adispatchd 0.0.0-stage → 0.1.0

package/dist/filters/shell-check.js

@@ -0,0 +1,304 @@
+/**
+ * Shell check runner for shell filters and conditions (Spec §6, §20.3, §20.6).
+ *
+ * - Command as argument list (no shell), unless `shell: true` is configured
+ *   explicitly (then `/bin/sh -c <command> sh <args...>`).
+ * - Minimal environment (PATH, HOME, LANG, TZ, USER, LOGNAME, TMPDIR) plus
+ *   explicit `env` plus `ADISPATCH_CHECK_CONTEXT_FILE` pointing to a JSON file with
+ *   the check context (written with mode 0600, removed afterwards).
+ * - Exit 0 = `true`, exit 1 = `false`; exit ≥ 2, signal, timeout, spawn error
+ *   or abort = `unknown` with error detail.
+ * - Output (stdout/stderr) is captured up to a limit, the rest is discarded.
+ * - The process runs in its own process group; on timeout/abort the whole
+ *   group gets SIGTERM, then SIGKILL after a grace period.
+ * - Optional TTL cache (Clock based) for workflow conditions; item checks run
+ *   uncached by default.
+ */
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { errorMessage, noopLogger, systemClock, systemTimers, } from '../core/index.js';
+/** Environment variable holding the path of the check context JSON file. */
+export const CHECK_CONTEXT_ENV = 'ADISPATCH_CHECK_CONTEXT_FILE';
+/** Variables copied from the controller environment into every check process. */
+export const MINIMAL_ENV_KEYS = ['PATH', 'HOME', 'LANG', 'TZ', 'USER', 'LOGNAME', 'TMPDIR'];
+/** Default per-stream output limit in bytes. */
+export const DEFAULT_MAX_CHECK_OUTPUT_BYTES = 16 * 1024;
+/** Default grace period between SIGTERM and SIGKILL. */
+export const DEFAULT_CHECK_KILL_GRACE_MS = 2000;
+/** Build a {@link ShellCheckContext}. `sourceType` is the adapter type (e.g. `github`). */
+export function buildCheckContext(kind, workflowId, item, sourceType) {
+    const ctx = { schema_version: 1, kind, workflow: { id: workflowId } };
+    if (item) {
+        ctx.source = {
+            id: item.sourceId,
+            type: sourceType ?? '',
+            item_id: item.itemId,
+            item_key: item.key,
+            url: item.url,
+            item_type: item.type,
+            ...(item.createdAt !== undefined ? { created_at: item.createdAt } : {}),
+            attributes: { ...item.fields },
+        };
+    }
+    return ctx;
+}
+class OutputBuffer {
+    limit;
+    chunks = [];
+    size = 0;
+    truncated = false;
+    constructor(limit) {
+        this.limit = limit;
+    }
+    push(chunk) {
+        const room = this.limit - this.size;
+        if (room <= 0) {
+            if (chunk.length > 0)
+                this.truncated = true;
+            return;
+        }
+        const part = chunk.length > room ? chunk.subarray(0, room) : chunk;
+        if (part.length < chunk.length)
+            this.truncated = true;
+        this.chunks.push(part);
+        this.size += part.length;
+    }
+    text() {
+        return Buffer.concat(this.chunks).toString('utf8');
+    }
+}
+/** Runs shell checks; one instance per orchestrator (holds the workflow-condition cache). */
+export class ShellCheckRunner {
+    clock;
+    timers;
+    logger;
+    hostEnv;
+    tempDir;
+    maxOutputBytes;
+    killGraceMs;
+    cache = new Map();
+    inflight = new Map();
+    constructor(options = {}) {
+        this.clock = options.clock ?? systemClock;
+        this.timers = options.timers ?? systemTimers;
+        this.logger = options.logger ?? noopLogger;
+        this.hostEnv = options.hostEnv ?? process.env;
+        this.tempDir = options.tempDir ?? tmpdir();
+        this.maxOutputBytes = options.maxOutputBytes ?? DEFAULT_MAX_CHECK_OUTPUT_BYTES;
+        this.killGraceMs = options.killGraceMs ?? DEFAULT_CHECK_KILL_GRACE_MS;
+    }
+    /** Environment for a check process (minimal env + explicit env + context file). */
+    buildEnv(spec, contextFile) {
+        const env = {};
+        for (const key of MINIMAL_ENV_KEYS) {
+            const v = this.hostEnv[key];
+            if (v !== undefined)
+                env[key] = v;
+        }
+        Object.assign(env, spec.env ?? {});
+        env[CHECK_CONTEXT_ENV] = contextFile;
+        return env;
+    }
+    /** Run a check without caching. Never throws. */
+    async run(spec, context, options = {}) {
+        const startedAt = this.clock.now();
+        const t = spec.timeoutMs;
