gcb-host 0.0.0 → 0.0.1

package/lib/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Host-side entry point: the broker daemon and administration commands.
+ *
+ * This is the only side that imports `yaml` (through config.ts) and holds the App key.
+ */
+import type { CommandBackend } from 'gcb-core';
+export * from './gh.ts';
+export declare const HOST_HELP = "gcb-host \u2014 host-side gcb broker and administration commands.\n\nUsage: gcb <command> [options]\n\nCommands\n  app          Run the app broker (alias for daemon)\n  host         Run the host operations opener (alias for host-opener)\n  daemon       Run the broker (normally started by the service manager)\n  init         Create or update the broker config, and install the key\n  stage        Export a reviewed commit to where the broker will run\n  compose      Print a Docker sidecar definition for the broker\n  diagnose     Ask GitHub what the App can actually see\n  authorize    Authorize this app once for person-authored pull requests\n  host-opener  Watch for the container's pull-request requests and create them\n\nClient commands such as setup/probe/logs/pr are in gcb-client.";
+export declare const hostBackend: CommandBackend;
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG/C,cAAc,SAAS,CAAC;AAExB,eAAO,MAAM,SAAS,8xBAeyC,CAAC;AA8BhE,eAAO,MAAM,WAAW,EAAE,cAKzB,CAAC"}

package/lib/index.js

@@ -0,0 +1,52 @@
+import { assertProxyEnabled } from './proxy.js';
+export * from './gh.js';
+export const HOST_HELP = `gcb-host — host-side gcb broker and administration commands.
+
+Usage: gcb <command> [options]
+
+Commands
+  app          Run the app broker (alias for daemon)
+  host         Run the host operations opener (alias for host-opener)
+  daemon       Run the broker (normally started by the service manager)
+  init         Create or update the broker config, and install the key
+  stage        Export a reviewed commit to where the broker will run
+  compose      Print a Docker sidecar definition for the broker
+  diagnose     Ask GitHub what the App can actually see
+  authorize    Authorize this app once for person-authored pull requests
+  host-opener  Watch for the container's pull-request requests and create them
+
+Client commands such as setup/probe/logs/pr are in gcb-client.`;
+async function run(argv) {
+    const [command, ...rest] = argv;
+    switch (command) {
+        case 'app':
+        case 'daemon': {
+            assertProxyEnabled();
+            const { runDaemon } = await import('./daemon.js');
+            return runDaemon(rest);
+        }
+        case 'init':
+            return (await import('./commands/init.js')).runInit(rest);
+        case 'stage':
+            return (await import('./commands/stage.js')).runStage(rest);
+        case 'compose':
+            return (await import('./commands/compose.js')).runCompose(rest);
+        case 'diagnose':
+            return (await import('./commands/diagnose.js')).runDiagnose(rest);
+        case 'authorize':
+            return (await import('./commands/authorize.js')).runAuthorize(rest);
+        case 'host':
+        case 'host-opener':
+            return (await import('./commands/host-opener.js')).runHostOpener(rest);
+        default:
+            process.stderr.write(`gcb: unknown host command \`${command ?? ''}\`.\n`);
+            return 1;
+    }
+}
+export const hostBackend = {
+    role: 'host',
+    commands: ['app', 'host', 'daemon', 'init', 'stage', 'compose', 'diagnose', 'authorize', 'host-opener'],
+    help: HOST_HELP,
+    run,
+};
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,cAAc,SAAS,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;+DAesC,CAAC;AAEhE,KAAK,UAAU,GAAG,CAAC,IAAuB;IACxC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,EAAE,CAAC;YACd,kBAAkB,EAAE,CAAC;YACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,SAAS;YACZ,OAAO,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClE,KAAK,UAAU;YACb,OAAO,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACpE,KAAK,WAAW;YACd,OAAO,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC;QACZ,KAAK,aAAa;YAChB,OAAO,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACzE;YACE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,OAAO,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC;IACvG,IAAI,EAAE,SAAS;IACf,GAAG;CACJ,CAAC"}

