gcb-host 0.0.0 → 0.0.1

package/lib/device-flow.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The device flow: how a person authorizes the app when the host has no browser.
+ *
+ * The point of it here is that it is the only way to obtain a **user** token without a callback
+ * server: GitHub hands the tool a short code to display, the person types it on whatever device has a
+ * browser, and the tool collects the token by polling. An installation token can never be a person's,
+ * which is exactly what is wanted — a pull request authored by the app is one reviewers may skip.
+ *
+ * Only the three exchanges live here, with fetch and sleep injected so they can be tested without a
+ * network or a clock. Deciding where the refresh token is stored, and who is allowed to ask for one, is
+ * somebody else's business.
+ */
+/** What a fetch has to look like for these exchanges. */
+export type Fetcher = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
+/** How long to wait between polls. */
+export type Sleep = (ms: number) => Promise<void>;
+/** What GitHub hands out to start with. */
+export interface DeviceCode {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    /** Seconds the code stays valid. */
+    readonly expiresIn: number;
+    /** Seconds to wait between polls, as GitHub asks. */
+    readonly interval: number;
+}
+/** A user token, and what it takes to get another one. */
+export interface UserToken {
+    readonly token: string;
+    /** Present when the app expires user tokens, which is the default and what is wanted here. */
+    readonly refreshToken?: string;
+    readonly expiresInSeconds?: number;
+}
+/** GitHub's endpoints. A constant so a test can see what is being called. */
+export declare const DEVICE_CODE_URL = "https://github.com/login/device/code";
+export declare const TOKEN_URL = "https://github.com/login/oauth/access_token";
+/** The grant type the device flow uses when it collects the token. */
+export declare const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/**
+ * Ask for a code to show a person.
+ *
+ * @param clientId - the app's client id, which a device flow needs and a secret it does not.
+ * @param fetcher - how to make the request.
+ * @returns the code to display and how to poll for it.
+ * @throws {Error} when GitHub refuses, naming the status and whatever it said.
+ */
+export declare function startDeviceFlow(clientId: string, fetcher: Fetcher): Promise<DeviceCode>;
+/**
+ * Wait until the person has authorized, then collect the token.
+ *
+ * `authorization_pending` is the normal answer while waiting, `slow_down` means GitHub wants a longer
+ * pause, and the rest are endings. Anything else is a failure worth showing.
+ *
+ * @param clientId - the app's client id.
+ * @param code - what {@link startDeviceFlow} returned.
+ * @param fetcher - how to make the request.
+ * @param sleep - how to wait.
+ * @returns the token, and the refresh token when there is one.
+ * @throws {Error} when the code expires, is refused, or GitHub answers something unexpected.
+ */
+export declare function collectUserToken(clientId: string, code: DeviceCode, fetcher: Fetcher, sleep: Sleep): Promise<UserToken>;
+/**
+ * Trade a refresh token for a fresh user token.
+ *
+ * @param clientId - the app's client id.
+ * @param refreshToken - the one from last time.
+ * @param fetcher - how to make the request.
+ * @returns the new token, and the new refresh token to keep instead of the old one.
+ * @throws {Error} when GitHub refuses, which one day means the person has to authorize again.
+ */
+export declare function refreshUserToken(clientId: string, refreshToken: string, fetcher: Fetcher): Promise<UserToken>;
+//# sourceMappingURL=device-flow.d.ts.map

package/lib/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,yDAAyD;AACzD,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAEvE,sCAAsC;AACtC,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAElD,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,0DAA0D;AAC1D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,6EAA6E;AAC7E,eAAO,MAAM,eAAe,yCAAyC,CAAC;AACtE,eAAO,MAAM,SAAS,gDAAgD,CAAC;AACvE,sEAAsE;AACtE,eAAO,MAAM,YAAY,iDAAiD,CAAC;AAmB3E;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B7F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,SAAS,CAAC,CAwCpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAyBpB"}