+        if (typeof t !== 'number' || !Number.isFinite(t) || t <= 0) {
+            return this.failure(startedAt, `invalid timeout: ${String(t)}`);
+        }
+        let dir;
+        try {
+            dir = await mkdtemp(join(this.tempDir, 'orch-check-'));
+            const contextFile = join(dir, 'context.json');
+            await writeFile(contextFile, JSON.stringify(context ?? null), { mode: 0o600 });
+            return await this.spawnCheck(spec, this.buildEnv(spec, contextFile), spec.cwd ?? dir, startedAt, options.signal);
+        }
+        catch (err) {
+            return this.failure(startedAt, `check preparation failed: ${errorMessage(err)}`);
+        }
+        finally {
+            if (dir)
+                await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+    /**
+     * Run a check with a TTL cache under `cacheKey` (e.g. `<workflowId>:condition:<index>`).
+     * Only definitive results (`true`/`false`) are cached; concurrent calls for
+     * the same key share one execution. `ttlMs <= 0` disables caching.
+     */
+    async runCached(cacheKey, ttlMs, spec, context, options = {}) {
+        if (ttlMs <= 0)
+            return this.run(spec, context, options);
+        const now = this.clock.now().getTime();
+        const entry = this.cache.get(cacheKey);
+        if (entry && now - entry.storedAt < entry.ttlMs)
+            return { ...entry.result, cached: true };
+        if (entry)
+            this.cache.delete(cacheKey);
+        const running = this.inflight.get(cacheKey);
+        if (running)
+            return { ...(await running), cached: true };
+        const p = this.run(spec, context, options).then((result) => {
+            if (result.value !== 'unknown')
+                this.cache.set(cacheKey, { storedAt: this.clock.now().getTime(), ttlMs, result });
+            return result;
+        });
+        this.inflight.set(cacheKey, p);
+        try {
+            return await p;
+        }
+        finally {
+            this.inflight.delete(cacheKey);
+        }
+    }
+    /** Drop one cache entry, or all (e.g. after a config reload). */
+    invalidate(cacheKey) {
+        if (cacheKey === undefined)
+            this.cache.clear();
+        else
+            this.cache.delete(cacheKey);
+    }
+    failure(startedAt, error) {
+        return {
+            value: 'unknown',
+            exitCode: null,
+            signal: null,
+            timedOut: false,
+            error,
+            stdout: '',
+            stderr: '',
+            outputTruncated: false,
+            startedAt: startedAt.toISOString(),
+            durationMs: Math.max(0, this.clock.now().getTime() - startedAt.getTime()),
+            cached: false,
+        };
+    }
+    spawnCheck(spec, env, cwd, startedAt, signal) {
+        const [file, args] = spec.shell
+            ? ['/bin/sh', ['-c', spec.command, 'sh', ...(spec.args ?? [])]]
+            : [spec.command, [...(spec.args ?? [])]];
+        const stdout = new OutputBuffer(this.maxOutputBytes);
+        const stderr = new OutputBuffer(this.maxOutputBytes);
+        return new Promise((resolve) => {
+            let settled = false;
+            let timedOut = false;
+            let aborted = false;
+            let spawnError;
+            const handles = [];
+            const child = spawn(file, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+            child.stdout.on('data', (c) => stdout.push(c));
+            child.stderr.on('data', (c) => stderr.push(c));
+            const killGroup = (sig) => {
+                if (child.pid === undefined)
+                    return;
+                try {
+                    process.kill(-child.pid, sig);
+                }
+                catch {
+                    try {
+                        child.kill(sig);
+                    }
+                    catch {
+                        /* already gone */
+                    }
+                }
+            };
+            const finish = (exitCode, sig) => {
+                if (settled)
+                    return;
+                settled = true;
+                for (const h of handles)
+                    this.timers.clearTimeout(h);
+                signal?.removeEventListener('abort', onAbort);
+                // Make sure no stray process of the group survives (e.g. background children).
