expxagents 0.30.21 → 0.30.22

package/dist/server/db/schema.d.ts

@@ -1,2 +1,2 @@
-export declare const SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS users (\n  id TEXT PRIMARY KEY,\n  username TEXT UNIQUE NOT NULL,\n  email TEXT,\n  password_hash TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'operator',\n  created_at TEXT NOT NULL,\n  last_login TEXT\n);\n\nCREATE TABLE IF NOT EXISTS sessions (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  token_hash TEXT NOT NULL,\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS audit_log (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  user_id TEXT NOT NULL REFERENCES users(id),\n  action TEXT NOT NULL,\n  details TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS conversations (\n  id TEXT PRIMARY KEY,\n  squad_name TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS chat_messages (\n  id TEXT PRIMARY KEY,\n  conversation_id TEXT NOT NULL REFERENCES conversations(id),\n  role TEXT NOT NULL,\n  content TEXT NOT NULL,\n  agent_id TEXT,\n  agent_name TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS squad_activities (\n  id TEXT PRIMARY KEY,\n  squad_code TEXT NOT NULL,\n  conversation_id TEXT,\n  started_at TEXT NOT NULL,\n  finished_at TEXT,\n  duration_ms INTEGER,\n  status TEXT NOT NULL DEFAULT 'running',\n  user_message TEXT,\n  result_summary TEXT,\n  triggered_by TEXT DEFAULT 'dashboard',\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_squad_date\n  ON squad_activities(squad_code, started_at);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_date\n  ON squad_activities(started_at);\n\nCREATE TABLE IF NOT EXISTS scheduled_jobs (\n  squad_name TEXT PRIMARY KEY,\n  cron_expression TEXT NOT NULL,\n  prompt TEXT NOT NULL,\n  mode TEXT DEFAULT 'autonomous',\n  timeout_minutes INTEGER DEFAULT 30,\n  retry_on_failure INTEGER DEFAULT 0,\n  timezone TEXT,\n  status TEXT DEFAULT 'active',\n  last_run_at TEXT,\n  last_result TEXT,\n  next_run_at TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_triggered_by\n  ON squad_activities(triggered_by, squad_code);\n\nCREATE TABLE IF NOT EXISTS leads (\n  id TEXT PRIMARY KEY,\n  email TEXT UNIQUE NOT NULL,\n  name TEXT,\n  company TEXT,\n  metadata TEXT,\n  status TEXT DEFAULT 'active',\n  source TEXT,\n  source_detail TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS lead_tags (\n  lead_id TEXT NOT NULL REFERENCES leads(id) ON DELETE CASCADE,\n  tag TEXT NOT NULL,\n  PRIMARY KEY (lead_id, tag)\n);\n\nCREATE TABLE IF NOT EXISTS lead_lists (\n  lead_id TEXT NOT NULL REFERENCES leads(id) ON DELETE CASCADE,\n  list_name TEXT NOT NULL,\n  PRIMARY KEY (lead_id, list_name)\n);\n\nCREATE TABLE IF NOT EXISTS email_campaigns (\n  id TEXT PRIMARY KEY,\n  name TEXT,\n  squad_name TEXT,\n  subject TEXT,\n  body_html TEXT,\n  body_text TEXT,\n  from_email TEXT,\n  from_name TEXT,\n  status TEXT DEFAULT 'draft',\n  total_recipients INTEGER DEFAULT 0,\n  sent_count INTEGER DEFAULT 0,\n  failed_count INTEGER DEFAULT 0,\n  bounce_count INTEGER DEFAULT 0,\n  complaint_count INTEGER DEFAULT 0,\n  created_at TEXT DEFAULT (datetime('now')),\n  started_at TEXT,\n  completed_at TEXT\n);\n\nCREATE TABLE IF NOT EXISTS email_queue (\n  id TEXT PRIMARY KEY,\n  campaign_id TEXT REFERENCES email_campaigns(id) ON DELETE CASCADE,\n  lead_id TEXT REFERENCES leads(id) ON DELETE SET NULL,\n  to_email TEXT NOT NULL,\n  status TEXT DEFAULT 'pending',\n  ses_message_id TEXT,\n  error TEXT,\n  attempts INTEGER DEFAULT 0,\n  scheduled_at TEXT,\n  sent_at TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_email_queue_status_scheduled\n  ON email_queue(status, scheduled_at);\nCREATE INDEX IF NOT EXISTS idx_email_queue_ses_message_id\n  ON email_queue(ses_message_id);\nCREATE INDEX IF NOT EXISTS idx_email_queue_campaign_status\n  ON email_queue(campaign_id, status);\nCREATE INDEX IF NOT EXISTS idx_lead_tags_tag\n  ON lead_tags(tag);\nCREATE INDEX IF NOT EXISTS idx_lead_lists_list_name\n  ON lead_lists(list_name);\n\nCREATE TABLE IF NOT EXISTS team_members (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  role TEXT NOT NULL,\n  email TEXT,\n  phone TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS integrations (\n  provider TEXT PRIMARY KEY,\n  enabled INTEGER NOT NULL DEFAULT 0,\n  config TEXT NOT NULL DEFAULT '{}',\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS kanban_tasks (\n  id TEXT PRIMARY KEY,\n  squad_code TEXT NOT NULL,\n  title TEXT NOT NULL,\n  description TEXT,\n  status TEXT NOT NULL DEFAULT 'planned',\n  position INTEGER NOT NULL DEFAULT 0,\n  result TEXT,\n  started_at TEXT,\n  finished_at TEXT,\n  step_id TEXT,\n  agent_id TEXT,\n  agent_name TEXT,\n  activity_id TEXT REFERENCES squad_activities(id) ON DELETE SET NULL,\n  triggered_by TEXT DEFAULT 'dashboard',\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_kanban_tasks_squad_status\n  ON kanban_tasks(squad_code, status);\n\nCREATE TABLE IF NOT EXISTS squad_states (\n  squad_code TEXT PRIMARY KEY,\n  status TEXT NOT NULL DEFAULT 'idle',\n  current_step INTEGER NOT NULL DEFAULT 0,\n  total_steps INTEGER NOT NULL DEFAULT 0,\n  step_label TEXT DEFAULT '',\n  started_at TEXT,\n  updated_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS agent_states (\n  id TEXT NOT NULL,\n  squad_code TEXT NOT NULL REFERENCES squad_states(squad_code) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  icon TEXT NOT NULL,\n  status TEXT NOT NULL DEFAULT 'idle',\n  step_index INTEGER NOT NULL DEFAULT 0,\n  step_label TEXT DEFAULT '',\n  deliver_to TEXT,\n  desk_col INTEGER NOT NULL,\n  desk_row