package/lib/policy.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Authorization policy: the only place that decides whether a host + repository pair may
+ * receive a credential.
+ *
+ * Design rules (see the design review, findings P0-1 and P2-3):
+ *  - default deny: an unknown host or an unlisted repository never yields a credential;
+ *  - repository paths are normalized (drop leading/trailing slashes, drop a trailing
+ *    `.git`, lowercase) before matching, because GitHub owner/repo names are
+ *    case-insensitive;
+ *  - matching is exact per path segment, never a prefix match, so an allowlist entry for
+ *    `acme/widget` can never authorize `acme/widget-evil`;
+ *  - a wildcard is allowed only as a whole segment, never inside one, so a malformed entry
+ *    matches nothing and therefore fails closed.
+ */
+import type { BrokerConfig, HostConfig, RepoRef } from 'gcb-core';
+/** One parsed allowlist entry. */
+export interface AllowEntry {
+    readonly owner: string;
+    readonly repo: string;
+}
+/**
+ * Normalize the `path=` value git hands to a credential helper into an `owner/repo` pair.
+ *
+ * @param rawPath - the raw `path` field, e.g. `acme/widget.git`.
+ * @returns the normalized reference, or null when the value is missing, has more than two
+ *   segments, is made of dots, or contains characters we refuse to guess about.
+ */
+export declare function normalizeRepoPath(rawPath: unknown): RepoRef | null;
+/**
+ * Parse one allowlist entry: exactly two segments, each either an identifier or a
+ * whole-segment wildcard.
+ *
+ * @param entry - the raw entry from configuration.
+ * @returns the parsed entry, or null when it is malformed (which matches nothing).
+ */
+export declare function parseAllowEntry(entry: unknown): AllowEntry | null;
+/**
+ * Whether a normalized repository is covered by an allowlist.
+ *
+ * @param allowList - configured allow entries.
+ * @param full - a normalized `owner/repo` string.
+ * @returns true only for an exact segment-wise match.
+ */
+export declare function repoAllowed(allowList: unknown, full: string): boolean;
+/** A host block together with the key it was configured under. */
+export type ResolvedHostConfig = HostConfig & {
+    readonly host: string;
+};
+/**
+ * Look up the configuration block for a host as git reports it.
+ *
+ * git sends `host=github.com` for the default port and `host=127.0.0.1:8080` otherwise, so
+ * the comparison is on the literal string, case-insensitively.
+ *
+ * @param config - a validated broker config.
+ * @param host - the `host` field from the credential request.
+ * @returns the matching block, or null (default deny).
+ */
+export declare function hostConfig(config: BrokerConfig, host: unknown): ResolvedHostConfig | null;
+//# sourceMappingURL=policy.d.ts.map

package/lib/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAclE,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CA2BlE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAUjE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAerE;AAED,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAOzF"}

package/lib/policy.js

@@ -0,0 +1,118 @@
+/** One `owner` or `repo` segment: starts alphanumeric, then letters/digits/._- */
+const SEGMENT_RE = /^[a-z0-9][a-z0-9._-]*$/;
+/** A whole repository path as git would report it, before normalization. */
+const REPO_PATH_RE = /^([A-Za-z0-9][A-Za-z0-9._-]*)\/([A-Za-z0-9._-]+)$/;
+/** A segment that is nothing but dots — `.`, `..`, `...` — never a real repository name. */
+const ALL_DOTS_RE = /^\.+$/;
+/** The wildcard that may stand in for one whole segment. */
+const WILDCARD = '*';
+/**
+ * Normalize the `path=` value git hands to a credential helper into an `owner/repo` pair.
+ *
+ * @param rawPath - the raw `path` field, e.g. `acme/widget.git`.
+ * @returns the normalized reference, or null when the value is missing, has more than two
+ *   segments, is made of dots, or contains characters we refuse to guess about.
+ */
+export function normalizeRepoPath(rawPath) {
+    if (typeof rawPath !== 'string')
+        return null;
+    let candidate = rawPath.trim();
+    if (!candidate)
+        return null;
+    const hash = candidate.indexOf('#');
+    if (hash >= 0)
+        candidate = candidate.slice(0, hash);
+    const query = candidate.indexOf('?');
+    if (query >= 0)
+        candidate = candidate.slice(0, query);
+    while (candidate.startsWith('/'))
+        candidate = candidate.slice(1);
+    while (candidate.endsWith('/'))
+        candidate = candidate.slice(0, -1);
+    if (candidate.toLowerCase().endsWith('.git'))
+        candidate = candidate.slice(0, -4);
+    if (!candidate)
+        return null;
+    const match = REPO_PATH_RE.exec(candidate);
+    if (!match)
+        return null;
+    const rawOwner = match[1];
+    const rawRepo = match[2];
+    if (rawOwner === undefined || rawRepo === undefined)
+        return null;
+    // `acme/..` satisfies the segment pattern above but is a traversal attempt, not a name.
+    if (ALL_DOTS_RE.test(rawOwner) || ALL_DOTS_RE.test(rawRepo))
+        return null;
+    const owner = rawOwner.toLowerCase();
+    const repo = rawRepo.toLowerCase();
+    return { owner, repo, full: `${owner}/${repo}` };
+}
+/**
+ * Parse one allowlist entry: exactly two segments, each either an identifier or a
+ * whole-segment wildcard.
+ *
+ * @param entry - the raw entry from configuration.
+ * @returns the parsed entry, or null when it is malformed (which matches nothing).
+ */
+export function parseAllowEntry(entry) {
+    if (typeof entry !== 'string')
+        return null;
+    const parts = entry.trim().toLowerCase().split('/');
+    if (parts.length !== 2)
+        return null;
+    const owner = parts[0];
+    const repo = parts[1];
+    if (owner === undefined || repo === undefined)
+        return null;
+    const valid = (segment) => segment === WILDCARD || SEGMENT_RE.test(segment);
+    if (!valid(owner) || !valid(repo))
+        return null;
+    return { owner, repo };
+}
+/**
+ * Whether a normalized repository is covered by an allowlist.
+ *
+ * @param allowList - configured allow entries.
+ * @param full - a normalized `owner/repo` string.
+ * @returns true only for an exact segment-wise match.
+ */
+export function repoAllowed(allowList, full) {
+    if (typeof full !== 'string' || !Array.isArray(allowList))
+        return false;
+    const slash = full.indexOf('/');
+    if (slash <= 0)
+        return false;
+    const owner = full.slice(0, slash);
+    const repo = full.slice(slash + 1);
+    for (const raw of allowList) {
+        const entry = parseAllowEntry(raw);
+        if (!entry)
+            continue;
+        const ownerMatches = entry.owner === WILDCARD || entry.owner === owner;
+        const repoMatches = entry.repo === WILDCARD || entry.repo === repo;
+        if (ownerMatches && repoMatches)
+            return true;
+    }
+    return false;
+}
+/**
+ * Look up the configuration block for a host as git reports it.
+ *
+ * git sends `host=github.com` for the default port and `host=127.0.0.1:8080` otherwise, so
+ * the comparison is on the literal string, case-insensitively.
+ *
+ * @param config - a validated broker config.
+ * @param host - the `host` field from the credential request.
+ * @returns the matching block, or null (default deny).
+ */
+export function hostConfig(config, host) {
+    if (typeof host !== 'string' || !host)
+        return null;
+    const wanted = host.toLowerCase();
+    for (const [configuredHost, block] of Object.entries(config.hosts)) {
+        if (configuredHost.toLowerCase() === wanted)
+            return { host: configuredHost, ...block };
+    }
+    return null;
+}
+//# sourceMappingURL=policy.js.map