+                if (child.pid !== undefined) {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        /* group already gone */
+                    }
+                }
+                let value = 'unknown';
+                let error;
+                if (spawnError !== undefined)
+                    error = `spawn failed: ${spawnError}`;
+                else if (timedOut)
+                    error = `timed out after ${spec.timeoutMs}ms`;
+                else if (aborted)
+                    error = 'aborted';
+                else if (sig !== null)
+                    error = `terminated by signal ${sig}`;
+                else if (exitCode === 0)
+                    value = true;
+                else if (exitCode === 1)
+                    value = false;
+                else
+                    error = `check error: exit code ${String(exitCode)}`;
+                if (error !== undefined)
+                    this.logger.warn('shell check failed', { command: spec.command, error });
+                resolve({
+                    value,
+                    exitCode,
+                    signal: sig,
+                    timedOut,
+                    ...(error !== undefined ? { error } : {}),
+                    stdout: stdout.text(),
+                    stderr: stderr.text(),
+                    outputTruncated: stdout.truncated || stderr.truncated,
+                    startedAt: startedAt.toISOString(),
+                    durationMs: Math.max(0, this.clock.now().getTime() - startedAt.getTime()),
+                    cached: false,
+                });
+            };
+            const terminate = () => {
+                killGroup('SIGTERM');
+                handles.push(this.timers.setTimeout(() => {
+                    killGroup('SIGKILL');
+                    // Last resort if pipes are held open by an escaped process.
+                    handles.push(this.timers.setTimeout(() => {
+                        child.stdout.destroy();
+                        child.stderr.destroy();
+                        finish(child.exitCode, child.signalCode);
+                    }, this.killGraceMs));
+                }, this.killGraceMs));
+            };
+            const onAbort = () => {
+                if (settled || timedOut)
+                    return;
+                aborted = true;
+                terminate();
+            };
+            child.on('error', (err) => {
+                spawnError = err.message;
+                // 'close' may not follow a failed spawn.
+                if (child.pid === undefined)
+                    finish(null, null);
+            });
+            child.on('close', (code, sig) => finish(code, sig));
+            child.on('exit', (code, sig) => {
+                // Pipes may be held open by background children; do not wait for them forever.
+                handles.push(this.timers.setTimeout(() => {
+                    child.stdout.destroy();
+                    child.stderr.destroy();
+                    finish(code, sig);
+                }, this.killGraceMs));
+            });
+            handles.push(this.timers.setTimeout(() => {
+                if (settled || aborted)
+                    return;
+                timedOut = true;
+                terminate();
+            }, spec.timeoutMs));
+            if (signal) {
+                if (signal.aborted)
+                    onAbort();
+                else
+                    signal.addEventListener('abort', onAbort, { once: true });
+            }
+        });
+    }
+}
+//# sourceMappingURL=shell-check.js.map

package/dist/filters/shell-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-check.js","sourceRoot":"","sources":["../../src/filters/shell-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,YAAY,GAMb,MAAM,kBAAkB,CAAC;AAE1B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;AAEhE,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAErG,gDAAgD;AAChD,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,wDAAwD;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAuChD,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAC/B,IAAoB,EACpB,UAAkB,EAClB,IAAiB,EACjB,UAAmB;IAEnB,MAAM,GAAG,GAAsB,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC;IACzF,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,MAAM,GAAG;YACX,EAAE,EAAE,IAAI,CAAC,QAAQ;YACjB,IAAI,EAAE,UAAU,IAAI,EAAE;YACtB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