INTEGER NOT NULL,\n  message TEXT,\n  updated_at TEXT NOT NULL,\n  PRIMARY KEY (squad_code, id)\n);\n\nCREATE TABLE IF NOT EXISTS handoffs (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  squad_code TEXT NOT NULL REFERENCES squad_states(squad_code),\n  from_agent TEXT NOT NULL,\n  to_agent TEXT NOT NULL,\n  message TEXT NOT NULL,\n  completed_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_handoffs_squad ON handoffs(squad_code, completed_at);\nCREATE INDEX IF NOT EXISTS idx_agent_states_status ON agent_states(squad_code, status);\n\nCREATE TABLE IF NOT EXISTS cost_entries (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  squad_code TEXT NOT NULL,\n  activity_id TEXT REFERENCES squad_activities(id) ON DELETE SET NULL,\n  agent_id TEXT NOT NULL,\n  agent_name TEXT,\n  step_index INTEGER,\n  model TEXT NOT NULL,\n  input_chars INTEGER NOT NULL,\n  output_chars INTEGER NOT NULL,\n  estimated_tokens_in INTEGER NOT NULL,\n  estimated_tokens_out INTEGER NOT NULL,\n  estimated_cost_usd REAL NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_cost_squad_date ON cost_entries(squad_code, created_at);\nCREATE INDEX IF NOT EXISTS idx_cost_agent ON cost_entries(squad_code, agent_id);\nCREATE INDEX IF NOT EXISTS idx_cost_activity ON cost_entries(activity_id);\n\nCREATE TABLE IF NOT EXISTS event_log (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  level TEXT NOT NULL DEFAULT 'info',\n  squad_code TEXT,\n  source TEXT NOT NULL,\n  message TEXT NOT NULL,\n  detail TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_event_log_created ON event_log(created_at);\nCREATE INDEX IF NOT EXISTS idx_event_log_squad ON event_log(squad_code, created_at);\nCREATE INDEX IF NOT EXISTS idx_event_log_level ON event_log(level, created_at);\n\nCREATE TABLE IF NOT EXISTS execution_logs (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  activity_id TEXT NOT NULL REFERENCES squad_activities(id) ON DELETE CASCADE,\n  squad_code TEXT NOT NULL,\n  chunk TEXT NOT NULL,\n  source TEXT NOT NULL DEFAULT 'output',\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_execution_logs_activity ON execution_logs(activity_id, created_at);\n\nCREATE TABLE IF NOT EXISTS user_squad_access (\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  squad_code TEXT NOT NULL,\n  PRIMARY KEY (user_id, squad_code)\n);\n\nCREATE TABLE IF NOT EXISTS user_page_access (\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  page TEXT NOT NULL,\n  PRIMARY KEY (user_id, page)\n);\n";
+export declare const SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS users (\n  id TEXT PRIMARY KEY,\n  username TEXT UNIQUE NOT NULL,\n  email TEXT,\n  password_hash TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'operator',\n  created_at TEXT NOT NULL,\n  last_login TEXT\n);\n\nCREATE TABLE IF NOT EXISTS sessions (\n  id TEXT PRIMARY KEY,\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  token_hash TEXT NOT NULL,\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS audit_log (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  user_id TEXT NOT NULL REFERENCES users(id),\n  action TEXT NOT NULL,\n  details TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS conversations (\n  id TEXT PRIMARY KEY,\n  squad_name TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS chat_messages (\n  id TEXT PRIMARY KEY,\n  conversation_id TEXT NOT NULL REFERENCES conversations(id),\n  role TEXT NOT NULL,\n  content TEXT NOT NULL,\n  agent_id TEXT,\n  agent_name TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS squad_activities (\n  id TEXT PRIMARY KEY,\n  squad_code TEXT NOT NULL,\n  conversation_id TEXT,\n  started_at TEXT NOT NULL,\n  finished_at TEXT,\n  duration_ms INTEGER,\n  status TEXT NOT NULL DEFAULT 'running',\n  user_message TEXT,\n  result_summary TEXT,\n  triggered_by TEXT DEFAULT 'dashboard',\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_squad_date\n  ON squad_activities(squad_code, started_at);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_date\n  ON squad_activities(started_at);\n\nCREATE TABLE IF NOT EXISTS scheduled_jobs (\n  squad_name TEXT PRIMARY KEY,\n  cron_expression TEXT NOT NULL,\n  prompt TEXT NOT NULL,\n  mode TEXT DEFAULT 'autonomous',\n  timeout_minutes INTEGER DEFAULT 30,\n  retry_on_failure INTEGER DEFAULT 0,\n  timezone TEXT,\n  status TEXT DEFAULT 'active',\n  last_run_at TEXT,\n  last_result TEXT,\n  next_run_at TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_squad_activities_triggered_by\n  ON squad_activities(triggered_by, squad_code);\n\nCREATE TABLE IF NOT EXISTS leads (\n  id TEXT PRIMARY KEY,\n  email TEXT UNIQUE NOT NULL,\n  name TEXT,\n  company TEXT,\n  metadata TEXT,\n  status TEXT DEFAULT 'active',\n  source TEXT,\n  source_detail TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS lead_tags (\n  lead_id TEXT NOT NULL REFERENCES leads(id) ON DELETE CASCADE,\n  tag TEXT NOT NULL,\n  PRIMARY KEY (lead_id, tag)\n);\n\nCREATE TABLE IF NOT EXISTS lead_lists (\n  lead_id TEXT NOT NULL REFERENCES leads(id) ON DELETE CASCADE,\n  list_name TEXT NOT NULL,\n  PRIMARY KEY (lead_id, list_name)\n);\n\nCREATE TABLE IF NOT EXISTS email_campaigns (\n  id TEXT PRIMARY KEY,\n  name TEXT,\n  squad_name TEXT,\n  subject TEXT,\n  body_html TEXT,\n  body_text TEXT,\n  from_email TEXT,\n  from_name TEXT,\n  status TEXT DEFAULT 'draft',\n  total_recipients INTEGER DEFAULT 0,\n  sent_count INTEGER DEFAULT 0,\n  failed_count INTEGER DEFAULT 0,\n  bounce_count INTEGER DEFAULT 0,\n  complaint_count INTEGER DEFAULT 0,\n  created_at TEXT DEFAULT (datetime('now')),\n  started_at