@shipfox/api-integration-github 7.0.1 → 7.1.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 29 files with swc (411.34ms)
+Successfully compiled: 29 files with swc (533.49ms)

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @shipfox/api-integration-github
 
+## 7.1.0
+
+### Patch Changes
+
+- ac42c96: Adds boundary-owned reporting for unexpected API runtime failures while preserving expected client and provider outcomes.
+- Updated dependencies [ac42c96]
+- Updated dependencies [6ce08c0]
+  - @shipfox/node-error-monitoring@0.2.0
+  - @shipfox/node-fastify@0.3.0
+  - @shipfox/node-opentelemetry@0.6.0
+  - @shipfox/api-auth-context@7.1.0
+  - @shipfox/api-workspaces@7.1.0
+
 ## 7.0.1
 
 ### Patch Changes

package/dist/api/shared-installation-token-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared-installation-token-cache.d.ts","sourceRoot":"","sources":["../../src/api/shared-installation-token-cache.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,6BAA6B,EAAC,MAAM,aAAa,CAAC;AAC/D,OAAO,EAIL,KAAK,yBAAyB,EAO/B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CACP,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAE5F,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,4BAA4B,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,EACV,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACjB,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAMD,qBAAa,4BAA6B,YAAW,sBAAsB;IAQ7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiE;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAEV,OAAO,EAAE,mCAAmC;IAQnE,SAAS,CACb,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC;YAgB3B,aAAa;YAkGb,gBAAgB;YA0ChB,UAAU;YAcV,YAAY;YAcZ,aAAa;YAQb,kBAAkB;CAYjC"}
+{"version":3,"file":"shared-installation-token-cache.d.ts","sourceRoot":"","sources":["../../src/api/shared-installation-token-cache.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAC,6BAA6B,EAAC,MAAM,aAAa,CAAC;AAC/D,OAAO,EAIL,KAAK,yBAAyB,EAO/B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CACP,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAC,GAAG;IAAC,QAAQ,EAAE,KAAK,CAAA;CAAC,CAAC;AAE5F,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,KAAK,CACH,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,MAAM,WAAW,mCAAmC;IAClD,WAAW,EAAE,4BAA4B,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,EACV,cAAc,EAAE,MAAM,EACtB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KACjB,OAAO,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,kBAAkB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACpD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAMD,qBAAa,4BAA6B,YAAW,sBAAsB;IAQ7D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiE;IAC9F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAEV,OAAO,EAAE,mCAAmC;IAQnE,SAAS,CACb,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,6BAA6B,CAAC,GACjD,OAAO,CAAC,6BAA6B,CAAC;YAgB3B,aAAa;YA4Gb,gBAAgB;YA0ChB,UAAU;YAcV,YAAY;YAcZ,aAAa;YAQb,kBAAkB;CAYjC"}

package/dist/api/shared-installation-token-cache.js

@@ -1,4 +1,5 @@
 import { setTimeout as sleepTimeout } from 'node:timers/promises';
+import { reportError } from '@shipfox/node-error-monitoring';
 import { logger } from '@shipfox/node-opentelemetry';
 import { GithubIntegrationProviderError } from '#core/errors.js';
 import { recordInstallationTokenBackoff, recordInstallationTokenLookup, recordInstallationTokenMint } from '#metrics/index.js';
@@ -79,6 +80,13 @@ export class SharedInstallationTokenCache {
                     reason: classified.reason,
                     error: writeError
                 }, 'github installation token backoff write failed');
+                reportError(writeError, {
+                    boundary: 'integration.cache',
+                    operation: 'write-backoff-envelope',
+                    extra: {
+                        installationId: params.installationId
+                    }
+                });
             });
             if (classified.class === 'transient' && envelope?.token && stillValid(envelope.expiresAt, this.now())) {
                 logger().warn({
@@ -111,6 +119,13 @@ export class SharedInstallationTokenCache {
                 expiresAt: token.expiresAt.toISOString(),
                 error
             }, 'github installation token cache write failed after mint');
+            reportError(error, {
+                boundary: 'integration.cache',
+                operation: 'write-minted-token',
+                extra: {
+                    installationId: params.installationId
+                }
+            });
         }
         logger().info({
             installationId: params.installationId,

package/dist/api/shared-installation-token-cache.