,QAAQ,EAAE,IAAI,CAAC,GAAG;YAClB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA0CD,MAAM,YAAY;IAKa,KAAK;IAJjB,MAAM,GAAa,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,CAAC;IACjB,SAAS,GAAG,KAAK,CAAC;IAElB,YAA6B,KAAa;qBAAb,KAAK;IAAW,CAAC;IAE9C,IAAI,CAAC,KAAa;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QACpC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAQ;IACb,MAAM,CAAS;IACf,MAAM,CAAS;IACf,OAAO,CAA+C;IACtD,OAAO,CAAS;IAChB,cAAc,CAAS;IACvB,WAAW,CAAS;IACpB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAAqC,CAAC;IAEzE,YAAY,OAAO,GAA4B,EAAE;QAC/C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,8BAA8B,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACxE,CAAC;IAED,mFAAmF;IACnF,QAAQ,CAAC,IAAoB,EAAE,WAAmB;QAChD,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,GAAG,CAAC,IAAoB,EAAE,OAAgB,EAAE,OAAO,GAA6B,EAAE;QACtF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAoB,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAC9C,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,6BAA6B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACT,IAAI,GAAG;gBAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,KAAa,EACb,IAAoB,EACpB,OAAgB,EAChB,OAAO,GAA6B,EAAE;QAEtC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1F,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO;YAAE,OAAO,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACzD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,UAAU,CAAC,QAAiB;QAC1B,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;;YAC1C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,OAAO,CAAC,SAAe,EAAE,KAAa;QAC5C,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,KAAK;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAEO,UAAU,CAChB,IAAoB,EACpB,GAA2B,EAC3B,GAAW,EACX,SAAe,EACf,MAA+B;QAE/B,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;YAC7B,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/D,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAErD,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAA8B,CAAC;YACnC,MAAM,OAAO,GAAuC,EAAE,CAAC;YAEvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAEvD,MAAM,SAAS,GAAG,CAAC,GAAmB,EAAQ,EAAE;gBAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,OAAO;gBACpC,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC;wBACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,CAAC,QAAuB,EAAE,GAAkB,EAAQ,EAAE;gBACnE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACrD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,+EAA+E;gBAC/E,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBAC5B,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,GAAa,SAAS,CAAC;gBAChC,IAAI,KAAyB,CAAC;gBAC9B,IAAI,UAAU,KAAK,SAAS;oBAAE,KAAK,GAAG,iBAAiB,UAAU,EAAE,CAAC;qBAC/D,IAAI,QAAQ;oBAAE,KAAK,GAAG,mBAAmB,IAAI,CAAC,SAAS,IAAI,CAAC;qBAC5D,IAAI,OAAO;oBAAE,KAAK,GAAG,SAAS,CAAC;qBAC/B,IAAI,GAAG,KAAK,IAAI;oBAAE,KAAK,GAAG,wBAAwB,GAAG,EAAE,CAAC;qBACxD,IAAI,QAAQ,KAAK,CAAC;oBAAE,KAAK,GAAG,IAAI,CAAC;qBACjC,IAAI,QAAQ,KAAK,CAAC;oBAAE,KAAK,GAAG,KAAK,CAAC;;oBAClC,KAAK,GAAG,0BAA0B,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1D,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClG,OAAO,CAAC;oBACN,KAAK;oBACL,QAAQ;oBACR,MAAM,EAAE,GAAG;oBACX,QAAQ;oBACR,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,eAAe,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;oBACrD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;oBAClC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;oBACzE,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,GAAS,EAAE;gBAC3B,SAAS,CAAC,SAAS,CAAC,CAAC;gBACrB,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;oBAC1B,SAAS,CAAC,SAAS,CAAC,CAAC;oBACrB,4DAA4D;oBAC5D,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;wBAC1B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACvB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACvB,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;oBAC3C,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CACrB,CAAC;gBACJ,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CACrB,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,GAAS,EAAE;gBACzB,IAAI,OAAO,IAAI,QAAQ;oBAAE,OAAO;gBAChC,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,CAAC;YAEF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxB,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC;gBACzB,yCAAyC;gBACzC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC7B,+EAA+E;gBAC/E,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;oBAC1B,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvB,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACvB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpB,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CACrB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,OAAO,IAAI,OAAO;oBAAE,OAAO;gBAC/B,QAAQ,GAAG,IAAI,CAAC;gBAChB,SAAS,EAAE,CAAC;YACd,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CACnB,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;;oBACzB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/identities/github-app.d.ts