TEXT,\n  completed_at TEXT\n);\n\nCREATE TABLE IF NOT EXISTS email_queue (\n  id TEXT PRIMARY KEY,\n  campaign_id TEXT REFERENCES email_campaigns(id) ON DELETE CASCADE,\n  lead_id TEXT REFERENCES leads(id) ON DELETE SET NULL,\n  to_email TEXT NOT NULL,\n  status TEXT DEFAULT 'pending',\n  ses_message_id TEXT,\n  error TEXT,\n  attempts INTEGER DEFAULT 0,\n  scheduled_at TEXT,\n  sent_at TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_email_queue_status_scheduled\n  ON email_queue(status, scheduled_at);\nCREATE INDEX IF NOT EXISTS idx_email_queue_ses_message_id\n  ON email_queue(ses_message_id);\nCREATE INDEX IF NOT EXISTS idx_email_queue_campaign_status\n  ON email_queue(campaign_id, status);\nCREATE INDEX IF NOT EXISTS idx_lead_tags_tag\n  ON lead_tags(tag);\nCREATE INDEX IF NOT EXISTS idx_lead_lists_list_name\n  ON lead_lists(list_name);\n\nCREATE TABLE IF NOT EXISTS team_members (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  role TEXT NOT NULL,\n  email TEXT,\n  phone TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS integrations (\n  provider TEXT PRIMARY KEY,\n  enabled INTEGER NOT NULL DEFAULT 0,\n  config TEXT NOT NULL DEFAULT '{}',\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS github_installations (\n  id TEXT PRIMARY KEY,\n  type TEXT NOT NULL,\n  account_login TEXT,\n  account_type TEXT,\n  access_token TEXT NOT NULL,\n  refresh_token TEXT,\n  token_expires_at TEXT,\n  scope TEXT,\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS github_webhook_registrations (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  repo_full_name TEXT NOT NULL,\n  webhook_id INTEGER NOT NULL,\n  squad_code TEXT,\n  created_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE TABLE IF NOT EXISTS kanban_tasks (\n  id TEXT PRIMARY KEY,\n  squad_code TEXT NOT NULL,\n  title TEXT NOT NULL,\n  description TEXT,\n  status TEXT NOT NULL DEFAULT 'planned',\n  position INTEGER NOT NULL DEFAULT 0,\n  result TEXT,\n  started_at TEXT,\n  finished_at TEXT,\n  step_id TEXT,\n  agent_id TEXT,\n  agent_name TEXT,\n  activity_id TEXT REFERENCES squad_activities(id) ON DELETE SET NULL,\n  triggered_by TEXT DEFAULT 'dashboard',\n  created_at TEXT DEFAULT (datetime('now')),\n  updated_at TEXT DEFAULT (datetime('now'))\n);\n\nCREATE INDEX IF NOT EXISTS idx_kanban_tasks_squad_status\n  ON kanban_tasks(squad_code, status);\n\nCREATE TABLE IF NOT EXISTS squad_states (\n  squad_code TEXT PRIMARY KEY,\n  status TEXT NOT NULL DEFAULT 'idle',\n  current_step INTEGER NOT NULL DEFAULT 0,\n  total_steps INTEGER NOT NULL DEFAULT 0,\n  step_label TEXT DEFAULT '',\n  started_at TEXT,\n  updated_at TEXT NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS agent_states (\n  id TEXT NOT NULL,\n  squad_code TEXT NOT NULL REFERENCES squad_states(squad_code) ON DELETE CASCADE,\n  name TEXT NOT NULL,\n  icon TEXT NOT NULL,\n  status TEXT NOT NULL DEFAULT 'idle',\n  step_index INTEGER NOT NULL DEFAULT 0,\n  step_label TEXT DEFAULT '',\n  deliver_to TEXT,\n  desk_col INTEGER NOT NULL,\n  desk_row INTEGER NOT NULL,\n  message TEXT,\n  updated_at TEXT NOT NULL,\n  PRIMARY KEY (squad_code, id)\n);\n\nCREATE TABLE IF NOT EXISTS handoffs (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  squad_code TEXT NOT NULL REFERENCES squad_states(squad_code),\n  from_agent TEXT NOT NULL,\n  to_agent TEXT NOT NULL,\n  message TEXT NOT NULL,\n  completed_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_handoffs_squad ON handoffs(squad_code, completed_at);\nCREATE INDEX IF NOT EXISTS idx_agent_states_status ON agent_states(squad_code, status);\n\nCREATE TABLE IF NOT EXISTS cost_entries (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  squad_code TEXT NOT NULL,\n  activity_id TEXT REFERENCES squad_activities(id) ON DELETE SET NULL,\n  agent_id TEXT NOT NULL,\n  agent_name TEXT,\n  step_index INTEGER,\n  model TEXT NOT NULL,\n  input_chars INTEGER NOT NULL,\n  output_chars INTEGER NOT NULL,\n  estimated_tokens_in INTEGER NOT NULL,\n  estimated_tokens_out INTEGER NOT NULL,\n  estimated_cost_usd REAL NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_cost_squad_date ON cost_entries(squad_code, created_at);\nCREATE INDEX IF NOT EXISTS idx_cost_agent ON cost_entries(squad_code, agent_id);\nCREATE INDEX IF NOT EXISTS idx_cost_activity ON cost_entries(activity_id);\n\nCREATE TABLE IF NOT EXISTS event_log (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  level TEXT NOT NULL DEFAULT 'info',\n  squad_code TEXT,\n  source TEXT NOT NULL,\n  message TEXT NOT NULL,\n  detail TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_event_log_created ON event_log(created_at);\nCREATE INDEX IF NOT EXISTS idx_event_log_squad ON event_log(squad_code, created_at);\nCREATE INDEX IF NOT EXISTS idx_event_log_level ON event_log(level, created_at);\n\nCREATE TABLE IF NOT EXISTS execution_logs (\n  id INTEGER PRIMARY KEY AUTOINCREMENT,\n  activity_id TEXT NOT NULL REFERENCES squad_activities(id) ON DELETE CASCADE,\n  squad_code TEXT NOT NULL,\n  chunk TEXT NOT NULL,\n  source TEXT NOT NULL DEFAULT 'output',\n  created_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_execution_logs_activity ON execution_logs(activity_id, created_at);\n\nCREATE TABLE IF NOT EXISTS user_squad_access (\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  squad_code TEXT NOT NULL,\n  PRIMARY KEY (user_id, squad_code)\n);\n\nCREATE TABLE IF NOT EXISTS user_page_access (\n  user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n  page TEXT NOT NULL,\n  PRIMARY KEY (user_id, page)\n);\n";
 //# sourceMappingURL=schema.d.ts.map

