import { recordInstallationTokenBackoff, recordInstallationTokenLookup, recordInstallationTokenMint } from '#metrics/index.js';
+import { backoffActive, backoffMs, classifyMintError, mintErrorClassForReason, parseInstallationTokenEnvelope, providerErrorFromBackoff, stillValid, toProviderError, usable } from './installation-token-envelope.js';
+const DEFAULT_POLL_DELAYS_MS = [
+    100,
+    200,
+    400,
+    500,
+    800
+];
+const DEFAULT_WORKSPACE_CACHE_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_MINT_TIMEOUT_MS = 30 * 1000;
+export class SharedInstallationTokenCache {
+    constructor(options){
+        this.options = options;
+        this.workspaceIds = new Map();
+        this.now = options.now ?? (()=>new Date());
+        this.sleep = options.sleep ?? ((ms)=>sleepTimeout(ms).then(()=>undefined));
+        this.pollDelaysMs = options.pollDelaysMs ?? DEFAULT_POLL_DELAYS_MS;
+        this.workspaceCacheTtlMs = options.workspaceCacheTtlMs ?? DEFAULT_WORKSPACE_CACHE_TTL_MS;
+        this.mintTimeoutMs = options.mintTimeoutMs ?? DEFAULT_MINT_TIMEOUT_MS;
+    }
+    async getOrMint(installationId, mint) {
+        const workspaceId = await this.resolveWorkspaceId(installationId);
+        const envelope = await this.readEnvelope(workspaceId, installationId);
+        if (usable(envelope, this.now())) {
+            recordInstallationTokenLookup('db-hit');
+            return tokenFromEnvelope(envelope);
+        }
+        const result = await this.options.withLock(installationId, ()=>this.mintUnderLock({
+                workspaceId,
+                installationId,
+                mint
+            }));
+        if (result.acquired) return result.value;
+        return await this.serveStaleOrPoll({
+            workspaceId,
+            installationId,
+            envelope
+        });
+    }
+    async mintUnderLock(params) {
+        const envelope = await this.readEnvelope(params.workspaceId, params.installationId);
+        const now = this.now();
+        if (usable(envelope, now)) {
+            recordInstallationTokenLookup('db-hit');
+            return tokenFromEnvelope(envelope);
+        }
+        if (activeBackoff(envelope, now)) {
+            if (canServeStale(envelope, now)) {
+                recordInstallationTokenLookup('served-stale');
+                return tokenFromEnvelope(envelope);
+            }
+            recordInstallationTokenLookup('backoff');
+            throw providerErrorFromBackoff(envelope?.backoffReason ?? 'provider-unavailable', (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime());
+        }
+        let token;
+        try {
+            token = await this.recordMint(params.mint);
+        } catch (error) {
+            const providerError = toProviderError(error);
+            const classified = classifyMintError(providerError);
+            const until = new Date(this.now().getTime() + backoffMs(classified));
+            recordInstallationTokenBackoff({
+                reason: classified.reason,
+                class: classified.class
+            });
+            await this.writeEnvelope(params.workspaceId, params.installationId, {
+                token: envelope?.token,
+                expiresAt: envelope?.expiresAt,
+                permissions: envelope?.permissions,
+                backoffUntil: until,
+                backoffReason: classified.reason
+            }).catch((writeError)=>{
+                logger().warn({
+                    installationId: params.installationId,
+                    reason: classified.reason,
+                    error: writeError
+                }, 'github installation token backoff write failed');
+            });
+            if (classified.class === 'transient' && envelope?.token && stillValid(envelope.expiresAt, this.now())) {
+                logger().warn({
+                    installationId: params.installationId,
+                    expiresAt: envelope.expiresAt?.toISOString(),
+                    reason: classified.reason,
+                    backoffUntil: until.toISOString()
+                }, 'github installation token mint failed; serving stale token');
+                recordInstallationTokenLookup('served-stale');
+                return tokenFromEnvelope(envelope);
+            }
+            logger().warn({
+                installationId: params.installationId,
+                reason: classified.reason,
+                backoffUntil: until.toISOString(),
+                error: providerError
+            }, 'github installation token mint failed; backoff recorded');
+            recordInstallationTokenLookup('backoff');
+            throw providerError;
+        }
+        try {
+            await this.writeEnvelope(params.workspaceId, params.installationId, {
+                token: token.token,
+                expiresAt: token.expiresAt,
+                permissions: token.permissions
+            });
+        } catch (error) {
+            logger().warn({