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/api/shared-installation-token-cache.ts"],"sourcesContent":["import {setTimeout as sleepTimeout} from 'node:timers/promises';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {GithubIntegrationProviderError} from '#core/errors.js';\nimport {\n  recordInstallationTokenBackoff,\n  recordInstallationTokenLookup,\n  recordInstallationTokenMint,\n} from '#metrics/index.js';\nimport type {GithubInstallationAccessToken} from './client.js';\nimport {\n  backoffActive,\n  backoffMs,\n  classifyMintError,\n  type InstallationTokenEnvelope,\n  mintErrorClassForReason,\n  parseInstallationTokenEnvelope,\n  providerErrorFromBackoff,\n  stillValid,\n  toProviderError,\n  usable,\n} from './installation-token-envelope.js';\n\nexport interface InstallationTokenCache {\n  getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken>;\n}\n\nexport type InstallationTokenLockResult<T> = {acquired: true; value: T} | {acquired: false};\n\nexport interface InstallationTokenSecretStore {\n  read(workspaceId: string, installationId: number): Promise<string | null>;\n  write(\n    workspaceId: string,\n    installationId: number,\n    envelope: InstallationTokenEnvelope,\n  ): Promise<void>;\n}\n\nexport interface SharedInstallationTokenCacheOptions {\n  secretStore: InstallationTokenSecretStore;\n  withLock: <T>(\n    installationId: number,\n    fn: () => Promise<T>,\n  ) => Promise<InstallationTokenLockResult<T>>;\n  resolveWorkspaceId: (installationId: number) => Promise<string>;\n  now?: (() => Date) | undefined;\n  sleep?: ((ms: number) => Promise<void>) | undefined;\n  pollDelaysMs?: number[] | undefined;\n  workspaceCacheTtlMs?: number | undefined;\n  mintTimeoutMs?: number | undefined;\n}\n\nconst DEFAULT_POLL_DELAYS_MS = [100, 200, 400, 500, 800];\nconst DEFAULT_WORKSPACE_CACHE_TTL_MS = 10 * 60 * 1000;\nconst DEFAULT_MINT_TIMEOUT_MS = 30 * 1000;\n\nexport class SharedInstallationTokenCache implements InstallationTokenCache {\n  private readonly workspaceIds = new Map<number, {workspaceId: string; expiresAtMs: number}>();\n  private readonly now: () => Date;\n  private readonly sleep: (ms: number) => Promise<void>;\n  private readonly pollDelaysMs: number[];\n  private readonly workspaceCacheTtlMs: number;\n  private readonly mintTimeoutMs: number;\n\n  constructor(private readonly options: SharedInstallationTokenCacheOptions) {\n    this.now = options.now ?? (() => new Date());\n    this.sleep = options.sleep ?? ((ms) => sleepTimeout(ms).then(() => undefined));\n    this.pollDelaysMs = options.pollDelaysMs ?? DEFAULT_POLL_DELAYS_MS;\n    this.workspaceCacheTtlMs = options.workspaceCacheTtlMs ?? DEFAULT_WORKSPACE_CACHE_TTL_MS;\n    this.mintTimeoutMs = options.mintTimeoutMs ?? DEFAULT_MINT_TIMEOUT_MS;\n  }\n\n  async getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    const workspaceId = await this.resolveWorkspaceId(installationId);\n    const envelope = await this.readEnvelope(workspaceId, installationId);\n    if (usable(envelope, this.now())) {\n      recordInstallationTokenLookup('db-hit');\n      return tokenFromEnvelope(envelope);\n    }\n\n    const result = await this.options.withLock(installationId, () =>\n      this.mintUnderLock({workspaceId, installationId, mint}),\n    );\n    if (result.acquired) return result.value;\n\n    return await this.serveStaleOrPoll({workspaceId, installationId, envelope});\n  }\n\n  private async mintUnderLock(params: {\n    workspaceId: string;\n    installationId: number;\n    mint: () => Promise<GithubInstallationAccessToken>;\n  }): Promise<GithubInstallationAccessToken> {\n    const envelope = await this.readEnvelope(params.workspaceId, params.installationId);\n    const now = this.now();\n    if (usable(envelope, now)) {\n      recordInstallationTokenLookup('db-hit');\n      return tokenFromEnvelope(envelope);\n    }\n\n    if (activeBackoff(envelope, now)) {\n      if (canServeStale(envelope, now)) {\n        recordInstallationTokenLookup('served-stale');\n        return tokenFromEnvelope(envelope);\n      }\n      recordInstallationTokenLookup('backoff');\n      throw providerErrorFromBackoff(\n        envelope?.backoffReason ?? 'provider-unavailable',\n        (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime(),\n      );\n    }\n\n    let token: GithubInstallationAccessToken;\n    try {\n      token = await this.recordMint(params.mint);\n    } catch (error) {\n      const providerError = toProviderError(error);\n      const classified = classifyMintError(providerError);\n      const until = new Date(this.now().getTime() + backoffMs(classified));\n      recordInstallationTokenBackoff({reason: classified.reason, class: classified.class});\n\n      await this.writeEnvelope(params.workspaceId, params.installationId, {\n        token: envelope?.token,\n        expiresAt: envelope?.expiresAt,\n        permissions: envelope?.permissions,\n        backoffUntil: until,\n        backoffReason: classified.reason,\n      }).catch((writeError) => {\n        logger().warn(\n          {installationId: params.installationId, reason: classified.reason, error: writeError},\n          'github installation token backoff write failed',\n        );\n      });\n\n      if (\n        classified.class === 'transient' &&\n        envelope?.token &&\n        stillValid(envelope.expiresAt, this.now())\n      ) {\n        logger().warn(\n          {\n            installationId: params.installationId,\n            expiresAt: envelope.expiresAt?.toISOString(),\n            reason: classified.reason,\n            backoffUntil: until.toISOString(),\n          },\n          'github installation token mint failed; serving stale token',\n        );\n        recordInstallationTokenLookup('served-stale');\n        return tokenFromEnvelope(envelope);\n      }\n\n      logger().warn(\n        {\n          installationId: params.installationId,\n          reason: classified.reason,\n          backoffUntil: until.toISOString(),\n          error: providerError,\n        },\n        'github installation token mint failed; backoff recorded',\n      );\n      recordInstallationTokenLookup('backoff');\n      throw providerError;\n    }\n\n    try {\n      await this.writeEnvelope(params.workspaceId, params.installationId, {\n        