package/lib/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAgBA,kFAAkF;AAClF,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAEzE,4FAA4F;AAC5F,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC;AAQrB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEjE,wFAAwF;IACxF,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,SAAkB,EAAE,IAAY;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QACnE,IAAI,YAAY,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAa;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/providers/github-app.d.ts

@@ -0,0 +1,56 @@
+import type { FetchLike, GithubAppHostConfig, Provider } from 'gcb-core';
+/** Options for {@link createGithubAppProvider}. */
+export interface GithubAppProviderOptions {
+    /** The host this provider serves. */
+    readonly host: string;
+    readonly cfg: GithubAppHostConfig;
+    /** Re-mint a cached token this many seconds before it expires. */
+    readonly skewSeconds?: number;
+    /** Transport, injectable for tests. */
+    readonly fetchImpl?: FetchLike;
+    /** Clock, injectable for tests. */
+    readonly now?: () => number;
+    /** gh executable, injectable for tests. */
+    readonly ghPath?: string;
+    /** Host-side diagnostics. */
+    readonly log?: (message: string) => void;
+}
+/** Options for {@link signAppJwt}. */
+export interface SignAppJwtOptions {
+    readonly privateKeyPem: string;
+    readonly iss: string | number;
+    readonly nowMs: number;
+    readonly lifetimeSeconds?: number;
+    readonly skewSeconds?: number;
+}
+/**
+ * Base64url-encode a string or buffer, without padding, as JWS requires.
+ *
+ * @param input - the value to encode.
+ * @returns the base64url encoding.
+ */
+export declare function base64url(input: string | Buffer): string;
+/**
+ * Sign a GitHub App JWT.
+ *
+ * @param options - signing options.
+ * @returns the compact JWS.
+ * @throws {Error} when required inputs are missing or the lifetime exceeds GitHub's limit.
+ */
+export declare function signAppJwt(options: SignAppJwtOptions): string;
+/**
+ * Extract the `rel="next"` URL from a `Link` header.
+ *
+ * @param linkHeader - the raw header value.
+ * @returns the next page URL, or null when there is none.
+ */
+export declare function nextLink(linkHeader: string | null): string | null;
+/**
+ * Build a GitHub App provider for one host.
+ *
+ * @param options - provider options.
+ * @returns the provider.
+ * @throws {Error} when the private key or app identity is missing (fail fast).
+ */
+export declare function createGithubAppProvider(options: GithubAppProviderOptions): Provider;
+//# sourceMappingURL=github-app.d.ts.map

package/lib/providers/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/providers/github-app.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAc,SAAS,EAAqB,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBxG,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CA+5BnF"}