package/lib/device-flow.js

@@ -0,0 +1,148 @@
+/**
+ * The device flow: how a person authorizes the app when the host has no browser.
+ *
+ * The point of it here is that it is the only way to obtain a **user** token without a callback
+ * server: GitHub hands the tool a short code to display, the person types it on whatever device has a
+ * browser, and the tool collects the token by polling. An installation token can never be a person's,
+ * which is exactly what is wanted — a pull request authored by the app is one reviewers may skip.
+ *
+ * Only the three exchanges live here, with fetch and sleep injected so they can be tested without a
+ * network or a clock. Deciding where the refresh token is stored, and who is allowed to ask for one, is
+ * somebody else's business.
+ */
+/** GitHub's endpoints. A constant so a test can see what is being called. */
+export const DEVICE_CODE_URL = 'https://github.com/login/device/code';
+export const TOKEN_URL = 'https://github.com/login/oauth/access_token';
+/** The grant type the device flow uses when it collects the token. */
+export const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+/**
+ * Read a JSON body, without pretending a non-JSON one is a mystery.
+ *
+ * A refused request can answer with a page rather than with JSON. Letting `JSON.parse` throw there
+ * replaces "GitHub answered 500" with an error about a token, which is the wrong story entirely.
+ *
+ * @param text - the response body.
+ * @returns the parsed object, or an empty one when it is not JSON.
+ */
+function parseJson(text) {
+    try {
+        const parsed = JSON.parse(text);
+        return typeof parsed === 'object' && parsed !== null ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Ask for a code to show a person.
+ *
+ * @param clientId - the app's client id, which a device flow needs and a secret it does not.
+ * @param fetcher - how to make the request.
+ * @returns the code to display and how to poll for it.
+ * @throws {Error} when GitHub refuses, naming the status and whatever it said.
+ */
+export async function startDeviceFlow(clientId, fetcher) {
+    const body = new URLSearchParams({ client_id: clientId }).toString();
+    const response = await fetcher(DEVICE_CODE_URL, {
+        method: 'POST',
+        headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded' },
+        body,
+    });
+    const text = await response.text();
+    if (!response.ok) {
+        throw new Error(`GitHub answered ${response.status} to the device code request: ${text.slice(0, 200)}`);
+    }
+    const parsed = parseJson(text);
+    if (!parsed.device_code || !parsed.user_code || !parsed.verification_uri) {
+        throw new Error(`GitHub did not answer with a device code: ${text.slice(0, 200)}`);
+    }
+    return {
+        deviceCode: parsed.device_code,
+        userCode: parsed.user_code,
+        verificationUri: parsed.verification_uri,
+        expiresIn: parsed.expires_in ?? 900,
+        interval: parsed.interval ?? 5,
+    };
+}
+/**
+ * Wait until the person has authorized, then collect the token.
+ *
+ * `authorization_pending` is the normal answer while waiting, `slow_down` means GitHub wants a longer
+ * pause, and the rest are endings. Anything else is a failure worth showing.
+ *
+ * @param clientId - the app's client id.
+ * @param code - what {@link startDeviceFlow} returned.
+ * @param fetcher - how to make the request.
+ * @param sleep - how to wait.
+ * @returns the token, and the refresh token when there is one.
+ * @throws {Error} when the code expires, is refused, or GitHub answers something unexpected.
+ */
+export async function collectUserToken(clientId, code, fetcher, sleep) {
+    const deadline = Date.now() + code.expiresIn * 1_000;
+    let interval = code.interval;
+    for (;;) {
+        await sleep(Math.max(interval, 1) * 1_000);
+        if (Date.now() > deadline)
+            throw new Error('the device code expired before it was authorized');
+        const response = await fetcher(TOKEN_URL, {
+            method: 'POST',
+            headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: clientId,
+                device_code: code.deviceCode,
+                grant_type: DEVICE_GRANT,
+            }).toString(),
+        });
+        const text = await response.text();
+        const parsed = parseJson(text);
+        if (parsed.access_token) {
+            return {
+                token: parsed.access_token,
+                refreshToken: parsed.refresh_token,
+                expiresInSeconds: parsed.expires_in,
+            };
+        }
+        if (parsed.error === 'authorization_pending')
+            continue;
+        if (parsed.error === 'slow_down') {
+            interval += 5;
+            continue;
+        }
+        if (parsed.error === 'access_denied')
+            throw new Error('the authorization was denied');
+        if (parsed.error === 'expired_token')
+            throw new Error('the device code expired');
+        throw new Error(`GitHub answered ${response.status} to the token request: ${text.slice(0, 200)}`);
+    }
+}
+/**
+ * Trade a refresh token for a fresh user token.
+ *
+ * @param clientId - the app's client id.
+ * @param refreshToken - the one from last time.
+ * @param fetcher - how to make the request.
+ * @returns the new token, and the new refresh token to keep instead of the old one.
+ * @throws {Error} when GitHub refuses, which one day means the person has to authorize again.
+ */
+export async function refreshUserToken(clientId, refreshToken, fetcher) {
+    const response = await fetcher(TOKEN_URL, {
+        method: 'POST',
+        headers: { accept: 'application/json', 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: clientId,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        }).toString(),
+    });
+    const text = await response.text();
+    const parsed = parseJson(text);
+    if (!parsed.access_token) {
+        throw new Error(`GitHub answered ${response.status} to the refresh: ${text.slice(0, 200)}`);
+    }
+    return {
+        token: parsed.access_token,
+        refreshToken: parsed.refresh_token ?? refreshToken,
+        expiresInSeconds: parsed.expires_in,
+    };
+}
+//# sourceMappingURL=device-flow.js.map