+                installationId: params.installationId,
+                expiresAt: token.expiresAt.toISOString(),
+                error
+            }, 'github installation token cache write failed after mint');
+        }
+        logger().info({
+            installationId: params.installationId,
+            expiresAt: token.expiresAt.toISOString()
+        }, 'github installation token minted');
+        recordInstallationTokenLookup('minted');
+        return token;
+    }
+    async serveStaleOrPoll(params) {
+        const initialNow = this.now();
+        if (canServeStale(params.envelope, initialNow)) {
+            recordInstallationTokenLookup('served-stale');
+            return tokenFromEnvelope(params.envelope);
+        }
+        if (activeBackoff(params.envelope, initialNow)) {
+            recordInstallationTokenLookup('backoff');
+            throw providerErrorFromBackoff(params.envelope.backoffReason, params.envelope.backoffUntil.getTime() - initialNow.getTime());
+        }
+        for (const delayMs of this.pollDelaysMs){
+            await this.sleep(delayMs);
+            const envelope = await this.readEnvelope(params.workspaceId, params.installationId);
+            const now = this.now();
+            if (usable(envelope, now)) {
+                recordInstallationTokenLookup('contended-poll');
+                return tokenFromEnvelope(envelope);
+            }
+            if (backoffActive(envelope, now)) {
+                recordInstallationTokenLookup('backoff');
+                throw providerErrorFromBackoff(envelope?.backoffReason ?? 'provider-unavailable', (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime());
+            }
+        }
+        throw new GithubIntegrationProviderError('provider-unavailable', 'GitHub installation token mint is still in progress', 1);
+    }
+    async recordMint(mint) {
+        const startedAt = Date.now();
+        try {
+            const token = await withTimeout(mint(), this.mintTimeoutMs);
+            recordInstallationTokenMint({
+                outcome: 'success',
+                durationMs: Date.now() - startedAt
+            });
+            return token;
+        } catch (error) {
+            recordInstallationTokenMint({
+                outcome: 'failure',
+                durationMs: Date.now() - startedAt
+            });
+            throw error;
+        }
+    }
+    async readEnvelope(workspaceId, installationId) {
+        const raw = await this.options.secretStore.read(workspaceId, installationId);
+        if (raw === null) return undefined;
+        const envelope = parseInstallationTokenEnvelope(raw);
+        if (envelope === undefined) {
+            logger().warn({
+                installationId
+            }, 'github installation token cache envelope failed to decode');
+        }
+        return envelope;
+    }
+    async writeEnvelope(workspaceId, installationId, envelope) {
+        await this.options.secretStore.write(workspaceId, installationId, envelope);
+    }
+    async resolveWorkspaceId(installationId) {
+        const nowMs = this.now().getTime();
+        const cached = this.workspaceIds.get(installationId);
+        if (cached && cached.expiresAtMs > nowMs) return cached.workspaceId;
+        const workspaceId = await this.options.resolveWorkspaceId(installationId);
+        this.workspaceIds.set(installationId, {
+            workspaceId,
+            expiresAtMs: nowMs + this.workspaceCacheTtlMs
+        });
+        return workspaceId;
+    }
+}
+function activeBackoff(envelope, now) {
+    return backoffActive(envelope, now) && envelope?.backoffUntil !== undefined && envelope.backoffReason !== undefined;
+}
+function canServeStale(envelope, now) {
+    const terminalBackoff = activeBackoff(envelope, now) && mintErrorClassForReason(envelope.backoffReason) === 'terminal';
+    return envelope?.token !== undefined && envelope.expiresAt !== undefined && stillValid(envelope.expiresAt, now) && !terminalBackoff;
+}
+function tokenFromEnvelope(envelope) {
+    if (!envelope.token || !envelope.expiresAt) {
+        throw new GithubIntegrationProviderError('malformed-provider-response', 'GitHub installation token cache envelope is missing a token or expiry');
+    }
+    return {
+        token: envelope.token,
+        expiresAt: envelope.expiresAt,
+        ...envelope.permissions === undefined ? {} : {
+            permissions: envelope.permissions
+        }
+    };
+}
+function withTimeout(promise, timeoutMs) {
+    let timer;
+    const timeout = new Promise((_, reject)=>{
+        timer = setTimeout(()=>{
+            reject(new GithubIntegrationProviderError('timeout', 'Timed out minting GitHub installation access token'));
+        }, timeoutMs);
+    });
+    return Promise.race([
+        promise,
+        timeout
+    ]).finally(()=>{
+        if (timer) clearTimeout(timer);
+    });
+}
+
+//# sourceMappingURL=shared-installation-token-cache.js.map