package/dist/server/db/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,00QA8RtB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,q4RAmTtB,CAAC"}

package/dist/server/db/schema.js

@@ -168,6 +168,27 @@ CREATE TABLE IF NOT EXISTS integrations (
   updated_at TEXT DEFAULT (datetime('now'))
 );
 
+CREATE TABLE IF NOT EXISTS github_installations (
+  id TEXT PRIMARY KEY,
+  type TEXT NOT NULL,
+  account_login TEXT,
+  account_type TEXT,
+  access_token TEXT NOT NULL,
+  refresh_token TEXT,
+  token_expires_at TEXT,
+  scope TEXT,
+  created_at TEXT DEFAULT (datetime('now')),
+  updated_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS github_webhook_registrations (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  repo_full_name TEXT NOT NULL,
+  webhook_id INTEGER NOT NULL,
+  squad_code TEXT,
+  created_at TEXT DEFAULT (datetime('now'))
+);
+
 CREATE TABLE IF NOT EXISTS kanban_tasks (
   id TEXT PRIMARY KEY,
   squad_code TEXT NOT NULL,

package/dist/server/db/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8RzB,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/db/schema.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmTzB,CAAC"}

package/dist/server/services/__tests__/github-action-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=github-action-service.test.d.ts.map

package/dist/server/services/__tests__/github-action-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-action-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/github-action-service.test.ts"],"names":[],"mappings":""}

package/dist/server/services/__tests__/github-action-service.test.js

@@ -0,0 +1,89 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { GitHubActionService } from '../github-action-service.js';
+function makeCredentials(token = 'ghp_test') {
+    return { getToken: vi.fn().mockResolvedValue(token) };
+}
+describe('GitHubActionService', () => {
+    let mockFetch;
+    beforeEach(() => {
+        mockFetch = vi.fn();
+        vi.stubGlobal('fetch', mockFetch);
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it('create_issue — calls correct GitHub API endpoint', async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => ({ number: 42, html_url: 'https://github.com/org/repo/issues/42' }),
+        });
+        const service = new GitHubActionService(makeCredentials());
+        const result = await service.execute('create_issue', {
+            repo: 'org/repo',
+            title: 'Test Issue',
+            body: 'Body text',
+            labels: ['bug'],
+        });
+        expect(mockFetch).toHaveBeenCalledWith('https://api.github.com/repos/org/repo/issues', expect.objectContaining({
+            method: 'POST',
+            headers: expect.objectContaining({ Authorization: 'Bearer ghp_test' }),
+        }));
+        expect(result).toEqual({ number: 42, url: 'https://github.com/org/repo/issues/42' });
+    });
+    it('create_pr — calls pulls endpoint', async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => ({ number: 7, html_url: 'https://github.com/org/repo/pull/7' }),
+        });
+        const service = new GitHubActionService(makeCredentials());
+        const result = await service.execute('create_pr', {
+            repo: 'org/repo',
+            title: 'My PR',
+            body: 'Description',
+            head: 'feature-branch',
+            base: 'main',
+        });
+        expect(mockFetch).toHaveBeenCalledWith('https://api.github.com/repos/org/repo/pulls', expect.objectContaining({ method: 'POST' }));
+        expect(result).toEqual({ number: 7, url: 'https://github.com/org/repo/pull/7' });
+    });
+    it('comment_issue — calls issues comments endpoint', async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => ({ id: 99, html_url: 'https://github.com/org/repo/issues/1#issuecomment-99' }),
+        });
+        const service = new GitHubActionService(makeCredentials());
+        await service.execute('comment_issue', {
+            repo: 'org/repo',
+            issue_number: 1,
+            body: 'LGTM!',
+        });
+        expect(mockFetch).toHaveBeenCalledWith('https://api.github.com/repos/org/repo/issues/1/comments', expect.objectContaining({ method: 'POST' }));
+    });
+    it('trigger_workflow — calls workflow dispatches endpoint', async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
+        const service = new GitHubActionService(makeCredentials());
+        await service.execute('trigger_workflow', {
+            repo: 'org/repo',
+            workflow: 'deploy.yml',
+            ref: 'main',
+            inputs: { environment: 'production' },
+        });
+        expect(mockFetch).toHaveBeenCalledWith('https://api.github.com/repos/org/repo/actions/workflows/deploy.yml/dispatches', expect.objectContaining({ method: 'POST' }));
+    });
+    it('unknown action — throws error', async () => {
+        const service = new GitHubActionService(makeCredentials());
+        await expect(service.execute('unknown_action', {})).rejects.toThrow('Unknown GitHub action: unknown_action');
+    });
+    it('GitHub API error — throws with status', async () => {
+        mockFetch.mockResolvedValue({
+            ok: false,
+            status: 422,
+            json: async () => ({ message: 'Validation Failed' }),
+        });
+        const service = new GitHubActionService(makeCredentials());
+        await expect(service.execute('create_issue', { repo: 'org/repo', title: 'X' }))
+            .rejects.toThrow('GitHub API error 422');
+    });
+});
+//# sourceMappingURL=github-action-service.test.js.map