@@ -0,0 +1,55 @@
+import { type AccessToken, type Clock, type CredentialProvider, type FetchLike, type IdentityDescription, type IdentityRef, type Logger, type SecretRedactor, type Timers } from '../core/index.js';
+import { GitHubHttpClient } from '../sources/index.js';
+/** Identity entry of type `github_app` (normalised, camelCase). */
+export interface GitHubAppIdentityConfig {
+    appId: string | number;
+    installationId: string | number;
+    /** Name of the environment variable holding the PEM private key. */
+    privateKeyEnv: string;
+}
+/** Dependencies of {@link GitHubAppCredentialProvider}. */
+export interface GitHubAppCredentialProviderDeps {
+    clock: Clock;
+    fetch?: FetchLike;
+    timers?: Timers;
+    logger?: Logger;
+    /** Environment to read private keys from. Default `process.env`. */
+    env?: Readonly<Record<string, string | undefined>>;
+    /** Registry that receives private keys and issued tokens for redaction. */
+    redactor?: SecretRedactor;
+    /** API base URL (default `https://api.github.com`). */
+    apiBaseUrl?: string;
+    /** Pre-built HTTP client (overrides fetch/timers/apiBaseUrl). */
+    http?: GitHubHttpClient;
+    /** Refresh a cached token this long before it expires. Default 5 min. */
+    refreshMarginMs?: number;
+}
+/** {@link CredentialProvider} for identities of type `github_app`. */
+export declare class GitHubAppCredentialProvider implements CredentialProvider {
+    private readonly identities;
+    private readonly clock;
+    private readonly logger;
+    private readonly env;
+    private readonly redactor;
+    private readonly http;
+    private readonly refreshMarginMs;
+    private readonly keys;
+    private readonly cache;
+    private readonly inflight;
+    /** Bumped on invalidate so that an in-flight exchange started earlier does not repopulate the cache. */
+    private readonly generation;
+    /** Issued tokens still registered with the redactor (removed once expired). */
+    private issued;
+    constructor(identities: Readonly<Record<string, GitHubAppIdentityConfig>>, deps: GitHubAppCredentialProviderDeps);
+    /** IDs of the configured identities. */
+    identityIds(): string[];
+    getToken(identity: IdentityRef, options?: {
+        signal?: AbortSignal;
+    }): Promise<AccessToken>;
+    describe(identity: IdentityRef): IdentityDescription | undefined;
+    invalidate(identity: IdentityRef): void;
+    private privateKey;
+    private exchange;
+    /** Register a new token for redaction and forget tokens that have expired (bounded registry). */
+    private trackForRedaction;
+}

package/dist/identities/github-app.js

@@ -0,0 +1,160 @@
+import { SourceError, noopLogger, } from '../core/index.js';
+import { GitHubHttpClient } from '../sources/index.js';
+import { createAppJwt, normalizePrivateKeyPem, parsePrivateKey } from './jwt.js';
+/** {@link CredentialProvider} for identities of type `github_app`. */
+export class GitHubAppCredentialProvider {
+    identities;
+    clock;
+    logger;
+    env;
+    redactor;
+    http;
+    refreshMarginMs;
+    keys = new Map();
+    cache = new Map();
+    inflight = new Map();
+    /** Bumped on invalidate so that an in-flight exchange started earlier does not repopulate the cache. */
+    generation = new Map();
+    /** Issued tokens still registered with the redactor (removed once expired). */
+    issued = [];
+    constructor(identities, deps) {
+        this.identities = new Map(Object.entries(identities));
+        this.clock = deps.clock;
+        this.logger = (deps.logger ?? noopLogger).child({ component: 'identities' });
+        this.env = deps.env ?? process.env;
+        this.redactor = deps.redactor;
+        this.refreshMarginMs = deps.refreshMarginMs ?? 5 * 60_000;
+        this.http =
+            deps.http ??