package/lib/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,sCAAsC,CAAC;AACtE,MAAM,CAAC,MAAM,SAAS,GAAG,6CAA6C,CAAC;AACvE,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAE3E;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AACD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAgB;IACtE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI;KACL,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAM5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,WAAW;QAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,eAAe,EAAE,MAAM,CAAC,gBAAgB;QACxC,SAAS,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,IAAgB,EAChB,OAAgB,EAChB,KAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACrD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,IAAI,CAAC,UAAU;gBAC5B,UAAU,EAAE,YAAY;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;QAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,YAAY;gBAC1B,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU;aACpC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,uBAAuB;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,YAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAK5B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY;QAClD,gBAAgB,EAAE,MAAM,CAAC,UAAU;KACpC,CAAC;AACJ,CAAC"}

package/lib/gh.d.ts

@@ -0,0 +1,37 @@
+import { type ActionValues } from 'gcb-core';
+/** The default stdout/stderr ceiling, in bytes per stream. */
+export declare const DEFAULT_GH_OUTPUT_BYTES = 200000;
+/** What one gh invocation produced. */
+export interface GhRunResult {
+    readonly code: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly truncated: boolean;
+    readonly timedOut: boolean;
+    /** Set only when the process could not be started at all. */
+    readonly error?: string;
+}
+/** Options for {@link runGhAction}. */
+export interface GhRunOptions {
+    readonly action: string;
+    readonly values: ActionValues;
+    readonly repo: string;
+    readonly token: string;
+    readonly host?: string;
+    readonly ghPath?: string;
+    readonly timeoutMs?: number;
+    readonly maxOutputBytes?: number;
+    /** Environment to copy only the proxy and PATH values from. */
+    readonly env?: NodeJS.ProcessEnv;
+    /** Per-command proxy: absent = copy env, null = direct, string = this proxy. */
+    readonly proxy?: string | null;
+}
+/**
+ * Run one allowed action.
+ *
+ * @param options - action, values, repository and token.
+ * @returns the bounded process result.
+ */
+export declare function runGhAction(options: GhRunOptions): Promise<GhRunResult>;
+//# sourceMappingURL=gh.d.ts.map

package/lib/gh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh.d.ts","sourceRoot":"","sources":["../src/gh.ts"],"names":[],"mappings":"AAaA,OAAO,EAA4B,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAGvE,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAE/C,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACjC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmI7E"}