package/dist/server/services/__tests__/github-action-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-action-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/github-action-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,SAAS,eAAe,CAAC,KAAK,GAAG,UAAU;IACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAwC,CAAC;AAC9F,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,SAAmC,CAAC;IAExC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACpB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,SAAS,CAAC,iBAAiB,CAAC;YAC1B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,uCAAuC,EAAE,CAAC;SACtF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE;YACnD,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,8CAA8C,EAC9C,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;SACvE,CAAC,CACH,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,uCAAuC,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,SAAS,CAAC,iBAAiB,CAAC;YAC1B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,oCAAoC,EAAE,CAAC;SAClF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;YAChD,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,6CAA6C,EAC7C,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC5C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,oCAAoC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,SAAS,CAAC,iBAAiB,CAAC;YAC1B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,sDAAsD,EAAE,CAAC;SACjG,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE;YACrC,IAAI,EAAE,UAAU;YAChB,YAAY,EAAE,CAAC;YACf,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,yDAAyD,EACzD,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACxC,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,YAAY;YACtB,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE;SACtC,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,+EAA+E,EAC/E,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,SAAS,CAAC,iBAAiB,CAAC;YAC1B,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;aAC5E,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/services/__tests__/github-credential-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=github-credential-service.test.d.ts.map

package/dist/server/services/__tests__/github-credential-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-credential-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/github-credential-service.test.ts"],"names":[],"mappings":""}

package/dist/server/services/__tests__/github-credential-service.test.js

@@ -0,0 +1,95 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import Database from 'better-sqlite3';
+import { runMigrations } from '../../db/migrations.js';
+import { GitHubCredentialService } from '../github-credential-service.js';
+function makeDb() {
+    const db = new Database(':memory:');
+    runMigrations(db);
+    return db;
+}
+describe('GitHubCredentialService', () => {
+    let db;
+    let service;
+    beforeEach(() => {
+        db = makeDb();
+        service = new GitHubCredentialService(db, 'test-jwt-secret-32chars-padding!!');
+    });
+    afterEach(() => {
+        db.close();
+        vi.restoreAllMocks();
+        vi.unstubAllGlobals();
+    });
+    it('getToken — throws when no credentials configured', async () => {
+        await expect(service.getToken()).rejects.toThrow('No GitHub credentials configured');
+    });
+    it('getToken — returns PAT from integrations table as fallback', async () => {
+        db.prepare("INSERT INTO integrations (provider, enabled, config) VALUES ('github', 1, ?)").run(JSON.stringify({ token: 'ghp_testtoken123' }));
+        const token = await service.getToken();
+        expect(token).toBe('ghp_testtoken123');
+    });
+    it('getToken — prefers oauth token over PAT', async () => {
+        db.prepare("INSERT INTO integrations (provider, enabled, config) VALUES ('github', 1, ?)").run(JSON.stringify({ token: 'ghp_pat_token' }));
+        await service.saveOAuthToken({
+            accessToken: 'gho_oauth_token',
+            scope: 'repo,read:org',
+            accountLogin: 'octocat',
+            accountType: 'User',
+        });
+        const token = await service.getToken();
+        expect(token).toBe('gho_oauth_token');
+    });
+    it('getInstallations — returns empty array with no installations', async () => {
+        const installations = await service.getInstallations();
+        expect(installations).toEqual([]);
+    });
+    it('saveOAuthToken — persists encrypted token', async () => {
+        await service.saveOAuthToken({
+            accessToken: 'gho_secret_token',
+            scope: 'repo',
+            accountLogin: 'octocat',
+            accountType: 'User',
+        });
+        const installations = await service.getInstallations();
+        expect(installations).toHaveLength(1);
+        expect(installations[0].type).toBe('oauth');
+        expect(installations[0].accountLogin).toBe('octocat');
+        // Raw DB should NOT contain the plaintext token
+        const raw = db.prepare('SELECT access_token FROM github_installations WHERE id = ?').get('oauth');
+        expect(raw.access_token).not.toBe('gho_secret_token');
+    });
+    it('revokeOAuth — removes installation from DB', async () => {
+        await service.saveOAuthToken({
+            accessToken: 'gho_token',
+            scope: 'repo',
+            accountLogin: 'octocat',
+            accountType: 'User',
+        });
+        vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true }));
+        await service.revokeOAuth();
+        const installations = await service.getInstallations();
+        expect(installations).toHaveLength(0);
+    });
+    it('getToken — auto-refreshes expired App token', async () => {
+        const mockFetch = vi.fn()
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({
+                token: 'ghs_refreshed_token',
+                expires_at: new Date(Date.now() + 3600_000).toISOString(),
+            }),
+        });
+        vi.stubGlobal('fetch', mockFetch);
+        const expiredAt = new Date(Date.now() - 1000).toISOString();
+        await service.saveAppInstallation({
+            installationId: 'inst_123',
+            accessToken: 'ghs_expired',
+            tokenExpiresAt: expiredAt,
+            accountLogin: 'my-org',
+            accountType: 'Organization',
+        });
+        const token = await service.getToken();
+        expect(token).toBe('ghs_refreshed_token');
+        expect(mockFetch).toHaveBeenCalledOnce();
+    });
+});
+//# sourceMappingURL=github-credential-service.test.js.map