token: token.token,\n        expiresAt: token.expiresAt,\n        permissions: token.permissions,\n      });\n    } catch (error) {\n      logger().warn(\n        {installationId: params.installationId, expiresAt: token.expiresAt.toISOString(), error},\n        'github installation token cache write failed after mint',\n      );\n    }\n\n    logger().info(\n      {installationId: params.installationId, expiresAt: token.expiresAt.toISOString()},\n      'github installation token minted',\n    );\n    recordInstallationTokenLookup('minted');\n    return token;\n  }\n\n  private async serveStaleOrPoll(params: {\n    workspaceId: string;\n    installationId: number;\n    envelope: InstallationTokenEnvelope | undefined;\n  }): Promise<GithubInstallationAccessToken> {\n    const initialNow = this.now();\n    if (canServeStale(params.envelope, initialNow)) {\n      recordInstallationTokenLookup('served-stale');\n      return tokenFromEnvelope(params.envelope);\n    }\n    if (activeBackoff(params.envelope, initialNow)) {\n      recordInstallationTokenLookup('backoff');\n      throw providerErrorFromBackoff(\n        params.envelope.backoffReason,\n        params.envelope.backoffUntil.getTime() - initialNow.getTime(),\n      );\n    }\n\n    for (const delayMs of this.pollDelaysMs) {\n      await this.sleep(delayMs);\n      const envelope = await this.readEnvelope(params.workspaceId, params.installationId);\n      const now = this.now();\n      if (usable(envelope, now)) {\n        recordInstallationTokenLookup('contended-poll');\n        return tokenFromEnvelope(envelope);\n      }\n      if (backoffActive(envelope, now)) {\n        recordInstallationTokenLookup('backoff');\n        throw providerErrorFromBackoff(\n          envelope?.backoffReason ?? 'provider-unavailable',\n          (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime(),\n        );\n      }\n    }\n\n    throw new GithubIntegrationProviderError(\n      'provider-unavailable',\n      'GitHub installation token mint is still in progress',\n      1,\n    );\n  }\n\n  private async recordMint(\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    const startedAt = Date.now();\n    try {\n      const token = await withTimeout(mint(), this.mintTimeoutMs);\n      recordInstallationTokenMint({outcome: 'success', durationMs: Date.now() - startedAt});\n      return token;\n    } catch (error) {\n      recordInstallationTokenMint({outcome: 'failure', durationMs: Date.now() - startedAt});\n      throw error;\n    }\n  }\n\n  private async readEnvelope(\n    workspaceId: string,\n    installationId: number,\n  ): Promise<InstallationTokenEnvelope | undefined> {\n    const raw = await this.options.secretStore.read(workspaceId, installationId);\n    if (raw === null) return undefined;\n\n    const envelope = parseInstallationTokenEnvelope(raw);\n    if (envelope === undefined) {\n      logger().warn({installationId}, 'github installation token cache envelope failed to decode');\n    }\n    return envelope;\n  }\n\n  private async writeEnvelope(\n    workspaceId: string,\n    installationId: number,\n    envelope: InstallationTokenEnvelope,\n  ): Promise<void> {\n    await this.options.secretStore.write(workspaceId, installationId, envelope);\n  }\n\n  private async resolveWorkspaceId(installationId: number): Promise<string> {\n    const nowMs = this.now().getTime();\n    const cached = this.workspaceIds.get(installationId);\n    if (cached && cached.expiresAtMs > nowMs) return cached.workspaceId;\n\n    const workspaceId = await this.options.resolveWorkspaceId(installationId);\n    this.workspaceIds.set(installationId, {\n      workspaceId,\n      expiresAtMs: nowMs + this.workspaceCacheTtlMs,\n    });\n    return workspaceId;\n  }\n}\n\ntype ActiveBackoffEnvelope = InstallationTokenEnvelope & {\n  backoffUntil: Date;\n  backoffReason: NonNullable<InstallationTokenEnvelope['backoffReason']>;\n};\n\ntype TokenEnvelope = InstallationTokenEnvelope & {token: string; expiresAt: Date};\n\nfunction activeBackoff(\n  envelope: InstallationTokenEnvelope | undefined,\n  now: Date,\n): envelope is ActiveBackoffEnvelope {\n  return (\n    backoffActive(envelope, now) &&\n    envelope?.backoffUntil !== undefined &&\n    envelope.backoffReason !== undefined\n  );\n}\n\nfunction canServeStale(\n  envelope: InstallationTokenEnvelope | undefined,\n  now: Date,\n): envelope is TokenEnvelope {\n  const terminalBackoff =\n    activeBackoff(envelope, now) && mintErrorClassForReason(envelope.backoffReason) === 'terminal';\n  return (\n    envelope?.token !== undefined &&\n    envelope.expiresAt !== undefined &&\n    stillValid(envelope.expiresAt, now) &&\n    !terminalBackoff\n  );\n}\n\nfunction tokenFromEnvelope(envelope: InstallationTokenEnvelope): GithubInstallationAccessToken {\n  if (!envelope.token || !envelope.expiresAt) {\n    throw new GithubIntegrationProviderError(\n      'malformed-provider-response',\n      'GitHub installation token cache envelope is missing a token or expiry',\n    );\n  }\n  return {\n    token: envelope.token,\n    expiresAt: envelope.expiresAt,\n    ...