+                new GitHubHttpClient({
+                    clock: deps.clock,
+                    logger: this.logger,
+                    ...(deps.fetch ? { fetch: deps.fetch } : {}),
+                    ...(deps.timers ? { timers: deps.timers } : {}),
+                    ...(deps.apiBaseUrl ? { baseUrl: deps.apiBaseUrl } : {}),
+                });
+    }
+    /** IDs of the configured identities. */
+    identityIds() {
+        return [...this.identities.keys()];
+    }
+    async getToken(identity, options = {}) {
+        const cached = this.cache.get(identity);
+        if (cached && cached.expiresAt.getTime() - this.refreshMarginMs > this.clock.now().getTime())
+            return cached;
+        let shared = this.inflight.get(identity);
+        if (!shared) {
+            const generation = this.generation.get(identity) ?? 0;
+            // The shared exchange is independent of any caller's signal: one caller
+            // aborting must not fail the exchange for the others.
+            const promise = this.exchange(identity, undefined)
+                .then((token) => {
+                if ((this.generation.get(identity) ?? 0) === generation)
+                    this.cache.set(identity, token);
+                return token;
+            })
+                .finally(() => {
+                if (this.inflight.get(identity) === promise)
+                    this.inflight.delete(identity);
+            });
+            this.inflight.set(identity, promise);
+            shared = promise;
+        }
+        return raceWithSignal(shared, options.signal);
+    }
+    describe(identity) {
+        const config = this.identities.get(identity);
+        return config ? { appId: String(config.appId) } : undefined;
+    }
+    invalidate(identity) {
+        this.cache.delete(identity);
+        this.inflight.delete(identity);
+        this.generation.set(identity, (this.generation.get(identity) ?? 0) + 1);
+    }
+    privateKey(identity, config) {
+        const cached = this.keys.get(identity);
+        if (cached)
+            return cached;
+        const raw = this.env[config.privateKeyEnv];
+        if (!raw || raw.trim() === '') {
+            throw new SourceError('auth', `Private key for identity "${identity}" missing: environment variable ${config.privateKeyEnv} is not set`, { retryable: false });
+        }
+        // Register every form the key may show up in (raw env value, `\n`-escaped and normalised PEM).
+        const normalized = normalizePrivateKeyPem(raw);
+        for (const form of [raw, raw.trim(), normalized, normalized.trim()])
+            this.redactor?.add(form);
+        const key = parsePrivateKey(raw, `identity "${identity}"`);
+        this.keys.set(identity, key);
+        return key;
+    }
+    async exchange(identity, signal) {
+        const config = this.identities.get(identity);
+        if (!config)
+            throw new SourceError('auth', `Unknown identity "${identity}"`, { retryable: false });
+        const jwt = createAppJwt(config.appId, this.privateKey(identity, config), this.clock.now());
+        this.redactor?.add(jwt);
+        let data;
+        try {
+            const res = await this.http.request('POST', `/app/installations/${encodeURIComponent(String(config.installationId))}/access_tokens`, 
+            // Token creation has no side effects worth reconciling: safe to retry.
+            { token: jwt, idempotent: true, ...(signal ? { signal } : {}) });
+            data = res.data ?? {};
+        }
+        catch (err) {
+            if (err instanceof SourceError) {
+                // Client errors (bad JWT, unknown installation, revoked app) are auth failures;
+                // transient/rate-limit errors keep their kind so callers can retry.