package/lib/gh.js

@@ -0,0 +1,181 @@
+/**
+ * Run one catalogued `gh` action as the App, with the action's short-lived token.
+ *
+ * The caller has already validated the action, repository and values. This module owns the process
+ * boundary: a temp HOME/GH_CONFIG_DIR, a minimal environment, no shell, a hard timeout and an output
+ * ceiling. The host user's gh configuration and token are never read.
+ */
+import { spawn } from 'node:child_process';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { StringDecoder } from 'node:string_decoder';
+import path from 'node:path';
+import { buildGhArgv, getGhAction } from 'gcb-core';
+import { applyProxyChoice, PROXY_ENV_KEYS } from './http.js';
+/** The default stdout/stderr ceiling, in bytes per stream. */
+export const DEFAULT_GH_OUTPUT_BYTES = 200_000;
+/**
+ * Run one allowed action.
+ *
+ * @param options - action, values, repository and token.
+ * @returns the bounded process result.
+ */
+export async function runGhAction(options) {
+    const maxBytes = options.maxOutputBytes ?? DEFAULT_GH_OUTPUT_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new Error('maxOutputBytes must be a non-negative safe integer');
+    }
+    const argv = buildGhArgv(options.action, options.values, options.repo);
+    const home = mkdtempSync(path.join(tmpdir(), 'gcb-gh-'));
+    const configDir = path.join(home, 'gh');
+    mkdirSync(configDir, { recursive: true });
+    const source = options.env ?? process.env;
+    const env = {
+        HOME: home,
+        GH_CONFIG_DIR: configDir,
+        GH_TOKEN: options.token,
+        GH_HOST: options.host ?? 'github.com',
+        NO_COLOR: '1',
+        GH_PROMPT_DISABLED: '1',
+        GH_NO_UPDATE_NOTIFIER: '1',
+        GIT_TERMINAL_PROMPT: '0',
+        PATH: source['PATH'] ?? '',
+    };
+    for (const key of PROXY_ENV_KEYS) {
+        const value = source[key];
+        if (value !== undefined && value !== '')
+            env[key] = value;
+    }
+    applyProxyChoice(env, options.proxy);
+    const timeoutMs = options.timeoutMs ?? getGhAction(options.action).timeoutSeconds * 1000;
+    try {
+        return await new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            let stdoutBytes = 0;
+            let stderrBytes = 0;
+            const stdoutDecoder = new StringDecoder('utf8');
+            const stderrDecoder = new StringDecoder('utf8');
+            let truncated = false;
+            let timedOut = false;
+            let settled = false;
+            let timer;
+            let killTimer;
+            const child = spawn(options.ghPath ?? 'gh', argv, {
+                cwd: home,
+                env,
+                shell: false,
+                detached: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            const finish = (result) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timer !== undefined)
+                    clearTimeout(timer);
+                // A closed parent does not prove the process group is gone; the repeat-kill interval below
+                // chases a fork created between the group signal and its delivery. Keep it until the group
+                // no longer exists.
+                const fullStdout = stdout + stdoutDecoder.end();
+                const fullStderr = stderr + stderrDecoder.end();
+                stdout = clampUtf8(fullStdout, maxBytes);
+                stderr = clampUtf8(fullStderr, maxBytes);
+                if (stdout !== fullStdout || stderr !== fullStderr)
+                    truncated = true;
+                resolve({ ...result, stdout, stderr, truncated, timedOut });
+            };
+            const signalGroup = () => {
+                if (child.pid === undefined)
+                    return false;
+                try {
+                    // The child is its own process-group leader; kill the group so a gh-spawned helper does
+                    // not keep the pipe open after timeout or output overflow.
+                    process.kill(-child.pid, 'SIGKILL');
+                    return true;
+                }
+                catch (error) {
+                    // ESRCH means the group itself is gone; do not fall back to the parent handle, which can
+                    // report success while only a zombie remains.
+                    if (error.code === 'ESRCH')
+                        return false;
+                    return child.exitCode === null && child.signalCode === null ? child.kill('SIGKILL') : false;
+                }
+            };
+            const kill = () => {
+                // Keep SIGKILLing after the parent closes: close does not prove a forked helper is gone.
+                // The interval stops itself when signalGroup can no longer find the group.
+                if (settled || killTimer !== undefined)
+                    return;
+                if (!signalGroup())
+                    return;
+                const handle = setInterval(() => {
+                    if (signalGroup())
+                        return;
+                    clearInterval(handle);
+                    if (killTimer === handle)
+                        killTimer = undefined;
+                }, 100);
+                handle.unref();
+                killTimer = handle;
+            };
+            const take = (stream, chunk) => {
+                if (truncated || timedOut)
+                    return;
+                const used = stream === 'stdout' ? stdoutBytes : stderrBytes;
+                if (used >= maxBytes) {
+                    truncated = true;
+                    kill();
+                    return;
+                }
+                const room = maxBytes - used;
+                const piece = chunk.subarray(0, room);
+                if (stream === 'stdout') {
+                    stdout += stdoutDecoder.write(piece);
+                    stdoutBytes += piece.length;
+                }
+                else {
+                    stderr += stderrDecoder.write(piece);
+                    stderrBytes += piece.length;
+                }
+                if (chunk.length > room) {
+                    truncated = true;
+                    kill();
+                }
+            };
+            timer = setTimeout(() => {
+                timedOut = true;
+                kill();
+            }, timeoutMs);
+            child.stdout?.on('data', (chunk) => take('stdout', chunk));
+            child.stderr?.on('data', (chunk) => take('stderr', chunk));
+            child.on('error', (error) => finish({ code: null, signal: null, error: error.message }));
+            child.on('close', (code, signal) => finish({ code, signal }));
+        });
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+}
+/**
+ * Keep a decoded string within a UTF-8 byte budget without splitting a code point.
+ *
+ * @param text - the decoded text.
+ * @param maxBytes - the byte budget.
+ * @returns the prefix that fits.
+ */
+function clampUtf8(text, maxBytes) {
+    if (Buffer.byteLength(text) <= maxBytes)
+        return text;
+    let used = 0;
+    let kept = '';
+    for (const character of text) {
+        const size = Buffer.byteLength(character);
+        if (used + size > maxBytes)
+            break;
+        kept += character;
+        used += size;
+    }
+    return kept;
+}
+//# sourceMappingURL=gh.js.map