(envelope.permissions === undefined ? {} : {permissions: envelope.permissions}),\n  };\n}\n\nfunction withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {\n  let timer: NodeJS.Timeout | undefined;\n  const timeout = new Promise<T>((_, reject) => {\n    timer = setTimeout(() => {\n      reject(\n        new GithubIntegrationProviderError(\n          'timeout',\n          'Timed out minting GitHub installation access token',\n        ),\n      );\n    }, timeoutMs);\n  });\n\n  return Promise.race([promise, timeout]).finally(() => {\n    if (timer) clearTimeout(timer);\n  });\n}\n"],"names":["setTimeout","sleepTimeout","logger","GithubIntegrationProviderError","recordInstallationTokenBackoff","recordInstallationTokenLookup","recordInstallationTokenMint","backoffActive","backoffMs","classifyMintError","mintErrorClassForReason","parseInstallationTokenEnvelope","providerErrorFromBackoff","stillValid","toProviderError","usable","DEFAULT_POLL_DELAYS_MS","DEFAULT_WORKSPACE_CACHE_TTL_MS","DEFAULT_MINT_TIMEOUT_MS","SharedInstallationTokenCache","options","workspaceIds","Map","now","Date","sleep","ms","then","undefined","pollDelaysMs","workspaceCacheTtlMs","mintTimeoutMs","getOrMint","installationId","mint","workspaceId","resolveWorkspaceId","envelope","readEnvelope","tokenFromEnvelope","result","withLock","mintUnderLock","acquired","value","serveStaleOrPoll","params","activeBackoff","canServeStale","backoffReason","backoffUntil","getTime","token","recordMint","error","providerError","classified","until","reason","class","writeEnvelope","expiresAt","permissions","catch","writeError","warn","toISOString","info","initialNow","delayMs","startedAt","withTimeout","outcome","durationMs","raw","secretStore","read","write","nowMs","cached","get","expiresAtMs","set","terminalBackoff","promise","timeoutMs","timer","timeout","Promise","_","reject","race","finally","clearTimeout"],"mappings":"AAAA,SAAQA,cAAcC,YAAY,QAAO,uBAAuB;AAChE,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,8BAA8B,QAAO,kBAAkB;AAC/D,SACEC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,2BAA2B,QACtB,oBAAoB;AAE3B,SACEC,aAAa,EACbC,SAAS,EACTC,iBAAiB,EAEjBC,uBAAuB,EACvBC,8BAA8B,EAC9BC,wBAAwB,EACxBC,UAAU,EACVC,eAAe,EACfC,MAAM,QACD,mCAAmC;AAkC1C,MAAMC,yBAAyB;IAAC;IAAK;IAAK;IAAK;IAAK;CAAI;AACxD,MAAMC,iCAAiC,KAAK,KAAK;AACjD,MAAMC,0BAA0B,KAAK;AAErC,OAAO,MAAMC;IAQX,YAAY,AAAiBC,OAA4C,CAAE;aAA9CA,UAAAA;aAPZC,eAAe,IAAIC;QAQlC,IAAI,CAACC,GAAG,GAAGH,QAAQG,GAAG,IAAK,CAAA,IAAM,IAAIC,MAAK;QAC1C,IAAI,CAACC,KAAK,GAAGL,QAAQK,KAAK,IAAK,CAAA,CAACC,KAAOzB,aAAayB,IAAIC,IAAI,CAAC,IAAMC,UAAS;QAC5E,IAAI,CAACC,YAAY,GAAGT,QAAQS,YAAY,IAAIb;QAC5C,IAAI,CAACc,mBAAmB,GAAGV,QAAQU,mBAAmB,IAAIb;QAC1D,IAAI,CAACc,aAAa,GAAGX,QAAQW,aAAa,IAAIb;IAChD;IAEA,MAAMc,UACJC,cAAsB,EACtBC,IAAkD,EACV;QACxC,MAAMC,cAAc,MAAM,IAAI,CAACC,kBAAkB,CAACH;QAClD,MAAMI,WAAW,MAAM,IAAI,CAACC,YAAY,CAACH,aAAaF;QACtD,IAAIlB,OAAOsB,UAAU,IAAI,CAACd,GAAG,KAAK;YAChClB,8BAA8B;YAC9B,OAAOkC,kBAAkBF;QAC3B;QAEA,MAAMG,SAAS,MAAM,IAAI,CAACpB,OAAO,CAACqB,QAAQ,CAACR,gBAAgB,IACzD,IAAI,CAACS,aAAa,CAAC;gBAACP;gBAAaF;gBAAgBC;YAAI;QAEvD,IAAIM,OAAOG,QAAQ,EAAE,OAAOH,OAAOI,KAAK;QAExC,OAAO,MAAM,IAAI,CAACC,gBAAgB,CAAC;YAACV;YAAaF;YAAgBI;QAAQ;IAC3E;IAEA,MAAcK,cAAcI,MAI3B,EAA0C;QACzC,MAAMT,WAAW,MAAM,IAAI,CAACC,YAAY,CAACQ,OAAOX,WAAW,EAAEW,OAAOb,cAAc;QAClF,MAAMV,MAAM,IAAI,CAACA,GAAG;QACpB,IAAIR,OAAOsB,UAAUd,MAAM;YACzBlB,8BAA8B;YAC9B,OAAOkC,kBAAkBF;QAC3B;QAEA,IAAIU,cAAcV,UAAUd,MAAM;YAChC,IAAIyB,cAAcX,UAAUd,MAAM;gBAChClB,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YACAhC,8BAA8B;YAC9B,MAAMO,yBACJyB,UAAUY,iBAAiB,wBAC3B,AAACZ,CAAAA,UAAUa,cAAcC,aAAa5B,IAAI4B,OAAO,EAAC,IAAK5B,IAAI4B,OAAO;QAEtE;QAEA,IAAIC;QACJ,IAAI;YACFA,QAAQ,MAAM,IAAI,CAACC,UAAU,CAACP,OAAOZ,IAAI;QAC3C,EAAE,OAAOoB,OAAO;YACd,MAAMC,gBAAgBzC,gBAAgBwC;YACtC,MAAME,aAAa/C,kBAAkB8C;YACrC,MAAME,QAAQ,IAAIjC,KAAK,IAAI,CAACD,GAAG,GAAG4B,OAAO,KAAK3C,UAAUgD;YACxDpD,+BAA+B;gBAACsD,QAAQF,WAAWE,MAAM;gBAAEC,OAAOH,WAAWG,KAAK;YAAA;YAElF,MAAM,IAAI,CAACC,aAAa,CAACd,OAAOX,WAAW,EAAEW,OAAOb,cAAc,EAAE;gBAClEmB,OAAOf,UAAUe;gBACjBS,WAAWxB,UAAUwB;gBACrBC,aAAazB,UAAUyB;gBACvBZ,cAAcO;gBACdR,eAAeO,WAAWE,MAAM;YAClC,GAAGK,KAAK,CAAC,CAACC;gBACR9D,SAAS+D,IAAI,CACX;oBAAChC,gBAAgBa,OAAOb,cAAc;oBAAEyB,QAAQF,WAAWE,MAAM;oBAAEJ,OAAOU;gBAAU,GACpF;YAEJ;YAEA,IACER,WAAWG,KAAK,KAAK,eACrBtB,UAAUe,SACVvC,WAAWwB,SAASwB,SAAS,EAAE,IAAI,CAACtC,GAAG,KACvC;gBACArB,SAAS+D,IAAI,CACX;oBACEhC,gBAAgBa,OAAOb,cAAc;oBACrC4B,WAAWxB,SAASwB,SAAS,EAAEK;oBAC/BR,QAAQF,WAAWE,MAAM;oBACzBR,cAAcO,MAAMS,WAAW;gBACjC,GACA;gBAEF7D,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YAEAnC,SAAS+D,IAAI,CACX;gBACEhC,gBAAgBa,OAAOb,cAAc;gBACrCyB,QAAQF,WAAWE,MAAM;gBACzBR,cAAcO,MAAMS,WAAW;gBAC/BZ,OAAOC;YACT,GACA;YAEFlD,8BAA8B;YAC9B,MAAMkD;QACR;QAEA,IAAI;YACF,MAAM,IAAI,CAACK,aAAa,CAACd,OAAOX,WAAW,EAAEW,OAAOb,cAAc,EAAE;gBAClEmB,OAAOA,MAAMA,KAAK;gBAClBS,WAAWT,MAAMS,SAAS;gBAC1BC,aAAaV,MAAMU,WAAW;YAChC;QACF,EAAE,OAAOR,OAAO;YACdpD,SAAS+D,IAAI,CACX;gBAAChC,gBAAgBa,OAAOb,cAAc;gBAAE4B,WAAWT,MAAMS,SAAS,CAACK,WAAW;gBAAIZ;YAAK,GACvF;QAEJ;QAEApD,SAASiE,IAAI,CACX;YAAClC,gBAAgBa,OAAOb,cAAc;YAAE4B,WAAWT,MAAMS,SAAS,CAACK,WAAW;QAAE,GAChF;QAEF7D,8BAA8B;QAC9B,OAAO+C;IACT;IAEA,MAAcP,iBAAiBC,MAI9B,EAA0C;QACzC,MAAMsB,aAAa,IAAI,CAAC7C,GAAG;QAC3B,IAAIyB,cAAcF,OAAOT,QAAQ,EAAE+B,aAAa;YAC9C/D,8BAA8B;YAC9B,OAAOkC,kBAAkBO,OAAOT,QAAQ;QAC1C;QACA,IAAIU,cAAcD,OAAOT,QAAQ,EAAE+B,aAAa;YAC9C/D,8BAA8B;YAC9B,MAAMO,yBACJkC,OAAOT,QAAQ,CAACY,aAAa,EAC7BH,OAAOT,QAAQ,CAACa,YAAY,CAACC,OAAO,KAAKiB,WAAWjB,OAAO;QAE/D;QAEA,KAAK,MAAMkB,WAAW,IAAI,CAACxC,YAAY,CAAE;YACvC,MAAM,IAAI,CAACJ,KAAK,CAAC4C;YACjB,MAAMhC,WAAW,MAAM,IAAI,CAACC,YAAY,CAACQ,OAAOX,WAAW,EAAEW,OAAOb,cAAc;YAClF,MAAMV,MAAM,IAAI,CAACA,GAAG;YACpB,IAAIR,OAAOsB,UAAUd,MAAM;gBACzBlB,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YACA,IAAI9B,cAAc8B,UAAUd,MAAM;gBAChClB,8BAA8B;gBAC9B,MAAMO,yBACJyB,UAAUY,iBAAiB,wBAC3B,AAACZ,CAAAA,UAAUa,cAAcC,aAAa5B,IAAI4B,OAAO,EAAC,IAAK