package/dist/server/services/__tests__/github-credential-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-credential-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/github-credential-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAE1E,SAAS,MAAM;IACb,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAI,EAAqB,CAAC;IAC1B,IAAI,OAAgC,CAAC;IAErC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,MAAM,EAAE,CAAC;QACd,OAAO,GAAG,IAAI,uBAAuB,CAAC,EAAE,EAAE,mCAAmC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,EAAE,CAAC,OAAO,CACR,8EAA8E,CAC/E,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,EAAE,CAAC,OAAO,CACR,8EAA8E,CAC/E,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAElD,MAAM,OAAO,CAAC,cAAc,CAAC;YAC3B,WAAW,EAAE,iBAAiB;YAC9B,KAAK,EAAE,eAAe;YACtB,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,CAAC,cAAc,CAAC;YAC3B,WAAW,EAAE,kBAAkB;YAC/B,KAAK,EAAE,MAAM;YACb,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEtD,gDAAgD;QAChD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,CAAC,OAAO,CAA6B,CAAC;QAC9H,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,OAAO,CAAC,cAAc,CAAC;YAC3B,WAAW,EAAE,WAAW;YACxB,KAAK,EAAE,MAAM;YACb,YAAY,EAAE,SAAS;YACvB,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;QAEH,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAE5B,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvD,MAAM,CAAC,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE;aACtB,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACjB,KAAK,EAAE,qBAAqB;gBAC5B,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;aAC1D,CAAC;SACH,CAAC,CAAC;QACL,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,mBAAmB,CAAC;YAChC,cAAc,EAAE,UAAU;YAC1B,WAAW,EAAE,aAAa;YAC1B,cAAc,EAAE,SAAS;YACzB,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/services/github-action-service.d.ts

@@ -0,0 +1,21 @@
+import type { GitHubCredentialService } from './github-credential-service.js';
+export interface ActionResult {
+    number?: number;
+    url?: string;
+    error?: string;
+}
+export declare class GitHubActionService {
+    private credentials;
+    constructor(credentials: GitHubCredentialService);
+    execute(action: string, params: Record<string, unknown>): Promise<ActionResult>;
+    private githubRequest;
+    private createIssue;
+    private createPR;
+    private commentIssue;
+    private commentPR;
+    private mergePR;
+    private triggerWorkflow;
+    private createRelease;
+    private pushFile;
+}
+//# sourceMappingURL=github-action-service.d.ts.map

package/dist/server/services/github-action-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-action-service.d.ts","sourceRoot":"","sources":["../../src/services/github-action-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,mBAAmB;IAClB,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,uBAAuB;IAElD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;YAyBvE,aAAa;YAwBb,WAAW;YAUX,QAAQ;YAWR,YAAY;YASZ,SAAS;YAST,OAAO;YASP,eAAe;YASf,aAAa;YAWb,QAAQ;CAoBvB"}

package/dist/server/services/github-action-service.js

@@ -0,0 +1,105 @@
+export class GitHubActionService {
+    credentials;
+    constructor(credentials) {
+        this.credentials = credentials;
+    }
+    async execute(action, params) {
+        const token = await this.credentials.getToken();
+        switch (action) {
+            case 'create_issue':
+                return this.createIssue(token, params);
+            case 'create_pr':
+                return this.createPR(token, params);
+            case 'comment_issue':
+                return this.commentIssue(token, params);
+            case 'comment_pr':
+                return this.commentPR(token, params);
+            case 'merge_pr':
+                return this.mergePR(token, params);
+            case 'trigger_workflow':
+                return this.triggerWorkflow(token, params);
+            case 'create_release':
+                return this.createRelease(token, params);
+            case 'push_file':
+                return this.pushFile(token, params);
+            default:
+                throw new Error(`Unknown GitHub action: ${action}`);
+        }
+    }
+    async githubRequest(token, method, path, body) {
+        const res = await fetch(`https://api.github.com${path}`, {
+            method,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: 'application/vnd.github+json',
+                'Content-Type': 'application/json',
+                'X-GitHub-Api-Version': '2022-11-28',
+            },
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        const data = await res.json();
+        if (!res.ok) {
+            throw new Error(`GitHub API error ${res.status}: ${data['message'] ?? 'Unknown error'}`);
+        }
+        return data;
+    }
+    async createIssue(token, p) {
+        const data = await this.githubRequest(token, 'POST', `/repos/${p['repo']}/issues`, {
+            title: p['title'],
+            body: p['body'],
+            labels: p['labels'],
+            assignees: p['assignees'],
+        });
+        return { number: data.number, url: data.html_url };
+    }
+    async createPR(token, p) {
+        const data = await this.githubRequest(token, 'POST', `/repos/${p['repo']}/pulls`, {
+            title: p['title'],
+            body: p['body'],
+            head: p['head'],
+            base: p['base'] ?? 'main',
+            draft: p['draft'] ?? false,
+        });
+        return { number: data.number, url: data.html_url };
+    }
+    async commentIssue(token, p) {
+        const data = await this.githubRequest(token, 'POST', `/repos/${p['repo']}/issues/${p['issue_number']}/comments`, { body: p['body'] });
+        return { url: data.html_url };
+    }
+    async commentPR(token, p) {
+        const data = await this.githubRequest(token, 'POST', `/repos/${p['repo']}/pulls/${p['pr_number']}/reviews`, { body: p['body'], event: 'COMMENT' });
+        return { url: data.html_url };
+    }
+    async mergePR(token, p) {
+        await this.githubRequest(token, 'PUT', `/repos/${p['repo']}/pulls/${p['pr_number']}/merge`, { merge_method: p['merge_method'] ?? 'merge' });
+        return {};
+    }
+    async triggerWorkflow(token, p) {
+        await this.githubRequest(token, 'POST', `/repos/${p['repo']}/actions/workflows/${p['workflow']}/dispatches`, { ref: p['ref'] ?? 'main', inputs: p['inputs'] ?? {} });
+        return {};
+    }
+    async createRelease(token, p) {
+        const data = await this.githubRequest(token, 'POST', `/repos/${p['repo']}/releases`, {
+            tag_name: p['tag'],
+            name: p['name'],
+            body: p['body'],
+            draft: p['draft'] ?? false,
+            prerelease: p['prerelease'] ?? false,
+        });
+        return { url: data.html_url };
+    }
+    async pushFile(token, p) {
+        let sha;
+        try {
+            const existing = await this.githubRequest(token, 'GET', `/repos/${p['repo']}/contents/${p['path']}`);
+            sha = existing.sha;
+        }
+        catch {
+            // File doesn't exist yet — that's fine
+        }
+        const content = Buffer.from(String(p['content'])).toString('base64');
+        await this.githubRequest(token, 'PUT', `/repos/${p['repo']}/contents/${p['path']}`, { message: p['message'], content, sha });
+        return {};
+    }
+}
+//# sourceMappingURL=github-action-service.js.map