+                if (err.kind === 'transient' || err.kind === 'rate_limited')
+                    throw err;
+                throw new SourceError('auth', `Could not obtain installation token for identity "${identity}": ${err.message}`, {
+                    retryable: false,
+                    ...(err.status !== undefined ? { status: err.status } : {}),
+                });
+            }
+            throw err;
+        }
+        finally {
+            this.redactor?.remove(jwt);
+        }
+        if (typeof data.token !== 'string' || typeof data.expires_at !== 'string' || Number.isNaN(Date.parse(data.expires_at))) {
+            throw new SourceError('auth', `Invalid installation token response for identity "${identity}"`, { retryable: false });
+        }
+        const token = { token: data.token, expiresAt: new Date(data.expires_at) };
+        this.trackForRedaction(token);
+        this.logger.info('Obtained GitHub installation token', { identity, expiresAt: token.expiresAt.toISOString() });
+        return token;
+    }
+    /** Register a new token for redaction and forget tokens that have expired (bounded registry). */
+    trackForRedaction(token) {
+        if (!this.redactor)
+            return;
+        const now = this.clock.now().getTime();
+        this.issued = this.issued.filter((t) => {
+            if (t.expiresAt.getTime() > now)
+                return true;
+            this.redactor?.remove(t.token);
+            return false;
+        });
+        this.redactor.add(token.token);
+        this.issued.push(token);
+    }
+}
+/** Resolve/reject with `promise`, but reject early with the signal's reason when `signal` aborts. */
+function raceWithSignal(promise, signal) {
+    if (!signal)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(signal.reason ?? new DOMException('aborted', 'AbortError'));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(signal.reason ?? new DOMException('aborted', 'AbortError'));
+        signal.addEventListener('abort', onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (err) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=github-app.js.map

package/dist/identities/github-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.js","sourceRoot":"","sources":["../../src/identities/github-app.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,WAAW,EACX,UAAU,GAUX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAiCjF,sEAAsE;AACtE,MAAM,OAAO,2BAA2B;IACrB,UAAU,CAA+C;IACzD,KAAK,CAAQ;IACb,MAAM,CAAS;IACf,GAAG,CAA+C;IAClD,QAAQ,CAA6B;IACrC,IAAI,CAAmB;IACvB,eAAe,CAAS;IACxB,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IACpC,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvC,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpE,wGAAwG;IACvF,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD,+EAA+E;IACvE,MAAM,GAAkB,EAAE,CAAC;IAEnC,YAAY,UAA6D,EAAE,IAAqC;QAC9G,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,CAAC,GAAG,MAAM,CAAC;QAC1D,IAAI,CAAC,IAAI;YACP,IAAI,CAAC,IAAI;gBACT,IAAI,gBAAgB,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD,CAAC,CAAC;IACP,CAAC;IAED,wCAAwC;IACxC,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAqB,EAAE,OAAO,GAA6B,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,MAAM,CAAC;QAC5G,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACtD,wEAAwE;YACxE,sDAAsD;YACtD,MAAM,OAAO,GAAyB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;iBACrE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,UAAU;oBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACzF,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,OAAO;oBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrC,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,QAAQ,CAAC,QAAqB;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,UAAU,CAAC,QAAqB;QAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,UAAU,CAAC,QAAgB,EAAE,MAA+B;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CACnB,MAAM,EACN,6BAA6B,QAAQ,mCAAmC,MAAM,CAAC,aAAa,aAAa,EACzG,EAAE,SAAS,EAAE,KAAK,EAAE,CACrB,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,aAAa,QAAQ,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,MAA+B;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,qBAAqB,QAAQ,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,IAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CACjC,MAAM,EACN,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,gBAAgB;YACvF,uEAAuE;YACvE,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAChE,CAAC;YACF,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;gBAC/B,gFAAgF;gBAChF,oEAAoE;gBACpE,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;oBAAE,MAAM,GAAG,CAAC;gBACvE,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,qDAAqD,QAAQ,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE;oBAC9G,SAAS,EAAE,KAAK;oBAChB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvH,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,qDAAqD,QAAQ,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iGAAiG;IACzF,iBAAiB,CAAC,KAAkB;QAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,qGAAqG;AACrG,SAAS,cAAc,CAAI,OAAmB,EAAE,MAA+B;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACtG,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/identities/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Component `identities` – public API (WI-06).
+ * Other components import from this module only.
+ */
+export * from './github-app.js';
+export * from './jwt.js';

package/dist/identities/index.js

@@ -0,0 +1,7 @@
+/**
+ * Component `identities` – public API (WI-06).
+ * Other components import from this module only.
+ */
+export * from './github-app.js';
+export * from './jwt.js';
+//# sourceMappingURL=index.js.map

package/dist/identities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identities/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,iBAAiB,CAAC;AAChC,cAAc,UAAU,CAAC"}

package/dist/identities/jwt.d.ts

@@ -0,0 +1,24 @@
+/**
+ * GitHub App JWT (RS256) creation with `node:crypto` (Spec §5.3).