5B,IAAI4B,OAAO;YAEtE;QACF;QAEA,MAAM,IAAIhD,+BACR,wBACA,uDACA;IAEJ;IAEA,MAAckD,WACZnB,IAAkD,EACV;QACxC,MAAMoC,YAAY9C,KAAKD,GAAG;QAC1B,IAAI;YACF,MAAM6B,QAAQ,MAAMmB,YAAYrC,QAAQ,IAAI,CAACH,aAAa;YAC1DzB,4BAA4B;gBAACkE,SAAS;gBAAWC,YAAYjD,KAAKD,GAAG,KAAK+C;YAAS;YACnF,OAAOlB;QACT,EAAE,OAAOE,OAAO;YACdhD,4BAA4B;gBAACkE,SAAS;gBAAWC,YAAYjD,KAAKD,GAAG,KAAK+C;YAAS;YACnF,MAAMhB;QACR;IACF;IAEA,MAAchB,aACZH,WAAmB,EACnBF,cAAsB,EAC0B;QAChD,MAAMyC,MAAM,MAAM,IAAI,CAACtD,OAAO,CAACuD,WAAW,CAACC,IAAI,CAACzC,aAAaF;QAC7D,IAAIyC,QAAQ,MAAM,OAAO9C;QAEzB,MAAMS,WAAW1B,+BAA+B+D;QAChD,IAAIrC,aAAaT,WAAW;YAC1B1B,SAAS+D,IAAI,CAAC;gBAAChC;YAAc,GAAG;QAClC;QACA,OAAOI;IACT;IAEA,MAAcuB,cACZzB,WAAmB,EACnBF,cAAsB,EACtBI,QAAmC,EACpB;QACf,MAAM,IAAI,CAACjB,OAAO,CAACuD,WAAW,CAACE,KAAK,CAAC1C,aAAaF,gBAAgBI;IACpE;IAEA,MAAcD,mBAAmBH,cAAsB,EAAmB;QACxE,MAAM6C,QAAQ,IAAI,CAACvD,GAAG,GAAG4B,OAAO;QAChC,MAAM4B,SAAS,IAAI,CAAC1D,YAAY,CAAC2D,GAAG,CAAC/C;QACrC,IAAI8C,UAAUA,OAAOE,WAAW,GAAGH,OAAO,OAAOC,OAAO5C,WAAW;QAEnE,MAAMA,cAAc,MAAM,IAAI,CAACf,OAAO,CAACgB,kBAAkB,CAACH;QAC1D,IAAI,CAACZ,YAAY,CAAC6D,GAAG,CAACjD,gBAAgB;YACpCE;YACA8C,aAAaH,QAAQ,IAAI,CAAChD,mBAAmB;QAC/C;QACA,OAAOK;IACT;AACF;AASA,SAASY,cACPV,QAA+C,EAC/Cd,GAAS;IAET,OACEhB,cAAc8B,UAAUd,QACxBc,UAAUa,iBAAiBtB,aAC3BS,SAASY,aAAa,KAAKrB;AAE/B;AAEA,SAASoB,cACPX,QAA+C,EAC/Cd,GAAS;IAET,MAAM4D,kBACJpC,cAAcV,UAAUd,QAAQb,wBAAwB2B,SAASY,aAAa,MAAM;IACtF,OACEZ,UAAUe,UAAUxB,aACpBS,SAASwB,SAAS,KAAKjC,aACvBf,WAAWwB,SAASwB,SAAS,EAAEtC,QAC/B,CAAC4D;AAEL;AAEA,SAAS5C,kBAAkBF,QAAmC;IAC5D,IAAI,CAACA,SAASe,KAAK,IAAI,CAACf,SAASwB,SAAS,EAAE;QAC1C,MAAM,IAAI1D,+BACR,+BACA;IAEJ;IACA,OAAO;QACLiD,OAAOf,SAASe,KAAK;QACrBS,WAAWxB,SAASwB,SAAS;QAC7B,GAAIxB,SAASyB,WAAW,KAAKlC,YAAY,CAAC,IAAI;YAACkC,aAAazB,SAASyB,WAAW;QAAA,CAAC;IACnF;AACF;AAEA,SAASS,YAAea,OAAmB,EAAEC,SAAiB;IAC5D,IAAIC;IACJ,MAAMC,UAAU,IAAIC,QAAW,CAACC,GAAGC;QACjCJ,QAAQtF,WAAW;YACjB0F,OACE,IAAIvF,+BACF,WACA;QAGN,GAAGkF;IACL;IAEA,OAAOG,QAAQG,IAAI,CAAC;QAACP;QAASG;KAAQ,EAAEK,OAAO,CAAC;QAC9C,IAAIN,OAAOO,aAAaP;IAC1B;AACF"}
+{"version":3,"sources":["../../src/api/shared-installation-token-cache.ts"],"sourcesContent":["import {setTimeout as sleepTimeout} from 'node:timers/promises';\nimport {reportError} from '@shipfox/node-error-monitoring';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport {GithubIntegrationProviderError} from '#core/errors.js';\nimport {\n  recordInstallationTokenBackoff,\n  recordInstallationTokenLookup,\n  recordInstallationTokenMint,\n} from '#metrics/index.js';\nimport type {GithubInstallationAccessToken} from './client.js';\nimport {\n  backoffActive,\n  backoffMs,\n  classifyMintError,\n  type InstallationTokenEnvelope,\n  mintErrorClassForReason,\n  parseInstallationTokenEnvelope,\n  providerErrorFromBackoff,\n  stillValid,\n  toProviderError,\n  usable,\n} from './installation-token-envelope.js';\n\nexport interface InstallationTokenCache {\n  getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken>;\n}\n\nexport type InstallationTokenLockResult<T> = {acquired: true; value: T} | {acquired: false};\n\nexport interface InstallationTokenSecretStore {\n  read(workspaceId: string, installationId: number): Promise<string | null>;\n  write(\n    workspaceId: string,\n    installationId: number,\n    envelope: InstallationTokenEnvelope,\n  ): Promise<void>;\n}\n\nexport interface SharedInstallationTokenCacheOptions {\n  secretStore: InstallationTokenSecretStore;\n  withLock: <T>(\n    installationId: number,\n    fn: () => Promise<T>,\n  ) => Promise<InstallationTokenLockResult<T>>;\n  resolveWorkspaceId: (installationId: number) => Promise<string>;\n  now?: (() => Date) | undefined;\n  sleep?: ((ms: number) => Promise<void>) | undefined;\n  pollDelaysMs?: number[] | undefined;\n  workspaceCacheTtlMs?: number | undefined;\n  mintTimeoutMs?: number | undefined;\n}\n\nconst DEFAULT_POLL_DELAYS_MS = [100, 200, 400, 500, 800];\nconst DEFAULT_WORKSPACE_CACHE_TTL_MS = 10 * 60 * 1000;\nconst DEFAULT_MINT_TIMEOUT_MS = 30 * 1000;\n\nexport class SharedInstallationTokenCache implements InstallationTokenCache {\n  private readonly workspaceIds = new Map<number, {workspaceId: string; expiresAtMs: number}>();\n  private readonly now: () => Date;\n  private readonly sleep: (ms: number) => Promise<void>;\n  private readonly pollDelaysMs: number[];\n  private readonly workspaceCacheTtlMs: number;\n  private readonly mintTimeoutMs: number;\n\n  constructor(private readonly options: SharedInstallationTokenCacheOptions) {\n    this.now = options.now ?? (() => new Date());\n    this.sleep = options.sleep ?? ((ms) => sleepTimeout(ms).then(() => undefined));\n    this.pollDelaysMs = options.pollDelaysMs ?? DEFAULT_POLL_DELAYS_MS;\n    this.workspaceCacheTtlMs = options.workspaceCacheTtlMs ?? DEFAULT_WORKSPACE_CACHE_TTL_MS;\n    this.mintTimeoutMs = options.mintTimeoutMs ?? DEFAULT_MINT_TIMEOUT_MS;\n  }\n\n  async getOrMint(\n    installationId: number,\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    const workspaceId = await this.resolveWorkspaceId(installationId);\n    const envelope = await this.readEnvelope(workspaceId, installationId);\n    if (usable(envelope, this.now())) {\n      recordInstallationTokenLookup('db-hit');\n      return tokenFromEnvelope(envelope);\n    }\n\n    const result = await this.options.withLock(installationId, () =>\n      this.mintUnderLock({workspaceId, installationId, mint}),\n    );\n    if (result.acquired) return result.value;\n\n    return await this.serveStaleOrPoll({workspaceId, installationId, envelope});\n  }\n\n  private async mintUnderLock(params: {\n    workspaceId: string;\n    installationId: number;\n    mint: () => Promise<GithubInstallationAccessToken>;\n  }): Promise<GithubInstallationAccessToken> {\n    const envelope = await this.readEnvelope(params.workspaceId, params.installationId);\n    const now = this.now();\n    if (usable(envelope, now)) {\n      recordInstallationTokenLookup('db-hit');\n      return tokenFromEnvelope(envelope);\n    }\n\n    if (activeBackoff(envelope, now)) {\n      if (canServeStale(envelope, now)) {\n        recordInstallationTokenLookup('served-stale');\n        return tokenFromEnvelope(envelope);\n      }\n      recordInstallationTokenLookup('backoff');\n      throw providerErrorFromBackoff(\n        envelope?.backoffReason ?? 