package/lib/gh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh.js","sourceRoot":"","sources":["../src/gh.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAqB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AA8B/C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAqB;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC1C,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,IAAI;QACV,aAAa,EAAE,SAAS;QACxB,QAAQ,EAAE,OAAO,CAAC,KAAK;QACvB,OAAO,EAAE,OAAO,CAAC,IAAI,IAAI,YAAY;QACrC,QAAQ,EAAE,GAAG;QACb,kBAAkB,EAAE,GAAG;QACvB,qBAAqB,EAAE,GAAG;QAC1B,mBAAmB,EAAE,GAAG;QACxB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;KAC3B,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D,CAAC;IACD,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC;IAEzF,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,EAAE;YAChD,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAAiC,CAAC;YACtC,IAAI,SAAqC,CAAC;YAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,IAAI,EAAE;gBAChD,GAAG,EAAE,IAAI;gBACT,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,CAAC,MAAyE,EAAQ,EAAE;gBACjG,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,KAAK,KAAK,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC7C,2FAA2F;gBAC3F,2FAA2F;gBAC3F,oBAAoB;gBACpB,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;gBAChD,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC;gBAChD,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACzC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU;oBAAE,SAAS,GAAG,IAAI,CAAC;gBACrE,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,GAAY,EAAE;gBAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,OAAO,KAAK,CAAC;gBAC1C,IAAI,CAAC;oBACH,wFAAwF;oBACxF,2DAA2D;oBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACpC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,yFAAyF;oBACzF,8CAA8C;oBAC9C,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;wBAAE,OAAO,KAAK,CAAC;oBACpE,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC9F,CAAC;YACH,CAAC,CAAC;YAEF,MAAM,IAAI,GAAG,GAAS,EAAE;gBACtB,yFAAyF;gBACzF,2EAA2E;gBAC3E,IAAI,OAAO,IAAI,SAAS,KAAK,SAAS;oBAAE,OAAO;gBAC/C,IAAI,CAAC,WAAW,EAAE;oBAAE,OAAO;gBAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;oBAC9B,IAAI,WAAW,EAAE;wBAAE,OAAO;oBAC1B,aAAa,CAAC,MAAM,CAAC,CAAC;oBACtB,IAAI,SAAS,KAAK,MAAM;wBAAE,SAAS,GAAG,SAAS,CAAC;gBAClD,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,MAAM,CAAC;YACrB,CAAC,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;gBAChE,IAAI,SAAS,IAAI,QAAQ;oBAAE,OAAO;gBAClC,MAAM,IAAI,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC7D,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;oBACrB,SAAS,GAAG,IAAI,CAAC;oBACjB,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC;gBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxB,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC9B,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;oBACxB,SAAS,GAAG,IAAI,CAAC;oBACjB,IAAI,EAAE,CAAC;gBACT,CAAC;YACH,CAAC,CAAC;YAEF,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,SAAS,CAAC,CAAC;YAEd,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAChG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,IAAI,GAAG,IAAI,GAAG,QAAQ;YAAE,MAAM;QAClC,IAAI,IAAI,SAAS,CAAC;QAClB,IAAI,IAAI,IAAI,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/http.d.ts

