@vizamodo/runtime-primitives 1.1.8 → 1.1.10

package/dist/aws/console-login.d.ts

@@ -7,8 +7,7 @@ export interface AwsConsoleLoginConfig {
     certBase64: string;
     privateKeyBase64: string;
 }
-export declare function issueAwsSessionCredentials(config: AwsConsoleLoginConfig): Promise<import("@vizamodo/aws-runtime-core").AwsCredentialResult>;
-export declare function createAwsFederatedLogin(params: AwsConsoleLoginConfig & {
+export declare function createAwsFederatedLoginWithRetry(params: AwsConsoleLoginConfig & {
     intent?: "console" | "billing" | "dynamodb" | "ssm";
 }): Promise<{
     loginUrl: string;

package/dist/aws/console-login.js

@@ -1,21 +1,9 @@
-import { issueAwsCredentials, buildFederationLoginUrl, } from "@vizamodo/aws-runtime-core";
+import { buildFederationLoginUrl, } from "@vizamodo/aws-runtime-core";
 import { retryOnce } from "../runtime/retry-once";
-export async function issueAwsSessionCredentials(config) {
-    const { profile, region, trustAnchorArn, roleArn, profileArn, certBase64, privateKeyBase64, } = config;
-    return await retryOnce((ctx) => issueAwsCredentials({
-        trustAnchorArn,
-        roleArn,
-        profileArn,
-        region,
-        certBase64,
-        privateKeyPkcs8Base64: privateKeyBase64,
-        profile,
-        ...ctx,
-    }));
-}
-export async function createAwsFederatedLogin(params) {
+import { issueAwsCredentialsWithRetry } from "./credentials";
+export async function createAwsFederatedLoginWithRetry(params) {
     const { intent, ...config } = params;
-    const creds = await issueAwsSessionCredentials(config);
+    const creds = await issueAwsCredentialsWithRetry(config);
     const { loginUrl, shortUrl } = await retryOnce((ctx) => buildFederationLoginUrl({
         accessKeyId: creds.accessKeyId,
         secretAccessKey: creds.secretAccessKey,

package/dist/aws/credentials.d.ts

@@ -0,0 +1,16 @@
+export interface AwsCredentialConfig {
+    profile: string;
+    region: string;
+    trustAnchorArn: string;
+    roleArn: string;
+    profileArn: string;
+    certBase64: string;
+    privateKeyBase64: string;
+}
+/**
+ * Primitive: Issue AWS credentials with a single retry.
+ * - No console-specific logic
+ * - No side effects beyond AWS call
+ * - Deterministic input/output
+ */
+export declare function issueAwsCredentialsWithRetry(config: AwsCredentialConfig): Promise<import("@vizamodo/aws-runtime-core").AwsCredentialResult>;

package/dist/aws/credentials.js

@@ -0,0 +1,24 @@
+import { issueAwsCredentials } from "@vizamodo/aws-runtime-core";
+import { retryOnce } from "../runtime/retry-once";
+/**
+ * Primitive: Issue AWS credentials with a single retry.
+ * - No console-specific logic
+ * - No side effects beyond AWS call
+ * - Deterministic input/output
+ */
+export async function issueAwsCredentialsWithRetry(config) {
+    const { profile, region, trustAnchorArn, roleArn, profileArn, certBase64, privateKeyBase64, } = config;
+    if (!profile || !region || !trustAnchorArn || !roleArn || !profileArn) {
+        throw new Error("Missing required AWS credential parameters");
+    }
+    return await retryOnce((ctx) => issueAwsCredentials({
+        trustAnchorArn,
+        roleArn,
+        profileArn,
+        region,
+        certBase64,
+        privateKeyPkcs8Base64: privateKeyBase64,
+        profile,
+        ...ctx,
+    }));
+}

package/dist/github/github-app-token.d.ts

@@ -1,4 +1,4 @@
-export declare function getGithubInstallationToken(installationId: number, privateKey: string, appId: string): Promise<{
+export declare function getGithubInstallationToken(installationId: number, privateKey: string, clientId: string): Promise<{
     token: string;
     expiresAt: string;
 }>;