package/dist/server/services/github-action-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-action-service.js","sourceRoot":"","sources":["../../src/services/github-action-service.ts"],"names":[],"mappings":"AAQA,MAAM,OAAO,mBAAmB;IACV;IAApB,YAAoB,WAAoC;QAApC,gBAAW,GAAX,WAAW,CAAyB;IAAG,CAAC;IAE5D,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAA+B;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAEhD,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1C,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvC,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACrC,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3C,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC;gBACE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,IAAI,EAAE,EAAE;YACvD,MAAM;YACN,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,6BAA6B;gBACrC,cAAc,EAAE,kBAAkB;gBAClC,sBAAsB,EAAE,YAAY;aACrC;YACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6B,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,CAA0B;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE;YACjF,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;YACnB,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC;SAC1B,CAAyC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,CAA0B;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;YAChF,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM;YACzB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK;SAC3B,CAAyC,CAAC;QAC3C,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,CAA0B;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC,WAAW,EAC1D,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CACgB,CAAC;QACtC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,CAA0B;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CACnC,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,UAAU,EACrD,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CACF,CAAC;QACtC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,CAA0B;QAC7D,MAAM,IAAI,CAAC,aAAa,CACtB,KAAK,EAAE,KAAK,EACZ,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,QAAQ,EACnD,EAAE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,OAAO,EAAE,CAC/C,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,CAA0B;QACrE,MAAM,IAAI,CAAC,aAAa,CACtB,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,UAAU,CAAC,aAAa,EACnE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CACvD,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,CAA0B;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE;YACnF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC;YAClB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACf,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK;YAC1B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,KAAK;SACrC,CAAqC,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,CAA0B;QAC9D,IAAI,GAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CACvC,KAAK,EAAE,KAAK,EACZ,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,CACxB,CAAC;YACtB,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,aAAa,CACtB,KAAK,EAAE,KAAK,EACZ,UAAU,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,EAC3C,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CACxC,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/server/services/github-credential-service.d.ts

@@ -0,0 +1,34 @@
+import type Database from 'better-sqlite3';
+export interface Installation {
+    id: string;
+    type: 'pat' | 'oauth' | 'app';
+    accountLogin?: string;
+    accountType?: string;
+    scope?: string;
+    tokenExpiresAt?: string;
+}
+export declare class GitHubCredentialService {
+    private db;
+    private jwtSecret;
+    constructor(db: Database.Database, jwtSecret: string);
+    getToken(accountLogin?: string): Promise<string>;
+    getInstallations(): Promise<Installation[]>;
+    saveOAuthToken(opts: {
+        accessToken: string;
+        scope: string;
+        accountLogin: string;
+        accountType: string;
+    }): Promise<void>;
+    saveAppInstallation(opts: {
+        installationId: string;
+        accessToken: string;
+        tokenExpiresAt: string;
+        accountLogin: string;
+        accountType: string;
+    }): Promise<void>;
+    revokeOAuth(): Promise<void>;
+    removeAppInstallation(installationId: string): Promise<void>;
+    private refreshAppTokenIfNeeded;
+    makeAppJwt(appId: string, privateKey: string): string;
+}
+//# sourceMappingURL=github-credential-service.d.ts.map

package/dist/server/services/github-credential-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-credential-service.d.ts","sourceRoot":"","sources":["../../src/services/github-credential-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AA8CD,qBAAa,uBAAuB;IAEhC,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,SAAS;gBADT,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,MAAM;IAGrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoChD,gBAAgB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAe3C,cAAc,CAAC,IAAI,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBX,mBAAmB,CAAC,IAAI,EAAE;QAC9B,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBX,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB5B,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIpD,uBAAuB;IA0CrC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;CAWtD"}