@@ -0,0 +1,20 @@
+import type { FetchLike } from 'gcb-core';
+/** A command's proxy choice: omitted keeps the host environment, null is direct. */
+export type ProxyChoice = string | null | undefined;
+/** Every spelling that can carry a proxy to Node or to a child process. */
+export declare const PROXY_ENV_KEYS: readonly ['http_proxy', 'https_proxy', 'all_proxy', 'no_proxy', 'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY', 'NODE_USE_ENV_PROXY'];
+/** Apply one command's proxy choice to an environment for a child process. */
+export declare function applyProxyChoice(env: NodeJS.ProcessEnv, proxy: ProxyChoice): void;
+/** Parse a proxy choice; false means it is not a usable http(s) URL. */
+export declare function parseProxy(value: unknown): ProxyChoice | false;
+/** Pass the current HTTP layer the proxy choice for one request. */
+export declare function withProxy<T>(proxy: ProxyChoice, fn: () => T): T;
+/** Return the stable key for one proxy choice. */
+export declare function proxyCacheKey(proxy: ProxyChoice): string;
+/** The current proxy's cache key, for provider caches that must not cross choices. */
+export declare function currentProxyKey(): string;
+/** The fetch instance for a proxy choice, created once per effective choice. */
+export declare function fetcherFor(proxy: ProxyChoice): FetchLike;
+/** Fetch using the proxy choice of the current request. */
+export declare const proxyFetch: FetchLike;
+//# sourceMappingURL=http.d.ts.map

package/lib/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,oFAAoF;AACpF,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,cAAc,YACzB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EACpD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,CAClE,CAAC;AAEX,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAQjF;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,KAAK,CAU9D;AAKD,oEAAoE;AACpE,wBAAgB,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE/D;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAIxD;AA4CD,sFAAsF;AACtF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAcxD;AAED,2DAA2D;AAC3D,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC"}