'provider-unavailable',\n        (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime(),\n      );\n    }\n\n    let token: GithubInstallationAccessToken;\n    try {\n      token = await this.recordMint(params.mint);\n    } catch (error) {\n      const providerError = toProviderError(error);\n      const classified = classifyMintError(providerError);\n      const until = new Date(this.now().getTime() + backoffMs(classified));\n      recordInstallationTokenBackoff({reason: classified.reason, class: classified.class});\n\n      await this.writeEnvelope(params.workspaceId, params.installationId, {\n        token: envelope?.token,\n        expiresAt: envelope?.expiresAt,\n        permissions: envelope?.permissions,\n        backoffUntil: until,\n        backoffReason: classified.reason,\n      }).catch((writeError) => {\n        logger().warn(\n          {installationId: params.installationId, reason: classified.reason, error: writeError},\n          'github installation token backoff write failed',\n        );\n        reportError(writeError, {\n          boundary: 'integration.cache',\n          operation: 'write-backoff-envelope',\n          extra: {installationId: params.installationId},\n        });\n      });\n\n      if (\n        classified.class === 'transient' &&\n        envelope?.token &&\n        stillValid(envelope.expiresAt, this.now())\n      ) {\n        logger().warn(\n          {\n            installationId: params.installationId,\n            expiresAt: envelope.expiresAt?.toISOString(),\n            reason: classified.reason,\n            backoffUntil: until.toISOString(),\n          },\n          'github installation token mint failed; serving stale token',\n        );\n        recordInstallationTokenLookup('served-stale');\n        return tokenFromEnvelope(envelope);\n      }\n\n      logger().warn(\n        {\n          installationId: params.installationId,\n          reason: classified.reason,\n          backoffUntil: until.toISOString(),\n          error: providerError,\n        },\n        'github installation token mint failed; backoff recorded',\n      );\n      recordInstallationTokenLookup('backoff');\n      throw providerError;\n    }\n\n    try {\n      await this.writeEnvelope(params.workspaceId, params.installationId, {\n        token: token.token,\n        expiresAt: token.expiresAt,\n        permissions: token.permissions,\n      });\n    } catch (error) {\n      logger().warn(\n        {installationId: params.installationId, expiresAt: token.expiresAt.toISOString(), error},\n        'github installation token cache write failed after mint',\n      );\n      reportError(error, {\n        boundary: 'integration.cache',\n        operation: 'write-minted-token',\n        extra: {installationId: params.installationId},\n      });\n    }\n\n    logger().info(\n      {installationId: params.installationId, expiresAt: token.expiresAt.toISOString()},\n      'github installation token minted',\n    );\n    recordInstallationTokenLookup('minted');\n    return token;\n  }\n\n  private async serveStaleOrPoll(params: {\n    workspaceId: string;\n    installationId: number;\n    envelope: InstallationTokenEnvelope | undefined;\n  }): Promise<GithubInstallationAccessToken> {\n    const initialNow = this.now();\n    if (canServeStale(params.envelope, initialNow)) {\n      recordInstallationTokenLookup('served-stale');\n      return tokenFromEnvelope(params.envelope);\n    }\n    if (activeBackoff(params.envelope, initialNow)) {\n      recordInstallationTokenLookup('backoff');\n      throw providerErrorFromBackoff(\n        params.envelope.backoffReason,\n        params.envelope.backoffUntil.getTime() - initialNow.getTime(),\n      );\n    }\n\n    for (const delayMs of this.pollDelaysMs) {\n      await this.sleep(delayMs);\n      const envelope = await this.readEnvelope(params.workspaceId, params.installationId);\n      const now = this.now();\n      if (usable(envelope, now)) {\n        recordInstallationTokenLookup('contended-poll');\n        return tokenFromEnvelope(envelope);\n      }\n      if (backoffActive(envelope, now)) {\n        recordInstallationTokenLookup('backoff');\n        throw providerErrorFromBackoff(\n          envelope?.backoffReason ?? 