+ */
+import { type KeyObject } from 'node:crypto';
+/** Seconds subtracted from `iat` to tolerate clock drift (GitHub recommendation). */
+export declare const JWT_IAT_SKEW_SECONDS = 60;
+/** JWT lifetime counted from the real "now"; GitHub allows at most 10 minutes. */
+export declare const JWT_LIFETIME_SECONDS: number;
+/**
+ * Normalise a PEM private key from an environment variable: accepts real
+ * newlines, literal `\n` escapes (common in `.env` files / systemd units),
+ * CRLF and surrounding quotes/whitespace.
+ */
+export declare function normalizePrivateKeyPem(raw: string): string;
+/**
+ * Parse a PEM private key. Throws `SourceError('auth')` with a message that
+ * never contains key material.
+ */
+export declare function parsePrivateKey(raw: string, label: string): KeyObject;
+/**
+ * Create a GitHub App JWT: header `{alg: RS256, typ: JWT}`, payload
+ * `{iat: now-60s, exp: now+9min, iss: appId}`.
+ */
+export declare function createAppJwt(appId: string | number, privateKey: KeyObject, now: Date): string;

package/dist/identities/jwt.js

@@ -0,0 +1,56 @@
+/**
+ * GitHub App JWT (RS256) creation with `node:crypto` (Spec §5.3).
+ */
+import { createPrivateKey, sign } from 'node:crypto';
+import { SourceError } from '../core/index.js';
+/** Seconds subtracted from `iat` to tolerate clock drift (GitHub recommendation). */
+export const JWT_IAT_SKEW_SECONDS = 60;
+/** JWT lifetime counted from the real "now"; GitHub allows at most 10 minutes. */
+export const JWT_LIFETIME_SECONDS = 9 * 60;
+/**
+ * Normalise a PEM private key from an environment variable: accepts real
+ * newlines, literal `\n` escapes (common in `.env` files / systemd units),
+ * CRLF and surrounding quotes/whitespace.
+ */
+export function normalizePrivateKeyPem(raw) {
+    let pem = raw.trim();
+    if ((pem.startsWith('"') && pem.endsWith('"')) || (pem.startsWith("'") && pem.endsWith("'"))) {
+        pem = pem.slice(1, -1).trim();
+    }
+    return `${pem.replace(/\\r\\n|\\n/g, '\n').replace(/\r\n/g, '\n').trim()}\n`;
+}
+/**
+ * Parse a PEM private key. Throws `SourceError('auth')` with a message that
+ * never contains key material.
+ */
+export function parsePrivateKey(raw, label) {
+    try {
+        const key = createPrivateKey({ key: normalizePrivateKeyPem(raw), format: 'pem' });
+        if (key.asymmetricKeyType !== 'rsa')
+            throw new Error('not an RSA key');
+        return key;
+    }
+    catch {
+        throw new SourceError('auth', `Private key for ${label} is not a valid RSA PEM key`, { retryable: false });
+    }
+}
+function base64url(input) {
+    return Buffer.from(input).toString('base64url');
+}
+/**
+ * Create a GitHub App JWT: header `{alg: RS256, typ: JWT}`, payload
+ * `{iat: now-60s, exp: now+9min, iss: appId}`.
+ */
+export function createAppJwt(appId, privateKey, now) {
+    const nowSeconds = Math.floor(now.getTime() / 1000);
+    const header = { alg: 'RS256', typ: 'JWT' };
+    const payload = {
+        iat: nowSeconds - JWT_IAT_SKEW_SECONDS,
+        exp: nowSeconds + JWT_LIFETIME_SECONDS,
+        iss: String(appId),
+    };
+    const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(payload))}`;
+    const signature = sign('RSA-SHA256', Buffer.from(signingInput), privateKey);
+    return `${signingInput}.${base64url(signature)}`;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/identities/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/identities/jwt.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,mBAAmB,KAAK,6BAA6B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAsB;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAsB,EAAE,UAAqB,EAAE,GAAS;IACnF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,UAAU,GAAG,oBAAoB;QACtC,GAAG,EAAE,UAAU,GAAG,oBAAoB;QACtC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC;KACnB,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC,CAAC;IAC5E,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;AACnD,CAAC"}