package/dist/server/services/github-credential-service.js

@@ -0,0 +1,158 @@
+import crypto from 'node:crypto';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+function deriveKey(secret) {
+    return crypto.createHash('sha256').update(secret).digest();
+}
+function encrypt(text, secret) {
+    const key = deriveKey(secret);
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([iv, authTag, encrypted]).toString('base64');
+}
+function decrypt(encoded, secret) {
+    const key = deriveKey(secret);
+    const buf = Buffer.from(encoded, 'base64');
+    const iv = buf.subarray(0, IV_LENGTH);
+    const authTag = buf.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+    const encrypted = buf.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+    decipher.setAuthTag(authTag);
+    return decipher.update(encrypted).toString('utf8') + decipher.final('utf8');
+}
+export class GitHubCredentialService {
+    db;
+    jwtSecret;
+    constructor(db, jwtSecret) {
+        this.db = db;
+        this.jwtSecret = jwtSecret;
+    }
+    async getToken(accountLogin) {
+        // Priority 1: GitHub App installation
+        const appRow = accountLogin
+            ? this.db.prepare(`SELECT * FROM github_installations WHERE type = 'app' AND account_login = ? LIMIT 1`).get(accountLogin)
+            : this.db.prepare(`SELECT * FROM github_installations WHERE type = 'app' LIMIT 1`).get();
+        if (appRow) {
+            return this.refreshAppTokenIfNeeded(appRow);
+        }
+        // Priority 2: OAuth token
+        const oauthRow = this.db.prepare(`SELECT * FROM github_installations WHERE type = 'oauth' LIMIT 1`).get();
+        if (oauthRow) {
+            return decrypt(oauthRow.access_token, this.jwtSecret);
+        }
+        // Priority 3: PAT from integrations table
+        const intRow = this.db.prepare(`SELECT config, enabled FROM integrations WHERE provider = 'github' AND enabled = 1`).get();
+        if (intRow) {
+            const config = JSON.parse(intRow.config);
+            if (config.token)
+                return config.token;
+        }
+        throw new Error('No GitHub credentials configured');
+    }
+    async getInstallations() {
+        const rows = this.db.prepare('SELECT id, type, account_login, account_type, scope, token_expires_at FROM github_installations').all();
+        return rows.map((r) => ({
+            id: r.id,
+            type: r.type,
+            accountLogin: r.account_login ?? undefined,
+            accountType: r.account_type ?? undefined,
+            scope: r.scope ?? undefined,
+            tokenExpiresAt: r.token_expires_at ?? undefined,
+        }));
+    }
+    async saveOAuthToken(opts) {
+        const now = new Date().toISOString();
+        const encrypted = encrypt(opts.accessToken, this.jwtSecret);
+        this.db.prepare(`
+      INSERT INTO github_installations (id, type, account_login, account_type, access_token, scope, created_at, updated_at)
+      VALUES ('oauth', 'oauth', ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        account_login = excluded.account_login,
+        account_type = excluded.account_type,
+        access_token = excluded.access_token,
+        scope = excluded.scope,
+        updated_at = excluded.updated_at
+    `).run(opts.accountLogin, opts.accountType, encrypted, opts.scope, now, now);
+    }
+    async saveAppInstallation(opts) {
+        const now = new Date().toISOString();
+        const encrypted = encrypt(opts.accessToken, this.jwtSecret);
+        this.db.prepare(`
+      INSERT INTO github_installations (id, type, account_login, account_type, access_token, token_expires_at, created_at, updated_at)
+      VALUES (?, 'app', ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        account_login = excluded.account_login,
+        account_type = excluded.account_type,
+        access_token = excluded.access_token,
+        token_expires_at = excluded.token_expires_at,
+        updated_at = excluded.updated_at
+    `).run(opts.installationId, opts.accountLogin, opts.accountType, encrypted, opts.tokenExpiresAt, now, now);
+    }
+    async revokeOAuth() {
+        const row = this.db.prepare(`SELECT access_token FROM github_installations WHERE id = 'oauth'`).get();
+        if (row) {
+            const token = decrypt(row.access_token, this.jwtSecret);
+            const clientId = process.env.GITHUB_CLIENT_ID;
+            const clientSecret = process.env.GITHUB_CLIENT_SECRET;
+            if (clientId && clientSecret) {
+                await fetch(`https://api.github.com/applications/${clientId}/token`, {
+                    method: 'DELETE',
+                    headers: {
+                        Authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`,
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({ access_token: token }),
+                }).catch(() => { });
+            }
+        }
+        this.db.prepare(`DELETE FROM github_installations WHERE id = 'oauth'`).run();
+    }
+    async removeAppInstallation(installationId) {
+        this.db.prepare('DELETE FROM github_installations WHERE id = ?').run(installationId);
+    }
+    async refreshAppTokenIfNeeded(row) {
+        const expiresAt = row.token_expires_at ? new Date(row.token_expires_at).getTime() : Infinity;
+        const fiveMinutes = 5 * 60 * 1000;
+        if (Date.now() + fiveMinutes < expiresAt) {
+            return decrypt(row.access_token, this.jwtSecret);
+        }
+        // Token expired or expiring soon — refresh via GitHub Apps API
+        const appId = process.env.GITHUB_APP_ID;
+        const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
+        // Build JWT auth header; if env vars are missing, use placeholder (fetch may be mocked in tests)
+        const jwtToken = appId && privateKey ? this.makeAppJwt(appId, privateKey) : '';
+        const authHeader = `Bearer ${jwtToken}`;
+        const res = await fetch(`https://api.github.com/app/installations/${row.id}/access_tokens`, {
+            method: 'POST',
+            headers: {
+                Authorization: authHeader,
+                Accept: 'application/vnd.github+json',
+            },
+        });
+        if (!res.ok) {
+            throw new Error(`GitHub App token refresh failed: ${res.status}`);
+        }
+        const data = await res.json();
+        const encrypted = encrypt(data.token, this.jwtSecret);
+        const now = new Date().toISOString();
+        this.db.prepare(`
+      UPDATE github_installations SET access_token = ?, token_expires_at = ?, updated_at = ? WHERE id = ?
+    `).run(encrypted, data.expires_at, now, row.id);
+        return data.token;
+    }
+    makeAppJwt(appId, privateKey) {
+        // RS256 JWT for GitHub App authentication (10 min expiry)
+        const now = Math.floor(Date.now() / 1000);
+        const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
+        const payload = Buffer.from(JSON.stringify({ iat: now - 60, exp: now + 600, iss: appId })).toString('base64url');
+        const signing = `${header}.${payload}`;
+        const sign = crypto.createSign('RSA-SHA256');
+        sign.update(signing);
+        const signature = sign.sign(privateKey, 'base64url');
+        return `${signing}.${signature}`;
+    }
+}
+//# sourceMappingURL=github-credential-service.js.map