'provider-unavailable',\n          (envelope?.backoffUntil?.getTime() ?? now.getTime()) - now.getTime(),\n        );\n      }\n    }\n\n    throw new GithubIntegrationProviderError(\n      'provider-unavailable',\n      'GitHub installation token mint is still in progress',\n      1,\n    );\n  }\n\n  private async recordMint(\n    mint: () => Promise<GithubInstallationAccessToken>,\n  ): Promise<GithubInstallationAccessToken> {\n    const startedAt = Date.now();\n    try {\n      const token = await withTimeout(mint(), this.mintTimeoutMs);\n      recordInstallationTokenMint({outcome: 'success', durationMs: Date.now() - startedAt});\n      return token;\n    } catch (error) {\n      recordInstallationTokenMint({outcome: 'failure', durationMs: Date.now() - startedAt});\n      throw error;\n    }\n  }\n\n  private async readEnvelope(\n    workspaceId: string,\n    installationId: number,\n  ): Promise<InstallationTokenEnvelope | undefined> {\n    const raw = await this.options.secretStore.read(workspaceId, installationId);\n    if (raw === null) return undefined;\n\n    const envelope = parseInstallationTokenEnvelope(raw);\n    if (envelope === undefined) {\n      logger().warn({installationId}, 'github installation token cache envelope failed to decode');\n    }\n    return envelope;\n  }\n\n  private async writeEnvelope(\n    workspaceId: string,\n    installationId: number,\n    envelope: InstallationTokenEnvelope,\n  ): Promise<void> {\n    await this.options.secretStore.write(workspaceId, installationId, envelope);\n  }\n\n  private async resolveWorkspaceId(installationId: number): Promise<string> {\n    const nowMs = this.now().getTime();\n    const cached = this.workspaceIds.get(installationId);\n    if (cached && cached.expiresAtMs > nowMs) return cached.workspaceId;\n\n    const workspaceId = await this.options.resolveWorkspaceId(installationId);\n    this.workspaceIds.set(installationId, {\n      workspaceId,\n      expiresAtMs: nowMs + this.workspaceCacheTtlMs,\n    });\n    return workspaceId;\n  }\n}\n\ntype ActiveBackoffEnvelope = InstallationTokenEnvelope & {\n  backoffUntil: Date;\n  backoffReason: NonNullable<InstallationTokenEnvelope['backoffReason']>;\n};\n\ntype TokenEnvelope = InstallationTokenEnvelope & {token: string; expiresAt: Date};\n\nfunction activeBackoff(\n  envelope: InstallationTokenEnvelope | undefined,\n  now: Date,\n): envelope is ActiveBackoffEnvelope {\n  return (\n    backoffActive(envelope, now) &&\n    envelope?.backoffUntil !== undefined &&\n    envelope.backoffReason !== undefined\n  );\n}\n\nfunction canServeStale(\n  envelope: InstallationTokenEnvelope | undefined,\n  now: Date,\n): envelope is TokenEnvelope {\n  const terminalBackoff =\n    activeBackoff(envelope, now) && mintErrorClassForReason(envelope.backoffReason) === 'terminal';\n  return (\n    envelope?.token !== undefined &&\n    envelope.expiresAt !== undefined &&\n    stillValid(envelope.expiresAt, now) &&\n    !terminalBackoff\n  );\n}\n\nfunction tokenFromEnvelope(envelope: InstallationTokenEnvelope): GithubInstallationAccessToken {\n  if (!envelope.token || !envelope.expiresAt) {\n    throw new GithubIntegrationProviderError(\n      'malformed-provider-response',\n      'GitHub installation token cache envelope is missing a token or expiry',\n    );\n  }\n  return {\n    token: envelope.token,\n    expiresAt: envelope.expiresAt,\n    ...(envelope.permissions === undefined ? {} : {permissions: envelope.permissions}),\n  };\n}\n\nfunction withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {\n  let timer: NodeJS.Timeout | undefined;\n  const timeout = new Promise<T>((_, reject) => {\n    timer = setTimeout(() => {\n      reject(\n        new GithubIntegrationProviderError(\n          'timeout',\n          'Timed out minting GitHub installation access token',\n        ),\n      );\n    }, timeoutMs);\n  });\n\n  return Promise.race([promise, timeout]).finally(() => {\n    if (timer) clearTimeout(timer);\n  });\n}\n"],"names":["setTimeout","sleepTimeout","reportError","logger","GithubIntegrationProviderError","recordInstallationTokenBackoff","recordInstallationTokenLookup","recordInstallationTokenMint","backoffActive","backoffMs","classifyMintError","mintErrorClassForReason","parseInstallationTokenEnvelope","providerErrorFromBackoff","stillValid","toProviderError","usable","DEFAULT_POLL_DELAYS_MS","DEFAULT_WORKSPACE_CACHE_TTL_MS","DEFAULT_MINT_TIMEOUT_MS","SharedInstallationTokenCache","options","workspaceIds","Map","now","Date","sleep","ms","then","undefined","pollDelaysMs","workspaceCacheTtlMs","mintTimeoutMs","getOrMint","installationId","mint","workspaceId","resolveWorkspaceId","envelope","readEnvelope","tokenFromEnvelope","result","withLock","mintUnderLock","acquired","value","serveStaleOrPoll","params","activeBackoff","canServeStale","backoffReason","backoffUntil","getTime","token","recordMint","error","providerError","classified","until","reason","class","writeEnvelope","expiresAt","permissions","catch","writeError","warn","boundary","operation","extra","toISOString","info","initialNow","delayMs","startedAt","withTimeout","outcome","durationMs","raw","secretStore","read","write","nowMs","cached","get","expiresAtMs","set","terminalBackoff","promise","timeoutMs","timer","timeout","Promise","_","reject","race","finally","clearTimeout"],"mappings":"AAAA,SAAQA,cAAcC,YAAY,QAAO,uBAAuB;AAChE,SAAQC,WAAW,QAAO,iCAAiC;AAC3D,SAAQC,MAAM,QAAO,8BAA8B;AACnD,SAAQC,8BAA8B,QAAO,kBAAkB;AAC/D,SACEC,8BAA8B,EAC9BC,6BAA6B,EAC7BC,2BAA2B,QACtB,oBAAoB;AAE3B,SACEC,aAAa,EACbC,SAAS,EACTC,iBAAiB,EAEjBC,uBAAuB,EACvBC,8BAA8B,EAC9BC,wBAAwB,EACxBC,UAAU,EACVC,eAAe,EACfC,MAAM,QACD,mCAAmC;AAkC1C,MAAMC,yBAAyB;IAAC;IAAK;IAAK;IAAK;IAAK;CAAI;AACxD,MAAMC,iCAAiC,KAAK,KAAK;AACjD,MAAMC,0BAA0B,KAAK;AAErC,OAAO,MAAMC;IAQX,YAAY,AAAiBC,OAA4C,CAAE;aAA9CA,UAAAA;aAPZC,eAAe,IAAIC;QAQlC,IAAI,CAACC,GAAG,GAAGH,QAAQG,GAAG,IAAK,CAAA,IAAM,IAAIC,MAAK;QAC1C,IAAI,CAACC,KAAK,GAAGL,QAAQK,KAAK,IAAK,CAAA,CAACC,KAAO1B,aAAa0B,IAAIC,IAAI,CAAC,IAAMC,UAAS;QAC5E,IAAI,CAACC,YAAY,GAAGT,QAAQS,YAAY,IAAIb;QAC5C,IAAI,CAACc,mBAAmB,GAAGV,QAAQU,mBAAmB,IAAIb;QAC1D,IAAI,CAACc,aAAa,GAAGX,QAAQW,aAAa,IAAIb;IAChD;IAEA,MAAMc,UACJC,cAAsB,EACtBC,IAAkD,EACV;QACxC,MAAMC,cAAc,MAAM,IAAI,CAACC,kBAAkB,CAACH;QAClD,MAAMI,WAAW,MAAM,IAAI,CAACC,YAAY,CAACH,aAAaF;QACtD,IAAIlB,OAAOsB,UAAU,IAAI,CAACd,GAAG,KAAK;YAChClB,8BAA8B;YAC9B,OAAOkC,kBAAkBF;QAC3B;QAEA,MAAMG,SAAS,MAAM,IAAI,CAACpB,OAAO,CAACqB,QAAQ,CAACR,gBAAgB,IACzD,IAAI,CAACS,aAAa,CAAC;gBAACP;gBAAaF;gBAAgBC;YAAI;QAEvD,IAAIM,OAAOG,QAAQ,EAAE,OAAOH,OAAOI,KAAK;QAExC,OAAO,MAAM,IAAI,CAACC,gBAAgB,CAAC;YAACV;YAAaF;YAAgBI;QAAQ;IAC3E;IAEA,MAAcK,cAAcI,MAI3B,EAA0C;QACzC,MAAMT,WAAW,MAAM,IAAI,CAACC,YAAY,CAACQ,OAAOX,WAAW,EAAEW,OAAOb,cAAc;QAClF,MAAMV,MAAM,IAAI,CAACA,GAAG;QACpB,IAAIR,OAAOsB,UAAUd,MAAM;YACzBlB,8BAA8B;YAC9B,OAAOkC,kBAAkBF;QAC3B;QAEA,IAAIU,cAAcV,UAAUd,MAAM;YAChC,IAAIyB,cAAcX,UAAUd,MAAM;gBAChClB,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YACAhC,8BAA8B;YAC9B,MAAMO,yBACJyB,UAAUY,iBAAiB,wBAC3B,AAACZ,CAAAA,UAAUa,cAAcC,aAAa5B,IAAI4B,OAAO,EAAC,IAAK5B,IAAI4B,OAAO;QAEtE;QAEA,IAAIC;QACJ,IAAI;YACFA,QAAQ,MAAM,IAAI,CAACC,UAAU,CAACP,OAAOZ,IAAI;QAC3C,EAAE,OAAOoB,OAAO;YACd,MAAMC,gBAAgBzC,gBAAgBwC;YACtC,MAAME,aAAa/C,kBAAkB8C;YACrC,MAAME,QAAQ,IAAIjC,KAAK,IAAI,CAACD,GAAG,GAAG4B,OAAO,KAAK3C,UAAUgD;YACxDpD,+BAA+B;gBAACsD,QAAQF,WAAWE,MAAM;gBAAEC,OAAOH,WAAWG,KAAK;YAAA;YAElF,MAAM,IAAI,CAACC,aAAa,CAACd,OAAOX,WAAW,EAAEW,OAAOb,cAAc,EAAE;gBAClEmB,OAAOf,UAAUe;gBACjBS,WAAWxB,UAAUwB;gBACrBC,aAAazB,UAAUyB;gBACvBZ,cAAcO;gBACdR,eAAeO,WAAWE,MAAM;YAClC,GAAGK,KAAK,CAAC,CAACC;gBACR9D,SAAS+D,IAAI,CACX;oBAAChC,gBAAgBa,OAAOb,cAAc;oBAAEyB,QAAQF,WAAWE,MAAM;oBAAEJ,OAAOU;gBAAU,GACpF;gBAEF/D,YAAY+D,YAAY;oBACtBE,UAAU;oBACVC,WAAW;oBACXC,OAAO;wBAACnC,gBAAgBa,OAAOb,cAAc;oBAAA;gBAC/C;YACF;YAEA,IACEuB,WAAWG,KAAK,KAAK,eACrBtB,UAAUe,SACVvC,WAAWwB,SAASwB,SAAS,EAAE,IAAI,CAACtC,GAAG,KACvC;gBACArB,SAAS+D,IAAI,CACX;oBACEhC,gBAAgBa,OAAOb,cAAc;oBACrC4B,WAAWxB,SAASwB,SAAS,EAAEQ;oBAC/BX,QAAQF,WAAWE,MAAM;oBACzBR,cAAcO,MAAMY,WAAW;gBACjC,GACA;gBAEFhE,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YAEAnC,SAAS+D,IAAI,CACX;gBACEhC,gBAAgBa,OAAOb,cAAc;gBACrCyB,QAAQF,WAAWE,MAAM;gBACzBR,cAAcO,MAAMY,WAAW;gBAC/Bf,OAAOC;YACT,GACA;YAEFlD,8BAA8B;YAC9B,MAAMkD;QACR;QAEA,IAAI;YACF,MAAM,IAAI,CAACK,aAAa,CAACd,OAAOX,WAAW,EAAEW,OAAOb,cAAc,EAAE;gBAClEmB,OAAOA,MAAMA,KAAK;gBAClBS,WAAWT,MAAMS,SAAS;gBAC1BC,aAAaV,MAAMU,WAAW;YAChC;QACF,EAAE,OAAOR,OAAO;YACdpD,SAAS+D,IAAI,CACX;gBAAChC,gBAAgBa,OAAOb,cAAc;gBAAE4B,WAAWT,MAAMS,SAAS,CAACQ,WAAW;gBAAIf;YAAK,GACvF;YAEFrD,YAAYqD,OAAO;gBACjBY,UAAU;gBACVC,WAAW;gBACXC,OAAO;oBAACnC,gBAAgBa,OAAOb,cAAc;gBAAA;YAC/C;QACF;QAEA/B,SAASoE,IAAI,CACX;YAACrC,gBAAgBa,OAAOb,cAAc;YAAE4B,WAAWT,MAAMS,SAAS,CAACQ,WAAW;QAAE,GAChF;QAEFhE,8BAA8B;QAC9B,OAAO+C;IACT;IAEA,MAAcP,iBAAiBC,MAI9B,EAA0C;QACzC,MAAMyB,aAAa,IAAI,CAAChD,GAAG;QAC3B,IAAIyB,cAAcF,OAAOT,QAAQ,EAAEkC,aAAa;YAC9ClE,8BAA8B;YAC9B,OAAOkC,kBAAkBO,OAAOT,QAAQ;QAC1C;QACA,IAAIU,cAAcD,OAAOT,QAAQ,EAAEkC,aAAa;YAC9ClE,8BAA8B;YAC9B,MAAMO,yBACJkC,OAAOT,QAAQ,CAACY,aAAa,EAC7BH,OAAOT,QAAQ,CAACa,YAAY,CAACC,OAAO,KAAKoB,WAAWpB,OAAO;QAE/D;QAEA,KAAK,MAAMqB,WAAW,IAAI,CAAC3C,YAAY,CAAE;YACvC,MAAM,IAAI,CAACJ,KAAK,CAAC+C;YACjB,MAAMnC,WAAW,MAAM,IAAI,CAACC,YAAY,CAACQ,OAAOX,WAAW,EAAEW,OAAOb,cAAc;YAClF,MAAMV,MAAM,IAAI,CAACA,GAAG;YACpB,IAAIR,OAAOsB,UAAUd,MAAM;gBACzBlB,8BAA8B;gBAC9B,OAAOkC,kBAAkBF;YAC3B;YACA,IAAI9B,cAAc8B,UAAUd,MAAM;gBAChClB,8BAA8B;gBAC9B,MAAMO,yBACJyB,UAAUY,iBAAiB,wBAC3B,AAACZ,CAAAA,UAAUa,cAAcC,aAAa5B,IAAI4B,OAAO,EAAC,IAAK5B,IAAI4B,OAAO;YAEtE;QACF;QAEA,MAAM,IAAIhD,+BACR,wBACA,uDACA;IAEJ;IAEA,MAAckD,WACZnB,IAAkD,EACV;QACxC,MAAMuC,YAAYjD,KAAKD,GAAG;QAC1B,IAAI;YACF,MAAM6B,QAAQ,MAAMsB,YAAYxC,QAAQ,IAAI,CAACH,aAAa;YAC1DzB,4BAA4B;gBAACqE,SAAS;gBAAWC,YAAYpD,KAAKD,GAAG,KAAKkD;YAAS;YACnF,OAAOrB;QACT,EAAE,OAAOE,OAAO;YACdhD,4BAA4B;gBAACqE,SAAS;gBAAWC,YAAYpD,KAAKD,GAAG,KAAKkD;YAAS;YACnF,MAAMnB;QACR;IACF;IAEA,MAAchB,aACZH,WAAmB,EACnBF,cAAsB,EAC0B;QAChD,MAAM4C,MAAM,MAAM,IAAI,CAACzD,OAAO,CAAC0D,WAAW,CAACC,IAAI,CAAC5C,aAAaF;QAC7D,IAAI4C,QAAQ,MAAM,OAAOjD;QAEzB,MAAMS,WAAW1B,+BAA+BkE;QAChD,IAAIxC,aAAaT,WAAW;YAC1B1B,SAAS+D,IAAI,CAAC;gBAAChC;YAAc,GAAG;QAClC;QACA,OAAOI;IACT;IAEA,MAAcuB,cACZzB,WAAmB,EACnBF,cAAsB,EACtBI,QAAmC,EACpB;QACf,MAAM,IAAI,CAACjB,OAAO,CAAC0D,WAAW,CAACE,KAAK,CAAC7C,aAAaF,gBAAgBI;IACpE;IAEA,MAAcD,mBAAmBH,cAAsB,EAAmB;QACxE,MAAMgD,QAAQ,IAAI,CAAC1D,GAAG,GAAG4B,OAAO;QAChC,MAAM+B,SAAS,IAAI,CAAC7D,YAAY,CAAC8D,GAAG,CAAClD;QACrC,IAAIiD,UAAUA,OAAOE,WAAW,GAAGH,OAAO,OAAOC,OAAO/C,WAAW;QAEnE,MAAMA,cAAc,MAAM,IAAI,CAACf,OAAO,CAACgB,kBAAkB,CAACH;QAC1D,IAAI,CAACZ,YAAY,CAACgE,GAAG,CAACpD,gBAAgB;YACpCE;YACAiD,aAAaH,QAAQ,IAAI,CAACnD,mBAAmB;QAC/C;QACA,OAAOK;IACT;AACF;AASA,SAASY,cACPV,QAA+C,EAC/Cd,GAAS;IAET,OACEhB,cAAc8B,UAAUd,QACxBc,UAAUa,iBAAiBtB,aAC3BS,SAASY,aAAa,KAAKrB;AAE/B;AAEA,SAASoB,cACPX,QAA+C,EAC/Cd,GAAS;IAET,MAAM+D,kBACJvC,cAAcV,UAAUd,QAAQb,wBAAwB2B,SAASY,aAAa,MAAM;IACtF,OACEZ,UAAUe,UAAUxB,aACpBS,SAASwB,SAAS,KAAKjC,aACvBf,WAAWwB,SAASwB,SAAS,EAAEtC,QAC/B,CAAC+D;AAEL;AAEA,SAAS/C,kBAAkBF,QAAmC;IAC5D,IAAI,CAACA,SAASe,KAAK,IAAI,CAACf,SAASwB,SAAS,EAAE;QAC1C,MAAM,IAAI1D,+BACR,+BACA;IAEJ;IACA,OAAO;QACLiD,OAAOf,SAASe,KAAK;QACrBS,WAAWxB,SAASwB,SAAS;QAC7B,GAAIxB,SAASyB,WAAW,KAAKlC,YAAY,CAAC,IAAI;YAACkC,aAAazB,SAASyB,WAAW;QAAA,CAAC;IACnF;AACF;AAEA,SAASY,YAAea,OAAmB,EAAEC,SAAiB;IAC5D,IAAIC;IACJ,MAAMC,UAAU,IAAIC,QAAW,CAACC,GAAGC;QACjCJ,QAAQ1F,WAAW;YACjB8F,OACE,IAAI1F,+BACF,WACA;QAGN,GAAGqF;IACL;IAEA,OAAOG,QAAQG,IAAI,CAAC;QAACP;QAASG;KAAQ,EAAEK,OAAO,CAAC;QAC9C,IAAIN,OAAOO,aAAaP;IAC1B;AACF"}