package/lib/http.js

@@ -0,0 +1,133 @@
+/**
+ * Per-request HTTP for providers.
+ *
+ * Node's native fetch reads proxy variables once, when its dispatcher is created, so a command that
+ * wants a different proxy cannot get one by editing `process.env` (verified on 24.22: a later
+ * `http_proxy` change is ignored). `node-fetch-native` supplies the node-fetch agents (a direct
+ * pair, or `createProxy().agent` for an explicit proxy), and `x-fetch` wraps that fetch. The wrapped
+ * instance is cached by the effective proxy choice, so a busy broker does not create an agent per
+ * command.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import http from 'node:http';
+import https from 'node:https';
+import { createProxy } from 'node-fetch-native/proxy';
+import { fetch as directFetch } from 'node-fetch-native/node';
+import { createXFetch, isXFetchError } from 'x-fetch';
+/** Every spelling that can carry a proxy to Node or to a child process. */
+export const PROXY_ENV_KEYS = [
+    'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy',
+    'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY', 'NODE_USE_ENV_PROXY',
+];
+/** Apply one command's proxy choice to an environment for a child process. */
+export function applyProxyChoice(env, proxy) {
+    if (proxy === undefined)
+        return;
+    for (const key of PROXY_ENV_KEYS)
+        delete env[key];
+    if (proxy === null)
+        return;
+    env.HTTP_PROXY = proxy;
+    env.HTTPS_PROXY = proxy;
+    env.ALL_PROXY = proxy;
+    env.NO_PROXY = 'localhost,127.0.0.1';
+}
+/** Parse a proxy choice; false means it is not a usable http(s) URL. */
+export function parseProxy(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === null)
+        return null;
+    if (typeof value !== 'string')
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:' ? value : false;
+    }
+    catch {
+        return false;
+    }
+}
+const context = new AsyncLocalStorage();
+const instances = new Map();
+/** Pass the current HTTP layer the proxy choice for one request. */
+export function withProxy(proxy, fn) {
+    return context.run({ proxy }, fn);
+}
+/** Return the stable key for one proxy choice. */
+export function proxyCacheKey(proxy) {
+    if (proxy === null)
+        return 'direct';
+    if (proxy !== undefined)
+        return `proxy:${proxy}`;
+    return `env:${process.env['https_proxy'] ?? ''}|${process.env['HTTPS_PROXY'] ?? ''}|${process.env['http_proxy'] ?? ''}|${process.env['HTTP_PROXY'] ?? ''}|${process.env['no_proxy'] ?? ''}|${process.env['NO_PROXY'] ?? ''}|${process.env['NODE_USE_ENV_PROXY'] ?? ''}`;
+}
+/**
+ * x-fetch throws on non-2xx, while every provider here wants to inspect the status and body itself.
+ * Turn the thrown error back into its response for this adapter.
+ */
+const returnResponse = async (_ctx, next) => {
+    try {
+        return await next();
+    }
+    catch (error) {
+        if (isXFetchError(error) && error.response !== undefined)
+            return error.response;
+        throw error;
+    }
+};
+function nodeFetchWithAgent(agentFor) {
+    // Pass the selector, not its result: node-fetch calls it per request, including redirects, so a
+    // redirect that changes scheme gets the right agent.
+    return ((url, init = {}) => directFetch(url, { ...init, agent: agentFor }));
+}
+function makeFetch(proxy) {
+    let native;
+    if (proxy === undefined) {
+        native = globalThis.fetch;
+    }
+    else if (proxy === null) {
+        // node-fetch's global agents are the ones Node points at the environment proxy when
+        // NODE_USE_ENV_PROXY=1, so a direct choice needs its own agents rather than agent: false.
+        const httpAgent = new http.Agent();
+        const httpsAgent = new https.Agent();
+        native = nodeFetchWithAgent((url) => (url.protocol === 'https:' ? httpsAgent : httpAgent));
+    }
+    else {
+        // createProxy's agent is a node-fetch agent; this works on Node 24 and 26, unlike handing its
+        // bundled undici dispatcher to the native fetch (Node 26 rejects that dispatcher).
+        const agent = createProxy({ url: proxy, noProxy: [] }).agent;
+        native = nodeFetchWithAgent(() => agent);
+    }
+    const instance = createXFetch(native);
+    instance.middlewares.use(returnResponse);
+    const raw = instance.xfetch;
+    return (url, init) => raw(url, { ...init, type: null });
+}
+/** The current proxy's cache key, for provider caches that must not cross choices. */
+export function currentProxyKey() {
+    return proxyCacheKey(context.getStore()?.proxy);
+}
+/** The fetch instance for a proxy choice, created once per effective choice. */
+export function fetcherFor(proxy) {
+    const key = proxyCacheKey(proxy);
+    let fetcher = instances.get(key);
+    if (fetcher === undefined) {
+        // A command may name a different proxy every time; keep the reuse bounded rather than letting
+        // arbitrary URLs grow this map for the life of the broker.
+        if (instances.size >= 16) {
+            const oldest = instances.keys().next().value;
+            if (oldest !== undefined)
+                instances.delete(oldest);
+        }
+        fetcher = makeFetch(proxy);
+        instances.set(key, fetcher);
+    }
+    return fetcher;
+}
+/** Fetch using the proxy choice of the current request. */
+export const proxyFetch = (url, init) => {
+    const current = context.getStore();
+    return fetcherFor(current?.proxy)(url, init);
+};
+//# sourceMappingURL=http.js.map

package/lib/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAyB,MAAM,SAAS,CAAC;AAM7E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU;IACpD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB;CAClE,CAAC;AAEX,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,GAAsB,EAAE,KAAkB;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,KAAK,MAAM,GAAG,IAAI,cAAc;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO;IAC3B,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC;IACvB,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;IACxB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC,QAAQ,GAAG,qBAAqB,CAAC;AACvC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAA0B,CAAC;AAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE/C,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAI,KAAkB,EAAE,EAAW;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,KAAK,EAAE,CAAC;IACjD,OAAO,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC;AAC1Q,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAqB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;QAChF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,SAAS,kBAAkB,CAAC,QAAgD;IAC1E,gGAAgG;IAChG,qDAAqD;IACrD,OAAO,CAAC,CAAC,GAAW,EAAE,IAAI,GAAgB,EAAE,EAAE,EAAE,CAC9C,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAsC,CAAC,CAA4B,CAAC;AACnH,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB;IACnC,IAAI,MAA+B,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;IAC5B,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,oFAAoF;QACpF,0FAA0F;QAC1F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,GAAG,kBAAkB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,8FAA8F;QAC9F,mFAAmF;QACnF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;QAC7D,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,CAAC,KAAmB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,MAA8D,CAAC;IACpF,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe;IAC7B,OAAO,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC7C,IAAI,MAAM,KAAK,SAAS;gBAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnC,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC"}