package/dist/github/github-app-token.js

@@ -1,4 +1,4 @@
-async function createGithubAppJwt(appId, privateKeyPem) {
+async function createGithubAppJwt(clientId, privateKeyPem) {
     // Convert PEM → ArrayBuffer
     const pem = privateKeyPem
         .replace(/-----BEGIN [A-Z ]+-----/g, "")
@@ -23,7 +23,7 @@ async function createGithubAppJwt(appId, privateKeyPem) {
     const payload = {
         iat: now - 60,
         exp: now + 540,
-        iss: appId,
+        iss: clientId,
     };
     const encode = (obj) => btoa(JSON.stringify(obj))
         .replace(/=/g, "")
@@ -43,8 +43,8 @@ async function createGithubAppJwt(appId, privateKeyPem) {
         .replace(/\//g, "_");
     return `${data}.${sigB64}`;
 }
-export async function getGithubInstallationToken(installationId, privateKey, appId) {
-    const jwt = await createGithubAppJwt(appId, privateKey);
+export async function getGithubInstallationToken(installationId, privateKey, clientId) {
+    const jwt = await createGithubAppJwt(clientId, privateKey);
     const res = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
         method: "POST",
         headers: {

package/dist/github/github-owner-token.d.ts

@@ -1,6 +1,11 @@
-export declare function getInstallationTokenCached(params: {
+/**
+ * Use-case helper: get installation token with built-in retry.
+ * - wraps getInstallationTokenCached
+ * - avoids forcing consumers to compose retry manually
+ */
+export declare function getInstallationTokenWithRetry(params: {
     installationId: number;
     appPrivateKey: string;
-    appId: string;
+    clientId: string;
     forceRefresh?: boolean;
 }): Promise<string>;

package/dist/github/github-owner-token.js

@@ -1,10 +1,11 @@
+import { retryOnce } from "../runtime/retry-once";
 import { getGithubInstallationToken } from "./github-app-token";
 import { getCachedOrFetch, wrapResult } from "@vizamodo/edge-cache-core";
-export async function getInstallationTokenCached(params) {
-    const { installationId, appPrivateKey, appId, forceRefresh } = params;
-    const key = `gh-token:${appId}:${installationId}`;
+async function getInstallationTokenCached(params) {
+    const { installationId, appPrivateKey, clientId, forceRefresh } = params;
+    const key = `gh-token:${clientId}:${installationId}`;
     const token = await getCachedOrFetch(key, async () => {
-        const { token, expiresAt } = await getGithubInstallationToken(installationId, appPrivateKey, appId);
+        const { token, expiresAt } = await getGithubInstallationToken(installationId, appPrivateKey, clientId);
         // use wrapResult pattern to let cache derive TTL from expiresAt
         return wrapResult(token, expiresAt);
     }, {
@@ -14,3 +15,14 @@ export async function getInstallationTokenCached(params) {
     );
     return token;
 }
+/**
+ * Use-case helper: get installation token with built-in retry.
+ * - wraps getInstallationTokenCached
+ * - avoids forcing consumers to compose retry manually
+ */
+export async function getInstallationTokenWithRetry(params) {
+    return await retryOnce((ctx) => getInstallationTokenCached({
+        ...params,
+        ...(ctx ?? {})
+    }));
+}

package/dist/index.d.ts

@@ -3,11 +3,11 @@
  * Organized by domain to keep imports explicit and tree-shake friendly
  */
 export * from "./aws/console-login";
+export * from "./aws/credentials";
 export * from "./aws/load-backup-from-ssm";
 export * from "./aws/resolve-config";
 export { buildSignedAwsRequest } from "@vizamodo/aws-runtime-core";
 export * from "./crypto/age";
-export * from "./github/github-app-token";
 export * from "./github/github-owner-token";
 export * from "./github/list-workflow-runs";
 export * from "./github/put-secret";

package/dist/index.js

@@ -4,13 +4,13 @@
  */
 // AWS
 export * from "./aws/console-login";
+export * from "./aws/credentials";
 export * from "./aws/load-backup-from-ssm";
 export * from "./aws/resolve-config";
 export { buildSignedAwsRequest } from "@vizamodo/aws-runtime-core";
 // Crypto
 export * from "./crypto/age";
 // GitHub
-export * from "./github/github-app-token";
 export * from "./github/github-owner-token";
 export * from "./github/list-workflow-runs";
 export * from "./github/put-secret";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizamodo/runtime-primitives",
-  "version": "1.1.8",
+  "version": "1.1.10",
   "description": "Edge-compatible runtime primitives for AWS, GitHub, crypto, and caching used across Viza services",
   "type": "module",
   "main": "dist/index.js",
@@ -28,7 +28,7 @@
     "tweetnacl-sealedbox-js": "^1.2.0"
   },
   "devDependencies": {
-    "@types/node": "^25.5.2",
+    "@types/node": "^25.6.0",
     "typescript": "^6.0.2"
   },
   "publishConfig": {